- stunnel-users - stunnel.org

Client setup
by Ting 21 Feb '06

21 Feb '06

Hello all, Wonder if anybody could advise. I have a client tn3270 application running on Solaris 2.8. Currently, it is using clear text to communicate with tn3270 server. Now, I need to run tn3270 with SSL. If I install stunnel in the Solaris 2.8 box to act as a wrapper. 1. Do I run the stunnel as a client only ? Is the command: stunnel -c -d <port1> -r <tn3270server>:<port2> a. Is port1 the original port where client tn3270 application sends to server ? b. Is port2 the same as port1 ? c. Alternatively, am I supposed to change the client tn3270 application to direct the data to a new port X, then port1 = X, while port2 is the port where the server is listening on. Thank you in advance. Warm Regards, TW --------------------------------- Do you Yahoo!? Yahoo! Movies - Search movie info and celeb profiles and photos.

2 1

Choosing local 'source' IP?
by Don Werve 20 Feb '06

20 Feb '06

Ok, so here's the problem: I've got stunnel handling SSL for a web-based service that is otherwise too stupid to be able to talk https. Unfortunately, I need to set up a redirection rule inside this service that bounces people back to the https:// page if they try to come in over http. Since said service isn't managing its own SSL, I have no solid way of determining which connections are wrappered by stunnel and which connections come in over the wire, and if I bounce stunnel connections, I end up in an infinite loop. Fortunately, all stunnel connections give a REMOTE_IP of the second ethernet adapter of the host system, which is good. My question is, how do I configure stunnel to 'force' this behavior? E.g., I want to explicitly specify in stunnel.conf 'Connect to the service for which you are acting as a wrapper from *this* IP/interface'. I've tried the 'local = ' option and setting socket flags for 'l' and 'r', and while they don't break anything, I can't use them to force a connection from any other adapter, so I don't think they are doing what I need. This wouldn't be an issue, either, except I don't know how stunnel determines this, and I don't want to (at some point in the future) have things 'magically change' (read: break horribly). Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

2 1

RE: question about stunnel setup
by Anthony Cicalla 15 Feb '06

15 Feb '06

Encrypting traffic to a remote syslog-ng server including SSL peer authentication 1. Install stunnel and syslog-ng on all machines. 2. Create certificates for all machines. On RedHat 9 and similar machines, you can do the following as root: # cd /etc/pki/tls/certs # make syslog-ng-server.pem # make syslog-ng-client.pem 3. Place copies of syslog-ng-server.pem on all machines in /etc/stunnel with one important alteration. The clients only need the certificate section of syslog-ng-server.pem. In other words, remove the private key section from syslog-ng-server.pem on all clients. Place every client's syslog-ng-client.pem in /etc/stunnel. For server, create a special syslog-ng-client.pem containing the certificate sections for all clients and place in /etc/stunnel. In other words, remove the private key sections from all syslog-ng-client.pem files and concatenate what is left to create server's special syslog-ng-client.pem. Ok my question is from above it says to create one syslog-ng-client.pem file per client. 1)Do the names for each of these need to remain syslog-ng-client.pem or can they have names that reflect the host that they are on? 2) if they all need to keep that name do just move the client file to one client/host and then delete it from the server then move on to create the next?

2 1

stunnel and syslog
by Bart Somers 10 Feb '06

10 Feb '06

Hi to all, We recently ran in to a problem using stunnel on our AIX 5.2 machines. This is our situation: we are running stunnel as a client to protect http (and a proprietary protocol) traffic between our company and a customer. We are using client-athentication to grant access to the server and on our client-side we validate the server-certificates. This all works fine. Due to new security-restrictions, we are moving all our private-key material into HSM-boxes, in our case these are nCipher nShield HSM's. According to the documantion on there website ( http://active.ncipher.com ) we builded openssl nCipher-enabled. Based on this openssl-version, we builded stunnel. All the build-options are shown below in this message. The compiler used is the IBM C compiler. According to the manuals from stunnel we needed to put in an extra line to the config-file which shows "engine = chil" (chil is the Cryptographic Hardware Interface Library, the way the nCipher HSM's are known to openssl) After all this, we created key's in the hsm, using the nCipher tools and loaded them into stunnel (using this method you get a "pseudo-pem-file", which is actually a reference to the hardware-key). Fire-up stunnel using the commands from nCipher to preload the key's and we are all good to go! When this all seems to work very stable after a few months, with thousands of connections and ditto megabytes transfered, we wanted to have all the logging to our syslogserver (it runs syslog-ng) and this is the place where my problem hits in: When commenting-out the option "output = /home/bart/stl/var/stunnel.log" and restarting stunnel, stunnel dies after the first or second connection, leaving no logging, corefiles or whatever behind. Using plain key's (so no HSM, but with the same build which is aware of the HSM), syslog is no problem. Using HSM-key's with plaintext logfiles (no syslog) works also excellent. As i don't have any ideas anymore where to search, i want to ask you if somebody ever have seen this behaviour or knows where it could be caused by. (And maybe how to solve it....) Thanks in advance! Best regards, Bart Somers. ############################# # Build- and config-options # ############################# bart@server1:./stunnel -version stunnel 4.11 on powerpc-ibm-aix5.2.0.0 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.8 05 Jul 2005 Global options cert = home/bart/stl/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /home/bart/stl/etc/stunnel/stunnel.pem pid = /home/bart/stl/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds bart@server1:./openssl version OpenSSL 0.9.8 05 Jul 2005 compile-options: Openssl: $ export LDFLAGS="-L/opt/nfast/toolkits/hwcrhk" $ ./config --prefix=/home/bart/stl –DNFast –ldl make and make install Stunnel: $ export CPPFLAGS="-I/home/bart/stl/include" $ export LDFLAGS="-L/opt/nfast/toolkits/hwcrhk" $ ./configure –-prefix=/home/bart/stl –-with-ssl=/home/bart/stl -–disable-libwrap make and make install Config-file: Include engine = chil Start-up: $ with-nfast –f /home/bart/stl/tmp/ff /home/bart/stl/sbin/stunnel /home/bart/stl/etc/stunnel/stunnel.conf Relevant information from the config-file: engine = chil cert = /home/bart/stl/etc/stunnel/my-key.pem key = /home/bart/stl/etc/stunnel/my-key-hsm.pem ;(no chroot options used) pid = /prj/stl_004/tmp/test/stunnel-client.pid debug = 7 ; output = /home/bart/stl/var/stunnel.log # when in comment, problems! client = yes [test] accept = 9400 connect = 10.10.10.10:443 All other values are the default from the example.

2 4

transparent mode in linux
by Jesse Small 10 Feb '06

10 Feb '06

Hello, I am having trouble with the 'transparent = yes' option in my configuration file. Basically the goal is to see the IP address of the client connecting to our server, but I am getting this error in the log file: bind transparent: Cannot assign requested address (99) Failed to initialize remote connection After searching through the stunnel archives, I saw that this option (-T back then) was supported only up to the Linux 2.2 kernel, but didn't work on the 2.4 kernel. All the messages I read through were a few years old. I am using Fedora Core 4 with a 2.6 kernel, and wanted to see if there were any updates and if it was now possible to see the client's IP address. Otherwise all incoming connections appear as if from localhost. We are using stunnel v4.14. Thanks for your help, Jesse

2 1

stunnel closing connections with RST ?
by sergei 09 Feb '06

09 Feb '06

I'm setting up load-balanced service requiring stunnel with SSL on its front end. There are two hosts behind load balancer running stunnel . Service behind stunnel does not speak SSL. Every few minutes load balancer checks if those stunnels are still alive by opening tcp connection to stunnel listening port. Now problem is that stunnel closes those test connections with RST and load balancer takes it as that host is dead. This is without "client = yes" option because service does not speak SSL load-balancer -> stunnel-host TCP D=1234 S=33007 Syn stunnel-host -> load-balancer TCP D=33007 S=1234 Syn Ack load-balancer -> stunnel-host TCP D=1234 S=33007 Ack load-balancer -> stunnel-host TCP D=1234 S=33007 Fin Ack stunnel-host -> load-balancer TCP D=33007 S=1234 Ack stunnel-host -> load-balancer TCP D=33007 S=1234 Rst On the other hand with client=yes everything works fine load-balancer -> stunnel-host TCP D=123 S=33010 Syn stunnel-host -> load-balancer TCP D=33010 S=123 Syn Ack load-balancer -> stunnel-host TCP D=123 S=33010 Ack load-balancer -> stunnel-host TCP D=123 S=33010 Fin Ack stunnel-host -> load-balancer TCP D=33010 S=123 Fin Ack load-balancer -> stunnel-host TCP D=123 S=33010 Ack Is there any way to make stunnel without "client = yes" close connection "normal way" with FIN instead of RST ? stunnel is last version, load balancer is some older F5 BigIP thanks sergei

3 7

certificate root chain
by Olivier twist 09 Feb '06

09 Feb '06

Hello, I've already sent a message for my problem but no answer. I have a server certificate signed by GlobalSign. I don't want to use client certificate. But if I don't put the certification chain on the CAFILE of stunnel and don't set verify at 1, stunnel doesn't check the server certification chain and the server certificate appears broken on client side !!! I've post this problem on the stunnel mailing list but you tell me that if I don't use client certificate I don't have to set verify at 1. But it doesn't work, and why GlobalSign and others explain how to install server certificatation chain on servers like apache mod ssl?(see http://support.globalsign.net/en/serversign/apachemodssl.cfm) when I read this help file I suppose that the ssl protocol on server side makes a check of server certificate, and that's the reason why the certificate chain appears broken or not on client side. My current ugly solution is to set verify at 1, in this case, on client side, the certificate appears good and not broken but... a dialog box appears and ask for client certificate and some plugin like flash doesn't support that. i use stunnel 4.14 stunnel.conf: cert = c:\certif\inTest.crt key = c:\certif\inTest.key socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 1 CAfile = c:\certif\ca.pem ;client = yes [https] accept = 443 connect = 127.0.0.1:901 TIMEOUTclose = 0 [rtmps] accept = 80 connect = 127.0.0.1:900 TIMEOUTclose = 0 Could anybody gives me a support? Thx Oliver

3 3

Re: [stunnel-users] certificate root chain
by Hans Werner Strube 09 Feb '06

09 Feb '06

Olivier twist wrote: > I have a server certificate signed by GlobalSign. I don't want to use client > certificate. > But if I don't put the certification chain on the CAFILE of stunnel and > don't set verify at 1, stunnel doesn't check the server certification chain > and the server certificate appears broken on client side !!! ... > cert = c:\certif\inTest.crt > key = c:\certif\inTest.key ... > CAfile = c:\certif\ca.pem AFAIK the whole certificate chain from your server certificate up to the CA certificate should be in inTest.crt (simply concatenate the PEM files). The CAfile would be needed for client verification only.

1 0

RE: [stunnel-users] stunnel help
by Anthony Cicalla 07 Feb '06

07 Feb '06

I sent an email last week for help with a stunnel setup. I am attempting to send syslog messages via a snare agent through stunnel to a fedora core 4 box with syslog-ng installed. I have been able to get one machine to successfully log to the fedora box out of 4. I set these boxes up the same way and I am confused as to why one is working and the others aren't . This is my stunnel.conf file for the clients cert = C:\bin\stunnel\syslog-ng-server.pem CAfile = c:\bin\stunnel\syslog-ng-client.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.168.185.60:5140 This is my stunnel.conf file for the server cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.168.185.60:5140 connect = 127.0.0.1:514 This is my syslog-ng.conf file on the server options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; The snare agents are configured to send logs to 127.0.0.1 514. Any thoughts or idea's would be great. sincerely, Anthony -----Original Message----- From: Michal Trojnara [mailto:[email protected]] Sent: Tuesday, February 07, 2006 1:03 AM To: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] stunnel closing connections with RST ? sergei wrote: > Is there any way to make stunnel without "client = yes" > close connection "normal way" with FIN instead of RST ? Stunnel resets connections for a reason. Probably it was reset by the other peer. Check your stunnel log files for details. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Multiple Instances of Same Application, Different Ports
by Steve Ricketts 06 Feb '06

06 Feb '06

1 0

stunnel not connecting to port 139 on server
by Neil Aggarwal 05 Feb '06

05 Feb '06

Hello: I have two windows machines. I am trying to connect to a shared drive on the server over an stunnel connection following the instructions on this page: http://research.lumeta.com/ches/cheap/stunnelsolution.html The connection from the client seems to connect to the server, but the server-side stunnel seems to be getting a timeout when it attempts to connect to port 139. I am able to map the network drive locally, so I am surprised it is not able to connect. Here is the log from stunnel on the server: 2006.02.04 18:22:17 LOG5[2116:3068]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.04 18:22:17 LOG7[2116:3968]: RAND_status claims sufficient entropy for the PRNG 2006.02.04 18:22:17 LOG6[2116:3968]: PRNG seeded successfully 2006.02.04 18:22:17 LOG7[2116:3968]: Certificate: stunnel.pem 2006.02.04 18:22:17 LOG7[2116:3968]: Key file: stunnel.pem 2006.02.04 18:22:17 LOG5[2116:3968]: No limit detected for the number of clients 2006.02.04 18:22:17 LOG7[2116:3968]: FD 168 in non-blocking mode 2006.02.04 18:22:17 LOG7[2116:3968]: SO_REUSEADDR option set on accept socket 2006.02.04 18:22:17 LOG7[2116:3968]: netDrives bound to 0.0.0.0:2139 2006.02.04 18:24:49 LOG7[2116:3968]: netDrives accepted FD=188 from 192.168.1.247:1334 2006.02.04 18:24:49 LOG7[2116:3968]: Creating a new thread 2006.02.04 18:24:49 LOG7[2116:3968]: New thread created 2006.02.04 18:24:49 LOG7[2116:2224]: netDrives started 2006.02.04 18:24:49 LOG7[2116:2224]: FD 188 in non-blocking mode 2006.02.04 18:24:49 LOG7[2116:2224]: TCP_NODELAY option set on local socket 2006.02.04 18:24:49 LOG5[2116:2224]: netDrives connected from 192.168.1.247:1334 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): before/accept initialization 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client hello A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server hello A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write certificate A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server done A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client key exchange A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read finished A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write change cipher spec A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write finished A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:49 LOG7[2116:2224]: 1 items in the session cache 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects (SSL_connect()) 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects that finished 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client renegotiatations requested 2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects (SSL_accept()) 2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects that finished 2006.02.04 18:24:49 LOG7[2116:2224]: 0 server renegotiatiations requested 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache hits 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache misses 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache timeouts 2006.02.04 18:24:49 LOG6[2116:2224]: SSL accepted: new session negotiated 2006.02.04 18:24:49 LOG6[2116:2224]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.02.04 18:24:49 LOG7[2116:2224]: FD 216 in non-blocking mode 2006.02.04 18:24:49 LOG7[2116:2224]: netDrives connecting 127.0.0.1:139 2006.02.04 18:24:49 LOG7[2116:2224]: connect_wait: waiting 10 seconds 2006.02.04 18:24:59 LOG7[2116:3968]: netDrives accepted FD=236 from 192.168.1.247:1336 2006.02.04 18:24:59 LOG7[2116:3968]: Creating a new thread 2006.02.04 18:24:59 LOG7[2116:3968]: New thread created 2006.02.04 18:24:59 LOG7[2116:3544]: netDrives started 2006.02.04 18:24:59 LOG7[2116:3544]: FD 236 in non-blocking mode 2006.02.04 18:24:59 LOG7[2116:3544]: TCP_NODELAY option set on local socket 2006.02.04 18:24:59 LOG5[2116:3544]: netDrives connected from 192.168.1.247:1336 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): before/accept initialization 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read client hello A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write server hello A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write change cipher spec A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write finished A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read finished A 2006.02.04 18:24:59 LOG7[2116:3544]: 1 items in the session cache 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects (SSL_connect()) 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects that finished 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client renegotiatations requested 2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects (SSL_accept()) 2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects that finished 2006.02.04 18:24:59 LOG7[2116:3544]: 0 server renegotiatiations requested 2006.02.04 18:24:59 LOG7[2116:3544]: 1 session cache hits 2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache misses 2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache timeouts 2006.02.04 18:24:59 LOG6[2116:2224]: connect_wait: s_poll_wait timeout 2006.02.04 18:24:59 LOG6[2116:3544]: SSL accepted: previous session reused 2006.02.04 18:24:59 LOG3[2116:2224]: Failed to initialize remote connection 2006.02.04 18:24:59 LOG7[2116:3544]: FD 216 in non-blocking mode 2006.02.04 18:24:59 LOG7[2116:2224]: netDrives finished (1 left) 2006.02.04 18:24:59 LOG7[2116:3544]: netDrives connecting 127.0.0.1:139 2006.02.04 18:24:59 LOG7[2116:3544]: connect_wait: waiting 10 seconds 2006.02.04 18:25:09 LOG6[2116:3544]: connect_wait: s_poll_wait timeout 2006.02.04 18:25:09 LOG3[2116:3544]: Failed to initialize remote connection 2006.02.04 18:25:09 LOG7[2116:3544]: netDrives finished (0 left) Here is the stunnel.conf file from the server: ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [netDrives] accept = 2139 connect = 139 In case you need it, here is the stunnel log from the client: 2006.02.04 18:23:43 LOG5[3236:2376]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.04 18:23:43 LOG7[3236:324]: RAND_status claims sufficient entropy for the PRNG 2006.02.04 18:23:43 LOG6[3236:324]: PRNG seeded successfully 2006.02.04 18:23:43 LOG7[3236:324]: Certificate: stunnel.pem 2006.02.04 18:23:43 LOG7[3236:324]: Key file: stunnel.pem 2006.02.04 18:23:43 LOG5[3236:324]: No limit detected for the number of clients 2006.02.04 18:23:43 LOG7[3236:324]: FD 200 in non-blocking mode 2006.02.04 18:23:43 LOG7[3236:324]: SO_REUSEADDR option set on accept socket 2006.02.04 18:23:43 LOG7[3236:324]: netDrives bound to 222.222.222.222:139 2006.02.04 18:24:42 LOG7[3236:324]: netDrives accepted FD=220 from 192.168.1.247:1333 2006.02.04 18:24:42 LOG7[3236:324]: Creating a new thread 2006.02.04 18:24:42 LOG7[3236:324]: New thread created 2006.02.04 18:24:42 LOG7[3236:572]: netDrives started 2006.02.04 18:24:42 LOG7[3236:572]: FD 220 in non-blocking mode 2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on local socket 2006.02.04 18:24:42 LOG5[3236:572]: netDrives connected from 192.168.1.247:1333 2006.02.04 18:24:42 LOG7[3236:572]: FD 252 in non-blocking mode 2006.02.04 18:24:42 LOG7[3236:572]: netDrives connecting 192.168.1.10:2139 2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: waiting 10 seconds 2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: connected 2006.02.04 18:24:42 LOG7[3236:572]: Remote FD=252 initialized 2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on remote socket 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): before/connect initialization 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client hello A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server hello A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server certificate A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server done A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client key exchange A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write change cipher spec A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write finished A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 flush data 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read finished A 2006.02.04 18:24:42 LOG7[3236:572]: 1 items in the session cache 2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects (SSL_connect()) 2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects that finished 2006.02.04 18:24:42 LOG7[3236:572]: 0 client renegotiatations requested 2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects (SSL_accept()) 2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects that finished 2006.02.04 18:24:42 LOG7[3236:572]: 0 server renegotiatiations requested 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache hits 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache misses 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache timeouts 2006.02.04 18:24:42 LOG6[3236:572]: SSL connected: new session negotiated 2006.02.04 18:24:42 LOG6[3236:572]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.02.04 18:24:52 LOG3[3236:572]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2006.02.04 18:24:52 LOG7[3236:324]: netDrives accepted FD=276 from 192.168.1.247:1335 2006.02.04 18:24:52 LOG5[3236:572]: Connection reset: 72 bytes sent to SSL, 0 bytes sent to socket 2006.02.04 18:24:52 LOG7[3236:324]: Creating a new thread 2006.02.04 18:24:52 LOG7[3236:572]: netDrives finished (0 left) 2006.02.04 18:24:52 LOG7[3236:324]: New thread created 2006.02.04 18:24:52 LOG7[3236:1336]: netDrives started 2006.02.04 18:24:52 LOG7[3236:1336]: FD 276 in non-blocking mode 2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on local socket 2006.02.04 18:24:52 LOG5[3236:1336]: netDrives connected from 192.168.1.247:1335 2006.02.04 18:24:52 LOG7[3236:1336]: FD 248 in non-blocking mode 2006.02.04 18:24:52 LOG7[3236:1336]: netDrives connecting 192.168.1.10:2139 2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: waiting 10 seconds 2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: connected 2006.02.04 18:24:52 LOG7[3236:1336]: Remote FD=248 initialized 2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on remote socket 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): before/connect initialization 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write client hello A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read server hello A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read finished A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write change cipher spec A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write finished A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 flush data 2006.02.04 18:24:52 LOG7[3236:1336]: 1 items in the session cache 2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects (SSL_connect()) 2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects that finished 2006.02.04 18:24:52 LOG7[3236:1336]: 0 client renegotiatations requested 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects (SSL_accept()) 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects that finished 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server renegotiatiations requested 2006.02.04 18:24:52 LOG7[3236:1336]: 1 session cache hits 2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache misses 2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache timeouts 2006.02.04 18:24:52 LOG6[3236:1336]: SSL connected: previous session reused 2006.02.04 18:25:02 LOG3[3236:1336]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2006.02.04 18:25:02 LOG5[3236:1336]: Connection reset: 72 bytes sent to SSL, 0 bytes sent to socket 2006.02.04 18:25:02 LOG7[3236:1336]: netDrives finished (0 left) Here is the stunnel.conf file from the client: ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [netDrives] accept = 222.222.222.222:139 connect = tcServer.crcBusinessServices.com:2139 Any ideas what could be wrong? Thanks, Neil -- Neil Aggarwal, JAMM Consulting, (214) 986-3533, www.JAMMConsulting.com FREE! Valuable info on how your business can reduce operating costs by 17% or more in 6 months or less! http://newsletter.JAMMConsulting.com

1 0

tappipe 1.01 released
by Michal Trojnara 04 Feb '06

04 Feb '06

Here is the ChangeLog entry: * version 1.01 2006.02.04, status: functional, not proven to be stable - TUN changed to TAP (project renamed from tunpipe to tappipe) - TCP-over-TCP meltdown problem fixed http://sites.inka.de/sites/bigred/devel/tcp-tcp.html - important bugfixes Download site: ftp://stunnel.mirt.net/tappipe/ Best regards, Mike

1 0

Stunnel with ntsyslog on windows 2000 forwarding to syslog-ng on fedora core 4 with stunnel in the middle.
by Anthony Cicalla 03 Feb '06

03 Feb '06

Website questions answered first 1) ntsyslog(on windows 2000 pro) is not connecting through stunnel to (fedora core 4) syslog-ng daemon. 2) latest version of stunnel just downloaded it. 3)stunnel syslog-ng -f /etc/syslog-ng.conf 4)ran the command but got no output. (stunnel /etc/stunnel/stunnel.conf -f -D -7) 5)ran the command and it exectuted as above but still got no optput ran (stunnel /etc/stunnel/stunnel.conf -V) 6)Linux echelon.bankserv.com 2.6.11-1.1369_FC4 #1 Thu Jun 2 22:55:56 EDT 2005 i686 i686 i386 GNU/Linux 7)sry I'm a noob and don't know how to get this. I am from the windows side of the house. If you need it send me the command and I will get you the output. 8)Using built-in specs. Target: i386-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,java,f95,ada --enable-java-awt=gtk --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --host=i386-redhat-linux Thread model: posix gcc version 4.0.0 20050519 (Red Hat 4.0.0-8) 9)This is the latest version for fedora core 4. I downloaded the packages for openssl and ran the updater. I am setting up centralized logging with stunnel, syslog-ng, ntsyslog. Following the directions from these two links. <http://www.stunnel.org/examples/syslog-ng.html> <http://www.monitorware.com/Common/en/Articles/eventlog-stunnel-syslog.php> Encrypting traffic to a remote syslog-ng server including SSL peer authentication 1. Install stunnel and syslog-ng on all machines. 2. Create certificates for all machines. On RedHat 9 and similar machines, you can do the following as root: # cd /etc/pki/tls/certs # make syslog-ng-server.pem # make syslog-ng-client.pem 3. Place copies of syslog-ng-server.pem on all machines in /etc/stunnel with one important alteration. The clients only need the certificate section of syslog-ng-server.pem. In other words, remove the private key section from syslog-ng-server.pem on all clients. Place every client's syslog-ng-client.pem in /etc/stunnel. For server, create a special syslog-ng-client.pem containing the certificate sections for all clients and place in /etc/stunnel. In other words, remove the private key sections from all syslog-ng-client.pem files and concatenate what is left to create server's special syslog-ng-client.pem. 4. Give only root ownership, read and write permissions for certificates. 5. On server, create /etc/stunnel/stunnel.conf containing the following replacing server IP address accordingly: cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.x.x.x:5140 connect = 127.0.0.1:514 On clients, create /etc/stunnel/stunnel.conf containing the following replacing server IP address accordingly: client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.x.x.x:5140 6. On server, create the following in /etc/syslog-ng.conf: options { long_hostnames(off); sync(0); keep_hostname(yes); chain_hostnames(no); }; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1") port(514) max-connections(1));}; destination remoteclient {file("/var/log/remoteclient");}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; log {source(stunnel); destination(remoteclient);}; On clients, create the following in /etc/syslog-ng.conf: options {long_hostnames(off); sync(0);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; destination stunnel {tcp("127.0.0.1" port(514));}; log {source(src);destination(dest);}; log {source(src);destination(stunnel);}; (See syslog-ng documentation for more sophisticated syslog-ng.conf alternatives.) 7. Open necessary ports with regards to packet filtering and TCP wrappers. 8. On all machines, add the following lines to boot procedure and execute them now: # stunnel # syslog-ng -f /etc/syslog-ng.conf That was the unix side stunnel config. Copy the files to a location of your choice. If in doubt what you need, download the latest stunnel binary as well as the ZIP file with the openssl libararies. Place everything in the same directory, e.g. c:\bin\stunnel. Please note that the stunnel binary (eg. stunnel-4.04.exe) is the actual stunnel program and NOT a self-extracting exe program. Once you have done this, you only need to supply stunnel with a correct configuration file. You can use the one from the stunnel UNIX/Linux tutorial, step 5. Make sure that you not only copy over the config file but also the needed .PEM files. You probably need to change the pathes in the stunnel.conf file to reflect your local Windows directory structure. Once you have the config file ready, you can start the Windows stunnel. Please note that it by default starts interactively. If all goes well, there is a small icon in the icon tray. Double-Click it to get a status window. If something goes wrong, the status window automatically appears with a nice error message. AT THIS POINT I AM ABLE TO START STUNNEL WITH NO ERRORS SHOW UP BUT 0 ACTIVE TUNNELS. Let's assume all went well. What is left is that we must tell the event log monitor where to forward events to. Installation: Install the service by executing the following command: NTsyslog -install The service will be started automatically by the service control manager during system startup. You can start and stop the service manually from the Services Control Panel. By default the service runs under the LocalSystem account. The service can be configured to run as a local user with the following rights: * Log on as a service * Manage auditing and security log The user the service runs as can be configured in the NTsyslog Properties page which can be accessed through the Services Control Panel. A GUI tool, NTSyslogCtrl is provided to configure what types of messages are monitored and what priority to use for each type. The priority for each event log type controls the service and facility that the syslog message is sent to. Each log type has a seperate priority. If the priority for a particular key does not exist, as if you were upgrading, or using an old NTSyslogCtrl app, the default is 9, user.alert. Usually, syslog refers to a "facility" and "severity". These are combined in to a single value called "priority". To calculate the priorities from normal facility and severity codes: Take the numeric value for the facility, multiply by 8, and add the numeric value for the severity. Standard facility and severity values are: Facility: (0) kernel (12) ntp (1) user (13) log audit (2) mail (14) log alert (3) system (15) clock 2 (4) security/auth 1 (16) local 0 (5) syslog (17) local 1 (6) line printer (18) local 2 (7) news (19) local 3 (8) uucp (20) local 4 (9) clock 1 (21) local 5 (10) security/auth 2 (22) local 6 (11) ftp (23) local 7 Severity: (0) emergency (4) warning (1) alert (5) notice (2) critical (6) information (3) error (7) debug Note that facility 4, 9, 10, and 15 have different meaning on various systems. Please consult your system manual pages or syslogd documentation. Complete details are available in RFC 3164. See: <http://www.ietf.org/rfc/rfc3164.txt> The NTSyslog service must be stopped and restarted for the Registry settings to take effect. By default all messages are sent using the user.alert priority. Registry Settings: The NTSyslogCtrl program is the preferred method of configuring the registry. Editing the registry manually is not required when using the configuration tool. The syslog host is configured by creating the following Registry entry: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet] "Syslog"="192.X.X.X" An additional syslog host may be configured for redundancy: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet] "Syslog1"="" The syslog host can be specified by domain name (loghost.example.com) or by IP address (10.123.112.1). The types of event log messages sent to the syslog host can be configured by setting the dword value for each of the types of messages. All types with a non-zero value will be processed. The included registry file enables all event types for each event log: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\System] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Security] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Application] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 Version 1.11 and later supports user defined event logs. Simply add the appropriate sub-key and settings to the registry in the same format as the three standard event logs: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Directory Service] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 ok after all of this configuration and setup I get no syslogs in on the logging server. I did and ethereal capture and tested a few settings. If I point it directly to the syslog ip address it's still not connecting becuase it's trying to connect on port 514. The syslog server is running on port 5140 from the config. I can telnet to port 5140 with no problems. I can start the nt syslog service with the server's ip and see packets attempting to be sent this tells me that ntsyslog is working. When I go to examine stunnel I get 2006.02.02 10:18:06 LOG5[484:108]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.02 10:18:07 LOG5[484:652]: No limit detected for the number of clients 2006.02.02 11:38:18 LOG5[484:640]: 5140 connected from 127.0.0.1:1386 2006.02.02 11:38:27 LOG3[484:640]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol And that is where I am stuck... any help would be greatly appreciated. I check this regularly so I will reply or attempt suggestions pretty quickly and reply the results. I am still pretty new with linux so if you want me to do something or to get you some information put the commands or step of how to do it in the post. It will not only help me but it will help others behind me that might not know as much as well. I followed the instructions above which has the commands. I created the pem files and the conf files just as above althought there is not /etc/syslog-ng.conf on the windows machine. I still made the files but they are put in c:\bin\stunnel becuase syslog-ng doesn't run on windows. they reccommended snare of something of the like to forward the logs so I chose ntsyslog. Ntsyslog is setup exactly like the instructions say. like I said above stunnel starts without an error when I start the ntsyslog the error appears in the stunnel log. Client Stunnel.conf cert = C:\bin\stunnel\syslog-ng-server.pem CAfile = c:\bin\stunnel\syslog-ng-client.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.168.x.x:5140 Client Server stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.168.x.x:5140 connect = 127.0.0.1:514 syslog-ng.conf options { long_hostnames(off); sync(0); keep_hostname(yes); chain_hostnames(no); }; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1") port(514) max-connections(1));}; destination remoteclient {file("/var/log/remoteclient");}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; log {source(stunnel); destination(remoteclient);}; When you run the gui for ntsyslog it creates the registry entries so i did no have to create them. Client is on windows the server is the fedora core 4 box

1 0

tunpipe
by Michal Trojnara 03 Feb '06

03 Feb '06

Dear Users, For the last two days I was working on a VPN solution for stunnel. The early alpha version is ready for download here: ftp://stunnel.mirt.net/tunpipe/ Advantages: - based on proven strength of SSL encryption (much better than IPSec or any proprietary encryption protocol), - very clean and lightweight design, - very easy to configure. Disadvantages: - only works on GNU/Linux (can be ported to some other Unixes), - use of TCP is the main performance limitation. Aternative solutions: http://www.math.ucla.edu/~jimc/documents/vpn.html Suggestions and comments are welcome. Best regards, Mike

2 3

Encrypted tunnel for HTTP traffic?
by Robert Nicholson 01 Feb '06

01 Feb '06

Can anybody tell me if it's possible for stunnel to act as a local web proxy that simply encrypts my outgoing HTTP traffic and decrypts it on the way back in? Specifically is it still possible to block urls at the hosting provider with this approach and is all my browsing then safe from prying eyes? What I want is along the lines of a VPN solution but it sounds like stunnel can at least take care of my HTTP needs.

2 1

FQDN validation and checking within
by Nagasundaram, Sekhar 01 Feb '06

01 Feb '06

Mike: Given this: what is the best way for Stunnel to make authentication And authorization decisions based on information presented in the Certificate from the peer. My question comes from: how do I do level 3 Checking in a scalable manner when my order of magnitude is in the Thousands... Much thanks Sekhar ------------------------------- Message: 3 Date: Tue, 31 Jan 2006 09:51:06 +0100 From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> Subject: RE: [stunnel-users] FQDN validation and checking within STunnel To: <stunnel-users(a)mirt.net> Message-ID: <20060131085108.B053F1C130(a)linode.mirt.net> Content-Type: text/plain; charset="us-ascii" Nagasundaram, Sekhar wrote: > Is there a setting in Stunnel to do FQDN checking? DNS is not a secure protocol (http://www.securesphere.net/download/papers/dnsspoof.htm). Security should not be based on DNS checks. I'm not going to implement this feature. Best regards, Mike ------------------------------ Message: 4 Date: Tue, 31 Jan 2006 10:41:37 +0100 From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> Subject: RE: --with-threads=ucontext portability (was Re: [stunnel-users] stunnel4.x.x and IRIX) To: <stunnel-users(a)mirt.net> Message-ID: <20060131094139.33A011C17C(a)linode.mirt.net> Content-Type: text/plain; charset="iso-8859-1" Miloslav Trmac wrote: > I have just seen a crash at a similar place on x86_64. The apparent > cause is sthreads.c:116: > makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); arg is a void > *, but: > - the size is given as 1; it should be > (sizeof (arg) + sizeof (int) - 1) / sizeof (int) > because the "size" is defined as a number of int arguments > - it won't work anyway; makecontext () is defined to work only for > integer parameters. It is not possible to pass a pointer as > integers on x86_64, which uses registers to pass the first 6 > integer or pointer parameters. Are we still talking about IRIX? http://nixdoc.net/man-pages/IRIX/man3c/makecontext.3c.html I can't find any of mentioned limitations in the manual. Just the opposite: "the arguments that follow the argc parameter for makecontext are restricted to longs and pointers only". Best regards, Mike ------------------------------ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users End of stunnel-users Digest, Vol 18, Issue 19 *********************************************

2 1

Encrypted tunnel for HTTP traffic?
by Robert Nicholson 01 Feb '06

01 Feb '06

Can anybody tell me if it's possible for stunnel to act as a local web proxy that simply encrypts my outgoing HTTP traffic and decrypts it on the way back in? Specifically is it still possible to block urls at the hosting provider with this approach and is all my browsing then safe from prying eyes? What I want is along the lines of a VPN solution but it sounds like stunnel can at least take care of my HTTP needs.

1 0

Stunnel Question /Feature request
by Mathias . 31 Jan '06

31 Jan '06

Hi everybody. Is it possible at the Client side specify where the Stunnel server should connect to? I mean. If I'm using stunnel both on the clisnt side and the Server side is it possible from within the Stunnel.conf file specify a destination at serverside that overides the "connect=" tag specified in the stunnel.conf file at the server side. This would make it possible to have two services accessible at the same port. I.e IIS using https (accessible from any browser) and a nother SSL, non-web, based service (accessible from a Stunnel client). Anyone that ever have thought about creating such a patch? /M

1 0

stunnel 4.x.x and IRIX
by Eric Haddix 31 Jan '06

31 Jan '06

I happened upon a user here that posted a couple of months ago(I think) who used IRIX and had successfully compiled stunnel. Any chance you're still around!?!? I get one of two things. Before I apply the patch, it will crash right after startup. No logs, just dumps core. After the patch, it starts and exits immediately. I can run it with -version, etc. and it seems to work fine. Anyone had this and/or know what can be done? Eric

3 10

FQDN validation and checking within STunnel
by Nagasundaram, Sekhar 31 Jan '06

31 Jan '06

All: Is there a setting in Stunnel to do FQDN checking? Level 3 checking requires a local copy of the Peer's certificate. When doing mutual authentication, I run into scalability issues when the devices Run into the thousands using Level3 validation. However, if Stunel was capable of doing FQDN checks, That would help while not requiring me to do level 3 checks (although that is probably better). Thanks Sekhar

2 1

stunnel errors on Solaris
by Kevin Mooney 27 Jan '06

27 Jan '06

Hello All, I am having some errors on a Solaris 8 machine with stunnel. Everything seems to be working fine, but I am just a little leary since it is under security violations. I couldn't get anything from google using the string Too many retries on SSL shutdown. I was curious if anyone has seen this before or if somebody might have an idea as to what this means. Thank You, Kevin Security Violations =-=-=-=-=-=-=-=-=-= Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown

2 1

Stunnel and Forte Agent
by Malcolm William Mason 27 Jan '06

27 Jan '06

Hello to all, I have been using Stunnel to access News Groups at ATT.net to by-pass or tunnel through ATT's SSL for some time. I have run into trouble and I am getting a message "connection" failed. At first I thought that it was Stunnel and after deleting and re-installing Stunnel, I an getting the same RESULT. Was there an older version of Stunnel that worked and will the new, updated Stunnel not work or does it need to have some settings changed? Malcolm Mason MWM1(a)jhu.edu

1 0

Proxy Support and 4.15b2
by Ben Green 26 Jan '06

26 Jan '06

Greetings everyone, I have been working for a few days with Stunnel and have been trying to get it working with the proxy servers that filter all outbound traffic at work. I stumbled across 4.15b2 today and was able to get it all to work well to SSL enable telnet and fix through the connect protocol. I plan to use this in production if all goes well in dev, test, and qa over the next 2 months. I was not around on the list when the announcement went out for 4.15b2 on November 16th (found it in the archives). I'll get to my point, now. I am wondering how testing is going with 4.15b2. Is it going to be released as 4.15, soon? Has anyone put 4.15b2 in a production situation? Thanks. Ben Green

2 1

Win32 proxy enabled version
by Richard Houston 24 Jan '06

24 Jan '06

Hi all, I am looking for a windows version of stunnel with proxy server support. I need to use this from behind a Novel Boarder manager firewall. Also is there any documentation on the config file options? Thanks much in advance! +------------------------------------+ Best regards, -Richard Houston -R.L.H. Consulting -E-Mail rhouston(a)rlhc.net -WWW http://www.rlhc.net -Blog http://www.rlhc.net/blog/

1 0

Re: [stunnel-users] exclusively TLS
by Jesse Small 24 Jan '06

24 Jan '06

I've been working through the same problem as John, but I tried using Jan's solution by setting the options and still haven't been able to get it to work. On server1 I am running openssl s_server with tls-only specified: openssl s_server -accept 8443 -cert XDS_REG_HXTI.cer -key hxti1.key -tls1 On the client side (server2), I have stunnel set up as a client listening on localhost port 8100, and forwarding over to server1, port 8443. Then to test I run 'telnet localhost 8100' and see the error message from s_server: ACCEPT ERROR 16656:error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number:s3_srvr.c:683: shutting down SSL CONNECTION CLOSED In my stunnel.log file I can see this error message: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure So to me it still seems to be sending out a client hello in sslv3, despite my efforts to the contrary. Below are the pertinent parts of my stunnel_client.conf file. Any help you could give would be greatly appreciated. Thanks, Jesse ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 [toOtherServer] accept = 8100 connect = devapp:8443 -----Original Message----- From: Jan Meijer [mailto:[email protected]] Sent: Friday, January 20, 2006 5:20 PM To: Moehrke, John (GE Healthcare) Cc: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] exclusively TLS On Fri, 20 Jan 2006, Moehrke, John (GE Healthcare) wrote: > It is not the list of ciphers that I want to choose from. We are indeed > using a select set of ciphers and that seems to be working fine. My > problem is that when stunnel connects to the server it is trying sslv3, > and this causes an error as the server is only supporting TLS. I could > easily be wrong... Ah, that way. options = SSL_options OpenSSL library options The parameter is the OpenSSL option name as described in the SSL_CTX_set_options(3ssl) manual, but without SSL_OP_ prefix. Several options can be used to specify multiple options. For example for compatibility with erroneous Eudora SSL implementation the following option can be used: options = DONT_INSERT_EMPTY_FRAGMENTS Check the SSL_CTX_set_options manpage, it says -amongst other things-: SSL_OP_NO_SSLv2 Do not use the SSLv2 protocol. SSL_OP_NO_SSLv3 Do not use the SSLv3 protocol. SSL_OP_NO_TLSv1 Do not use the TLSv1 protocol. That ought to do the trick I'd say. Let us know if it did :) Jan -- http://www.surfnet.nl/organisatie/jame

1 0

ad tdions
by Malcolm William Mason 23 Jan '06

23 Jan '06

I am, apparently on this But how do I post to it as others seen to. Pro Posterioribus

1 0

Looking for a job in UK or Ireland
by Michal Trojnara 23 Jan '06

23 Jan '06

Hi, I hope you don't mind this time I'll use stunnel mailing lists for something personal. I've just updated my Resume: http://mike.mirt.net/cv-en.pdf Do you know of interesting job openings? Possibly as an architect or in a similar position. Best regards, Mike

1 0

https to http proxy is buggy with IE
by Glen 22 Jan '06

22 Jan '06

Hi Everyone, I am trying to use stunnel to do the ssl portion for the web server. Mainly because the certificate I have is easy to setup in stunnel (was originally created for an openssl based serer) and the web server supports it's own propriatery cert format which I would like to avoid having to convert to. I have it working fine with all browsers except for the buggy Internet Explorer. With internet explorer anything requiring a page redirect fails (from viewing the logs it appears the socket gets closed before the redirect is finished resulting in a blank page being sent to the browser. I have tried the TIMEOUTclose = 0 but that hasn't helped. Any suggestions? thanks, Glen

2 1

stunnel 4.14 errors and dropped connection
by stunnelusers＠tinfoil.cotse.net 21 Jan '06

21 Jan '06

Hello, If I leave my computer downloading via stunnel and come back to it later, I find the download has stopped halfway and in the stunnel log it says: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) and then a number of lines like: Error resolving 'xxx.xxx.xxx': Neither nodename nor servname known (EAI_NONAME) where xxx.xxx.xxx is the url I was downloading from. I am using stunnel 4.14 on win xp. If I try to load a web page like google I get told it cannot be found. I have to switch off the router and switch it back on. When Windows finds the "new" connection it resets itself and everything works perfectly again, for a while, and then it happens all over again. This did not happen before I upgraded to 4.14. What is happening? Why is it happening? How do i stop it? Thanks.

1 0

RE: [stunnel-users] exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

It is not the list of ciphers that I want to choose from. We are indeed using a select set of ciphers and that seems to be working fine. My problem is that when stunnel connects to the server it is trying sslv3, and this causes an error as the server is only supporting TLS. I could easily be wrong... John > > I need to talk to a server that is requiring pure TLS. It seems that > > STUNNEL always starts with SSL. How do I get STUNNEL to > start the client > > side conversation with TLS? > > http://www.stunnel.org/faq/stunnel.html#global_options > > ciphers = cipherlist > > Select permitted SSL ciphers > > A colon delimited list of the ciphers to allow in the SSL > connection. > For example DES-CBC3-SHA:IDEA-CBC-MD5 > > > For an exhaustive table of allowed ciphersuite values, if > it's not in the > stunnel manual check > http://www.modssl.org/docs/2.8/ssl_reference.html#ToC9 > > Jan > > -- > http://www.surfnet.nl/organisatie/jame > >

2 1

exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

I need to talk to a server that is requiring pure TLS. It seems that STUNNEL always starts with SSL. How do I get STUNNEL to start the client side conversation with TLS? John Moehrke Enterprise Security Architect GE Healthcare T 262 293 1667 W126 N7449 Flint Road, Suite 200, Menomonee Falls, WI 53051 John.Moehrke(a)med.ge.com <mailto:[email protected]> www.gehealthcare.com <http://www.gehealthcare.com/> What I may see or hear in the course of the treatment or even outside of the treatment in regard to the life of men, which on no account one must spread abroad, I will keep to myself, holding such things shameful to be spoken about. (One Portion of the Hippocratic Oath - Hippocrates, circa 400 B.C.)

2 1

Stunnel in a three tier setup
by Louis Young 19 Jan '06

19 Jan '06

Hi Guys I would like to set up stunnel in a three tier environment, i.e. instead of just having a client and a server, I have a client, midware and server. I tried doing this: On the client: [VNC on TestMachine] accept = 9000 connect = 192.168.100.12:9000 192.168.100.12 is the "mid-ware" machine: On this "mid-ware" machine: [VNC on TestMachine] accept = 9000 connect = 192.168.100.16:9000 192.168.100.16 is the destination: Then on the destination: [VNC] accept = 9000 connect = 192.168.100.16:5900 The only machine with client=yes is the client and they all use the same key. If I change the settings on the client to point directly to the destination (i.e. using only two machines), it works, but with three machines there seems to be a problem Any ideas? Regards, Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

2 1

verify server certification is missing
by Olivier twist 17 Jan '06

17 Jan '06

I think a functionnality is missing in stunnel. I compare the behaviour of stunnel and apache mod-ssl. If you have a certificate signed by third party, apache checks the root certificate like stunnel do this with -v 1 option but apache don't ask for a client certificate, stunnel do this :-( I think that stunnel should control server certificate chain defined in CA file even if option -v 1 is not set !!! Could you give your opinion? If I use stunnel and not apache it's because I have some protocols to handle with ssl and stunnel is a very easy to use solution. Thanks Oliver

1 0

Delay option
by Stefaan Van Dooren 16 Jan '06

16 Jan '06

Hi, I'm setting up stunnel and I'm facing a problem with dynamic IP-adresses. Searching google and the man pages I tought that the "delay = yes" option would solve my problem, but it doesn't seems to. If I had "delay = yes" to my config file, none of my services seems to work anymore. If I remove it, everything is working fine, until the the remote-IP changes, and I have to restart stunnel. What am I doing wrong ? Or isn't this the right option for this job ? Stunnel -version : stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Stefaan

2 1

Connection Refused by libwrap
by Eddie Atherton 16 Jan '06

16 Jan '06

Hi, With Version 4.14, I've now started seeing the following messages occaisionally when I fire up 4 concurrent connections from my Windows box, via stunnel on Linux, to my NewsServer: Jan 3 17:55:13 The-Tardis stunnel: LOG3[17760:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17760:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:401]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:401]: Connection from 192.168.0.2:2075 REFUSED by libwrap Following this, the connections continues as normal. Now, ASAIK, I'm not using the wrappers. I'm starting stunnel as a daemon, in rc.local. There are no entries in inetd.conf for the port that the windows machine connects from. Here's the relevent parts of the config file: ; Use it for client mode client = yes [nntps] accept = 563 connect = newsgroups.comcast.net:563 Cheers, Eddie

2 2

need help with verify 1 option
by Olivier twist 13 Jan '06

13 Jan '06

2 2

Some newbie question for stunnel
by Thomas Stein 13 Jan '06

13 Jan '06

Hello, After reading some doc pages about stunnel I have still some questions: 1.) I read that the client part of a pop3 connection (e.g. for GoogleMail) is like stunnel -c -d pop3 -r bar:pop3s However I did not found any explations of the flags -d, -d and -r When I type stunnel -help none of these flags are explained. 2.) Can I replace pop3 and pop3s in the command above by real port numbers? 3.) Is stunnel compatible with SSH servers ? In other words: can stunnel on the local machine communicate with a SSH server on the remote computer and vice versa? 4.) Is there a timeout function? Read: When I start stunnel I would like to exit the service after lets say 5 minutes automatically. Is there such a feature/option? 5.) Has someone experiences with googlemail pop3 retrieval of emails? Is the following stunnel command recommendable for googlemail.com? stunnel -c -d pop3 -r pop.googlemail.com:pop3 Thank you in advance for the answer Thomas -- ___________________________________________________ Play 100s of games for FREE! http://games.mail.com/

2 1

Sniffing the network --how to disable SSL?
by david-e.hansen＠ubs.com 12 Jan '06

12 Jan '06

Hi, I know this sort of defeats the whole purpose of stunnel, but I have an LDAP server which listens for non-SSL on one port, and SSL on another. We decided to use stunnel and the SSL port on our LDAP server for security purposes. However, now we need to see the communication between clients and the LDAP server, in order to debug a production problem. Sniffing won't be terribly useful unless we can turn off the SSL encryption of the communication. I can't just re-point the application to the non-SSL port because this is stored in a central database and would affect everyone (it's a 3rd pty app), so I just want to change the stunnel.conf file on my PC so that it does port-forwarding but no encryption. Is this possible to do? Regards, David E. Hansen Stunnel version 4, LDAP version 3 Visit our website at http://www.ubs.com This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments.

2 1

running on one machine stunnel server AND client
by Dan Beldiman 11 Jan '06

11 Jan '06

Hi, I am using stunnel4 (stunnel 4.09 on i386-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004) on debian linux. I want to run on one machine an stunnel server and an stunnel client, so it can recive a connection and also open a new connection to a different server (in the ascii graphic below server b) SERVER A SERVER B SERVER C | | | | ------>------ ----->---- The configuration file only allows me to specify client=yes or no, but I can not specify this for each connection. How can I set up a client and server on the same machine? Thanks Dan

2 3

Stunnel 4.14 & 4.15 don't compile on Tru64 (5.1A)!
by Alberto D'Ambrosio 11 Jan '06

11 Jan '06

Hi! I'd like to upgrade Stunnel from 4.04 to 4.14/4.15 on my Tru64 box, but it no longer compiles: ========================================= cc: Error: client.c, line 173: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 893: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 1003: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t optlen; ----^ cc: Error: client.c, line 175: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Warning: client.c, line 259: In this statement, the referenced type of the pointer value "sid_ctx" is "unsigned char", which is not compatible with "const char" because they differ by signed/unsigned attribute. (ptrmismatch1) SSL_set_session_id_context(c->ssl, sid_ctx, strlen(sid_ctx)); -------------------------------------------------------^ cc: Error: client.c, line 904: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Error: client.c, line 1019: In this statement, "optlen" is not declared. (undeclared) optlen=sizeof(error); ------------^ *** Exit 1 Stop. *** Exit 1 Stop. ========================================= For your information: - Version 4.04 compiles and works fine. - Version 4.06 compiles but doesn't work: Jan 11 10:36:14 scilla stunnel[701061]: daemon_loop: s_poll_wait: Invalid argument (22) Jan 11 10:38:37 scilla last message repeated 77888 times Jan 11 10:36:44 scilla last message repeated 24118 times - any version >= 4.07 no longer compiles. - OpenSSL 0.9.8a compiles and works fine. Any help is appreciated. Ciao, Alberto

2 1

Private key storage on usb token or CD
by Siddhartha Jain 10 Jan '06

10 Jan '06

Hi, What would I need to do to store private keys generated on a Windows client on a USB Token or a CD? Thanks, - Siddhartha

2 1

Re: Connection reset by peer on same local network?
by Gabe Martin-Dempesy 04 Jan '06

04 Jan '06

On Jan 4, 2006, at 5:00 AM, stunnel-users-request(a)mirt.net wrote: > Please try the latest stunnel and OpenSSL first. > Also send detailed logs (debug=7). Same behavior occurs after upgrade. on debug 7: Server log: 2006.01.04 09:01:35 LOG7[14085:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=7, (OUT)->(ERRHUP) 2006.01.04 09:01:35 LOG7[14085:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:01:35 LOG7[14085:0]: CONTEXT 2, FD=7, (OUT)->(ERRHUP) 2006.01.04 09:01:35 LOG3[14085:2]: transfer() loop executes not transferring any data 2006.01.04 09:01:35 LOG3[14085:2]: please report the problem to Michal.Trojnara(a)mirt.net 2006.01.04 09:01:35 LOG3[14085:2]: socket open: rd=yes wr=yes, ssl open: rd=yes wr=yes 2006.01.04 09:01:35 LOG3[14085:2]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2006.01.04 09:01:35 LOG3[14085:2]: ssl want: rd=no wr=no 2006.01.04 09:01:35 LOG3[14085:2]: socket input buffer: 16384 byte (s), ssl input buffer: 16384 byte(s) 2006.01.04 09:01:35 LOG3[14085:2]: check_SSL_pending=0, ssl_closing=0 2006.01.04 09:01:35 LOG5[14085:2]: Connection reset: 1345269015 bytes sent to SSL, 213024 bytes sent to socket 2006.01.04 09:01:35 LOG7[14085:2]: 973 finished (0 left) 2006.01.04 09:01:35 LOG5[14085:2]: stack_info: size=65536, current=4620 (7%), maximum=4620 (7%) 2006.01.04 09:01:35 LOG7[14085:2]: Context 2 closed 2006.01.04 09:01:35 LOG7[14085:0]: Waiting -1 second(s) for 2 file descriptor(s) Client log: 2006.01.04 09:00:39 LOG7[9605:0]: Waiting 43200 second(s) for 5 file descriptor(s) 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=7, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2006.01.04 09:00:39 LOG7[9605:2]: SSL_write returned WANT_WRITE: retrying 2006.01.04 09:00:39 LOG3[9605:2]: SSL socket closed with 16384 byte (s) in buffer 2006.01.04 09:00:39 LOG5[9605:2]: Connection reset: 348124 bytes sent to SSL, 1345102011 bytes sent to socket 2006.01.04 09:00:39 LOG7[9605:2]: 8001 finished (0 left) 2006.01.04 09:00:39 LOG7[9605:2]: Context 2 closed 2006.01.04 09:00:39 LOG7[9605:0]: Waiting -1 second(s) for 3 file descriptor(s) This part of the logs: 2006.01.04 09:00:39 LOG7[9605:0]: Waiting 43200 second(s) for 5 file descriptor(s) 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=4, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=6, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 1, FD=7, (IN)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=8, (OUT)->() 2006.01.04 09:00:39 LOG7[9605:0]: CONTEXT 2, FD=9, (OUT)->(OUT) loops continuously in both server and client lots the entire time, repeating several times each second. One rsync session over stunnel generates stunnel logs over 50MB. I have no idea if this is typical LOG7 behavior or not, but I'm mentioning it just in case.

1 0

stunnel 4.14 and zlib compression problem
by David Cheung 03 Jan '06

03 Jan '06

I'm hoping that someone can shed some light on the following problem: when I run stunnel: [root@test stunnel]# stunnel /etc/stunnel/stunnel.conf 2006.01.03 10:49:27 LOG5[4619:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7h 11 Oct 2005 2006.01.03 10:49:27 LOG3[4619:1]: Failed to initialize zlib compression method content of stunnel.conf: foreground = yes debug = 7 cert = /etc/stunnel/stunnel.pem output = /dev/stdout chroot = /var/run/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 compression = zlib [demo] accept = 1443 connect = www:80 TIMEOUTclose = 0 It also appears that the libraries are properly linked in: [root@test tmp]# ldd /usr/sbin/stunnel linux-gate.so.1 => (0xffffe000) libz.so.1 => /usr/lib/libz.so.1 (0xb7fc9000) libdl.so.2 => /lib/libdl.so.2 (0xb7fc5000) libutil.so.1 => /lib/libutil.so.1 (0xb7fc1000) libnsl.so.1 => /lib/libnsl.so.1 (0xb7fab000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0xb7f78000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0xb7e66000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0xb7e5f000) libc.so.6 => /lib/tls/libc.so.6 (0xb7d40000) /lib/ld-linux.so.2 (0xb7fdf000) I'm running this on Arch Linux with a stock 2.6.15 kernel. Any help would be appreciated.

2 1

Connection reset by peer on same local network?
by Gabe Martin-Dempesy 03 Jan '06

03 Jan '06

I'm attempting to setup an encrypted rsync to pull backups off of a file server onto a safe backup machine. To do this I'm using a combination of stunnel and rsyncd (It needs to pull root-owned files, so -e ssh wouldn't work unless I want to have a backup script remotely logging in as root!!) For now the machines are both on the same local network, 10.10.10.0/24, but I'm have weird problems with stunnel getting a 'connection reset by peer' after a couple minutes of the rsync, halting the transfer prematurely. Here's what I see in the logs: Client: Dec 29 10:19:21 backup stunnel[2568]: 8001 connected from 127.0.0.1:39215 Dec 29 10:21:09 backup stunnel[2568]: SSL_write: Connection reset by peer (104) Dec 29 10:21:09 backup stunnel[2568]: Connection reset: 192532 bytes sent to SSL, 5920666 bytes sent to socket Server: Dec 29 10:20:00 proto stunnel[30434]: 973 connected from 10.10.10.20:54054 Dec 29 10:20:00 proto rsyncd[1776]: rsync on xserve from localhost (127.0.0.1) Dec 29 10:21:49 proto stunnel[30434]: SSL socket closed with 16384 byte(s) in buffer Dec 29 10:21:49 proto stunnel[30434]: Connection reset: 5953434 bytes sent to SSL, 98416 bytes sent to socket Dec 29 16:21:49 proto rsyncd[1776]: rsync: writefd_unbuffered failed to write 4096 bytes: phase "unknown": Connection reset by peer Dec 29 16:21:49 proto rsyncd[1776]: rsync error: error in rsync protocol data stream (code 12) at io.c(666) Note that the client gets the 'connection reset by peer' a good 40 seconds before the server notices the disconnect. Here are the associated stunnel.conf's, which are pretty basic Client: cert = /etc/stunnel/backup.crt key = /etc/stunnel/backup.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [8001] accept = 8001 connect = 10.10.10.15:973 Server: cert = /etc/stunnel/proto.crt key = /etc/stunnel/proto.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [973] accept = 973 connect = 127.0.0.1:rsync Both are using: stunnel 4.09 on i686-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/lib/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Both of these machines are Gentoo 2005.1, updated to current, using the hardened 2.6 profile. Neither of them use non-standard make flags. Does anyone have some insight? There shouldn't be any "peer" (besides themselves) in the way between these two boxes to disconnect them.

2 1

RE: [stunnel-users] Connection reset by peer on same local networ k?
by Jeremy Simons 03 Jan '06

03 Jan '06

The problem is not with stunnel, but with rsyncd. I assume you are running rsyncd on the source machine in conjunction with the /etc/rsyncd.conf file. The cool thing about running rsyncd through stunnel is the rsync client appears to the rsyncd as a local machine (obviously) so permissions are a problem. The best way I could recommend since you need to access root owned files would be to setup your rsyncd entry something like: ## Example of full access to /home directory [home] uid = root gid = root path = /home comment = home directory. hosts allow = 127.0.0.1 read only = no ignore nonreadable = no refuse options = checksum dont compress = * If you notice the "hosts allow" directive only allows access from localhost(127.0.0.1). The problem is *anyone* can connect to your stunnel server unless you require security I would recommend using your firewall to allow access to your stunnel instance and also to use non-standard ports (I.E. 50000-50010). Using a firewall in lieu of authentication is obviously NOT secure or even recommended for a production environment but is simply added security that certainly doesn't hurt. The workaround would be to secure stunnel and leave rsyncd wide-open to localhost. As for the "connection reset" errors I was getting the same thing until I upgraded to the latest version of stunnel. I read a post on stunnel.mirt.net about it. Are you sure you're using the latest version of stunnel? Jeremy -----Original Message----- From: Gabe Martin-Dempesy [mailto:[email protected]] Sent: Tuesday, January 03, 2006 1:49 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Connection reset by peer on same local network? I'm attempting to setup an encrypted rsync to pull backups off of a file server onto a safe backup machine. To do this I'm using a combination of stunnel and rsyncd (It needs to pull root-owned files, so -e ssh wouldn't work unless I want to have a backup script remotely logging in as root!!) For now the machines are both on the same local network, 10.10.10.0/24, but I'm have weird problems with stunnel getting a 'connection reset by peer' after a couple minutes of the rsync, halting the transfer prematurely. Here's what I see in the logs: Client: Dec 29 10:19:21 backup stunnel[2568]: 8001 connected from 127.0.0.1:39215 Dec 29 10:21:09 backup stunnel[2568]: SSL_write: Connection reset by peer (104) Dec 29 10:21:09 backup stunnel[2568]: Connection reset: 192532 bytes sent to SSL, 5920666 bytes sent to socket Server: Dec 29 10:20:00 proto stunnel[30434]: 973 connected from 10.10.10.20:54054 Dec 29 10:20:00 proto rsyncd[1776]: rsync on xserve from localhost (127.0.0.1) Dec 29 10:21:49 proto stunnel[30434]: SSL socket closed with 16384 byte(s) in buffer Dec 29 10:21:49 proto stunnel[30434]: Connection reset: 5953434 bytes sent to SSL, 98416 bytes sent to socket Dec 29 16:21:49 proto rsyncd[1776]: rsync: writefd_unbuffered failed to write 4096 bytes: phase "unknown": Connection reset by peer Dec 29 16:21:49 proto rsyncd[1776]: rsync error: error in rsync protocol data stream (code 12) at io.c(666) Note that the client gets the 'connection reset by peer' a good 40 seconds before the server notices the disconnect. Here are the associated stunnel.conf's, which are pretty basic Client: cert = /etc/stunnel/backup.crt key = /etc/stunnel/backup.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [8001] accept = 8001 connect = 10.10.10.15:973 Server: cert = /etc/stunnel/proto.crt key = /etc/stunnel/proto.key setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [973] accept = 973 connect = 127.0.0.1:rsync Both are using: stunnel 4.09 on i686-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/lib/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Both of these machines are Gentoo 2005.1, updated to current, using the hardened 2.6 profile. Neither of them use non-standard make flags. Does anyone have some insight? There shouldn't be any "peer" (besides themselves) in the way between these two boxes to disconnect them. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

stunnel library inconsistencies
by Brian T 29 Dec '05

29 Dec '05

Hi, I've been using stunnel 4.08 on an embedded Linux platform for a while now, and am attempting to move to the 2.6 kernel from the 2.4.20, which has changed my building platform. I am cross-compiling with libs and tools targeted for the embedded system, which is an i486 type AMD Elan chip. I have tried 4.08, 4.14 and 4.15b, all with the same result. Everything looks to compile properly, but when running stunnel I get the following: Inconsistency detected by ld.so: dl-minimal.c: 134: realloc: Assertion `ptr == alloc_last_block' failed! strace doesn't supply any helpful information. I have tried building with and without tcpwrappers, and have tried libssl 0.9.7g and 0.9.7i. Libssl v0.9.8a doesn't seem to play very nice. Anyone able to look at my config.log? It's 140k uncompressed, but will zip it up if needed. Thanks, -Brian

2 2

./configure issues
by Campbell Vertesi 29 Dec '05

29 Dec '05

I'm running a fresh install of Solaris 10-sparc, and am having a helluvatime getting stunnel to configure. I come from a Gentoo background, where compiling apps is second nature, and I'm not used to this kind of problem! I originally installed gcc3.3.2 using the sunfreeware package, and as an afterthought went back again using pkg-get to make sure I had all the dependencies I needed. When I run ./configure, it errors out: # ./configure configure: **************************************** initialization checking for a BSD-compatible install... /opt/sfw/bin/ginstall -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking build system type... sparc-sun-solaris2.10 checking host system type... sparc-sun-solaris2.10 checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for a BSD-compatible install... /opt/sfw/bin/ginstall -c checking whether make sets $(MAKE)... (cached) yes configure: **************************************** libtool checking for a sed that does not truncate output... /opt/sfw/bin/gsed checking for egrep... egrep checking for ld used by gcc... /usr/ccs/bin/ld checking if the linker (/usr/ccs/bin/ld) is GNU ld... no checking for /usr/ccs/bin/ld option to reload object files... -r checking for BSD-compatible nm... /opt/sfw/lib/bin//nm -B checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking how to run the C preprocessor... /lib/cpp configure: error: C preprocessor "/lib/cpp" fails sanity check See `config.log' for more details. relevant chunk of config.log: configure:2615: checking whether gcc accepts -g configure:2636: gcc -c -g conftest.c >&5 configure:2642: $? = 0 configure:2645: test -z || test ! -s conftest.err configure:2648: $? = 0 configure:2651: test -s conftest.o configure:2654: $? = 0 configure:2665: result: yes configure:2682: checking for gcc option to accept ANSI C configure:2752: gcc -c -g -O2 conftest.c >&5 In file included from conftest.c:13: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:36:27: iso/stdio_iso.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:105:27: iso/stdio_c99.h: No such file or directory In file included from conftest.c:13: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:210: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:246: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:247: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:256: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:258: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:282: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:284: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:295: error: parse error before '*' token /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/stdio.h:296: error: parse error before "FILE" In file included from conftest.c:14: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:27:31: sys/feature_tests.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:28 :26: sys/isa_defs.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:33:27: sys/machtypes.h: No such file or directory /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:45:27: sys/int_types.h: No such file or directory In file included from conftest.c:14: /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:68: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:72: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:214: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:219: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:225: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:230: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:233: error: parse error before "offset_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:234: error: parse error before "u_offset_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:235: error: parse error before "len_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:236: error: parse error before "diskaddr_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:395: error: parse error before "uint16_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:397: error: parse error before "__pthread_mutex_ceiling" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:398: error: parse error before "__pthread_mutex_type" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:399: error: parse error before "__pthread_mutex_magic" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:403: error: parse error before "uint8_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:406: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:409: error: parse error before "__pthread_mutex_owner64" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:411: error: parse error before "__pthread_mutex_data" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:416: error: parse error before "uint8_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:418: error: parse error before "__pthread_cond_magic" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:420: error: parse error before "__pthread_cond_data" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:427: error: parse error before "int32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:429: error: parse error before "__pthread_rwlock_magic" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:430: error: parse error before "__pthread_rwlock_mutex" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:431: error: parse error before "__pthread_rwlock_readercv" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:432: error: parse error before "__pthread_rwlock_writercv" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:439: error: parse error before "uint32_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:441: error: parse error before "__pthread_barrier_cycle" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:442: error: parse error before "__pthread_barrier_reserved" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:443: error: parse error before "__pthread_barrier_lock" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:444: error: parse error before "__pthread_barrier_cond" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:447: error: parse error before "pthread_spinlock_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:474: error: parse error before "upad64_t" /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/include/sys/types.h:618:24: sys/select.h: No such file or directory conftest.c:15:22: sys/stat.h: No such file or directory conftest.c:18: error: parse error before '*' token conftest.c:18: warning: `struct stat' declared inside parameter list conftest.c:18: warning: its scope is only this definition or declaration, which is probably not what you want conftest.c:18: warning: data definition has no type or storage class conftest.c:47: error: parse error before "FILE" conftest.c:47: warning: `struct stat' declared inside parameter list conftest.c:47: error: `pairnames' declared as function returning a function conftest.c:47: error: parse error before "int" configure:2758: $? = 1 configure: failed program was: | /* confdefs.h. */ | | #define PACKAGE_NAME "stunnel" | #define PACKAGE_TARNAME "stunnel" | #define PACKAGE_VERSION "4.14" | #define PACKAGE_STRING "stunnel 4.14" | #define PACKAGE_BUGREPORT "" | #define PACKAGE "stunnel" | #define VERSION "4.14" | #define HOST "sparc-sun-solaris2.10" | /* end confdefs.h. */ | #include <stdarg.h> | #include <stdio.h> | #include <sys/types.h> | #include <sys/stat.h> | /* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ | struct buf { int x; }; | FILE * (*rcsopen) (struct buf *, struct stat *, int); | static char *e (p, i) | char **p; | int i; | { | return p[i]; | } | static char *f (char * (*g) (char **, int), char **p, ...) | { | char *s; | va_list v; | va_start (v,p); | s = g (p, va_arg (v,int)); | va_end (v); | return s; | } | | /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has | function prototypes and stuff, but not '\xHH' hex character constants. | These don't provoke an error unfortunately, instead are silently treated | as 'x'. The following induces an error, until -std1 is added to get | proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an | array size at least. It's necessary to write '\x00'==0 to get something | that's true only with -std1. */ | int osf4_cc_array ['\x00' == 0 ? 1 : -1]; | | int test (int i, double x); | struct s1 {int (*f) (int a);}; | struct s2 {int (*f) (double a);}; | int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); | int argc; | char **argv; | int | main () | { | return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; | ; | return 0; | } I'm at my wits end at this point. Any help would be greatly appreciated! # uname -a SunOS foobar 5.10 Generic sun4u sparc SUNW,Sun-Blade-100 # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # make -v GNU Make 3.80 Copyright (C) 2002 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Thanks Cam

1 0

how do i configure stunnel to work with TLS_RSA_WITH_RC4_128_SHA
by Nadav, Erez 29 Dec '05

29 Dec '05

hi, I had installed stunnel to work as client. I do i configure the stunnel to encrypt send data in TLS_RSA_WITH_RC4_128_SHA Regards Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

how do i configure SSL or stunnel for the following encription
by Nadav, Erez 28 Dec '05

28 Dec '05

1. TLS_RSA_WITH_RC4_128_SHA 2. TLS_RSA_WITH_AES_256_CBC_SHA Regards Nadav Erez R&D Verint Systems Inc Phone: +972+9-9624753 Cellular: +972-54-7784753 Email: Erez.Nadav(a)verint.com Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

stunnel + openbsd + popa3d
by Pedro [bodymind] 28 Dec '05

28 Dec '05

hi! I'm getting nuts with this... i hope someone can help me... i'm trying to use popa3d trough stunnel, with inetd... stunnel.log: 2005.12.28 14:03:45 LOG5[6298:2102628352]: stunnel 4.11 on i386-unknown-openbsd3.8 PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.12.28 14:03:45 LOG7[6298:2102628352]: Snagged 64 random bytes from /dev/arandom 2005.12.28 14:03:45 LOG7[6298:2102628352]: RAND_status claims sufficient entropy for the PRNG 2005.12.28 14:03:45 LOG6[6298:2102628352]: PRNG seeded successfully 2005.12.28 14:03:45 LOG7[6298:2102628352]: Certificate: /etc/stunnel/teste.pem 2005.12.28 14:03:45 LOG7[6298:2102628352]: Key file: /etc/stunnel/teste.pem 2005.12.28 14:03:45 LOG7[6298:2102628352]: stunnel started 2005.12.28 14:03:45 LOG7[6298:2102628352]: FD 0 in non-blocking mode 2005.12.28 14:03:45 LOG7[6298:2102628352]: FD 1 in non-blocking mode 2005.12.28 14:03:45 LOG5[6298:2102628352]: stunnel connected from 2x.x.x.x :37594 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): before/accept initialization 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 read client hello A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write server hello A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write certificate A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write server done A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 flush data 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 read client key exchange A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 read finished A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write change cipher spec A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 write finished A 2005.12.28 14:03:45 LOG7[6298:2102628352]: SSL state (accept): SSLv3 flush data 2005.12.28 14:03:45 LOG7[6298:2102628352]: 1 items in the session cache 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 client connects (SSL_connect()) 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 client connects that finished 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 client renegotiatations requested 2005.12.28 14:03:45 LOG7[6298:2102628352]: 1 server connects (SSL_accept()) 2005.12.28 14:03:45 LOG7[6298:2102628352]: 1 server connects that finished 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 server renegotiatiations requested 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 session cache hits 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 session cache misses 2005.12.28 14:03:45 LOG7[6298:2102628352]: 0 session cache timeouts 2005.12.28 14:03:45 LOG6[6298:2102628352]: SSL accepted: new session negotiated 2005.12.28 14:03:45 LOG6[6298:2102628352]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.12.28 14:03:45 LOG7[6298:2102628352]: bind#1: Invalid argument (22) 2005.12.28 14:03:45 LOG7[6298:2102628352]: bind#2: Invalid argument (22) 2005.12.28 14:03:45 LOG3[6298:2102628352]: connect: Invalid argument (22) 2005.12.28 14:03:45 LOG3[6298:2102628352]: Failed to initialize remote connection 2005.12.28 14:03:45 LOG7[6298:2102628352]: stunnel finished (0 left) openssl error when i connect: $ openssl s_client -connect xxx.xxx.xxx.xxx:995 -state -debug CONNECTED(00000003) SSL_connect:before/connect initialization write to 080A6E20 [080A6E68] (148 bytes => 148 (0x94)) 0000 - 80 92 01 03 01 00 69 00-00 00 20 00 00 39 00 00 ......i... ..9.. 0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 0020 - 00 00 33 00 00 32 00 00-2f 00 00 07 05 00 80 03 ..3..2../....... 0030 - 00 80 00 00 66 00 00 05-00 00 04 01 00 80 08 00 ....f........... 0040 - 80 00 00 63 00 00 62 00-00 61 00 00 15 00 00 12 ...c..b..a...... 0050 - 00 00 09 06 00 40 00 00-65 00 00 64 00 00 60 00 [email protected]..`. 0060 - 00 14 00 00 11 00 00 08-00 00 06 04 00 80 00 00 ................ 0070 - 03 02 00 80 1f e8 cf 61-77 e3 92 52 b4 e8 c6 04 .......aw..R.... 0080 - c9 67 e7 93 20 4e 20 36-28 fa 98 6f b6 e5 29 c3 .g.. N 6(..o..). 0090 - 53 b0 ce 69 S..i SSL_connect:SSLv2/v3 write client hello A read from 080A6E20 [080AC3C8] (7 bytes => 7 (0x7)) 0000 - 16 03 01 00 4a 02 ....J. 0007 - <SPACES/NULS> read from 080A6E20 [080AC3CF] (72 bytes => 72 (0x48)) 0000 - 00 46 03 01 43 b2 9f 7f-42 8f 27 c4 ec 25 62 81 .F..C...B.'..%b. 0010 - 93 e3 33 1b f5 4f 12 ab-41 50 97 69 29 ba a2 b4 ..3..O..AP.i)... 0020 - 56 5c d6 10 20 c3 77 7b-35 5b 05 da 22 0f 14 47 V\.. .w{5[.."..G 0030 - 00 21 e3 96 d8 5b 57 04-5d b1 75 60 fa 72 62 49 .!...[W.].u`.rbI 0040 - 19 2a 0d 12 af 00 35 .*....5 0048 - <SPACES/NULS> SSL_connect:SSLv3 read server hello A read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 16 03 01 02 39 ....9 read from 080A6E20 [080AC3CD] (569 bytes => 569 (0x239)) 0000 - 0b 00 02 35 00 02 32 00-02 2f 30 82 02 2b 30 82 ...5..2../0..+0. 0010 - 01 94 02 09 00 eb 73 d0-24 42 f1 a3 36 30 0d 06 ......s.$B..60.. 0020 - 09 2a 86 48 86 f7 0d 01-01 04 05 00 30 5a 31 0b .*.H........0Z1. 0030 - 30 09 06 03 55 04 06 13-02 70 74 31 0e 30 0c 06 0...U....pt1.0.. 0040 - 03 55 04 08 13 05 45 76-6f 72 61 31 0e 30 0c 06 .U....Xxxxx1.0.. 0050 - 03 55 04 07 13 05 45 76-6f 72 61 31 0d 30 0b 06 .U....Xxxxx1.0.. 0060 - 03 55 04 0a 13 04 4e 65-65 69 31 0d 30 0b 06 03 .U....Xxxx1.0... 0070 - 55 04 0b 13 04 4e 65 65-69 31 0d 30 0b 06 03 55 U....Xxxx1.0...U 0080 - 04 03 13 04 4e 65 65 69-30 1e 17 0d 30 35 31 32 ....Xxxx0...0512 0090 - 32 36 30 31 30 31 33 31-5a 17 0d 30 36 30 31 32 26010131Z..06012 00a0 - 35 30 31 30 31 33 31 5a-30 5a 31 0b 30 09 06 03 5010131Z0Z1.0... 00b0 - 55 04 06 13 02 70 74 31-0e 30 0c 06 03 55 04 08 U....pt1.0...U.. 00c0 - 13 05 45 76 6f 72 61 31-0e 30 0c 06 03 55 04 07 ..Xxxxx1.0...U.. 00d0 - 13 05 45 76 6f 72 61 31-0d 30 0b 06 03 55 04 0a ..Xxxxx1.0...U.. 00e0 - 13 04 4e 65 65 69 31 0d-30 0b 06 03 55 04 0b 13 ..Xxxx1.0...U... 00f0 - 04 4e 65 65 69 31 0d 30-0b 06 03 55 04 03 13 04 .Xxxx1.0...U.... 0100 - 4e 65 65 69 30 81 9f 30-0d 06 09 2a 86 48 86 f7 Xxxx0..0...*.H.. 0110 - 0d 01 01 01 05 00 03 81-8d 00 30 81 89 02 81 81 ..........0..... 0120 - 00 9e e7 9f f2 de 73 9e-79 d5 76 4c d9 83 63 94 ......s.y.vL..c. 0130 - 53 12 e8 8d 73 43 9d 09-b1 48 d6 69 05 5d 31 1d S...sC...H.i.]1. 0140 - 24 a7 bd d6 8f a0 79 4a-1c 73 dc 78 75 9b 66 0b $.....yJ.s.xu.f. 0150 - dc 0b 27 a2 fe 4f 4a 0b-67 77 d4 96 34 c8 81 3f ..'..OJ.gw..4..? 0160 - 4a 6d a6 50 f5 6a f0 fa-53 f8 ed ba f7 51 c5 27 Jm.P.j..S....Q.' 0170 - 71 77 cf cb 95 85 83 f8-a2 c0 2b 0a c2 56 b9 6e qw........+..V.n 0180 - d1 fa e4 1a 72 a0 58 6a-41 99 ba 5e 3c 75 0c 97 ....r.XjA..^<u.. 0190 - 0f 67 e2 93 a5 48 b1 1a-18 9c 22 cf 41 2b 75 ec .g...H....".A+u. 01a0 - 05 02 03 01 00 01 30 0d-06 09 2a 86 48 86 f7 0d ......0...*.H... 01b0 - 01 01 04 05 00 03 81 81-00 8c ef 64 ef d0 62 8d ...........d..b. 01c0 - c5 77 68 00 28 d5 c6 18-d0 c8 17 d2 c4 9a 65 40 .wh.(.........e@ 01d0 - 4c 7b c8 bb 5d 5b 03 af-db e6 00 c7 3f 5a a0 a2 L{..][......?Z.. 01e0 - d5 90 bc eb 77 c2 87 88-e2 6a 25 09 c9 f6 3c 47 ....w....j%...<G 01f0 - 25 b2 85 90 d3 a2 a2 51-52 26 7a 50 b3 f4 e3 a2 %......QR&zP.... 0200 - 97 b9 ea bd 31 19 5b c8-70 bc c3 01 8e ea 0b a2 ....1.[.p....... 0210 - d5 5b 60 64 cd 65 37 60-63 94 8d 8f 72 4a d3 4f .[`d.e7`c...rJ.O 0220 - 0a a3 be c8 b4 f0 fa 60-83 b2 30 f5 59 47 45 2e .......`..0.YGE. 0230 - 50 a2 2f 17 52 0c d9 23-d1 P./.R..#. depth=0 /C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx verify error:num=18:self signed certificate verify return:1 depth=0 /C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx verify return:1 SSL_connect:SSLv3 read server certificate A read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 16 03 01 00 04 ..... read from 080A6E20 [080AC3CD] (4 bytes => 4 (0x4)) 0000 - 0e . 0004 - <SPACES/NULS> SSL_connect:SSLv3 read server done A write to 080A6E20 [080B6640] (139 bytes => 139 (0x8B)) 0000 - 16 03 01 00 86 10 00 00-82 00 80 65 51 68 44 44 ...........eQhDD 0010 - 2e 50 99 2d 01 7b 10 39-93 94 8e 9d 0d 80 bf b8 .P.-.{.9........ 0020 - fd 55 11 35 a2 3c 9d 66-cd bb 0e 91 32 fe c6 b9 .U.5.<.f....2... 0030 - 86 2c 21 6c af ba c5 ac-08 2a 17 4a a8 97 5c b5 .,!l.....*.J..\. 0040 - e4 36 ed a0 a3 0b ab c4-19 61 c3 fc 17 cf b3 7f .6.......a...... 0050 - 5b f3 8b bc 8f e5 e4 fd-88 5c 83 da 61 1f a3 4b [........\..a..K 0060 - df 00 37 61 31 8f 50 fe-72 8b 72 8d 48 bf 2f 3b ..7a1.P.r.r.H./; 0070 - 10 fc 3b cf 5a 61 4a 51-ab e4 76 54 57 5e d6 4d ..;.ZaJQ..vTW^.M 0080 - 9a c2 a7 9f fc 5c f8 0d-55 40 bb .....\..U@. SSL_connect:SSLv3 write client key exchange A write to 080A6E20 [080B6640] (6 bytes => 6 (0x6)) 0000 - 14 03 01 00 01 01 ...... SSL_connect:SSLv3 write change cipher spec A write to 080A6E20 [080B6640] (53 bytes => 53 (0x35)) 0000 - 16 03 01 00 30 fe 84 71-85 05 57 bf bc 74 1f 55 ....0..q..W..t.U 0010 - db 54 8f eb 38 a8 d4 fe-1d 24 a9 4e d1 65 6b 6a .T..8....$.N.ekj 0020 - e1 c8 47 57 1f 64 80 1e-7a af a0 9b fd 6e 1c 0b ..GW.d..z....n.. 0030 - 0c a7 a6 3e 30 ...>0 SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 14 03 01 00 01 ..... read from 080A6E20 [080AC3CD] (1 bytes => 1 (0x1)) 0000 - 01 . read from 080A6E20 [080AC3C8] (5 bytes => 5 (0x5)) 0000 - 16 03 01 00 30 ....0 read from 080A6E20 [080AC3CD] (48 bytes => 48 (0x30)) 0000 - ef 6b 5b 33 44 bb 18 4a-a4 e5 95 07 cf 17 d2 4c .k[3D..J.......L 0010 - b2 c0 10 59 68 4b aa a4-96 a7 e7 9c 0c bd ae 80 ...YhK.......... 0020 - 38 fb 08 ec 28 2c 51 15-26 fe 44 3f c8 31 f7 99 8...(,Q.&.D?.1.. SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx i:/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx --- Server certificate -----BEGIN CERTIFICATE----- MIICKzCCAZQCCQDrc9AkQvGjNjANBgkqhkiG9w0BAQQFADBaMQswCQYDVQQGEwJw dDEOMAwGA1UECBMFRXZvcmExDjAMBgNVBAcTBUV2b3JhMQ0wCwYDVQQKEwROZWVp MQ0wCwYDVQQLEwROZWVpMQ0wCwYDVQQDEwROZWVpMB4XDTA1MTIyNjAxMDEzMVoX DTA2MDEyNTAxMDEzMVowWjELMAkGA1UEBhMCcHQxDjAMBgNVBAgTBUV2b3JhMQ4w DAYDVQQHEwVFdm9yYTENMAsGA1UEChMETmVlaTENMAsGA1UECxMETmVlaTENMAsG A1UEAxMETmVlaTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAnuef8t5znnnV dkzZg2OUUxLojXNDnQmxSNZpBV0xHSSnvdaPoHlKHHPceHWbZgvcCyei/k9KC2d3 1JY0yIE/Sm2mUPVq8PpT+O2691HFJ3F3z8uVhYP4osArCsJWuW7R+uQacqBYakGZ ul48dQyXD2fik6VIsRoYnCLPQSt17AUCAwEAATANBgkqhkiG9w0BAQQFAAOBgQCM 72Tv0GKNxXdoACjVxhjQyBfSxJplQEx7yLtdWwOv2+YAxz9aoKLVkLzrd8KHiOJq JQnJ9jxHJbKFkNOiolFSJnpQs/Tjope56r0xGVvIcLzDAY7qC6LVW2BkzWU3YGOU jY9yStNPCqO+yLTw+mCDsjD1WUdFLlCiLxdSDNkj0Q== -----END CERTIFICATE----- subject=/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx issuer=/C=pt/ST=Xxxxx/L=Xxxxx/O=Xxxx/OU=Xxxx/CN=Xxxx --- No client certificate CA names sent --- SSL handshake has read 721 bytes and written 346 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: C3777B355B05DA220F14470021E396D85B57045DB17560FA726249192A0D12AF Session-ID-ctx: Master-Key: 89A9BC55E2B4700DDA80F799A1B5B958CAF9BFEF8970921A7158CB6EFE3F352693B500BA258CA508B3B2A25517941FD6 Key-Arg : None Start Time: 1135779714 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- read from 080A6E20 [080AC3C8] (5 bytes => -1 (0xFFFFFFFF)) read:errno=104 write to 080A6E20 [080B0BD8] (37 bytes => -1 (0xFFFFFFFF)) configs: inetd.conf: pop3s stream tcp nowait root /usr/local/sbin/stunnel stunnel /etc/stunnel/pop3s.conf pop3s.conf: exec = /usr/sbin/popa3d execargs = popa3d output = /var/log/stunnel.log debug = 7 cert = /etc/stunnel/stunnel.pem Versions: OpenSSL 0.9.7g 11 Apr 2005 stunnel: stunnel 4.11 on i386-unknown-openbsd3.8 PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/arandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds $ uname -a OpenBSD xxx.xxx.xxx.xxx 3.8 GENERIC#138 i386 Thanks in advance for helping me =) Pedro Gouveia

1 0

stunnel connect success even if remote side do not exist
by Nadav, Erez 28 Dec '05

28 Dec '05

i have a question: I conbfigure the stunnel to work as tcp wrapper. I configure stunnel for accept on 2003 and connect to 10.1.1.1:2003 (not exist address). I see that any TCP connect to 2003 always succeed. I expect that the TCP connect will fail if the remote side connection failed. Is there a way to make it happen Nadav Erez R&D Verint Systems Inc Phone: +972+9-9624753 Cellular: +972-54-7784753 Email: Erez.Nadav(a)verint.com Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

2 1

online stunnel configuration
by Nadav, Erez 26 Dec '05

26 Dec '05

hi, i have a question: How can i change the stunnel service configuration (add/change accept/connect values) without stop and start the stunnel service ? Nadav Erez R&D Verint Systems Inc Phone: +972+9-9624753 Cellular: +972-54-7784753 Email: Erez.Nadav(a)verint.com Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

(Other) client to stunnel server 4.14
by Jurgen Tessers 24 Dec '05

24 Dec '05

Hi all, I'm in a situation where Biztalk has to communicatie through Stunnel with a broker on a other site (both on Win XP). Now the only way to reach this broker is through a proxy, and that seems the problem with Stunnel, you can't configure a proxy. Is there another way, or another client that have the possibility to configure a proxy and can connect to a Stunnel server. With regards, Jurgen

1 0

Transparency issues
by Alaric Dailey 16 Dec '05

16 Dec '05

I am trying to run stunnel on my linux machine every works fine, until I set transparent = yes then stunnel doesn't work at all, I am running stunnel 4.09 on a debian sarge box, can anyone offer a suggestion?

1 0

Can not estabilish stunnel
by McDouglas 13 Dec '05

13 Dec '05

Hi, I have difficulties setting up a tunnel between two linux box I administrate. Right now its only in test phase, i would like to make an stunnel connection to the smpt server at 195.56.52.140. My final goal is to set up syslog through stunnel, thats why the port name/numbers. Config file for the server: cert = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /usr/local/etc/stunnel/stunnel.log [ssyslog] accept = 195.56.52.140:2514 connect = 10.10.2.1:25 Config file for the client: cert = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /usr/local/etc/stunnel/stunnel.log client = yes [ssyslog] accept = 2514 connect = 195.56.52.140:2514 I get the following messages in the logs after, executing a "telnet 127.0.0.1 2514" command at the client machine (of course, smtp works on the other side, and i set iptables to allow incomming connections on 2514 dport) Server: 2005.12.13 09:09:22 LOG5[11505:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.12.13 09:09:22 LOG7[11505:1]: Snagged 64 random bytes from /root/.rnd 2005.12.13 09:09:22 LOG7[11505:1]: Wrote 1024 new random bytes to /root/.rnd 2005.12.13 09:09:22 LOG7[11505:1]: RAND_status claims sufficient entropy for the PRNG 2005.12.13 09:09:22 LOG6[11505:1]: PRNG seeded successfully 2005.12.13 09:09:22 LOG7[11505:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:09:22 LOG7[11505:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:09:22 LOG6[11505:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.12.13 09:09:22 LOG6[11505:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.12.13 09:09:22 LOG5[11505:1]: 500 clients allowed 2005.12.13 09:09:22 LOG7[11505:1]: FD 6 in non-blocking mode 2005.12.13 09:09:22 LOG7[11505:1]: FD 8 in non-blocking mode 2005.12.13 09:09:22 LOG7[11505:1]: FD 9 in non-blocking mode 2005.12.13 09:09:22 LOG7[11505:1]: SO_REUSEADDR option set on accept socket 2005.12.13 09:09:22 LOG7[11505:1]: ssyslog bound to 195.56.52.140:2514 2005.12.13 09:09:22 LOG7[11506:1]: Created pid file /usr/local/etc/stunnel/stunnel.pid 2005.12.13 09:09:22 LOG7[11506:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->(IN) 2005.12.13 09:11:23 LOG7[11506:1]: ssyslog accepted FD=10 from 81.183.222.1:35225 2005.12.13 09:11:23 LOG7[11506:1]: Creating a new context 2005.12.13 09:11:23 LOG7[11506:1]: Context 2 created 2005.12.13 09:11:23 LOG7[11506:2]: Context swap: 1 -> 2 2005.12.13 09:11:23 LOG7[11506:2]: ssyslog started 2005.12.13 09:11:23 LOG7[11506:2]: FD 10 in non-blocking mode 2005.12.13 09:11:23 LOG7[11506:2]: TCP_NODELAY option set on local socket 2005.12.13 09:11:23 LOG5[11506:2]: ssyslog connected from 81.183.222.1:35225 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): before/accept initialization 2005.12.13 09:11:23 LOG7[11506:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->() 2005.12.13 09:11:23 LOG7[11506:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 read client hello A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write server hello A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write certificate A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 write server done A 2005.12.13 09:11:23 LOG7[11506:2]: SSL state (accept): SSLv3 flush data 2005.12.13 09:11:23 LOG7[11506:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->() 2005.12.13 09:11:25 LOG7[11506:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 read client key exchange A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 read finished A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 write change cipher spec A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 write finished A 2005.12.13 09:11:25 LOG7[11506:2]: SSL state (accept): SSLv3 flush data 2005.12.13 09:11:25 LOG7[11506:2]: 1 items in the session cache 2005.12.13 09:11:25 LOG7[11506:2]: 0 client connects (SSL_connect()) 2005.12.13 09:11:25 LOG7[11506:2]: 0 client connects that finished 2005.12.13 09:11:25 LOG7[11506:2]: 0 client renegotiatations requested 2005.12.13 09:11:25 LOG7[11506:2]: 1 server connects (SSL_accept()) 2005.12.13 09:11:25 LOG7[11506:2]: 1 server connects that finished 2005.12.13 09:11:25 LOG7[11506:2]: 0 server renegotiatiations requested 2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache hits 2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache misses 2005.12.13 09:11:25 LOG7[11506:2]: 0 session cache timeouts 2005.12.13 09:11:25 LOG6[11506:2]: SSL accepted: new session negotiated 2005.12.13 09:11:25 LOG6[11506:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.12.13 09:11:25 LOG7[11506:2]: FD 11 in non-blocking mode 2005.12.13 09:11:25 LOG7[11506:2]: ssyslog connecting 10.10.2.1:25 2005.12.13 09:11:25 LOG7[11506:2]: connect_wait: waiting 10 seconds 2005.12.13 09:11:25 LOG7[11506:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 1, FD=6, (IN)->() 2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 1, FD=9, (IN)->() 2005.12.13 09:11:35 LOG7[11506:0]: CONTEXT 2, FD=11, (INOUT)->() 2005.12.13 09:11:35 LOG6[11506:2]: connect_wait: s_poll_wait timeout 2005.12.13 09:11:35 LOG3[11506:2]: Failed to initialize remote connection 2005.12.13 09:11:35 LOG7[11506:2]: ssyslog finished (0 left) 2005.12.13 09:11:35 LOG5[11506:2]: stack_info: size=65536, current=4204 (6%), maximum=4204 (6%) 2005.12.13 09:11:35 LOG7[11506:2]: Context 2 closed 2005.12.13 09:11:35 LOG7[11506:0]: Waiting -1 second(s) for 2 file descriptor(s) Client: 2005.12.13 09:05:26 LOG5[17901:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7 31 Dec 2002 2005.12.13 09:05:26 LOG7[17901:1]: Snagged 64 random bytes from /root/.rnd 2005.12.13 09:05:26 LOG7[17901:1]: Wrote 1024 new random bytes to /root/.rnd 2005.12.13 09:05:26 LOG7[17901:1]: RAND_status claims sufficient entropy for the PRNG 2005.12.13 09:05:26 LOG6[17901:1]: PRNG seeded successfully 2005.12.13 09:05:26 LOG7[17901:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:05:26 LOG7[17901:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.12.13 09:05:26 LOG6[17901:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.12.13 09:05:26 LOG6[17901:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.12.13 09:05:26 LOG5[17901:1]: 500 clients allowed 2005.12.13 09:05:26 LOG7[17901:1]: FD 5 in non-blocking mode 2005.12.13 09:05:26 LOG7[17901:1]: FD 7 in non-blocking mode 2005.12.13 09:05:26 LOG7[17901:1]: FD 8 in non-blocking mode 2005.12.13 09:05:26 LOG7[17901:1]: SO_REUSEADDR option set on accept socket 2005.12.13 09:05:26 LOG7[17901:1]: ssyslog bound to 0.0.0.0:2514 2005.12.13 09:05:26 LOG7[17902:1]: Created pid file /usr/local/etc/stunnel/stunnel.pid 2005.12.13 09:05:26 LOG7[17902:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->(IN) 2005.12.13 09:07:03 LOG7[17902:1]: ssyslog accepted FD=9 from 127.0.0.1:40024 2005.12.13 09:07:03 LOG7[17902:1]: Creating a new context 2005.12.13 09:07:03 LOG7[17902:1]: Context 2 created 2005.12.13 09:07:03 LOG7[17902:2]: Context swap: 1 -> 2 2005.12.13 09:07:03 LOG7[17902:2]: ssyslog started 2005.12.13 09:07:03 LOG7[17902:2]: FD 9 in non-blocking mode 2005.12.13 09:07:03 LOG7[17902:2]: TCP_NODELAY option set on local socket 2005.12.13 09:07:03 LOG5[17902:2]: ssyslog connected from 127.0.0.1:40024 2005.12.13 09:07:03 LOG7[17902:2]: FD 10 in non-blocking mode 2005.12.13 09:07:03 LOG7[17902:2]: ssyslog connecting 195.56.52.140:2514 2005.12.13 09:07:03 LOG7[17902:2]: connect_wait: waiting 10 seconds 2005.12.13 09:07:03 LOG7[17902:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:03 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.12.13 09:07:03 LOG7[17902:2]: connect_wait: connected 2005.12.13 09:07:03 LOG7[17902:2]: Remote FD=10 initialized 2005.12.13 09:07:03 LOG7[17902:2]: TCP_NODELAY option set on remote socket 2005.12.13 09:07:03 LOG7[17902:2]: SSL state (connect): before/connect initialization 2005.12.13 09:07:03 LOG7[17902:2]: SSL state (connect): SSLv3 write client hello A 2005.12.13 09:07:03 LOG7[17902:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:06 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read server hello A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read server certificate A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 read server done A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write client key exchange A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write change cipher spec A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 write finished A 2005.12.13 09:07:06 LOG7[17902:2]: SSL state (connect): SSLv3 flush data 2005.12.13 09:07:06 LOG7[17902:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:08 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.12.13 09:07:08 LOG7[17902:2]: SSL state (connect): SSLv3 read finished A 2005.12.13 09:07:08 LOG7[17902:2]: 1 items in the session cache 2005.12.13 09:07:08 LOG7[17902:2]: 1 client connects (SSL_connect()) 2005.12.13 09:07:08 LOG7[17902:2]: 1 client connects that finished 2005.12.13 09:07:08 LOG7[17902:2]: 0 client renegotiatations requested 2005.12.13 09:07:08 LOG7[17902:2]: 0 server connects (SSL_accept()) 2005.12.13 09:07:08 LOG7[17902:2]: 0 server connects that finished 2005.12.13 09:07:08 LOG7[17902:2]: 0 server renegotiatiations requested 2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache hits 2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache misses 2005.12.13 09:07:08 LOG7[17902:2]: 0 session cache timeouts 2005.12.13 09:07:08 LOG6[17902:2]: SSL connected: new session negotiated 2005.12.13 09:07:08 LOG6[17902:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.12.13 09:07:08 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->() 2005.12.13 09:07:10 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.12.13 09:07:10 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->() 2005.12.13 09:07:11 LOG7[17902:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.12.13 09:07:11 LOG7[17902:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 1, FD=5, (IN)->() 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 1, FD=8, (IN)->() 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 2, FD=9, (IN)->() 2005.12.13 09:07:16 LOG7[17902:0]: CONTEXT 2, FD=10, (IN)->(INERRHUP) 2005.12.13 09:07:16 LOG3[17902:2]: SSL_read: Connection reset by peer (104) 2005.12.13 09:07:16 LOG5[17902:2]: Connection reset: 4 bytes sent to SSL, 0 bytes sent to socket 2005.12.13 09:07:16 LOG7[17902:2]: ssyslog finished (0 left) 2005.12.13 09:07:16 LOG5[17902:2]: stack_info: size=65536, current=4180 (6%), maximum=4180 (6%) 2005.12.13 09:07:16 LOG7[17902:2]: Context 2 closed 2005.12.13 09:07:16 LOG7[17902:0]: Waiting -1 second(s) for 2 file descriptor(s) Strange thing, i did set up a windows box for testing, and i get the exact same error mesages when trying to connect to the server. Any ideas?

1 0

stunnel closing on first packet
by justin alexander 11 Dec '05

11 Dec '05

I have a client application on a windows machine, which tunnels through stunnel v4.14 to launch and inetd through stunnel v4.09 on a Linux box. The Linux side INETD successfully sends a packet of 25B to the client. The client (windows) receives this packet and returns a 12B packet. The packet IS received by the INETD but then stunnel immediately closes the socket. Why is it doing this? I'm including all configs and longs.

1 0

windows stunnel
by Noel Sanchez 09 Dec '05

09 Dec '05

Hello List. What I'd like to do is use stunnel on a Windows server behind the firewall then forward the data that comes in to the Windows server to another machine (another public ip behind the firewall) that's running an app that needs the original data. For example, I have a device out in the field that is using ssl to send data on port 4000 to my server in the office that has stunnel installed and listens on port 4000. Once the data is sent to the Windows server using stunnel, I'd like the Windows server to send the data to another computer that needs it but that doesn't have stunnel on it. The encryption will happen from the field device to the Windows server in the office, then that Windows server will have to forward the data to another computer that needs the data. I am at a lost on how to do this if at all possible. Any help would be great! Device using ssl out in the field sending data on port 4000---------firewall forwarding traffic from port 4000 to Windows server running stunnel behind firewall-----------Windows server receives stunnel data then forwards to another computer-------system that needs data---- Regards

1 0

Re: Windows config with both SSL listen and non-SSL listen
by Han Jun Li 08 Dec '05

08 Dec '05

Paul, This is a temporary solution but it works. What you need to do is run two instances of Stunnel--one instance configured in client mode and the other in server mode. If you want to run both as services, you can install the standard one with the "-install" switch. For the second instance, you need to use some other binary to install it with a different name and change the imagepath to point to the executable. /han >_____ > >From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] >On Behalf Of Paul Hethmon >Sent: Wednesday, December 07, 2005 2:50 PM >To: stunnel-users(a)mirt.net >Subject: [stunnel-users] Windows config with both SSL listen and >non-SSLlisten > > >I'm trying to set up using the Windows service the ability to listen in SSL >mode on one port (5102) and forward to non-SSL port (5010) and then also >listen on one port (5101) in non-SSL mode and forward to a remote port >(5102) in SSL mode. What I have currently in the config is: > >[inbound] >accept = 5102 >connect = 5010 > >[outbound] >accept = 5101 >connect = x.x.x.x:5102 > >The first STunnel example on the website talks about doing this, sort of, >but I don't see any options to specify on a service configuration level >whether the listen port is in SSL or non-SSL mode. The use of a service name >like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom >application I'm trying to tunnel two way, not a standard IETF service. > >A perusal of the last year's mailing list archives didn't yield anything. I >guess the next step is to look at the source and see if it's supported >unless someone here can tell me one way or the other. If it's not supported, >I guess I'll add it in. > >thanks, > >Paul > > >Paul Hethmon >Senior Engineer >ClareityT Security >SAFEMLST Security Education, Consulting and Solutions >http://www.SAFEMLS.com <http://www.safemls.com/> >paul.hethmon(a)callclareity.com >work: 865.671.6630 >cell: 865.250.3517 > >

1 0

RE: [stunnel-users] Windows config with both SSL listen andnon-SSLlisten
by Paul Hethmon 07 Dec '05

07 Dec '05

Michal, Ok, the next obvious questions then: 1. When is 4.15 expected? 2. If not in the next 7 days, what can I do to help? I've done C/C++ and sockets for the last 10 years. I've looked at the code briefly so far, but have not set up a build environment yet. I need it in the next week so if there is any coding I can do which would help you, let me know your thoughts and where to put stuff. Also, just a public thanks for putting the package together. I started coding my own a couple of days ago and then thought there must have been someone else who just needed an SSL tunnel (and not a full blown SSH setup). Thanks, Paul -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Wednesday, December 07, 2005 9:03 AM To: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] Windows config with both SSL listen andnon-SSLlisten Paul, This feature is going to be supported in the next release (4.15). Your config will look like this: [inbound] client = no accept = 5102 connect = 5010 [outbound] client = yes accept = 5101 connect = x.x.x.x:5102 Best regards, Mike ________________________________ From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Paul Hethmon Sent: Wednesday, December 07, 2005 2:50 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Windows config with both SSL listen and non-SSLlisten I'm trying to set up using the Windows service the ability to listen in SSL mode on one port (5102) and forward to non-SSL port (5010) and then also listen on one port (5101) in non-SSL mode and forward to a remote port (5102) in SSL mode. What I have currently in the config is: [inbound] accept = 5102 connect = 5010 [outbound] accept = 5101 connect = x.x.x.x:5102 The first STunnel example on the website talks about doing this, sort of, but I don't see any options to specify on a service configuration level whether the listen port is in SSL or non-SSL mode. The use of a service name like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom application I'm trying to tunnel two way, not a standard IETF service. A perusal of the last year's mailing list archives didn't yield anything. I guess the next step is to look at the source and see if it's supported unless someone here can tell me one way or the other. If it's not supported, I guess I'll add it in. thanks, Paul Paul Hethmon Senior Engineer ClareityT Security SAFEMLST Security Education, Consulting and Solutions http://www.SAFEMLS.com <http://www.safemls.com/> paul.hethmon(a)callclareity.com work: 865.671.6630 cell: 865.250.3517 _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Windows config with both SSL listen and non-SSL listen
by Paul Hethmon 07 Dec '05

07 Dec '05

I'm trying to set up using the Windows service the ability to listen in SSL mode on one port (5102) and forward to non-SSL port (5010) and then also listen on one port (5101) in non-SSL mode and forward to a remote port (5102) in SSL mode. What I have currently in the config is: [inbound] accept = 5102 connect = 5010 [outbound] accept = 5101 connect = x.x.x.x:5102 The first STunnel example on the website talks about doing this, sort of, but I don't see any options to specify on a service configuration level whether the listen port is in SSL or non-SSL mode. The use of a service name like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom application I'm trying to tunnel two way, not a standard IETF service. A perusal of the last year's mailing list archives didn't yield anything. I guess the next step is to look at the source and see if it's supported unless someone here can tell me one way or the other. If it's not supported, I guess I'll add it in. thanks, Paul Paul Hethmon Senior Engineer Clareity(tm) Security SAFEMLS(tm) Security Education, Consulting and Solutions http://www.SAFEMLS.com <http://www.safemls.com/> paul.hethmon(a)callclareity.com work: 865.671.6630 cell: 865.250.3517

2 1

stunnel install failure
by James.Bartkowicz＠bedbath.com 05 Dec '05

05 Dec '05

Pretty new to stunnel and not very familiar with compiling programs at all: 1. Description: Installation of stunnel 4.14 failing on a Solaris 9 box. #>make Making all in src /bin/bash ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o libstunnel.la -rpath /usr/local/lib -avoid-version env.lo -lz -ldl -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap gcc -shared -Wl,-h -Wl,libstunnel.so -o .libs/libstunnel.so .libs/env.o -lz -ldl -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap -lc ld: fatal: library -lwrap: not found ld: fatal: File processing errors. No output written to .libs/libstunnel.so collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `libstunnel.la' Current working directory /local1/home/stunnel/stunnel-4.14/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' ******************************************* James Bartkowicz Bed Bath & Beyond Server Administration Team - UNIX 908-688-0888 ext.4441 ******************************************* ------------------------------------------------------ CONFIDENTIALITY NOTICE: This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please permanently delete the original and any copy of any e-mail and any printout thereof. Thank you for your compliance.

2 1

Server connecting back to client?
by Joshua Kugler 02 Dec '05

02 Dec '05

I've looked through the man pages, FAQ's, examples, and found one post (without a reply: http://stunnel.mirt.net/pipermail/stunnel-users/2005-May/000487.html) about this, but still don't have my question answered. I have a machine outside the firewall (let's call it outThere) that needs to connect back to a machine inside the firewall (let's call in inHere) for backup procedures. Now, because of the firewall, outThere cannot connect to inHere, but inHere can connect to anything on outThere that it wants. Can I initiate an stunnel connection from inHere to outThere, and then have stunnel on outThere listen on a localhost port, which, when connected to, would actually forward the connection (over SSL) back to a configured port on inHere? Is this at all doable? j----- k----- -- Joshua Kugler CDE System Administrator http://distance.uaf.edu/

2 1

Stunnel sending ICMP packet at startup
by Paul Jones 30 Nov '05

30 Nov '05

Hi there, I have set up Stunnel on both the server and the client. There is a firewall on the server side that only allows TCP connections through. When Stunnel is started up on the client side, the firewall is actually receiving an ICMP packet, not a TCP. Is this how Stunnel should be working? I assume it's doing a ping or something at startup. Thanks in advance. Paul _________________________________________________________________ SEEK: Over 80,000 jobs across all industries at Australia's #1 job site. http://ninemsn.seek.com.au?hotmail

2 1

4th Dimension and Stunnel
by Mark 28 Nov '05

28 Nov '05

Does anyone have a sample config file to allow 4th Dimension client and server to use stunnel?

1 0

How to protect private key in Windows XP Home
by Andrus 28 Nov '05

28 Nov '05

My stunnel client must start without user intervention. So I installed stunnel in client mode in a Windows XP Home computer as XP service. In XP Proffesional I can specify that only Administrators group has access to stunnel directory. XP Home does not have security tab in folder properties. Any person working in XP Home compter can copy stunnel private key How to protect private key from copying ? Andrus. My stunnel.conf file: Cafile=server.crt cert=privkey.pem client = yes service=RDPClient verify = 2 [terminal server] accept = 83389 connect = 1.2.3.4:83389

1 0

socklen_t undeclared
by tc 24 Nov '05

24 Nov '05

Hi, I'm getting socklet_t undeclared in client.c making stunnel4.14 in an embedded linux 2.038 system. What can I do? Thanks TC __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

2 1

Newbie Question
by Mark 23 Nov '05

23 Nov '05

I am completely new to SSL and stunnel. I need to test the differences between 4th Dimension's SSL and doing the same thing without the 4D implementation of SSL using stunnel. Can anyone please tell me where to get started? Mark Zinke

2 1

Call for Beta Testers: Tool similar to Stunnel.
by Wilfred Nilsen 22 Nov '05

22 Nov '05

We have designed a tool that is similar to Stunnel and we would like to know if anyone would be interested in testing the tool. A short introduction: The Barracuda HTTPS tunnel allows you to encrypt arbitrary TCP connections inside SSL. The HTTPS tunnel allows you to secure non-SSL aware services such as TELNET, FTP, VNC, etc., by having the HTTPS tunnel provide the encryption. The HTTPS tunnel can also be used, for example, to tunnel traffic out from behind a restrictive firewall/proxy that only allows outgoing HTTPS web connections. The client is a Java program that can either be downloaded and started from the command prompt or started using Java Web Start. The server is BarracudaDrive. http://barracudaserver.com/examples/BarracudaDrive/ We will make the beta program (the server and client) available if anyone is interested in testing the tool and give us feedback. We are specifically interested in beta testers that are behind a restrictive company proxy. Thanks, Wilfred

7 10

Re: [stunnel-users] Problem with Stunnel Working fine on the firstconnection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05

19 Nov '05

> I'd try to disable chroot and run stunnel under strace with "foreground = yes" option. Mike, When running in foreground, with or without chroot, things work as expected. Without foreground, it did not work. Two key differences on the logs for each: Output of "Cleaning up the signal pipe" prior to checking the libwrap permissions a finish line of "ssmtp finished (0 left)" instead of "ssmtp finished (-1 left)" (Yes, this is a dual processor box.) It looks like the key problem lies in the regerenation of the standalone mode. Is there a way with v4 to just use inetd to answer on port 465, negotiate and connect on port 25 on another host because perhaps that will avoid the issue. Regards, KAM 2005.11.19 13:07:51 LOG7[3893:1024]: Key file: /usr/local/ssl/certs/stunnel.pem 2005.11.19 13:07:51 LOG6[3893:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.11.19 13:07:51 LOG6[3893:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2005.11.19 13:07:51 LOG5[3893:1024]: 500 clients allowed 2005.11.19 13:07:51 LOG7[3893:1024]: FD 4 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: FD 5 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: FD 6 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: SO_REUSEADDR option set on accept socket 2005.11.19 13:07:51 LOG7[3893:1024]: ssmtp bound to 0.0.0.0:465 2005.11.19 13:07:51 LOG7[3893:1024]: Created pid file /stunnel.pid [ed: 1st email] 2005.11.19 13:08:32 LOG7[3893:1024]: ssmtp accepted FD=7 from 66.149.103.32:3130 2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp started 2005.11.19 13:08:32 LOG7[3898:1026]: FD 7 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on local socket 2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: FD 11 in non-blocking mode 2005.11.19 13:08:32 LOG7[3893:1024]: Cleaning up the signal pipe 2005.11.19 13:08:32 LOG7[3898:1026]: Connection from 66.149.103.32:3130 permitted by libwrap 2005.11.19 13:08:32 LOG5[3898:1026]: ssmtp connected from 66.149.103.32:3130 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): before/accept initialization 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:32 LOG7[3898:1026]: 1 items in the session cache 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects (SSL_connect()) 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects that finished 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client renegotiatations requested 2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects (SSL_accept()) 2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects that finished 2005.11.19 13:08:32 LOG7[3898:1026]: 0 server renegotiatiations requested 2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache hits 2005.11.19 13:08:32 LOG7[3898:1026]: 1 session cache misses 2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache timeouts 2005.11.19 13:08:32 LOG6[3898:1026]: SSL accepted: new session negotiated 2005.11.19 13:08:32 LOG6[3898:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: waiting 10 seconds 2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: connected 2005.11.19 13:08:32 LOG7[3898:1026]: Remote FD=10 initialized 2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on remote socket 2005.11.19 13:08:33 LOG7[3898:1026]: Socket closed on read 2005.11.19 13:08:33 LOG7[3898:1026]: SSL write shutdown 2005.11.19 13:08:33 LOG7[3898:1026]: SSL alert (write): warning: close notify 2005.11.19 13:08:33 LOG7[3898:1026]: SSL_shutdown retrying 2005.11.19 13:08:33 LOG7[3898:1026]: SSL doesn't need to read or write 2005.11.19 13:08:33 LOG7[3898:1026]: SSL socket closed on SSL_read 2005.11.19 13:08:33 LOG7[3898:1026]: Socket write shutdown 2005.11.19 13:08:33 LOG5[3898:1026]: Connection closed: 834 bytes sent to SSL, 1358 bytes sent to socket 2005.11.19 13:08:33 LOG7[3898:1026]: ssmtp finished (0 left) [ed: 2nd email] 2005.11.19 13:08:40 LOG7[3893:1024]: ssmtp accepted FD=7 from 66.149.103.32:3137 2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp started 2005.11.19 13:08:40 LOG7[3900:2050]: FD 7 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on local socket 2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: FD 11 in non-blocking mode 2005.11.19 13:08:40 LOG7[3893:1024]: Cleaning up the signal pipe 2005.11.19 13:08:40 LOG7[3900:2050]: Connection from 66.149.103.32:3137 permitted by libwrap 2005.11.19 13:08:40 LOG5[3900:2050]: ssmtp connected from 66.149.103.32:3137 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): before/accept initialization 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:40 LOG7[3900:2050]: 2 items in the session cache 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects (SSL_connect()) 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects that finished 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client renegotiatations requested 2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects (SSL_accept()) 2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects that finished 2005.11.19 13:08:40 LOG7[3900:2050]: 0 server renegotiatiations requested 2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache hits 2005.11.19 13:08:40 LOG7[3900:2050]: 2 session cache misses 2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache timeouts 2005.11.19 13:08:40 LOG6[3900:2050]: SSL accepted: new session negotiated 2005.11.19 13:08:40 LOG6[3900:2050]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: waiting 10 seconds 2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: connected 2005.11.19 13:08:40 LOG7[3900:2050]: Remote FD=10 initialized 2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on remote socket 2005.11.19 13:08:42 LOG7[3900:2050]: Socket closed on read 2005.11.19 13:08:42 LOG7[3900:2050]: SSL write shutdown 2005.11.19 13:08:42 LOG7[3900:2050]: SSL alert (write): warning: close notify 2005.11.19 13:08:42 LOG7[3900:2050]: SSL_shutdown retrying 2005.11.19 13:08:42 LOG7[3900:2050]: SSL doesn't need to read or write 2005.11.19 13:08:42 LOG7[3900:2050]: SSL socket closed on SSL_read 2005.11.19 13:08:42 LOG7[3900:2050]: Socket write shutdown 2005.11.19 13:08:42 LOG5[3900:2050]: Connection closed: 834 bytes sent to SSL, 1358 bytes sent to socket 2005.11.19 13:08:42 LOG7[3900:2050]: ssmtp finished (0 left) Without foreground, things do not continue past the first connection: 2005.11.19 13:10:32 LOG7[3910:1024]: ssmtp accepted FD=7 from 66.149.103.32:3268 2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp started 2005.11.19 13:10:32 LOG7[3916:1026]: FD 7 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on local socket 2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: FD 11 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: Connection from 66.149.103.32:3268 permitted by libwrap 2005.11.19 13:10:32 LOG5[3916:1026]: ssmtp connected from 66.149.103.32:3268 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): before/accept initialization 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:10:32 LOG7[3916:1026]: 1 items in the session cache 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects (SSL_connect()) 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects that finished 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client renegotiatations requested 2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects (SSL_accept()) 2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects that finished 2005.11.19 13:10:32 LOG7[3916:1026]: 0 server renegotiatiations requested 2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache hits 2005.11.19 13:10:32 LOG7[3916:1026]: 1 session cache misses 2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache timeouts 2005.11.19 13:10:32 LOG6[3916:1026]: SSL accepted: new session negotiated 2005.11.19 13:10:32 LOG6[3916:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: waiting 10 seconds 2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: connected 2005.11.19 13:10:32 LOG7[3916:1026]: Remote FD=10 initialized 2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on remote socket 2005.11.19 13:10:33 LOG7[3916:1026]: Socket closed on read 2005.11.19 13:10:33 LOG7[3916:1026]: SSL write shutdown 2005.11.19 13:10:33 LOG7[3916:1026]: SSL alert (write): warning: close notify 2005.11.19 13:10:33 LOG7[3916:1026]: SSL_shutdown retrying 2005.11.19 13:10:33 LOG7[3916:1026]: SSL doesn't need to read or write 2005.11.19 13:10:34 LOG7[3916:1026]: SSL socket closed on SSL_read 2005.11.19 13:10:34 LOG7[3916:1026]: Socket write shutdown 2005.11.19 13:10:34 LOG5[3916:1026]: Connection closed: 834 bytes sent to SSL, 1353 bytes sent to socket 2005.11.19 13:10:34 LOG7[3916:1026]: ssmtp finished (-1 left)

1 0

Problem with Stunnel Working fine on the first connection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05

19 Nov '05

Have worked on this all day without any glimmer of hope and would appreciate help and feedback! Regards, KAM # Description of your problem. What programs are on which machines, and how are they attempting to communicate. What connections are you attempting to secure in SSL. I am having problems with the regeneration of stunnel on an old but fairly reliable machine. I am switching from v3 to v4 and it works absolutely perfectly ONCE. The second time it just hangs. # What version of Stunnel you're using - remember, Stunnel 4.x doesn't take Stunnel 3.x command line options! 4.x # The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd. I am running it in standalone. My conf file is: cert = /usr/local/ssl/certs/stunnel.pem key = /usr/local/ssl/certs/stunnel.pem chroot = /usr/local/var/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log [ssmtp] accept = 465 connect = 10.10.10.30:25 # Output of "stunnel -f -D 7 <your-parameters>". Not sure this works on v4.X but here are the logs from the connection: 2005.11.18 19:17:56 LOG7[13166:1024]: ssmtp accepted FD=7 from 66.149.103.32:3542 2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp started 2005.11.18 19:17:56 LOG7[13171:1026]: FD 7 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on local socket 2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: FD 11 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: Connection from 66.149.103.32:3542 permitted by libwrap 2005.11.18 19:17:56 LOG5[13171:1026]: ssmtp connected from 66.149.103.32:3542 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): before/accept initialization 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server done A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read finished A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write finished A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data 2005.11.18 19:17:56 LOG7[13171:1026]: 1 items in the session cache 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects (SSL_connect()) 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects that finished 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client renegotiatations requested 2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects (SSL_accept()) 2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects that finished 2005.11.18 19:17:56 LOG7[13171:1026]: 0 server renegotiatiations requested 2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache hits 2005.11.18 19:17:56 LOG7[13171:1026]: 1 session cache misses 2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache timeouts 2005.11.18 19:17:56 LOG6[13171:1026]: SSL accepted: new session negotiated 2005.11.18 19:17:56 LOG6[13171:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp connecting 10.10.10.30:25 2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: waiting 10 seconds 2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: connected 2005.11.18 19:17:56 LOG7[13171:1026]: Remote FD=10 initialized 2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on remote socket 2005.11.18 19:17:58 LOG7[13171:1026]: Socket closed on read 2005.11.18 19:17:58 LOG7[13171:1026]: SSL write shutdown 2005.11.18 19:17:58 LOG7[13171:1026]: SSL alert (write): warning: close notify 2005.11.18 19:17:58 LOG7[13171:1026]: SSL_shutdown retrying 2005.11.18 19:17:58 LOG7[13171:1026]: SSL doesn't need to read or write 2005.11.18 19:17:58 LOG7[13171:1026]: SSL socket closed on SSL_read 2005.11.18 19:17:58 LOG7[13171:1026]: Socket write shutdown 2005.11.18 19:17:58 LOG5[13171:1026]: Connection closed: 827 bytes sent to SSL, 1362 bytes sent to socket 2005.11.18 19:17:58 LOG7[13171:1026]: ssmtp finished (-1 left) There is nothing more after this point # Output of "stunnel -V". I think you want -version: /usr/local/sbin/stunnel -version stunnel 4.14 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds # Output of "uname -a". Linux <removed> 2.2.26 #8 Fri Jul 16 00:42:34 EDT 2004 i686 unknown # Your libc version if you use Linux. 2.2.5 # Output of "gcc -v". Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/specs gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release) # Output of "openssl version" or "ssleay version" depending on your library. Subscribe to stunnel-users. OpenSSL 0.9.7e 25 Oct 2004

2 1

Stunnel Session Hangs
by Zachariah K Zachariah 17 Nov '05

17 Nov '05

Hi folks, I use stunnel-4.12 with openssl-0.9.7g to tunnel my CVS-pserver protocols. I have set up the local stunnel client to listen to port 22400 and to forward any connections on it to the cvs server that has the server side stunnel listening on port 22401 forwarding connections to the cvs-pserver on port 2401. Having set up thus, I can do a cvs login just fine. I can watch the negotiation happening using tcpdump. However when I try to check out a module from the repository, I see some files coming through but only to eventually hang. If I <Ctrl C> and try again, more files come in but hangs before the transaction is complete. I have to do this several time in order to download all the files to my local workspace. Upon checking the logs, I find that the hang occurs immediately after the message: 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying I have included a snippet of the log file for reference. I have also included my stunnel.conf file. Sorry for the voluminous output. Can some one help me here? Thanks in advance. -ZZ ===============================STUNNEL.LOG================================== The full log file reads: 2005.10.28 14:20:44 LOG6[15095:64]: SSL accepted: previous session reused 2005.10.28 14:20:44 LOG7[15095:64]: FD 1 in non-blocking mode 2005.10.28 14:20:44 LOG7[15095:64]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:44 LOG7[15095:64]: Remote FD=1 initialized 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (read): warning: close notify 2005.10.28 14:20:50 LOG7[15095:64]: SSL closed on SSL_read 2005.10.28 14:20:50 LOG7[15095:64]: Socket write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (write): warning: close notify 2005.10.28 14:20:50 LOG6[15095:64]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:50 LOG5[15095:64]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:50 LOG7[15095:64]: smd-pserver finished (0 left) 2005.10.28 14:20:50 LOG5[15095:64]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:50 LOG7[15095:64]: Context 64 closed 2005.10.28 14:20:51 LOG7[15095:1]: Context set: 64 (dropped) -> 1 2005.10.28 14:20:51 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:51 LOG7[15095:1]: Releasing context 64 2005.10.28 14:20:51 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:51 LOG7[15095:1]: Context 65 created 2005.10.28 14:20:51 LOG7[15095:65]: Context swap: 1 -> 65 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver started 2005.10.28 14:20:51 LOG7[15095:65]: FD 0 in non-blocking mode 2005.10.28 14:20:51 LOG5[15095:65]: smd-pserver connected from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): before/accept initialization 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:51 LOG7[15095:65]: 6 items in the session cache 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects (SSL_connect()) 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 client renegotiatations requested 2005.10.28 14:20:51 LOG7[15095:65]: 64 server connects (SSL_accept()) 2005.10.28 14:20:51 LOG7[15095:65]: 55 server connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 server renegotiatiations requested 2005.10.28 14:20:51 LOG7[15095:65]: 38 session cache hits 2005.10.28 14:20:51 LOG7[15095:65]: 0 session cache misses 2005.10.28 14:20:51 LOG7[15095:65]: 11 session cache timeouts 2005.10.28 14:20:51 LOG6[15095:65]: SSL accepted: previous session reused 2005.10.28 14:20:51 LOG7[15095:65]: FD 1 in non-blocking mode 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:51 LOG7[15095:65]: Remote FD=1 initialized 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (read): warning: close notify 2005.10.28 14:20:57 LOG7[15095:65]: SSL closed on SSL_read 2005.10.28 14:20:57 LOG7[15095:65]: Socket write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (write): warning: close notify 2005.10.28 14:20:57 LOG6[15095:65]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:57 LOG5[15095:65]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:57 LOG7[15095:65]: smd-pserver finished (0 left) 2005.10.28 14:20:57 LOG5[15095:65]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:57 LOG7[15095:65]: Context 65 closed 2005.10.28 14:20:58 LOG7[15095:1]: Context set: 65 (dropped) -> 1 2005.10.28 14:20:58 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:58 LOG7[15095:1]: Releasing context 65 2005.10.28 14:20:58 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:58 LOG7[15095:1]: Context 66 created 2005.10.28 14:20:58 LOG7[15095:66]: Context swap: 1 -> 66 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver started 2005.10.28 14:20:58 LOG7[15095:66]: FD 0 in non-blocking mode 2005.10.28 14:20:58 LOG5[15095:66]: smd-pserver connected from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): before/accept initialization 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:58 LOG7[15095:66]: 6 items in the session cache 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects (SSL_connect()) 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 client renegotiatations requested 2005.10.28 14:20:58 LOG7[15095:66]: 65 server connects (SSL_accept()) 2005.10.28 14:20:58 LOG7[15095:66]: 56 server connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 server renegotiatiations requested 2005.10.28 14:20:58 LOG7[15095:66]: 39 session cache hits 2005.10.28 14:20:58 LOG7[15095:66]: 0 session cache misses 2005.10.28 14:20:58 LOG7[15095:66]: 11 session cache timeouts 2005.10.28 14:20:58 LOG6[15095:66]: SSL accepted: previous session reused 2005.10.28 14:20:58 LOG7[15095:66]: FD 1 in non-blocking mode 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:58 LOG7[15095:66]: Remote FD=1 initialized 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (read): warning: close notify 2005.10.28 14:21:50 LOG7[15095:66]: SSL closed on SSL_read 2005.10.28 14:21:50 LOG7[15095:66]: Socket write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (write): warning: close notify 2005.10.28 14:21:50 LOG6[15095:66]: SSL_shutdown successfully sent close_notify 2005.10.28 14:21:50 LOG5[15095:66]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:21:50 LOG7[15095:66]: smd-pserver finished (0 left) 2005.10.28 14:21:50 LOG5[15095:66]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:21:50 LOG7[15095:66]: Context 66 closed 2005.10.28 14:21:52 LOG7[15095:1]: Context set: 66 (dropped) -> 1 2005.10.28 14:21:52 LOG7[15095:1]: Current context: 1 2005.10.28 14:21:52 LOG7[15095:1]: Releasing context 66 2005.10.28 14:21:52 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:1]: Creating a new context 2005.10.28 14:21:52 LOG7[15095:1]: Context 67 created 2005.10.28 14:21:52 LOG7[15095:67]: Context swap: 1 -> 67 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver started 2005.10.28 14:21:52 LOG7[15095:67]: FD 0 in non-blocking mode 2005.10.28 14:21:52 LOG5[15095:67]: smd-pserver connected from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): before/accept initialization 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 flush data 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:21:52 LOG7[15095:67]: 6 items in the session cache 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects (SSL_connect()) 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 client renegotiatations requested 2005.10.28 14:21:52 LOG7[15095:67]: 66 server connects (SSL_accept()) 2005.10.28 14:21:52 LOG7[15095:67]: 57 server connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 server renegotiatiations requested 2005.10.28 14:21:52 LOG7[15095:67]: 40 session cache hits 2005.10.28 14:21:52 LOG7[15095:67]: 0 session cache misses 2005.10.28 14:21:52 LOG7[15095:67]: 11 session cache timeouts 2005.10.28 14:21:52 LOG6[15095:67]: SSL accepted: previous session reused 2005.10.28 14:21:52 LOG7[15095:67]: FD 1 in non-blocking mode 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:21:52 LOG7[15095:67]: Remote FD=1 initialized 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying ========================================================================== =========================STUNNEL.CONF====================================== ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ;Delay DNS Lookups delay = yes ; Certificate/key is needed in server mode and optional in client mode cert = /tools/stunnel/4.12/etc/stunnel/stunnel.pem ;key = /tools/stunnel/4.12/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /tools/stunnel/4.12/var/stunnel/ setuid = cvsadmin setgid = cvs ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath; CApath is located inside chroot jail: ;CApath = /certs ; It's often easier to use CAfile: ;CAfile = /tools/stunnel/4.12/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: ;CRLpath = /crls ; Alternatively you can use CRLfile: ;CRLfile = /tools/stunnel/4.12/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /tools/stunnel/current/var/stunnel/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [pserver] accept = 22401 connect = 2401 TIMEOUTclose = 30 ; vim:ft=dosini

3 3

Strict.pm
by Jorge Abrines 17 Nov '05

17 Nov '05

Hi all, Once installed stunnel4 debian package, when I execute stunnel stunnel-mysql-client.conf (given sample) get following errors: Can't locate strict.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.8.7 /usr/local/share/perl/5.8.7 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at /usr/share/perl/5.8/AutoLoader.pm line 3. BEGIN failed--compilation aborted at /usr/share/perl/5.8/AutoLoader.pm line 3. Compilation failed in require at /usr/lib/perl/5.8/POSIX.pm line 7. BEGIN failed--compilation aborted at /usr/lib/perl/5.8/POSIX.pm line 7. Compilation failed in require at /usr/sbin/stunnel line 26. BEGIN failed--compilation aborted at /usr/sbin/stunnel line 26. Any ideas? Thanks in advance. Regards, Jorge.

2 2

Filesystem Hierarchy Standard 2.3
by Michal Trojnara 17 Nov '05

17 Nov '05

Dear Users, I tried to make stunnel more compatible with Filesystem Hierarchy Standard 2.3. Here is the current status: - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup Your critical comments are welcome. Best regards, Mike

1 0

Visual studio compilation errors
by Jorge Abrines 17 Nov '05

17 Nov '05

Hi, After browsing all previous list messages I havent found information about an error I get compiling stunnel with visual studio. The errors appear in linking step with undefined symbol message: "undefined symbol: LNK2019 undefined symbol _exit_stunnel referenced in function _main_initialize". I also attach the Makefile.w32 changed to work with visual studio. Thanks in advance. Regards, Jorge. Makefile.w32 follows: # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2000 # # Modified by Brian Hatch (bri(a)stunnel.org) # This makefile is only tested on the mingw compiler. Mingw # can successfully compile both openssl and stunnel. If you want # to use another compiler, give it a shot, and tell us how it went. # Modify this to point to your actual openssl compile directory # (You did already compile openssl, didn't you???) SSLDIR=..\..\openssl-0.9.7g DEFINES=-DUSE_WIN32 -DHAVE_OPENSSL # You may want to add some of the following flags # to the DEFINES definition above. # Location of default certificate file for -v option # -DCERT_FILE=\"/stunnel/certs/certs.pem\" # Location of default certificate directory for -v option # -DCERT_DIR=\"/stunnel/certs\" # Default directory for stunnel.pem file # -DPEM_DIR=\"/stunnel/private\" # Use the default certificate sources from your ssl library? (0==no, 1==yes) # -DSSLLIB_CS=0 CC=cl CFLAGS= $(DEFINES) /I"$(SSLDIR)inc32" LDFLAGS=/LIBPATH:"$(SSLDIR)\out" /LIBPATH:"$(SSLDIR)\out32dll" # LIBS=-L$(SSLDIR)/out -lssl -lcrypto -lwsock32 -lgdi32 # LIBS=-L$(SSLDIR)/out -leay32 -lssl32 -lwsock32 -lgdi32 LIBS="$(SSLDIR)\out32dll\libeay32.lib" "$(SSLDIR)\out32dll\ssleay32.lib" " wsock32.lib" "gdi32.lib" OBJS=stunnel.obj ssl.obj protocol.obj sthreads.obj log.obj stunnel.exe: $(OBJS) $(CC) $(LDFLAGS) -o stunnel.exe $(OBJS) $(LIBS) .c.obj: # {.}.c{_obj\}.obj:: $(CC) /c $(CFLAGS) $(INCPATH) @<< $< << clean: del *.o del stunnel.exe

2 2

CONNECT protocol negotiations
by Michal Trojnara 16 Nov '05

16 Nov '05

Dear Users, I think some of you could be interested in testing this new feature: ftp://stunnel.mirt.net/stunnel/stunnel-4.15b2.tar.gz ftp://stunnel.mirt.net/stunnel/stunnel-4.15b2-installer.exe Sample configuration: debug=7 client = yes [my_proxy] accept=1111 connect=proxy.example.com:8080 protocol=connect protocolHost=stunnel.mirt.net:443 protocolCredentials=username:password Best regards, Mike

1 0

Vasudha Upadhyaya is out of the office.
by vasudha.upadhyaya＠convergys.com 16 Nov '05

16 Nov '05

I will be out of the office starting 11/16/2005 and will not return until 12/05/2005. I will respond to your message when I return. -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0

more stunnel problems
by Louis Young 10 Nov '05

10 Nov '05

Hi guys Ok, as I've said in a previous mail, I'm now merely trying to get the linux client to work. In the config file: [ssmtp] accept = 465 connect = 25 But now: louislaptop:/usr/local/etc/stunnel # telnet localhost 25 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 louislaptop.kpho.local ESMTP Postfix Works fine. I get the SMTP prompt. And now: louislaptop:/usr/local/etc/stunnel # telnet localhost 465 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. No SMTP prompt. In the log files: 2005.11.09 16:32:47 LOG5[32348:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.11.09 16:32:47 LOG7[32348:1]: Snagged 64 random bytes from /root/.rnd 2005.11.09 16:32:47 LOG7[32348:1]: Wrote 1024 new random bytes to /root/.rnd 2005.11.09 16:32:47 LOG7[32348:1]: RAND_status claims sufficient entropy for the PRNG 2005.11.09 16:32:47 LOG6[32348:1]: PRNG seeded successfully 2005.11.09 16:32:47 LOG7[32348:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.11.09 16:32:47 LOG7[32348:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.11.09 16:32:47 LOG6[32348:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.11.09 16:32:47 LOG6[32348:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.11.09 16:32:47 LOG5[32348:1]: 500 clients allowed 2005.11.09 16:32:47 LOG7[32348:1]: FD 4 in non-blocking mode 2005.11.09 16:32:47 LOG7[32348:1]: FD 5 in non-blocking mode 2005.11.09 16:32:47 LOG7[32348:1]: FD 6 in non-blocking mode 2005.11.09 16:32:47 LOG7[32348:1]: SO_REUSEADDR option set on accept socket 2005.11.09 16:32:47 LOG7[32348:1]: ssmtp bound to 0.0.0.0:7777 2005.11.09 16:32:47 LOG7[32349:1]: Created pid file /stunnel.pid 2005.11.09 16:32:47 LOG7[32349:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.11.09 16:32:53 LOG7[32349:0]: CONTEXT 1, FD=4, (IN)->() 2005.11.09 16:32:53 LOG7[32349:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.11.09 16:32:53 LOG7[32349:1]: ssmtp accepted FD=7 from 127.0.0.1:15767 2005.11.09 16:32:53 LOG7[32349:1]: Creating a new context 2005.11.09 16:32:53 LOG7[32349:1]: Context 2 created 2005.11.09 16:32:53 LOG7[32349:2]: Context swap: 1 -> 2 2005.11.09 16:32:53 LOG7[32349:2]: ssmtp started 2005.11.09 16:32:53 LOG7[32349:2]: FD 7 in non-blocking mode 2005.11.09 16:32:53 LOG7[32349:2]: TCP_NODELAY option set on local socket 2005.11.09 16:32:53 LOG5[32349:2]: ssmtp connected from 127.0.0.1:15767 2005.11.09 16:32:53 LOG7[32349:2]: SSL state (accept): before/accept initialization 2005.11.09 16:32:53 LOG7[32349:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.11.09 16:37:53 LOG7[32349:0]: CONTEXT 1, FD=4, (IN)->() 2005.11.09 16:37:53 LOG7[32349:0]: CONTEXT 1, FD=6, (IN)->() 2005.11.09 16:37:53 LOG7[32349:0]: CONTEXT 2, FD=7, (IN)->() 2005.11.09 16:37:53 LOG6[32349:2]: init_ssl: s_poll_wait timeout 2005.11.09 16:37:53 LOG7[32349:2]: ssmtp finished (0 left) 2005.11.09 16:37:53 LOG3[32349:2]: STACK_RESERVE is too high 2005.11.09 16:37:53 LOG7[32349:2]: Context 2 closed 2005.11.09 16:37:53 LOG7[32349:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.11.09 16:58:51 LOG5[32349:0]: Received signal 15; terminating 2005.11.09 16:58:51 LOG7[32349:0]: removing pid file /stunnel.pid Any ideas? -- Regards Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

2 3

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 09 Nov '05

09 Nov '05

Hans Werner Strube wrote: > 1. Line 92 of sthreads.c, > (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; > causes a compiler warning: "a cast does not yield an lvalue." > > 2. The Solaris <9 SPARC peculiarity concerning the third argument of > makecontext might be taken into account. > > Both would be fixed by the following changes. > ***Caveat: I do not know how the third argument of makecontext behaves > in Solaris x86 for versions <9 vs. >=9. Have no machine to test this. Sorry, my patch contained a bad error: ctx->stack+=STACK_SIZE-8 is, of course, nonsense, since ctx->stack must not be changed. My patch to version 4.15b1 should read instead: *** sthreads.c.15b1 Wed Nov 9 12:18:18 2005 --- sthreads.c Wed Nov 9 17:07:57 2005 *************** *** 78,85 **** return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! ctx->ctx.uc_stack.ss_sp=ctx->stack; ! #if defined(__sgi) || (defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ --- 78,84 ---- return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! #if defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ *************** *** 88,96 **** defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8))) ! (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; #endif ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; --- 87,102 ---- defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8)) ! #define MCTXA 2 ! #else ! #define MCTXA 1 #endif + #if defined(__sgi) || (MCTXA == 2) + ctx->ctx.uc_stack.ss_sp=ctx->stack+STACK_SIZE-8; + #else + ctx->ctx.uc_stack.ss_sp=ctx->stack; + #endif ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; *************** *** 121,127 **** if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); return 0; } --- 127,133 ---- if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, MCTXA, arg); return 0; }

1 0

Trouble between linux client and windows server
by Louis Young 09 Nov '05

09 Nov '05

Hi guys I'm trying to use stunnel between a windows server and a linux client. On the windows server: [VNC] accept = 5901 connect = 5900 and on the linux client: ; VNC server on 192.168.100.57 accept = 5901 connect = 192.168.100.65:5901 But, alas: Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused Trying ::1... telnet: connect to address ::1: Connection refused It's almost as if stunnel isn't listening on that port on the linux client. Any ideas? -- Regards Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

1 1

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 09 Nov '05

09 Nov '05

Michal Trojnara wrote: > Please try: ftp://stunnel.mirt.net/stunnel/stunnel-4.15b1.tar.gz The changes to common.h and sthreads.c with respect to new_context and makecontext are reasonable. However, there are two problems: 1. Line 92 of sthreads.c, (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; causes a compiler warning: "a cast does not yield an lvalue." 2. The Solaris <9 SPARC peculiarity concerning the third argument of makecontext might be taken into account. Both would be fixed by the following changes. ***Caveat: I do not know how the third argument of makecontext behaves in Solaris x86 for versions <9 vs. >=9. Have no machine to test this. *** sthreads.c.15b1 Wed Nov 9 12:18:18 2005 --- sthreads.c Wed Nov 9 14:56:18 2005 *************** *** 78,85 **** return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! ctx->ctx.uc_stack.ss_sp=ctx->stack; ! #if defined(__sgi) || (defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ --- 78,84 ---- return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! #if defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ *************** *** 88,96 **** defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8))) ! (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; #endif ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; --- 87,101 ---- defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8)) ! #define MCtxA 2 ! #else ! #define MCtxA 1 #endif + #if defined(__sgi) || (MCtxA == 2) + ctx->stack+=STACK_SIZE-8; + #endif + ctx->ctx.uc_stack.ss_sp=ctx->stack; ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; *************** *** 121,127 **** if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); return 0; } --- 126,132 ---- if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, MCtxA, arg); return 0; }

1 0

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 09 Nov '05

09 Nov '05

Alexander Lazic wrote: > The semantics of the uc_stack member of the ucontext_t structure have > changed as they apply to inputs to makecontext(). Prior to Solaris 10, > the ss_sp member of the uc_stack structure represented the high memory > address of the area reserved for the stack. The ss_sp member now > represents the base (low memory address), in keeping with other uses of > ss_sp. > > This change in the meaning of ss_sp is now the default behavior. The > -D__MAKECONTEXT_V2_SOURCE compilation flag used in Solaris 9 update > releases to access this behavior is obsolete. Solaris 9_x86 does not use __MAKECONTEXT_V2_SOURCE, see /usr/include/ucontext.h: *** Solaris 9: #if defined(__MAKECONTEXT_V2_SOURCE) && defined(__sparc) #ifdef __PRAGMA_REDEFINE_EXTNAME #pragma redefine_extname makecontext __makecontext_v2 #else #define makecontext __makecontext_v2 #endif #endif *** Solaris 10: #ifdef __sparc #ifdef __PRAGMA_REDEFINE_EXTNAME #pragma redefine_extname makecontext __makecontext_v2 #else #define makecontext __makecontext_v2 #endif In libc.so.1, __makecontext_v2 is the "new" function and makecontext the "old" one (binary compatible to Solaris 8 and earlier). For Solaris x86, there is only one function makecontext in all versions. Thus the behavior might not have been changed. A small test program in Solaris 9_x86 (have no earlier versions) indicated the "new" behavior.

2 1

IPTables/Stunnel Help needed
by Alaric Dailey 08 Nov '05

08 Nov '05

Ok, I have a fairly complex firewall setup on my Linux box with 7 host IPs, 2 Internet connections, and a DMZ. I need to direct 1 IP to stunnel on the firewall to be forwarded to the mail server in the DMZ on ports 8383, 993, 995 etc.. but leave ports 25, and 3389 forwarded via iptables, can anyone lend a hand?

1 0

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 08 Nov '05

08 Nov '05

Michal Trojnara wrote: > I had no Solaris 10 to test it... So what's the correct way to detect > Solaris 10? This must probably be done by a modified configure and a new #if or #ifdef. uname -r gives 5.10 for Solaris 10. > Solaris 9 behaves correctly if __MAKECONTEXT_V2_SOURCE is defined (it > is defined in common.h). I've tested this case. Yes, of course. I have not stated anything different. > The manual claims: > The value of > argc must match the number of integer arguments passed to > func, otherwise the behavior is undefined. > (SunOS mion 5.9 Generic_112233-12 sun4u sparc SUNW,Ultra-250) > > I only pass single argument... Yes, but up to Solaris 8 it claimed: The integer value of argc must be one-greater-than the number of arguments that follow argc; otherwise, the behavior is undefined. For 5 arguments, the value of argc must be 6. AfaIk this would also hold for Solaris 9 without __MAKECONTEXT_V2_SOURCE, but this is deprecated. Btw, Solaris 9 and 10 can still handle binaries compiled under earlier versions.

1 0

Re: stunnel 4.14 and openssl 0.9.8a
by MeeAGhost 08 Nov '05

08 Nov '05

I am using stunnel to tunnel my VNC connection. As recent as version 4.12 I have been able to use the libeay32.dll and libssl32.dll files I created with openssl 0.9.X.X using Msys and Mingw with the steps below: 1. I comment out line 910 in the openssl Configure script 2. Create .def for dll's: perl util/mkdef.pl 32 libeay > ms/libeay32.def perl util/mkdef.pl 32 ssleay > ms/ssleay32.def 3. Execute the openssl configure script ./Configure mingw 4. Execute the make for openssl make 5. After the make completes I create the dlls dllwrap --dllname libeay32.dll --output-lib libeay32.a --def ms/libeay32.def libcrypto.a -lwsock32 -lgdi32 dllwrap --dllname libssl32.dll --output-lib libssl32.a --def ms/ssleay32.def libssl.a libeay32.a When I place the resulting dlls on the remote machine with version 4.14installed and establish a VNC connection to machine stunnel crashes and generates a Dr. Watson error. If I revert back to version 4.12 the dlls I created using the steps above --- everything works. If I install the 0.9.7idlls (which come as a part of the 4.14 Win Install package) everything works. I am trying to keep server and clients on the same version of openssl which is why I have been compling new dlls whenever I have upgraded the servers. Is there something unique being done in version 4.14 that prevents dlls created with 0.9.8a from being used? -- Chris

2 3

Solaris: new_context, makecontext
by Hans Werner Strube 08 Nov '05

08 Nov '05

Concerns all versions of sthreads.c using ucontext: As far as I know from the Solaris documentation and some experiments, the context treatment in new_context() is not universally correct. #if defined(__sgi) || (defined(__sparc) && !defined(HAVE___MAKECONTEXT_V2)) ctx->ctx.uc_stack.ss_sp=ctx->stack+STACK_SIZE-8; #else /* not an IRIX or old and buggy Solaris on Sparc */ ctx->ctx.uc_stack.ss_sp=ctx->stack; #endif The first case is wrong for Solaris 10, since HAVE___MAKECONTEXT_V2 is not defined there but the behavior is _always_ as with HAVE___MAKECONTEXT_V2 in Solaris 9 SPARC. (Solaris 9 SPARC behaves like Solaris 7 and 8 SPARC ["old and buggy"] if HAVE___MAKECONTEXT_V2 is not set, and like Solaris 10 if it is set.) In the "old and buggy" case, the third argument of makecontext() should be 2 instead of 1 (although the latter _may_ work). I do not know how this is in Solaris x86. At least, HAVE___MAKECONTEXT_V2 has no meaning there.

3 3

stunnel 4.14 released
by Michal Trojnara 03 Nov '05

03 Nov '05

The ChangeLog entry for stunnel 4.14: Version 4.14, 2005.11.02, urgency: HIGH: * Bugfixes - transfer() fixed to avoid random stalls introduced in version 4.12. - poll() error handing bug fixed. - Checking for dynamic loader libraries added again. - Default pidfile changed from $localstatedir/run/stunnel.pid to $localstatedir/stunnel/stunnel.pid. - Basic SSL library initalization moved to the beginning of execution. * Release notes - This is an important bugfix release. Upgrade is recommended. sha1sum for stunnel-4.14.tar.gz: b2edb3a2473367f2a9f04a877adcb332483a5267 Home page and download: http://stunnel.mirt.net/ Best regards, Mike

2 2

I: error=certificate signature failure
by Pulcini Maddalena 03 Nov '05

03 Nov '05

________________________________ Da: Pulcini Maddalena Inviato: gio 03/11/2005 8.58 A: stunnel Oggetto: I: error=certificate signature failure ________________________________ Da: Pulcini Maddalena Inviato: mer 02/11/2005 17.14 A: stunnel Oggetto: error=certificate signature failure Hi All, someone could help me to understand what happens and what my client needs to verify the peer? Thanks&Regards I configure stunnel in this way: stunnel.conf ================================ client = yes debug=7 cert = client69f.pem key = chiave69.pem cafile=cacert.pem verify = 1 capath= . [telnet] accept = 23 connect = 10.36.3.191:4433 ============================ I put all the files configured above in the same directory where stunnel-4.07.exe runs; I have a machine in which ssl server runs with a certificate signed by the same CA (cacert.pem). The log file is : ====================================== 2005.11.02 16:33:47 LOG5[1456:1084]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 2005.11.02 16:33:47 LOG7[1456:1504]: Snagged 64 random bytes from C:/.rnd 2005.11.02 16:33:47 LOG7[1456:1504]: Wrote 1024 new random bytes to C:/.rnd 2005.11.02 16:33:47 LOG7[1456:1504]: RAND_status claims sufficient entropy for the PRNG 2005.11.02 16:33:47 LOG6[1456:1504]: PRNG seeded successfully 2005.11.02 16:33:47 LOG7[1456:1504]: Certificate: client69f.pem 2005.11.02 16:33:47 LOG7[1456:1504]: Key file: chiave69.pem 2005.11.02 16:33:47 LOG7[1456:1504]: Loaded verify certificates from cacert.pem 2005.11.02 16:33:47 LOG7[1456:1504]: Verify directory set to . 2005.11.02 16:33:47 LOG5[1456:1504]: No limit detected for the number of clients 2005.11.02 16:33:47 LOG7[1456:1504]: FD 156 in non-blocking mode 2005.11.02 16:33:47 LOG7[1456:1504]: SO_REUSEADDR option set on accept socket 2005.11.02 16:33:47 LOG7[1456:1504]: telnet bound to 0.0.0.0:23 2005.11.02 16:34:14 LOG7[1456:1504]: telnet accepted FD=168 from 127.0.0.1:2501 2005.11.02 16:34:14 LOG7[1456:1504]: FD 168 in non-blocking mode 2005.11.02 16:34:14 LOG7[1456:1504]: Creating a new thread 2005.11.02 16:34:14 LOG7[1456:1504]: New thread created 2005.11.02 16:34:14 LOG7[1456:1320]: telnet started 2005.11.02 16:34:14 LOG5[1456:1320]: telnet connected from 127.0.0.1:2501 2005.11.02 16:34:14 LOG7[1456:1320]: FD 192 in non-blocking mode 2005.11.02 16:34:14 LOG7[1456:1320]: telnet connecting 10.36.3.191:4433 2005.11.02 16:34:14 LOG7[1456:1320]: connect_wait: waiting 10 seconds 2005.11.02 16:34:14 LOG7[1456:1320]: connect_wait: connected 2005.11.02 16:34:14 LOG7[1456:1320]: Remote FD=192 initialized 2005.11.02 16:34:14 LOG7[1456:1320]: SSL state (connect): before/connect initialization 2005.11.02 16:34:14 LOG7[1456:1320]: SSL state (connect): SSLv3 write client hello A 2005.11.02 16:34:14 LOG7[1456:1320]: SSL state (connect): SSLv3 read server hello A 2005.11.02 16:34:14 LOG4[1456:1320]: VERIFY ERROR: depth=1, error=certificate signature failure: /C=Siena/O=amtec/OU=elsag/CN=CERTIFICATION AUTHORITY 2.0/description=CA CERTIFICATE/L=Abbadia San Salvatore 2005.11.02 16:34:14 LOG7[1456:1320]: SSL alert (write): fatal: handshake failure 2005.11.02 16:34:14 LOG3[1456:1320]: error stack: 14090086 : error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2005.11.02 16:34:14 LOG3[1456:1320]: error stack: D089006 : error:0D089006:asn1 encoding routines:ASN1_verify:EVP lib 2005.11.02 16:34:14 LOG3[1456:1320]: SSL_connect: 4077068: error:04077068:rsa routines:RSA_verify:bad signature 2005.11.02 16:34:14 LOG7[1456:1320]: telnet finished (0 left)

1 0

4.14b1+0.9.7i client loop in s_poll_wait/scan_waiting_queue
by Richard.Hall 30 Oct '05

30 Oct '05

Obviously stunnel problems are like London buses - you wait years for one, then two come along inside a week ;-) Having fixed my server-side problems by installing 4.14b1, I now have a problem on the client side. Apologies for the voluminous diagnostics below, but hopefully they will help make the problem clear. I am running Apache + mod_jk, stunneling to a remote JBoss server. The client is stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 When things are running normally, everything is sweetness and light. However, if I 'kill -HUP' the Apache server (eg to do a log rotation), the mod_jk connection to stunnel gets closed, and stunnel goes into a loop. If I enable DEBUG_UCONTEXT in network.c, and add a few lines of diagnostics:- $ diff -c network.c.orig network.c.loop *** network.c.orig Thu Oct 20 08:37:47 2005 --- network.c.loop Thu Oct 27 13:07:10 2005 *************** *** 31,37 **** #include "common.h" #include "prototypes.h" ! /* #define DEBUG_UCONTEXT */ #ifndef USE_WIN32 static int signal_pipe[2]={-1, -1}; --- 31,37 ---- #include "common.h" #include "prototypes.h" ! #define DEBUG_UCONTEXT #ifndef USE_WIN32 static int signal_pipe[2]={-1, -1}; *************** *** 156,167 **** for(i=0; i<ctx->fds->nfds; i++) { ctx->fds->ufds[i].revents=ufds[nfds].revents; #ifdef DEBUG_UCONTEXT ! s_log(LOG_DEBUG, "CONTEXT %ld, FD=%d, (%s%s)->(%s%s)", ctx->id, ufds[nfds].fd, ufds[nfds].events & POLLIN ? "IN" : "", ufds[nfds].events & POLLOUT ? "OUT" : "", ufds[nfds].revents & POLLIN ? "IN" : "", ! ufds[nfds].revents & POLLOUT ? "OUT" : ""); #endif if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; --- 156,170 ---- for(i=0; i<ctx->fds->nfds; i++) { ctx->fds->ufds[i].revents=ufds[nfds].revents; #ifdef DEBUG_UCONTEXT ! s_log(LOG_DEBUG, "CONTEXT %ld, FD=%d, (%s%s)->(%s%s%s%s%s)", ctx->id, ufds[nfds].fd, ufds[nfds].events & POLLIN ? "IN" : "", ufds[nfds].events & POLLOUT ? "OUT" : "", ufds[nfds].revents & POLLIN ? "IN" : "", ! ufds[nfds].revents & POLLOUT ? "OUT" : "", ! ufds[nfds].revents & POLLERR ? "ERR" : "", ! ufds[nfds].revents & POLLHUP ? "HUP" : "", ! ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; I get (with fd=9 being the mod_jk socket, fd=10 the SSL one, and TIMEOUTidle set to 35 seconds for demo purposes) ... 2005.10.27 13:13:42 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 2, FD=9, (INOUT)->(OUT) 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:42 LOG7[1286:2]: SSL_read returned WANT_READ: retrying 2005.10.27 13:13:42 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:43 LOG7[1286:2]: Socket closed on read ... ie mod_jk has disconnected. Everything carries on for a while ... 2005.10.27 13:13:43 LOG7[1286:2]: SSL write shutdown 2005.10.27 13:13:43 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.10.27 13:13:43 LOG7[1286:2]: SSL alert (write): warning: close notify 2005.10.27 13:13:43 LOG7[1286:2]: SSL_shutdown retrying 2005.10.27 13:13:43 LOG7[1286:2]: SSL doesn't need to read or write 2005.10.27 13:13:43 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:45 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(OUT) [...] 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:46 LOG7[1286:2]: SSL_read returned WANT_READ: retrying 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) ... but eventually we start getting ERRHUP (ie POLLERR | POLLHUP), not OUT, on fd 9, and then we end up in a tight loop of 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) ... until eventually we get [...] 2005.10.27 13:14:23 LOG7[1286:0]: Waiting 2 second(s) for 6 file descriptor(s) 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:14:25 LOG7[1286:0]: Waiting 0 second(s) for 6 file descriptor(s) 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:14:25 LOG6[1286:2]: s_poll_wait timeout: connection reset 2005.10.27 13:14:25 LOG5[1286:2]: Connection reset: 260 bytes sent to SSL, 24734 bytes sent to socket The problem seems to be in network.c:s_poll_wait(), in the code while(!ready_head) /* no context ready */ scan_waiting_queue(); because poll() returns > 0, but scan_waiting_queue() never sets ready_head because no fd has yielded POLLIN or POLLOUT:- if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; The end result is that we chew up CPU until TIMEOUTidle expires (which is rather a long time if left at the default of 12 hours!!) I have fudged a circumvention as follows (because I couldn't follow the logic well enough to do it cleanly, and time is running out on me, I'm afraid.) $ diff -c network.c.loop network.c *** network.c.loop Thu Oct 27 13:07:10 2005 --- network.c Thu Oct 27 13:05:21 2005 *************** *** 166,172 **** ufds[nfds].revents & POLLHUP ? "HUP" : "", ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif ! if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; nfds++; } --- 166,172 ---- ufds[nfds].revents & POLLHUP ? "HUP" : "", ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif ! if(ufds[nfds].revents & (POLLIN|POLLOUT|POLLERR|POLLHUP|POLLNVAL)) ctx->ready++; nfds++; } ... which seems to solve the problem but produces a rather untidy result:- 2005.10.27 13:17:46 LOG7[1759:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2005.10.27 13:17:46 LOG7[1759:0]: Waiting 35 second(s) for 6 file descriptor(s) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:17:46 LOG3[1759:2]: INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready 2005.10.27 13:17:46 LOG5[1759:2]: Connection reset: 260 bytes sent to SSL, 41132 bytes sent to socket ... i.e it sorts itself out quickly, but at the cost of logging an INTERNAL ERROR, which doesn't look very good ;-) As far as I could tell (but haven't shown), everything actually got close'd correctly. As I say, I appear to have a circumvention, so I'm not hanging on a proper fix (unless anyone can see any fatal flaw in what I've done?) Regards, Richard

2 1

Question on config for Global Option 'output'
by Tara.L.Weaver＠wellsfargo.com 30 Oct '05

30 Oct '05

Can a file size be determined for 'output' in the config? If so, how can that be done? Or can overwrite be configured for output? STunnel version 4.09 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7e (SQL)Server config: client = no taskbar = yes CAFile = root_ca.cer ciphers = AES128-SHA cert = stunnel.pem output = d:\STunnel\STunnelLog debug=5 [FraudProd] accept = 1364 connect = 1433 Tara L. Weaver Network Analyst 2 Wells Fargo Services Contact Center System Support Office: 612\667-5795 Tara.L.Weaver(a)WellsFargo.com > This message may contain confidential and/or privileged information. > If you are not the addressee or authorized to receive this for the > addressee, you must not use, copy, disclose, or take any action based > on this message or any information herein. If you have received this > message in error, please advise the sender immediately by reply e-mail > and delete this message. Thank you for your cooperation. >

2 1

Boot Password
by Bob 30 Oct '05

30 Oct '05

I need to use signed certificates with stunnel. New to the whole certificate thing. I have the certificate and key and built the .PEM file but when I try to start stunnel in the background it asks me to enter the PEM password. How can I enter the password and have stunnel start during boot? _______________________________________________________________________ Thanks, Bob (bobif(a)yahoo.com) YahooIM: bobif AOLIM: bobifmd ICQ: 111083556

2 1

4.13+0.9.7i server stops writing SSL output
by Richard.Hall 25 Oct '05

25 Oct '05

First-time post (though long-time satisfied occasional user). Searched the archives but if there is anything relevant, I've obviously missed it. I really cannot decide if this is an stunnel problem or an OpenSSL problem. Client is remote and running stunnel 4.12 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.6i Server is local, I've been through 4.12 + 0.9.6m 4.13 + 0.9.6m and now trying stunnel 4.13 on sparc-sun-solaris2.8 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7i (I've resisted the urge to try OpenSSL 0.9.8* as people seem to be experiencing 'issues') Small amounts of data are fine. But for larger amounts the connection goes to sleep. The way I read it, the server end stops trying to write to the SSL side. The relevant parts of # truss -w2 -v poll -dl /usr/local/stunnel-4.13/sbin/stunnel look like this: (apologies for doing it like this, but it seemed the easiest way to combine the debug output and truss output) (fd=7 is the SSL side, fd=8 the local side, TIMEOUTidle is set to 35 seconds for demo purposes) /1: 15.5722 read(8, " A B\0\n03\007\t\t\r\n\t".., 8178) = 8178 /1: poll(0x00049DD8, 3, 35000) (sleeping...) /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLIN /1: 17.3166 poll(0x00049DD8, 3, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLOUT /1: 17.3229 write(7, "1703\0\0188CBEC9 : O\t u".., 16442) = 16442 /1: 17.3234 poll(0x00049DD8, 4, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=8 ev=POLLIN rev=POLLIN /1: fd=7 ev=POLLIN rev=0 So far, so good. /1: 17.3238 read(8, "\t\t\t\r\n\t\t\t\r\n\t\t".., 16384) = 16384 /1: 17.3240 poll(0x00049DD8, 3, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLOUT /1: 17.3299 write(7, "1703\0\018ED 1AD91A888 i".., 16442) = 14480 For whatever reason, the write() was only partial. I'm guessing n/w issues, as the client is a loooong way away ;-) /1: 17.3303 write(7, " fE3DDA8FE ! i8DD8\fEBEC".., 1962) Err#11 EAGAIN /1: 17.3308 write(2, 0x00071D60, 74) = 74 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 0 : 3 0 L O G 7 [ 2 0 6 4 7 : 2 /1: ] : S S L _ w r i t e r e t u r n e d W A N T _ W R I T E /1: : r e t r y i n g /1: 17.3312 write(2, "\n", 1) = 1 /1: 17.3315 read(7, 0x000778D8, 5) Err#11 EAGAIN /1: 17.3318 write(2, 0x00071D60, 72) = 72 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 0 : 3 0 L O G 7 [ 2 0 6 4 7 : 2 /1: ] : S S L _ r e a d r e t u r n e d W A N T _ R E A D : /1: r e t r y i n g /1: 17.3321 write(2, "\n", 1) = 1 So we've now done an SSL_write, which yielded SSL_ERROR_WANT_WRITE, _and_ an SSL_read, which yielded SSL_ERROR_WANT_READ, (and which I think removes the SSL_ERROR_WANT_WRITE condition, as we can only have one or the other.) This means that, the next time round the loop (in client.c:transfer()), want_rd is TRUE, want_wr is FALSE, so we don't poll the SSL connection for output, only input: /1: poll(0x00049DD8, 3, 35000) (sleeping...) /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN rev=POLLOUT But there won't be any input (trust me on that!), so we time out ... /1: 52.3387 poll(0x00049DD8, 3, 35000) = 0 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN rev=0 /1: 52.3394 write(2, 0x00071D60, 72) = 72 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 1 : 0 5 L O G 6 [ 2 0 6 4 7 : 2 /1: ] : s _ p o l l _ w a i t t i m e o u t : c o n n e c t i /1: o n r e s e t /1: 52.3399 write(2, "\n", 1) = 1 /1: 52.3403 write(2, 0x00071DD0, 102) = 102 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 1 : 0 5 L O G 5 [ 2 0 6 4 7 : 2 /1: ] : C o n n e c t i o n r e s e t : 5 7 6 1 7 b y t e s /1: s e n t t o S S L , 1 3 1 b y t e s s e n t t o /1: s o c k e t Now I have never before needed (nor wanted!) to delve into the inner workings of either stunnel or OpenSSL, so I may be in completely the wrong ballpark here. But I cannot understand the logic of the following bit of code in transfer() :- if((c->sock_ptr && !want_rd) || /* socket input buffer not empty */ ssl_closing==CL_INIT /* need to send close_notify */ || ((c->ssl_ptr<BUFFSIZE || ssl_closing==CL_RETRY) && want_wr)) /* want to SSL_read or SSL_shutdown but write to the * underlying socket needed for the SSL protocol */ s_poll_add(&c->fds, c->ssl_wfd->fd, 0, 1); In particular, if I change the first line to if(c->sock_ptr || /* socket input buffer not empty */ then everything starts working (correctly as far as I can see). The OpenSSL man pages seem (to me) to say that it is perfectly permissible to call SSL_write when we have SSL_ERROR_WANT_READ. Help? TIA, Richard Hall

4 6

how to sign each pem file with the local CA
by Jonathan Carpenter 21 Oct '05

21 Oct '05

I am trying to setup stunnel to encrypt syslog-ng logs, but all the tutorials that I have found tell me to sign each pem file with the local CA I have tried to find out how in the stunnel archives but have had no luck. Can anyone help me? Thanks

1 0

Stunnel Configure Warning
by G J Piper 21 Oct '05

21 Oct '05

I was upgrading my Stunnel 4.11 to 4.13 when I saw this in the config check and decided to post it to see if I should continue installing... the config told me (obvoiously) to post this message... heh: > checking ucontext.h usability... no > checking ucontext.h presence... yes > configure: WARNING: ucontext.h: present but cannot be compiled > configure: WARNING: ucontext.h: check for missing prerequisite headers? > configure: WARNING: ucontext.h: see the Autoconf documentation > configure: WARNING: ucontext.h: section "Present But Cannot Be Compiled" > configure: WARNING: ucontext.h: proceeding with the preprocessor's result > configure: WARNING: ucontext.h: in the future, the compiler will take precedence > configure: WARNING: ## ---------------------------------- ## > configure: WARNING: ## Report this to the stunnel lists. ## > configure: WARNING: ## ---------------------------------- ## > checking for ucontext.h... yes > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes What can be done? ~ Greg

2 1

stunnel 4.13 released
by Michal Trojnara 21 Oct '05

21 Oct '05

Version 4.13, 2005.10.21, urgency: MEDIUM: * DLLs for OpenSSL 0.9.7i included because protection faults were reported in 0.9.8 and 0.9.8a. * New features - Libwrap code is executed as a separate process (no more delays due to a global and potentially long critical section). * Bugfixes - Problem with zombies in UCONTEXT threading fixed. - Workaround for non-standard makecontext() uc_stack.ss_sp parameter semantics on SGI IRIX. - Protection fault in signals handling on IRIX fixed. - Problem finding pthread library on AIX fixed. - size_t printf() fixed in stack_info() (the previous fix didn't work). - socklen_t is used instead of int where required. Homepage: http://stunnel.mirt.net/ sha1sum for stunnel-4.13.tar.gz: 4cb8e162e6cd4b4a966d601d1c890df2c2ee198f Best regards, Mike

1 0

smtp and tls
by Andy Cravens 21 Oct '05

21 Oct '05

Does stunnel support using TLS with SMTP? My SMTP server requires TLS but my client does not support it. Unfortunately, my SMTP server does not support SMTP over SSL so my only choice is to use TLS. I've seen some old threads concerning a patch to stunnel 3.x to do TLS but I read it was not a good solution. Does anybody have any information or opinions on this?

3 3

SSL alert (write): fatal: bad record mac
by Huy Vu 21 Oct '05

21 Oct '05

Hi all, I was tried stunnel 4.0.9 compiled with Openssl 0.9.7g on Redhat ES 3.0 and got the telnets sessions disconnected with error messages in stunnel.log as below: SSL alert (write): fatal: bad record mac SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac The same problem with stunnel 4.0.12 compiled with Openssl 0.9.8a Tried to disable the option socket = a:SO_REUSEADDR=0 in stunne server configuration file but still not help. Thanks in advance for any help: Full stunnel.log: -------------------- 2005.10.21 04:07:33 LOG5[19485:1]: stunnel 4.12 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2005.10.21 04:07:33 LOG7[19485:1]: Snagged 64 random bytes from /dev/urandom 2005.10.21 04:07:33 LOG7[19485:1]: RAND_status claims sufficient entropy for the PRNG 2005.10.21 04:07:33 LOG6[19485:1]: PRNG seeded successfully 2005.10.21 04:07:33 LOG7[19485:1]: Certificate: /usr/local/stunnel/etc/stunnel/stunnel.pem 2005.10.21 04:07:33 LOG7[19485:1]: Key file: /usr/local/stunnel/etc/stunnel/stunnel.pem 2005.10.21 04:07:33 LOG6[19485:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.10.21 04:07:33 LOG6[19485:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.10.21 04:07:33 LOG5[19485:1]: 500 clients allowed 2005.10.21 04:07:33 LOG7[19485:1]: FD 4 in non-blocking mode 2005.10.21 04:07:33 LOG7[19485:1]: FD 5 in non-blocking mode 2005.10.21 04:07:33 LOG7[19485:1]: FD 6 in non-blocking mode 2005.10.21 04:07:33 LOG7[19485:1]: SO_REUSEADDR option set on accept socket 2005.10.21 04:07:33 LOG7[19485:1]: telnets bound to 192.168.34.35:992 2005.10.21 04:07:33 LOG7[19486:1]: Created pid file /stunnel.pid 2005.10.21 04:07:33 LOG5[19487:1]: stunnel 4.12 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2005.10.21 04:07:33 LOG7[19487:1]: Snagged 64 random bytes from /dev/urandom 2005.10.21 04:07:33 LOG7[19487:1]: RAND_status claims sufficient entropy for the PRNG 2005.10.21 04:07:33 LOG6[19487:1]: PRNG seeded successfully 2005.10.21 04:07:33 LOG6[19487:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.10.21 04:07:33 LOG6[19487:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.10.21 04:07:33 LOG5[19487:1]: 500 clients allowed 2005.10.21 04:07:33 LOG7[19487:1]: FD 4 in non-blocking mode 2005.10.21 04:07:33 LOG7[19487:1]: FD 5 in non-blocking mode 2005.10.21 04:07:33 LOG7[19487:1]: FD 6 in non-blocking mode 2005.10.21 04:07:33 LOG7[19487:1]: SO_REUSEADDR option set on accept socket 2005.10.21 04:07:33 LOG7[19487:1]: soap bound to 127.0.0.1:44300 2005.10.21 04:07:33 LOG7[19488:1]: Created pid file /stunnel.pid 2005.10.21 04:09:30 LOG7[19486:1]: telnets accepted FD=7 from 65.94.188.47:60677 2005.10.21 04:09:30 LOG7[19486:1]: Creating a new context 2005.10.21 04:09:30 LOG7[19486:1]: Context 2 created 2005.10.21 04:09:30 LOG7[19486:2]: Context swap: 1 -> 2 2005.10.21 04:09:30 LOG7[19486:2]: telnets started 2005.10.21 04:09:30 LOG7[19486:2]: FD 7 in non-blocking mode 2005.10.21 04:09:30 LOG7[19486:2]: TCP_NODELAY option set on local socket 2005.10.21 04:09:30 LOG5[19486:2]: telnets connected from 65.94.188.47:60677 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): before/accept initialization 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 read client hello A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write server hello A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write certificate A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write server done A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 flush data 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 read client key exchange A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 read finished A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write finished A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 flush data 2005.10.21 04:09:30 LOG7[19486:2]: 1 items in the session cache 2005.10.21 04:09:30 LOG7[19486:2]: 0 client connects (SSL_connect()) 2005.10.21 04:09:30 LOG7[19486:2]: 0 client connects that finished 2005.10.21 04:09:30 LOG7[19486:2]: 0 client renegotiatations requested 2005.10.21 04:09:30 LOG7[19486:2]: 1 server connects (SSL_accept()) 2005.10.21 04:09:30 LOG7[19486:2]: 1 server connects that finished 2005.10.21 04:09:30 LOG7[19486:2]: 0 server renegotiatiations requested 2005.10.21 04:09:30 LOG7[19486:2]: 0 session cache hits 2005.10.21 04:09:30 LOG7[19486:2]: 0 session cache misses 2005.10.21 04:09:30 LOG7[19486:2]: 0 session cache timeouts 2005.10.21 04:09:30 LOG6[19486:2]: SSL accepted: new session negotiated 2005.10.21 04:09:30 LOG6[19486:2]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.10.21 04:09:30 LOG7[19486:2]: FD 8 in non-blocking mode 2005.10.21 04:09:30 LOG7[19486:2]: telnets connecting 127.0.0.1:23 2005.10.21 04:09:30 LOG7[19486:2]: connect_wait: waiting 10 seconds 2005.10.21 04:09:30 LOG7[19486:2]: connect_wait: connected 2005.10.21 04:09:30 LOG7[19486:2]: Remote FD=8 initialized 2005.10.21 04:09:30 LOG7[19486:2]: TCP_NODELAY option set on remote socket 2005.10.21 04:09:31 LOG7[19488:1]: soap accepted FD=7 from 127.0.0.1:37120 2005.10.21 04:09:31 LOG7[19488:1]: Creating a new context 2005.10.21 04:09:31 LOG7[19488:1]: Context 2 created 2005.10.21 04:09:31 LOG7[19488:2]: Context swap: 1 -> 2 2005.10.21 04:09:31 LOG7[19488:2]: soap started 2005.10.21 04:09:31 LOG7[19488:2]: FD 7 in non-blocking mode 2005.10.21 04:09:31 LOG7[19488:2]: TCP_NODELAY option set on local socket 2005.10.21 04:09:31 LOG5[19488:2]: soap connected from 127.0.0.1:37120 2005.10.21 04:09:31 LOG7[19488:2]: FD 8 in non-blocking mode 2005.10.21 04:09:31 LOG7[19488:2]: soap connecting 199.84.230.35:443 2005.10.21 04:09:31 LOG7[19488:2]: connect_wait: waiting 10 seconds 2005.10.21 04:09:31 LOG7[19488:2]: connect_wait: connected 2005.10.21 04:09:31 LOG7[19488:2]: Remote FD=8 initialized 2005.10.21 04:09:31 LOG7[19488:2]: TCP_NODELAY option set on remote socket 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): before/connect initialization 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 write client hello A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read server hello A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read server certificate A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read server key exchange A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read server done A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 write client key exchange A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 write change cipher spec A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 write finished A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 flush data 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read finished A 2005.10.21 04:09:31 LOG7[19488:2]: 1 items in the session cache 2005.10.21 04:09:31 LOG7[19488:2]: 1 client connects (SSL_connect()) 2005.10.21 04:09:31 LOG7[19488:2]: 1 client connects that finished 2005.10.21 04:09:31 LOG7[19488:2]: 0 client renegotiatations requested 2005.10.21 04:09:31 LOG7[19488:2]: 0 server connects (SSL_accept()) 2005.10.21 04:09:31 LOG7[19488:2]: 0 server connects that finished 2005.10.21 04:09:31 LOG7[19488:2]: 0 server renegotiatiations requested 2005.10.21 04:09:31 LOG7[19488:2]: 0 session cache hits 2005.10.21 04:09:31 LOG7[19488:2]: 0 session cache misses 2005.10.21 04:09:31 LOG7[19488:2]: 0 session cache timeouts 2005.10.21 04:09:31 LOG6[19488:2]: SSL connected: new session negotiated 2005.10.21 04:09:31 LOG6[19488:2]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2005.10.21 04:09:31 LOG7[19488:2]: SSL_read returned WANT_READ: retrying 2005.10.21 04:09:31 LOG7[19488:2]: SSL_read returned WANT_READ: retrying 2005.10.21 04:09:31 LOG7[19488:2]: SSL alert (read): warning: close notify 2005.10.21 04:09:31 LOG7[19488:2]: SSL closed on SSL_read 2005.10.21 04:09:31 LOG7[19488:2]: Socket write shutdown 2005.10.21 04:09:31 LOG7[19488:2]: SSL write shutdown 2005.10.21 04:09:31 LOG7[19488:2]: SSL alert (write): warning: close notify 2005.10.21 04:09:31 LOG6[19488:2]: SSL_shutdown successfully sent close_notify 2005.10.21 04:09:31 LOG7[19488:2]: Socket closed on read 2005.10.21 04:09:31 LOG5[19488:2]: Connection closed: 818 bytes sent to SSL, 4558 bytes sent to socket 2005.10.21 04:09:31 LOG7[19488:2]: soap finished (0 left) 2005.10.21 04:09:31 LOG5[19488:2]: stack_info: size=65536, current=9560 (14%), maximum=9560 (14%) 2005.10.21 04:09:31 LOG7[19488:2]: Context 2 closed 2005.10.21 04:09:45 LOG7[19486:2]: SSL alert (write): fatal: bad record mac 2005.10.21 04:09:45 LOG3[19486:2]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.10.21 04:09:45 LOG5[19486:2]: Connection reset: 4313 bytes sent to SSL, 232 bytes sent to socket 2005.10.21 04:09:45 LOG7[19486:2]: telnets finished (0 left) 2005.10.21 04:09:45 LOG5[19486:2]: stack_info: size=65536, current=9560 (14%), maximum=9560 (14%) 2005.10.21 04:09:45 LOG7[19486:2]: Context 2 closed _________________________________________________________________ Take advantage of powerful junk e-mail filters built on patented Microsoft® SmartScreen Technology. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

1 0

ECC-enabled version of Stunnel
by Dennis Laupichler 19 Oct '05

19 Oct '05

Hello, I want to use a ECC-certificate for stunnel.pem, but it doesn't work. Can anybody help me, what I have to do, to use Elliptique Curve cryptography certificates in Stunnel? Is it still possible or not? The ECC-Ciphers "ECDH-ECDSA-AES256-SHA" from openssl 0.9.8 works, but when I loaded the certificate into stunnel, there was follow messages in the log-file: stunnel.log in Server ################## error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key Server is down ################## Thanks, Dennis

2 1

Lost Connection to MySQL
by Dave.Wismer＠faa.gov 18 Oct '05

18 Oct '05

1 0

stunnel silently dies
by Uffe Vedenbrant 18 Oct '05

18 Oct '05

Hi! After using stunnel on several freebsd boxes i decided to try it out on my mailserver.. Unfortunately it silently died after first connection.. ( and with exitcode=0 ) debug = 7 Nothing more in the log than startup + a line about a incomming connection on port 9143.. ( where i put my incomming imap ) Nothing in any log on the box.. Ok.. It might be my openssl freebsd version or stunnel version so i started to upgrade everything.. Freebsd 4.4 -> 4.11 stunnel 4.05 -> 4.11 etc.. Well did it work.. Nop..;-) Finally i found out after tryin ktrace that the problem was that the tcpwrapper code killed me.. That's ok but there where no logging at all that the tcpwrapper silently decided that i was comming from a blocked host.. It's up now without tcpwrapper enabled and works perfect..;-) Is there any possibility to have stunnel to say something about tcpwrapper problems..;-) And not just die..;-) Regards /Uffe

4 9

client and server together?
by Sholund, Mark D, GVSOL 18 Oct '05

18 Oct '05

I have a situation in which I have a client system, a middle-tier application server, and a backend database. The middle-tier takes info from the client and sends requests to the database, in other words the middle-tier has to act as both a client and a server in different parts of a transaction. Is it necessary that I run two instances of stunnel, one with an stunnel-client.conf wherein client=yes and another instance with stunnel-server.conf wherein client=no or is it possible to configure a single stunnel to do this? I would guess it would be kind of like having "client=yes|no" at the service level; this is not an option as far as I can see from the man page for 4.12 but I figured I could at least ask.

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users