- stunnel-users - stunnel.org

Re: [stunnel-users] HTTPS Proxy support?
by Sean Covel 18 Jul '05

18 Jul '05

Yeah, good for you. Don't we all. I'll just go shove off then. Sean Michal Trojnara wrote: > Sean, > >> $25. > > > It's not enough to allocate my time. 8-) > I usually work for $75/hour. > > Anyway I'm going to support this feature some day. > > Best regards, > Mike > > Sean Covel wrote: > Mike, > > $25. > > I have a paypal link on my development site. Rarely see a payment, but > I have seen some. Doesn't cost anything to have the link or the paypal > account. > > Sean > > Michal Trojnara wrote: > >>Sean, >> >> >>>Do you have a PayPal link somewhere? >> >> >>So far I didn't use PayPal. >>How much money would you like to spend to sponsor stunnel development? >> >>Best regards, >> Mike >> > >

1 0

Stunnel on openwrt
by Markus Mauch 16 Jul '05

16 Jul '05

Hello, I'm using stunnel on a asus router with a openwrt like linux on it. The Idea is to secure traffic from and to a thttpd web server which is running on that box as well. Problem is that stunnel only seems to be able to handle one connection at a time. Whenever it has to cope with more than one it crashes. Unfortunatelly this happens all the time because usually a web browser opens several tcp connections in order to speed things up. So whenever I browse to a web page on the router through stunnel I get only the text. The rest (e.g. the images) which is loaded via different tcp connections does not appear and stunnel won't respond to any further requests until it is restarted. My explanation to this is that the very first request is processed normally but as soon as one other connection causes stunnel to create a second process the whole thing goes to the dogs. ps reveals that there are always two instances of stunnel running after such an experiment, both hanging, of course. So my question is what could I do to keep stunnel from creating new processes when a client tries to communicate over more than one tcp connection or - better - what chould I do in the first place to prevent stunnel from hanging in such a case? Any help would be very apreciated...

1 0

Re: [stunnel-users] HTTPS Proxy support?
by seanecovel＠comcast.net 16 Jul '05

16 Jul '05

Mike, GREAT! I did see a patch out on the web that seems to add this feature. Any chance that patch will be included in MAIN? I don't want to have to patch stunnel on multiple OS especially when you are going to implement the feature yourself. What can I do to "encourage" you to add that support sooner than later? Sean -------------- Original message -------------- > "Sean E. Covel" wrote: > > Does stunnel support HTTPS Proxies with authentication? > > Currently not. > > > Could it? > > Yes, CONNECT protocol support (RFC 2817 section 5.2) is on my TODO list: > http://stunnel.mirt.net/todo_sdf.html > > Best regards, > Mike > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

3 2

HTTPS Proxy support?
by Sean E. Covel 14 Jul '05

14 Jul '05

I am trying to use stunnel to tunnel VNC through a firewall using port 443. When I test on 2 machines on the LAN everything works fine. Nice tool! When I try to connect through the firewall I suspect the HTTPS Proxy is getting in the way. It requires authentication. Does stunnel support HTTPS Proxies with authentication? Could it? Thanks, Sean

2 1

Q: controlled access to service?
by Nardmann, Heiko 14 Jul '05

14 Jul '05

Hi, I want to control access to a through stunnel reachable service. Only those clients shall be allowed to use the service which provide a known certificate. I have found the option "CApath"; can this directory be used to collect all client certificates? Or is it absolutely necessary to have CA certs there? Another thing in this environment: I do not know or own every CA certificate used by the clients - I only get the client certificates itself. So I want to do only a one-level client cert verification. Which verify level do I need for this? 2 or 3? What about removing certificates from the CApath directory? Do I have to restart stunnel to make this change be effective? Another thing: since the client certificates are not revoked by us I am not able to use CRLs for controlling access to our service. -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50

3 2

Re: [stunnel-users] Certificate renaming
by Paul Jones 13 Jul '05

13 Jul '05

>"The easiest option is to use CAfile instead of CApath." So does the CA (Certificate Authority) certificate still go in the CAfile? That would mean the CAfile contains the CA certificate and all client certificates (on the server side), right? Cheers, Paul. _________________________________________________________________ REALESTATE: biggest buy/rent/share listings http://ninemsn.realestate.com.au

1 0

debugging stunnel
by edonald1＠rochester.rr.com 12 Jul '05

12 Jul '05

Been trying to debug stunnel issues for stunnel-4.09 on Solaris 2.8. When in trouble I resort to reading documentation. It is now that I notice these two small lines in the begining of the document called INSTALL: 1. If your machine supports POSIX threads make sure your SSL library is compiled with -DTHREADS. I did not do this .... ( verify openssl is compiled with -DTHREADS). WHat is the result of not compiling openssl with THREADS? Also what version of openssl is recommended. I am using OpenSSL 0.9.6m . Thanks in advance, Liz

2 1

Solaris 2.8 stunnel stop running
by edonald1＠rochester.rr.com 12 Jul '05

12 Jul '05

Running stunnel on Solaris 2.8. Stunnel running as client quits unexpectedly . here are the lines in the log: 2005.07.12 11:01:31 LOG7[5736:1]: mod_jk_secure accepted FD=2 from 127.0.0.1:57610 2005.07.12 11:01:31 LOG7[5736:1]: FD 2 in non-blocking mode 2005.07.12 11:02:28 LOG3[5736:4]: SSL_connect: Peer suddenly disconnected 2005.07.12 11:02:28 LOG7[5736:4]: linger (remote): Invalid argument (22) 2005.07.12 11:02:28 LOG7[5736:4]: mod_jk_secure finished (1 left) 2005.07.12 11:02:28 LOG7[5736:5]: mod_jk_secure started 2005.07.12 11:02:28 LOG7[5736:5]: TCP_NODELAY option set on local socket 2005.07.12 11:02:28 LOG5[5736:5]: mod_jk_secure connected from 127.0.0.1:57610 2005.07.12 11:02:28 LOG7[5736:5]: FD 0 in non-blocking mode 2005.07.12 11:02:28 LOG7[5736:5]: mod_jk_secure connecting 150.247.130.5:51001 2005.07.12 11:02:28 LOG7[5736:5]: connect_wait: waiting 10 seconds 2005.07.12 11:02:28 LOG7[5736:1]: mod_jk_secure accepted FD=1 from 127.0.0.1:57614 2005.07.12 11:02:28 LOG7[5736:1]: FD 1 in non-blocking mode 2005.07.12 11:02:29 LOG7[5736:6]: mod_jk_secure started 2005.07.12 11:02:29 LOG7[5736:6]: TCP_NODELAY option set on local socket 2005.07.12 11:02:29 LOG5[5736:6]: mod_jk_secure connected from 127.0.0.1:57614 2005.07.12 11:02:29 LOG7[5736:6]: FD 7 in non-blocking mode 2005.07.12 11:02:29 LOG7[5736:6]: mod_jk_secure connecting 150.247.130.5:51001 2005.07.12 11:02:29 LOG7[5736:6]: connect_wait: waiting 10 seconds 2005.07.12 11:02:29 LOG7[5736:5]: connect_wait: connected 2005.07.12 11:02:29 LOG7[5736:5]: Remote FD=0 initialized 2005.07.12 11:02:29 LOG7[5736:5]: TCP_NODELAY option set on remote socket 2005.07.12 11:02:29 LOG7[5736:5]: SSL state (connect): before/connect initialization 2005.07.12 11:02:29 LOG7[5736:5]: SSL state (connect): SSLv3 write client hello A 2005.07.12 11:02:29 LOG7[5736:6]: connect_wait: connected 2005.07.12 11:02:29 LOG7[5736:6]: Remote FD=7 initialized 2005.07.12 11:02:29 LOG7[5736:6]: TCP_NODELAY option set on remote socket 2005.07.12 11:02:29 LOG7[5736:6]: SSL state (connect): before/connect initialization 2005.07.12 11:02:29 LOG7[5736:6]: SSL state (connect): SSLv3 write client hello A All ideas welcome. I happen to know that the server side stunnel is down. SHouldn't the client side keep running under these circumstances? Thanks, Liz

1 0

stunnel 4.11 relaesed
by Michal Trojnara 12 Jul '05

12 Jul '05

Dear Users, Here is the ChangeLog entry: Version 4.11, 2005.07.09, urgency: MEDIUM: * New features - New ./configure option --with-threads to select thread model. - ./configure option --with-tcp-wrappers renamed to --disable-libwrap. I hope the meaning of the option is much more clear, now. * Bugfixes - Workaround for non-standard makecontext() uc_stack.ss_sp parameter semantics on Sparc/Solaris 9 and earlier. - scan_waiting_queue() no longer drops contexts. - Inetd mode coredumps with UCONTEXT fixed. - Cleanup context is no longer used. - Releasing memory of the current context is delayed. - Win32 headers reordered for Visual Studio 7. - Some Solaris compilation warnings fixed. - Rejected inetd mode without 'connect' or 'exec'. * Release notes - UCONTEXT threading seems stable, now. Upgrade is recommended. Home page, downloads: http://stunnel.mirt.net/ sha1sum for stunnel-4.11.tar.gz file: cf57169d591fbe3371a29e432d840e7f66103a9f Best regards, Mike

3 3

Stunnel-4.10 and Stunnel-4.11 in HPUX-11.23 IPF gives coredump
by Punitha 12 Jul '05

12 Jul '05

Hello All, I'm using HP-UX11.23 IPF. I have built Stunnel-4.11 with OpenSSL - 0.9.7e. I could build it successfully but I'm failed in connecting with telnet. After a while connecting to the telnet the client gets coredump and kills the process. So the connection is no more established. Note: I had the same problem in Stunnel-4.10 also but not before that. I could very well compile and use Stunnel-4.09. My configuration file for client is: cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem chroot = /opt/iexpress/stunnel/var/stunnel pid = setuid = root setgid = root CAfile = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem debug = 7 client = yes foreground = yes verify = 3 [test1] accept = 8080 connect = 9090 For server: cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem chroot = /opt/iexpress/stunnel/var/stunnel pid = setuid = root setgid = root CAfile = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem debug = 6 client = no foreground = yes verify = 1 [test1] accept = 9090 connect = 23 The client log shows as follows: # ../../sbin/stunnel stunnel-client.conf 2005.07.10 23:39:26 LOG5[8909:1]: stunnel 4.11 on ia64-hp-hpux11.23 UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 2005.07.10 23:39:26 LOG7[8909:1]: Snagged 64 random bytes from /dev/random 2005.07.10 23:39:26 LOG7[8909:1]: RAND_status claims sufficient entropy for the PRNG 2005.07.10 23:39:26 LOG6[8909:1]: PRNG seeded successfully 2005.07.10 23:39:26 LOG7[8909:1]: Certificate: /home/punitha/stunnel1/etc/stunnel/stunnel.pem 2005.07.10 23:39:26 LOG7[8909:1]: Key file: /home/punitha/stunnel1/etc/stunnel/stunnel.pem 2005.07.10 23:39:26 LOG7[8909:1]: Loaded verify certificates from /home/punitha/stunnel1/etc/stunnel/stunnel.pem 2005.07.10 23:39:26 LOG6[8909:1]: file ulimit = 2048 (can be changed with 'ulimit -n') 2005.07.10 23:39:26 LOG6[8909:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.07.10 23:39:26 LOG5[8909:1]: 1000 clients allowed 2005.07.10 23:39:26 LOG7[8909:1]: FD 3 in non-blocking mode 2005.07.10 23:39:26 LOG7[8909:1]: FD 4 in non-blocking mode 2005.07.10 23:39:26 LOG7[8909:1]: FD 5 in non-blocking mode 2005.07.10 23:39:26 LOG7[8909:1]: SO_REUSEADDR option set on accept socket 2005.07.10 23:39:26 LOG7[8909:1]: test1 bound to 0.0.0.0:8080 2005.07.10 23:39:26 LOG7[8909:1]: No pid file being created 2005.07.10 23:40:08 LOG7[8909:1]: test1 accepted FD=8 from 127.0.0.1:49700 2005.07.10 23:40:08 LOG7[8909:1]: Creating a new context 2005.07.10 23:40:08 LOG7[8909:1]: Context 2 created 2005.07.10 23:40:08 LOG7[8909:2]: Context swap: 1 -> 2 Memory fault(coredump) # It will be helpful if anyone of you guide me in this. Thanx In Advance. Regards, Punitha, V.

2 3

Re: [stunnel-users] Poll/Descriptor Problem
by Andrew Gay 11 Jul '05

11 Jul '05

Hi I get the same/similar error messages using Stunnel 4.10 (client) on Solaris 9 (sparc). I also see some very large integer numbers (e.g. FD=2615261238) in the log which art file descriptors. Perhaps there is an issue with big/little endedness in the later Stunnel releases. I went back to using Stunnel 4.07 and the problems went away. Andrew Gay > > I am running Stunnel 4.09 on Mac OS X 10.4 to provide HTTPS service on > the standard ports (accept on 443, connect to 80). > > All connections are either truncated or dropped entirely, with the > following messages written to the log: > > ------------------------------------------ > https connected from ... > INTERNAL ERROR:s_poll_wait returned 1, but no descriptor is ready > Connection reset: XXXXXX bytes sent to SSL, XXX bytes sent to socket > ------------------------------------------ > > I've tried 4.10, but the result is exactly the same. > > Does anybody have any thoughts on what might be going on? > > Thanks, > John >

2 1

Poll/Descriptor Problem
by John O'Fallon 08 Jul '05

08 Jul '05

I am running Stunnel 4.09 on Mac OS X 10.4 to provide HTTPS service on the standard ports (accept on 443, connect to 80). All connections are either truncated or dropped entirely, with the following messages written to the log: ------------------------------------------ https connected from ... INTERNAL ERROR:s_poll_wait returned 1, but no descriptor is ready Connection reset: XXXXXX bytes sent to SSL, XXX bytes sent to socket ------------------------------------------ I've tried 4.10, but the result is exactly the same. Does anybody have any thoughts on what might be going on? Thanks, John

1 0

Re: [stunnel-users] Certificate renaming
by Paul Jones 07 Jul '05

07 Jul '05

>From the discussion here, I got the impression that it is still possible for Stunnel to run correctly and successful connections to be made if the certificate files are NOT renamed using the xxxxx.0 format, where xxxxx is the hash value of the certificate. So I simply placed the .crt files for all clients on the server (under the directory specified in the CApath field in the CONF file). Now, I've tried, tried, and tried, but it still doesn't work. I get a "bad certificate" error when attempting to connect from the client. Am I missing something? Note: I am running Stunnel on Win2K. Cheers. Paul _________________________________________________________________ Single? Start dating at Lavalife. Try our 7 day FREE trial! http://lavalife9.ninemsn.com.au/clickthru/clickthru.act?context=an99&locale…

1 0

Re: [stunnel-users] Stunnel for pop3 on solaris 2.6 (more info)
by Douglas Phillipson 06 Jul '05

06 Jul '05

Should I have "protocol = pop3" in my config file? When I do, I get this from the stunnel log: 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 1, FD=6, (IN)->() 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 2, FD=0, (IN)->(IN) 2005.07.06 12:46:54 LOG7[18045:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 1, FD=4, (IN)->() 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 1, FD=6, (IN)->() 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 2, FD=0, (IN)->(IN) 2005.07.06 12:46:54 LOG7[18045:2]: <- .g.. 2005.07.06 12:46:54 LOG3[18045:2]: Client does not want TLS 2005.07.06 12:46:54 LOG5[18045:2]: Protocol negotiation failed 2005.07.06 12:46:54 LOG3[18045:2]: Protocol negotiations failed 2005.07.06 12:46:54 LOG7[18045:2]: pop3s finished (0 left) 2005.07.06 12:46:54 LOG7[18045:2]: Context 2 closed 2005.07.06 12:46:54 LOG7[18045:0]: Waiting -1 second(s) for 2 file descriptor(s) Doug P Douglas Phillipson wrote: > I'm not sure it it applies but if I do: > > openssl s_client -connect 172.20.12.59:995 > > I get the following error: > > CONNECTED(00000003) > 17964:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226: > > > Doug P > > > Douglas Phillipson wrote: > >> I have a Solaris 2.6 box and am trying to get pop3 over SSL running. I use: >> >> qpopper 4.0.5 >> openssl-0.9.7g >> stunnel 4.10 compiled with gcc 2.95.3 >> >> When I compiled stunnel it made a private ket and certificate in /usr/local/etc/stunnel/stunnel.pem. >> >> Do I need anything else? >> >> I have the following configuration: >> >> Inetd.conf: >> >> pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S -t /poplog >> >> stunnel.conf: >> >> cert = /usr/local/etc/stunnel/stunnel.pem >> key = /usr/local/etc/stunnel/stunnel.pem >> debug = 7 >> output = /stunnel.log >> pid = /stunnel.pid >> client = yes >> >> [pop3s] >> accept = 995 >> connect = 110 >> >> I run stunnel and get the following output: >> >> 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 >> 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd >> 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd >> 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy for the PRNG >> 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully >> 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem >> 2005.07.06 11:34:18 LOG7[17873:1]: Key file: /usr/local/etc/stunnel/stunnel.pem >> 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 'ulimit -n') >> 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for file descriptors >> 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed >> 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode >> 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode >> 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode >> 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket >> 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995 >> 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid >> 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file descriptor(s) >> >> >> I connect via pop3 in thunderbird with ssl and qpopper always says: >> (null) at localhost (127.0.0.1): -ERR Unknown command: "". >> (nulI/O error flushing output to client at localhost [127.0.0.1]: Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error >> >> Stunnel says: >> >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN) >> 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 172.20.10.7:45464 >> 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context >> 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created >> 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started >> 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode >> 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket >> 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464 >> 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode >> 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110 >> 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized >> 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket >> 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect initialization >> 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write client hello A >> 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file descriptor(s) >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->() >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN) >> >> The mail never gets delivered to either Thunderbird or outlook express. >> I get a certificate approval request from Thunderbird to which I grant, then nothing. If I disable ssl in thunderbird the mail gets accepted normally. >> >> What might I be doing wrong??? >> >> Thanks >> >> Doug P

1 0

Re: [stunnel-users] Stunnel for pop3 on solaris 2.6 ( Even more info)
by Douglas Phillipson 06 Jul '05

06 Jul '05

If I set "client = no" in stunnels config file I get the following from: openssl s_client -connect 172.20.12.59:995 CONNECTED(00000003) depth=0 /C=US/ST=Nevada/L=Las Vegas/O=Bechtel/OU=RSL/CN=test1 verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=Nevada/L=Las Vegas/O=Bechtel/OU=RSL/CN=test1 verify return:1 30463:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226: Is a "self signed" Cert OK? I didn't sign anything though. Compiling stunnel created a cert. Installing openssl I think created a cert. Do these need to match somehow? If so how do you do that? I think I'm lost here... Regards Doug P Douglas Phillipson wrote: > I have a Solaris 2.6 box and am trying to get pop3 over SSL running. I use: > > qpopper 4.0.5 > openssl-0.9.7g > stunnel 4.10 compiled with gcc 2.95.3 > > When I compiled stunnel it made a private ket and certificate in /usr/local/etc/stunnel/stunnel.pem. > > Do I need anything else? > > I have the following configuration: > > Inetd.conf: > > pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S -t /poplog > > stunnel.conf: > > cert = /usr/local/etc/stunnel/stunnel.pem > key = /usr/local/etc/stunnel/stunnel.pem > debug = 7 > output = /stunnel.log > pid = /stunnel.pid > client = yes > > [pop3s] > accept = 995 > connect = 110 > > I run stunnel and get the following output: > > 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 > 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd > 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd > 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy for the PRNG > 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully > 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem > 2005.07.06 11:34:18 LOG7[17873:1]: Key file: /usr/local/etc/stunnel/stunnel.pem > 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 'ulimit -n') > 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for file descriptors > 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed > 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode > 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode > 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode > 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket > 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995 > 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid > 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file descriptor(s) > > > I connect via pop3 in thunderbird with ssl and qpopper always says: > (null) at localhost (127.0.0.1): -ERR Unknown command: "". > (nulI/O error flushing output to client at localhost [127.0.0.1]: Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error > > Stunnel says: > > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN) > 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 172.20.10.7:45464 > 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context > 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created > 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started > 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode > 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket > 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464 > 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode > 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110 > 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized > 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket > 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect initialization > 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write client hello A > 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file descriptor(s) > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->() > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN) > > The mail never gets delivered to either Thunderbird or outlook express. > I get a certificate approval request from Thunderbird to which I grant, then nothing. If I disable ssl in thunderbird the mail gets accepted normally. > > What might I be doing wrong??? > > Thanks > > Doug P > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Stunnel for pop3 on solaris 2.6
by Douglas Phillipson 06 Jul '05

06 Jul '05

I have a Solaris 2.6 box and am trying to get pop3 over SSL running. I use: qpopper 4.0.5 openssl-0.9.7g stunnel 4.10 compiled with gcc 2.95.3 When I compiled stunnel it made a private ket and certificate in /usr/local/etc/stunnel/stunnel.pem. Do I need anything else? I have the following configuration: Inetd.conf: pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S -t /poplog stunnel.conf: cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem debug = 7 output = /stunnel.log pid = /stunnel.pid client = yes [pop3s] accept = 995 connect = 110 I run stunnel and get the following output: 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy for the PRNG 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.07.06 11:34:18 LOG7[17873:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 'ulimit -n') 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file descriptor(s) I connect via pop3 in thunderbird with ssl and qpopper always says: (null) at localhost (127.0.0.1): -ERR Unknown command: "". (nulI/O error flushing output to client at localhost [127.0.0.1]: Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error Stunnel says: 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 172.20.10.7:45464 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect initialization 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write client hello A 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->() 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN) The mail never gets delivered to either Thunderbird or outlook express. I get a certificate approval request from Thunderbird to which I grant, then nothing. If I disable ssl in thunderbird the mail gets accepted normally. What might I be doing wrong??? Thanks Doug P

1 4

Certificate renaming
by Paul Jones 05 Jul '05

05 Jul '05

So what you are saying is that Stunnel will still work successfully and find the correct certificates if I do NOT name the certificate files using their hash values? And since my server will only have a maximum of 16 clients, finding the correct certificate shouldn't cause too many speed issues. Right? Cheers. Paul _________________________________________________________________ Sell your car for $9 on carpoint.com.au http://www.carpoint.com.au/sellyourcar

1 0

Certificate renaming
by Paul Jones 04 Jul '05

04 Jul '05

Hi all, I understand that in order for Stunnel to find a certificate, it has to be renamed to something like xxxxxx.0 (where xxxxxx is obtained by using the "openssl x509" command on the certificate). Why is this the case? I read somewhere that this helps Stunnel find the certificate quicker (i.e. Stunnel does not need to look at every certificate file before it knows which one it wants). Can someone provide me a better explanation please? Is there any way around this? Renaming the certificate file in such a manner causes confusion when searching for the certificate of a particular client... Cheers. Paul _________________________________________________________________ REALESTATE: biggest buy/rent/share listings http://ninemsn.realestate.com.au

4 4

AW: [stunnel-users] Reporting problems
by Smith, Derek John 01 Jul '05

01 Jul '05

Hi all, sorry to have to use the list for this, but it would appear to be the last option available. This is from a previous posting from Brian Hatch ... > As the maintenance man of the 3.x branch (yes, some folks do > use it still) > the official stance is this: > > * if it's a security bug, I'll patch it. > * if it's a bug and you have a patch that works, I'll probably > apply it > * if it's a bug and you don't have a patch, I probably don't > have the cycles to investigate it, sorry. > However, the reality is different. Yes, some people still do use release 3. I have customers who prefer proven stability over new innovation. This is meant to be understood in a general way (i.e. database upgrades, OS updates etc) and not specifically to stunnel. I have mailed Brian several times about problems concerning release 3.26 and not a single reply has been received. Maybe the mails never arrived, but I doubt it very much. Also, no changes have been made to the software, so the supplied patch never got applied. In the complete absence of any proof to the contrary, I can only assume that the following statement holds:- RELEASE 3 IS DEAD !!!!!!!!!! I welcome evidence refuting this, but won't hold my breath. In the meantime, testing will start on release 4. Brian, if you're reading this, I'm not trying to start a flame war, or dissing you. A simple mail would have sufficed ... Derek

2 1

4.10 Crashes with Multiple Connections
by Eddie Atherton 30 Jun '05

30 Jun '05

Hi. Just started to use stunnel for NNTP traffic to Giga on a gateway Linux 2.4 box that sits between Windows and my cable modem. The NewsReader I use is configured to open 4 connections at the same time. Downloaded and installed 4.10, then immediately hit the -lpthread problem. Edited the Makefile, did a "make clean", "make", and "make install". Tried again. Got an immediate crash. Tried a few more times. Sometimes it crashed, other times the NewsReader reported one connection as working, one as connected, but not pulling any data, and two connections as connecting. So, it looks like everything works with only one active connection, but it segfaults when 2 or more threads are pulling data. The problem is, I can't always get it to crash. Plus, cpu use of stunnel sometimes pegs at 99%, even after closing the connections, and again this isn't consistent. When I turn debug on, it has always only used one active connection, so I don't get the crash. Plus, when debug is on, and I terminate the connections from the NewsReader, the log file expanded to 18meg in less than a minute. I then downloaded and installed 4.9, and this appears to handle the 4 active connections without any problems. Any suggestions as to what kind of information I should try and collect for this. Cheers, Eddie

1 0

SSL_read returned WANT_ - retry
by Leach, Rich 30 Jun '05

30 Jun '05

Greetings all- I'm an internet developer (mainly ColdFusion, some Windows, database stuff, etc.) and I've just inherited a Windows system that is utilizing Stunnel (I believe it's version 3.4) and in the log files I'm seeing this error all over the place: "SSL_read returned WANT_ - retry" It's usually listed around other messages in the log file such as "socket closed", "connection closed", etc. I noticed these messages in our logs because I got a call to restart our web services; everything froze up and the site would not come up. I stopped and started the web services and everything came back up. For a long time everyone around here has been blaming our ColdFusion server (version 6.1) but it looks to me like the Stunnel is throwing a wrench and halting everything - does anyone know what these errors mean or could you direct me to a place on the stunnel site that could offer some insight? I tried looking around the FAQ section but didn't see my error listed. Any help or input you could provide would be most appreciated! Many thanks in advance, Rich

1 0

win32 help
by chris rheinherren 28 Jun '05

28 Jun '05

I am running a win32 based IRC server and I wanted to add SSL to it. I have stunnel up and running. I have the necessary dlls installed. And I have found various help pages on creating the config file. And lastly my irc client is capable of connecting to SSL based servers. so here is my config file: <---- beging ------> RNDfile = C:\stunnel-prnd.txt RNDoverwrite = yes debug = 7 output = C:\stunnel.log [irc] accept = 66.98.154.87:994 connect = 127.0.0.1:994 <---- ending -----> And here is the log outup to help figure out what is wrong as well. <---- log -----> 2005.06.27 21:38:46 LOG5[2364:4084]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7c 30 Sep 2003 2005.06.27 21:38:46 LOG7[2364:3120]: RAND_status claims sufficient entropy for the PRNG 2005.06.27 21:38:46 LOG6[2364:3120]: PRNG seeded successfully 2005.06.27 21:38:46 LOG7[2364:3120]: Certificate: stunnel.pem 2005.06.27 21:38:46 LOG7[2364:3120]: Key file: stunnel.pem 2005.06.27 21:38:46 LOG5[2364:3120]: WIN32 platform: 30000 clients allowed 2005.06.27 21:38:46 LOG7[2364:3120]: FD 132 in non-blocking mode 2005.06.27 21:38:46 LOG7[2364:3120]: SO_REUSEADDR option set on accept socket 2005.06.27 21:38:46 LOG7[2364:3120]: irc bound to 66.98.154.87:994 2005.06.27 21:39:43 LOG7[2364:3120]: irc accepted FD=144 from 12.216.55.121:1583 2005.06.27 21:39:43 LOG7[2364:3120]: FD 144 in non-blocking mode 2005.06.27 21:39:43 LOG7[2364:396]: irc started 2005.06.27 21:39:43 LOG5[2364:396]: irc connected from 12.216.55.121:1583 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): before/accept initialization 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: FD=144, DIR=read 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: ok 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 flush data 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: FD=144, DIR=read 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: ok 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 flush data 2005.06.27 21:39:43 LOG7[2364:396]: 1 items in the session cache 2005.06.27 21:39:43 LOG7[2364:396]: 0 client connects (SSL_connect()) 2005.06.27 21:39:43 LOG7[2364:396]: 0 client connects that finished 2005.06.27 21:39:43 LOG7[2364:396]: 0 client renegotiatations requested 2005.06.27 21:39:43 LOG7[2364:396]: 1 server connects (SSL_accept()) 2005.06.27 21:39:43 LOG7[2364:396]: 1 server connects that finished 2005.06.27 21:39:43 LOG7[2364:396]: 0 server renegotiatiations requested 2005.06.27 21:39:43 LOG7[2364:396]: 0 session cache hits 2005.06.27 21:39:43 LOG7[2364:396]: 0 session cache misses 2005.06.27 21:39:43 LOG7[2364:396]: 0 session cache timeouts 2005.06.27 21:39:43 LOG6[2364:396]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:39:43 LOG7[2364:396]: FD 164 in non-blocking mode 2005.06.27 21:39:43 LOG7[2364:396]: irc connecting 127.0.0.1:994 2005.06.27 21:39:43 LOG7[2364:396]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: FD=164, DIR=write 2005.06.27 21:44:43 LOG7[2364:396]: waitforsocket: timeout 2005.06.27 21:44:43 LOG3[2364:396]: Failed to initialize remote connection 2005.06.27 21:44:43 LOG7[2364:396]: irc finished (0 left) 2005.06.27 21:44:47 LOG7[2364:3120]: irc accepted FD=180 from 12.216.55.121:1639 2005.06.27 21:44:47 LOG7[2364:3120]: FD 180 in non-blocking mode 2005.06.27 21:44:47 LOG7[2364:768]: irc started 2005.06.27 21:44:47 LOG5[2364:768]: irc connected from 12.216.55.121:1639 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): before/accept initialization 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: FD=180, DIR=read 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: ok 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 flush data 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: FD=180, DIR=read 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: ok 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 flush data 2005.06.27 21:44:47 LOG7[2364:768]: 2 items in the session cache 2005.06.27 21:44:47 LOG7[2364:768]: 0 client connects (SSL_connect()) 2005.06.27 21:44:47 LOG7[2364:768]: 0 client connects that finished 2005.06.27 21:44:47 LOG7[2364:768]: 0 client renegotiatations requested 2005.06.27 21:44:47 LOG7[2364:768]: 2 server connects (SSL_accept()) 2005.06.27 21:44:47 LOG7[2364:768]: 2 server connects that finished 2005.06.27 21:44:47 LOG7[2364:768]: 0 server renegotiatiations requested 2005.06.27 21:44:47 LOG7[2364:768]: 0 session cache hits 2005.06.27 21:44:47 LOG7[2364:768]: 0 session cache misses 2005.06.27 21:44:47 LOG7[2364:768]: 0 session cache timeouts 2005.06.27 21:44:47 LOG6[2364:768]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:44:47 LOG7[2364:768]: FD 148 in non-blocking mode 2005.06.27 21:44:47 LOG7[2364:768]: irc connecting 127.0.0.1:994 2005.06.27 21:44:47 LOG7[2364:768]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: FD=148, DIR=write 2005.06.27 21:49:47 LOG7[2364:768]: waitforsocket: timeout 2005.06.27 21:49:47 LOG3[2364:768]: Failed to initialize remote connection 2005.06.27 21:49:47 LOG7[2364:768]: irc finished (0 left) 2005.06.27 21:49:51 LOG7[2364:3120]: irc accepted FD=168 from 12.216.55.121:1689 2005.06.27 21:49:51 LOG7[2364:3120]: FD 168 in non-blocking mode 2005.06.27 21:49:51 LOG7[2364:2508]: irc started 2005.06.27 21:49:51 LOG5[2364:2508]: irc connected from 12.216.55.121:1689 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): before/accept initialization 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: FD=168, DIR=read 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: ok 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 flush data 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: FD=168, DIR=read 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: ok 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 flush data 2005.06.27 21:49:51 LOG7[2364:2508]: 3 items in the session cache 2005.06.27 21:49:51 LOG7[2364:2508]: 0 client connects (SSL_connect()) 2005.06.27 21:49:51 LOG7[2364:2508]: 0 client connects that finished 2005.06.27 21:49:51 LOG7[2364:2508]: 0 client renegotiatations requested 2005.06.27 21:49:51 LOG7[2364:2508]: 3 server connects (SSL_accept()) 2005.06.27 21:49:51 LOG7[2364:2508]: 3 server connects that finished 2005.06.27 21:49:51 LOG7[2364:2508]: 0 server renegotiatiations requested 2005.06.27 21:49:51 LOG7[2364:2508]: 0 session cache hits 2005.06.27 21:49:51 LOG7[2364:2508]: 0 session cache misses 2005.06.27 21:49:51 LOG7[2364:2508]: 0 session cache timeouts 2005.06.27 21:49:51 LOG6[2364:2508]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:49:51 LOG7[2364:2508]: FD 156 in non-blocking mode 2005.06.27 21:49:51 LOG7[2364:2508]: irc connecting 127.0.0.1:994 2005.06.27 21:49:51 LOG7[2364:2508]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: FD=156, DIR=write 2005.06.27 21:54:51 LOG7[2364:2508]: waitforsocket: timeout 2005.06.27 21:54:51 LOG3[2364:2508]: Failed to initialize remote connection 2005.06.27 21:54:51 LOG7[2364:2508]: irc finished (0 left) 2005.06.27 21:54:55 LOG7[2364:3120]: irc accepted FD=164 from 12.216.55.121:1747 2005.06.27 21:54:55 LOG7[2364:3120]: FD 164 in non-blocking mode 2005.06.27 21:54:55 LOG7[2364:460]: irc started 2005.06.27 21:54:55 LOG5[2364:460]: irc connected from 12.216.55.121:1747 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): before/accept initialization 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 flush data 2005.06.27 21:54:55 LOG7[2364:460]: waitforsocket: FD=164, DIR=read 2005.06.27 21:54:55 LOG7[2364:460]: waitforsocket: ok 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 flush data 2005.06.27 21:54:55 LOG7[2364:460]: 4 items in the session cache 2005.06.27 21:54:55 LOG7[2364:460]: 0 client connects (SSL_connect()) 2005.06.27 21:54:55 LOG7[2364:460]: 0 client connects that finished 2005.06.27 21:54:55 LOG7[2364:460]: 0 client renegotiatations requested 2005.06.27 21:54:55 LOG7[2364:460]: 4 server connects (SSL_accept()) 2005.06.27 21:54:55 LOG7[2364:460]: 4 server connects that finished 2005.06.27 21:54:55 LOG7[2364:460]: 0 server renegotiatiations requested 2005.06.27 21:54:55 LOG7[2364:460]: 0 session cache hits 2005.06.27 21:54:55 LOG7[2364:460]: 0 session cache misses 2005.06.27 21:54:55 LOG7[2364:460]: 0 session cache timeouts 2005.06.27 21:54:55 LOG6[2364:460]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:54:55 LOG7[2364:460]: FD 144 in non-blocking mode 2005.06.27 21:54:55 LOG7[2364:460]: irc connecting 127.0.0.1:994 2005.06.27 21:54:55 LOG7[2364:460]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:54:55 LOG7[2364:460]: waitforsocket: FD=144, DIR=write 2005.06.27 21:59:55 LOG7[2364:460]: waitforsocket: timeout 2005.06.27 21:59:55 LOG3[2364:460]: Failed to initialize remote connection 2005.06.27 21:59:55 LOG7[2364:460]: irc finished (0 left) 2005.06.27 21:59:59 LOG7[2364:3120]: irc accepted FD=148 from 12.216.55.121:1813 2005.06.27 21:59:59 LOG7[2364:3120]: FD 148 in non-blocking mode 2005.06.27 21:59:59 LOG7[2364:2240]: irc started 2005.06.27 21:59:59 LOG5[2364:2240]: irc connected from 12.216.55.121:1813 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): before/accept initialization 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: FD=148, DIR=read 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: ok 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 flush data 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: FD=148, DIR=read 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: ok 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 flush data 2005.06.27 21:59:59 LOG7[2364:2240]: 5 items in the session cache 2005.06.27 21:59:59 LOG7[2364:2240]: 0 client connects (SSL_connect()) 2005.06.27 21:59:59 LOG7[2364:2240]: 0 client connects that finished 2005.06.27 21:59:59 LOG7[2364:2240]: 0 client renegotiatations requested 2005.06.27 21:59:59 LOG7[2364:2240]: 5 server connects (SSL_accept()) 2005.06.27 21:59:59 LOG7[2364:2240]: 5 server connects that finished 2005.06.27 21:59:59 LOG7[2364:2240]: 0 server renegotiatiations requested 2005.06.27 21:59:59 LOG7[2364:2240]: 0 session cache hits 2005.06.27 21:59:59 LOG7[2364:2240]: 0 session cache misses 2005.06.27 21:59:59 LOG7[2364:2240]: 0 session cache timeouts 2005.06.27 21:59:59 LOG6[2364:2240]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:59:59 LOG7[2364:2240]: FD 180 in non-blocking mode 2005.06.27 21:59:59 LOG7[2364:2240]: irc connecting 127.0.0.1:994 2005.06.27 21:59:59 LOG7[2364:2240]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: FD=180, DIR=write <--- end log -----> Any help that gets this working would be great. Thanks

2 1

Re: [stunnel-users] Transparent client IP on Windows
by Michal Trojnara 28 Jun '05

28 Jun '05

"Paul Jones" <jonesy_boy10(a)hotmail.com> wrote: > Apparently this can be enabled on Linux with the -T argument. Does anyone > know if (and how) this is somehow possible on Windows? Implementing a transparent proxy on Windows (Winsock) requires a process to globaly intercept Winsock API function. It's a lame, MSDOS-like solution that I'm not going to support. Best regards, Mike

1 0

Transparent client IP on Windows
by Paul Jones 28 Jun '05

28 Jun '05

Hi all, I've read (and tested for myself) on a few sites that Stunnel does not transparently pass the IP of the connecting client to the server app. My server app thinks all connecting clients are coming from IP 127.0.01. Apparently this can be enabled on Linux with the -T argument. Does anyone know if (and how) this is somehow possible on Windows? Cheers. Paul _________________________________________________________________ REALESTATE: biggest buy/rent/share listings http://ninemsn.realestate.com.au

1 0

Stunnel 4.09 exits unexpected on solaris 2.8
by edonald1＠rochester.rr.com 27 Jun '05

27 Jun '05

Hi, I am running the following version of Stunnel: ./stunnel -version stunnel 4.09 on sparc-sun-solaris2.8 PTHREAD+POLL+IPv4 with OpenSSL 0.9.6m 17 Mar 2004 Global options cert = /apps/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH debug = 5 key = /apps/stunnel/etc/stunnel/stunnel.pem pid = /apps/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds It is compiled with pthreads and without TCPwrappers. I am using it to tunnel a mod_jk connection between apache and tomcat. It works perfectly in my Development and QA environment ( runs for weeks on end). When I moved it to production it started not to work so well. Stunnel would mysterious stop working on the server side (procesd disappears). There are no errors in the log whatsoever and the log level is set at 7. One difference in my production environment is that there are multiple clients (apache) and one server (tomcat). All Thoughts are welcome. Thank You

1 0

Errors sending email thru gmail's smtp server
by Melinda Chin 27 Jun '05

27 Jun '05

Hi, I have written an email client application to send/receive email. However, gmail accounts requires that email clients use SSL. In order to do this, I am running stunnel in the background. I am able to retrieve emails from gmail pop3 server, but I am not able To send email thru gmail smtp server. Gmail requires that email clients Support SMTP authentication, and also requires TLS. I am receiving the following errors in stunnel.log when trying to send email from gmail accounts. Attached is my stunnel.conf file. Is there something I am missing to cause these errors ? Does stunnel support SMTP authentication ? - Melinda 2005.06.27 11:26:17 LOG7[25398:81923]: <- 220 2.0.0 Ready to start TLS. 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): before/connect initialization 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write client hello A 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: FD=13, DIR=read 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: ok 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read server hello A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read server certificate A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read server done A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write client key exchange A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write change cipher spec A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write finished A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 flush data 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: FD=13, DIR=read 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: ok 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read finished A 2005.06.27 11:26:17 LOG7[25398:81923]: 5 items in the session cache 2005.06.27 11:26:17 LOG7[25398:81923]: 5 client connects (SSL_connect()) 2005.06.27 11:26:17 LOG7[25398:81923]: 5 client connects that finished 2005.06.27 11:26:17 LOG7[25398:81923]: 0 client renegotiatations requested 2005.06.27 11:26:17 LOG7[25398:81923]: 0 server connects (SSL_accept()) 2005.06.27 11:26:17 LOG7[25398:81923]: 0 server connects that finished 2005.06.27 11:26:17 LOG7[25398:81923]: 0 server renegotiatiations requested 2005.06.27 11:26:17 LOG7[25398:81923]: 0 session cache hits 2005.06.27 11:26:17 LOG7[25398:81923]: 0 session cache misses 2005.06.27 11:26:17 LOG7[25398:81923]: 0 session cache timeouts 2005.06.27 11:26:17 LOG6[25398:81923]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.06.27 11:26:18 LOG7[25398:81923]: Socket closed on read 2005.06.27 11:26:18 LOG7[25398:81923]: SSL alert (write): warning: close notify 2005.06.27 11:26:18 LOG7[25398:81923]: SSL write shutdown (output buffer empty) 2005.06.27 11:26:19 LOG7[25398:81923]: SSL socket closed on SSL_read 2005.06.27 11:26:19 LOG5[25398:81923]: Connection closed: 59 bytes sent to SSL, 165 bytes sent to socket 2005.06.27 11:26:19 LOG7[25398:81923]: ssmtp finished (1 left)

1 0

Passphrase validation
by Peter Pentes 27 Jun '05

27 Jun '05

Hi, As I understand it, Stunnel does not currently support the validation of certificate passphrases. For example, to make a connection from the client to the server, no passphrase is requested when a certificate is selected. Are there any plans for this feature to be added to Stunnel? Regards, PP __________________________________ Do you Yahoo!? Make Yahoo! your home page http://www.yahoo.com/r/hs

3 5

Have extra bandwidth. does stunnel need a mirror?
by christopher＠baus.net 27 Jun '05

27 Jun '05

I have extra bandwidth. Does stunnel need a mirror? I'm using stunnel exclusively for my SSL needs. I works great, and I just want to give back. Christopher Baus

3 4

Re: [stunnel-users] Passphrase validation
by Paul Jones 27 Jun '05

27 Jun '05

That's all well and good for a Unix environment, but what about on Windows? No chown or chmod on there! I believe that it is sometimes useful for the passphrase to be requested by Stunnel on startup (on the client side), but you all make valid points. Paul. --- Vasil Dimov <vd(a)datamax.bg> wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >On Wed, Jun 22, 2005 at 04:30:56PM -0700, Joseph >Mocker wrote: > > > It depends on how the machine were broken. >Presumably if you > > were that hell-bent on using passprhases on >private keys, you'd > > likely isolate stunnel to run as an unpriviledged >user in a chrooted >That is a good idea anyway :) > > > environment, and you may very well set the >coredump size to zero > > and remove a debugger all together. So unless the >user was able > > to break root, the effects of the break-in might >be minimized. > >Private key stealing table: >* the key and the plain text file, holding the >password (if any) > should always be chown root and chmod 400 >* stunnel is the (unprivileged) user stunnel is >running as >* we assume that stunnel is running at the time of >breakage, because > this is the worst case. > > key storage \ break as root stunnel other user >- >--------------------------------------------------------------------------- >1. unencrypted key YES YES NO > >2. crypted key/password in text file YES YES NO > >3. crypted key/password entered at startup YES YES NO >- >--------------------------------------------------------------------------- > >As we see there is no difference if the private key >will be kept >crypted or unencrypted with or without text file >holding the passphrase. > >What happens if the stunnel daemon is not running >during the breakage? >Note that this is an optimistic suggestion and we >should not rely on it. > > key storage \ break as root stunnel other user >- >--------------------------------------------------------------------------- >1. unencrypted key YES NO NO > >2. crypted key/password in text file YES NO NO > >3. crypted key/password entered at startup NO > NO NO >- >--------------------------------------------------------------------------- > >So the only difference in all cases is if stunnel is >not running and the >hacker gets root on the machine and the key is >crypted and the password >is entered at startup - then it will not be possible >to steal the >private key. > >As a conclusion, it is obviously - that there is >really no sense to >keep the password in a text file and it makes a >LITTLE sense if the >password is entered at startup - in just one, rare, >case this setup >will save the private key. > >-----BEGIN PGP SIGNATURE----- > >iD8DBQFCunHRFw6SP/bBpCARAtN4AJ0TBfANXVyyLNKojIaFzb1E/7WBqQCeIcop >rAqsbhJmK9oBYg/Rb9iJzSE= >=rFAJ >-----END PGP SIGNATURE----- >_______________________________________________ >stunnel-users mailing list >stunnel-users(a)mirt.net >http://stunnel.mirt.net/mailman/listinfo/stunnel-users > _________________________________________________________________ Sell your car for $9 on carpoint.com.au http://www.carpoint.com.au/sellyourcar

2 2

4.10 runtime crash (alignment error?) in Solaris 7
by Old Wolf 24 Jun '05

24 Jun '05

When I run stunnel 4.10 with openssl 0.9.8 beta4 in Solaris 7, it crashes just after a connection is established. Nothing appears in the stunnel log. If I run it in foreground mode, "Bus Error" appears on the console. Running with 'truss -f', I see the output that follows. Gdb reveals nothing (it's not compiled for debug and I"m not sure how to change that). so_socket(2, 2, 0, "", 1) = 9 fcntl(9, F_GETFL, 0x00000000) = 2 fstat64(9, 0x001686B8) = 0 getsockopt(9, 65535, 8192, 0x001687B8, 0x001687B0, 0) = 0 fstat64(9, 0x001686B8) = 0 getsockopt(9, 65535, 8192, 0x001687B8, 0x001687B4, 0) = 0 setsockopt(9, 65535, 8192, 0x001687B8, 4, 0) = 0 fcntl(9, F_SETFL, 0x00000082) = 0 time() = 1118632479 getpid() = 25472 [25471] write(3, " 2 0 0 5 . 0 6 . 1 3 1".., 61) = 61 time() = 1118632479 getpid() = 25472 [25471] write(3, " 2 0 0 5 . 0 6 . 1 3 1".., 78) = 78 connect(9, 0x00168998, 16, 1) = 0 time() = 1118632479 getpid() = 25472 [25471] write(3, " 2 0 0 5 . 0 6 . 1 3 1".., 59) = 59 Incurred fault #5, FLTACCESS %pc = 0x00031720 siginfo: SIGBUS BUS_ADRALN addr=0x0002CDE9 Received signal #10, SIGBUS [default] siginfo: SIGBUS BUS_ADRALN addr=0x0002CDE9 *** process killed *** The stunnel options are: stunnel 4.10 on sparc-sun-solaris2.7 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.8-beta4 06 Jun 2005 Global options cert = /u/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /u/etc/stunnel/stunnel.pem pid = /u/var/run/stunnel.pid RNDbytes = 64 RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Also, I had some warnings errors during compilation , which should be fixed (compiling with gcc 3.4.1 in pedantic mode). (None of them are the cause of the crash though, as I hacked up some fixes and the crash still happened). log.c: In function `s_log': log.c:134: warning: implicit declaration of function `localtime_r' log.c:134: warning: assignment makes pointer from integer without a cast The culprit here is that config.h defines HAVE_LOCALTIME_R, but when the system header with that function is included, the #defines are set up so that localtime_r is NOT defined. (I guess this is an autoconf problem). The code links successfully but I'm not sure how reliable it will be, since localtime_r was not declared properly. options.c and network: there were many uses of isspace() with a (signed) char value, this is incorrect (isspace requires an unsigned char value -- it could fail if it gets a negative number). However many C libraries (eg. glibc) work with negative values anyway, although I have used compilers that don't. resolver.c has some cases of potential alignment errors, but I guess they aren't a problem in this case.

1 0

Compile stunnel 4.10 using VC7(aka Visual Studio 2003)
by Han Jun Li 23 Jun '05

23 Jun '05

Stunnel 4.10 does not compile with Visual Studio 7. After spending the past few days to get it to compile, I thought someone might find this useful. There is a change to the common.h that you need to hack. Basically, you need to include <winsock2.h> and <ws2tcpip.h> before <windows.h> to make it compile without any warning. The content of the make file(stunnel.mak) is below: !IF "$(CFG)" == "" CFG=stunnel - Release !MESSAGE No configuration specified. Defaulting to "stunnel - Release" !ENDIF !IF "$(CFG)" != "stunnel - Release" !MESSAGE Invalid configuration "$(CFG)" specified. !MESSAGE You can specify a configuration when running NMAKE !MESSAGE by defining the macro CFG on the command line. For example: !MESSAGE !MESSAGE NMAKE /f "stunnel.mak" CFG="stunnel - Release" !MESSAGE !MESSAGE Possible choices for configuration are: !MESSAGE !MESSAGE "stunnel Release" (based on "Win32 (x86) Console Application") !MESSAGE !ERROR An invalid configuration is specified. !ENDIF !IF "$(OS)" == "Windows_NT" NULL= !ELSE NULL=nul !ENDIF CPP=cl.exe RSC=rc.exe !IF "$(CFG)" == "stunnel - Release" OPENSSL=c:\openssl-0.9.7g !MESSAGE === OpenSSL is configured to be at $(OPENSSL) === OUTDIR=.\Release INTDIR=.\Release # Begin Custom Macros OutDir=.\Release # End Custom Macros ALL : "$(OUTDIR)\stunnel.exe" CLEAN : -@erase "$(INTDIR)\client.obj" -@erase "$(INTDIR)\gui.obj" -@erase "$(INTDIR)\log.obj" -@erase "$(INTDIR)\network.obj" -@erase "$(INTDIR)\options.obj" -@erase "$(INTDIR)\protocol.obj" -@erase "$(INTDIR)\resources.res" -@erase "$(INTDIR)\resolver.obj" -@erase "$(INTDIR)\ssl.obj" -@erase "$(INTDIR)\sthreads.obj" -@erase "$(INTDIR)\stunnel.obj" -@erase "$(INTDIR)\vc60.idb" -@erase "$(OUTDIR)\stunnel.exe" "$(OUTDIR)" : if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)" CPP_PROJ=/nologo /MT /W3 /G5 /O2 /I "$(OPENSSL)\inc32" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "USE_WIN32" /D "HAVE_OPENSSL" /D "HAVE_GETADDRINFO" /D "HAVE_GETNAMEINFO" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c RSC_PROJ=/l 0x409 /fo"$(INTDIR)\resources.res" /d "NDEBUG" .c{$(INTDIR)}.obj:: $(CPP) @<< $(CPP_PROJ) $< << .cpp{$(INTDIR)}.obj:: $(CPP) @<< $(CPP_PROJ) $< << .cxx{$(INTDIR)}.obj:: $(CPP) @<< $(CPP_PROJ) $< << .c{$(INTDIR)}.sbr:: $(CPP) @<< $(CPP_PROJ) $< << .cpp{$(INTDIR)}.sbr:: $(CPP) @<< $(CPP_PROJ) $< << .cxx{$(INTDIR)}.sbr:: $(CPP) @<< $(CPP_PROJ) $< << BSC32=bscmake.exe BSC32_FLAGS=/nologo /o"$(OUTDIR)\stunnel.bsc" BSC32_SBRS= \ LINK32=link.exe LINK32_FLAGS=kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib wsock32.lib $(OPENSSL)\out32dll\ssleay32.lib $(OPENSSL)\out32dll\libeay32.lib /nologo /subsystem:windows /incremental:no /pdb:"$(OUTDIR)\stunnel.pdb" /machine:I386 /out:"$(OUTDIR)\stunnel.exe" LINK32_OBJS= \ "$(INTDIR)\stunnel.obj" \ "$(INTDIR)\client.obj" \ "$(INTDIR)\gui.obj" \ "$(INTDIR)\log.obj" \ "$(INTDIR)\network.obj" \ "$(INTDIR)\options.obj" \ "$(INTDIR)\protocol.obj" \ "$(INTDIR)\resources.res" \ "$(INTDIR)\resolver.obj" \ "$(INTDIR)\ssl.obj" \ "$(INTDIR)\sthreads.obj" "$(OUTDIR)\stunnel.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS) $(LINK32) @<< $(LINK32_FLAGS) $(LINK32_OBJS) << !ENDIF !IF "$(CFG)" == "stunnel - Release" || "$(CFG)" == "stunnel - Debug" SOURCE=.\client.c "$(INTDIR)\client.obj" : $(SOURCE) "$(INTDIR)" SOURCE=.\gui.c "$(INTDIR)\gui.obj" : $(SOURCE) "$(INTDIR)" SOURCE=.\log.c "$(INTDIR)\log.obj" : $(SOURCE) "$(INTDIR)" SOURCE=.\network.c "$(INTDIR)\network.obj" : $(SOURCE) "$(INTDIR)" SOURCE=.\options.c "$(INTDIR)\options.obj" : $(SOURCE) "$(INTDIR)" SOURCE=.\protocol.c "$(INTDIR)\protocol.obj" : $(SOURCE) "$(INTDIR)" SOURCE=.\resources.rc "$(INTDIR)\resources.res" : $(SOURCE) "$(INTDIR)" $(RSC) $(RSC_PROJ) $(SOURCE) SOURCE=.\resolver.c "$(INTDIR)\resolver.obj" : $(SOURCE) "$(INTDIR)" SOURCE=.\ssl.c "$(INTDIR)\ssl.obj" : $(SOURCE) "$(INTDIR)" SOURCE=.\sthreads.c "$(INTDIR)\sthreads.obj" : $(SOURCE) "$(INTDIR)" SOURCE=.\stunnel.c "$(INTDIR)\stunnel.obj" : $(SOURCE) "$(INTDIR)" !ENDIF

1 0

Certificate integrration
by Nadeem Mohiudeen 23 Jun '05

23 Jun '05

Dear Members, I need to know the procedures to install a *.cer file into the format we using in stunnel.conf.actually lately we renewed a certificate from Verisign and they send a file which we save as test.cer .now I need to put this file into my format in stunnel.conf as follows key = /pbx_u01/apps/tomcat/current/conf/mnet-priv_nbk.pfx.pem cert = /pbx_u01/apps/tomcat/current/conf/mnet-priv_nbk.pfx.x509 since we are using tomcat as application server which is using stunnel as https port forwarder so advice the steps would be thanks at the earliest. Regards Nadeem

2 1

Help
by Nadeem Mohiudeen 23 Jun '05

23 Jun '05

Dear Members, I need to know the procedures to install a *.cer file into the format we using in stunnel.conf.actually lately we renewed a certificate from Verisign and they send a file which we save as test.cer .now I need to put this file into my format in stunnel.conf as follows key = /pbx_u01/apps/tomcat/current/conf/mnet-priv_nbk.pfx.pem cert = /pbx_u01/apps/tomcat/current/conf/mnet-priv_nbk.pfx.x509 since we are using tomcat as application server which is using stunnel as https port forwarder so advice the steps would be thanks at the earliest. Regards Nadeem

1 0

Re: [stunnel-users] Passphrase validation
by Vasil Dimov 23 Jun '05

23 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Jun 22, 2005 at 04:30:56PM -0700, Joseph Mocker wrote: > > It depends on how the machine were broken. Presumably if you > were that hell-bent on using passprhases on private keys, you'd > likely isolate stunnel to run as an unpriviledged user in a chrooted That is a good idea anyway :) > environment, and you may very well set the coredump size to zero > and remove a debugger all together. So unless the user was able > to break root, the effects of the break-in might be minimized. Private key stealing table: * the key and the plain text file, holding the password (if any) should always be chown root and chmod 400 * stunnel is the (unprivileged) user stunnel is running as * we assume that stunnel is running at the time of breakage, because this is the worst case. key storage \ break as root stunnel other user - --------------------------------------------------------------------------- 1. unencrypted key YES YES NO 2. crypted key/password in text file YES YES NO 3. crypted key/password entered at startup YES YES NO - --------------------------------------------------------------------------- As we see there is no difference if the private key will be kept crypted or unencrypted with or without text file holding the passphrase. What happens if the stunnel daemon is not running during the breakage? Note that this is an optimistic suggestion and we should not rely on it. key storage \ break as root stunnel other user - --------------------------------------------------------------------------- 1. unencrypted key YES NO NO 2. crypted key/password in text file YES NO NO 3. crypted key/password entered at startup NO NO NO - --------------------------------------------------------------------------- So the only difference in all cases is if stunnel is not running and the hacker gets root on the machine and the key is crypted and the password is entered at startup - then it will not be possible to steal the private key. As a conclusion, it is obviously - that there is really no sense to keep the password in a text file and it makes a LITTLE sense if the password is entered at startup - in just one, rare, case this setup will save the private key. -----BEGIN PGP SIGNATURE----- iD8DBQFCunHRFw6SP/bBpCARAtN4AJ0TBfANXVyyLNKojIaFzb1E/7WBqQCeIcop rAqsbhJmK9oBYg/Rb9iJzSE= =rFAJ -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Passphrase validation
by Vasil Dimov 23 Jun '05

23 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Jun 22, 2005 at 01:20:10PM +0100, Colin McKinnon wrote: > On Wednesday 22 June 2005 13:12, Vasil Dimov wrote: > > On Tue, Jun 21, 2005 at 10:29:37PM -0700, Peter Pentes wrote: > > > Sorry, what I am referring to here is actually the > > > passphrase for the private keys, and how Stunnel does > > > not support encrypted private keys. > > > > This would be useless. How do you expect the passphrase for the > > encrypted private key to be obtained at stunnel startup? > > Apache manages it. > Encrypted private keys will prevent stunnel from automatic startup, after a power failure or some other accidential machine reboot. And even being crypted on the filesystem once decrypted the private key will stay in memory unencrypted all the time. If someone breaks in the machine while it is running he/she will get the key from memory not from the filesystem. The only use of crypted private keys (for deamon-services) I can think of is that you can prevent someone from stealing your private key if he/she steals physically the harddisk or the whole machine from your server-room. And even this has the major disadvantage that the service will not start without human intervention (the private key's passphrase input) after unexpected reboots. -----BEGIN PGP SIGNATURE----- iD8DBQFCuVvWFw6SP/bBpCARAuTEAJ0bdKAURvMh4VZA7QEXplNYySrxTQCgoOBH XY4ftFyPqY36xDdZww6kSFU= =2/nK -----END PGP SIGNATURE-----

2 1

Re: [stunnel-users] Passphrase validation
by Vasil Dimov 23 Jun '05

23 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Jun 22, 2005 at 07:39:54PM +0200, Sergio Gelato wrote: > ... > operation, there is little (if any) actual security benefit from using a > non-null passphrase and storing it in a separate file; however, some > software (e.g., Java) does work that way, and I don't see any harm in ... Having encrypted private_key.pem and a plain text file private_key.pem.passphrase which contains the encryption password really does not make any sense. Ofcourse both files should be chown root and chmod 400. -----BEGIN PGP SIGNATURE----- iD8DBQFCumGtFw6SP/bBpCARAp52AJ9cOGOgwTqnuDN82ubkU5Vk3uieWgCdHQSS tBmrJ3voYiHwD9hJOwtwocM= =+cCS -----END PGP SIGNATURE-----

1 0

RE: [stunnel-users] GUI for openssl certificate generation
by Paul Jones 23 Jun '05

23 Jun '05

Hi, Yes, I do have a batch file for this purpose, though I would prefer a GUI. Could you please mail me your batch file anyway? I would like to compare. Cheers. Paul >From: "Aditya Deshmukh" <aditya.deshmukh(a)online.gateway.strangled.net> >Reply-To: <ald2003(a)users.sourceforge.net> >To: "'Paul Jones'" <jonesy_boy10(a)hotmail.com>,<stunnel-users(a)mirt.net> >Subject: RE: [stunnel-users] GUI for openssl certificate generation >Date: Wed, 22 Jun 2005 23:41:49 +0530 > >May be the best thing to do is to use a batch file for this purpose - >please >mail me if you want my batch file used for creating these certs > > > -----Original Message----- > > From: stunnel-users-bounces(a)mirt.net > > [mailto:[email protected]] On Behalf Of Paul Jones > > Sent: Wednesday, June 22, 2005 7:34 AM > > To: stunnel-users(a)mirt.net > > Subject: [stunnel-users] GUI for openssl certificate generation > > > > Hi all, > > > > I'm looking at building a small GUI app (possibly in VB6) on > > a Windows > > platform for generating certificates using OpenSSL. How can > > I do this? The > > command-line call to the openssl EXE does not seem to take > > things such as > > the Common Name, Organizational Unit, etc as parameters. > > > > Any help would be appreciated. > > > > Thanks in advance. > > > > Paul > > > > _________________________________________________________________ > > SEEK: Over 80,000 jobs across all industries at Australia's > > #1 job site. > > http://ninemsn.seek.com.au?hotmail > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >________________________________________________________________________ >Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) _________________________________________________________________ REALESTATE: biggest buy/rent/share listings http://ninemsn.realestate.com.au

1 0

Re: [stunnel-users] Passphrase validation
by Peter Pentes 23 Jun '05

23 Jun '05

I agree. It would be useful on the client side. PP --- Sergio Gelato <Sergio.Gelato(a)astro.su.se> wrote: > Vasil Dimov wrote: > > >-----BEGIN PGP SIGNED MESSAGE----- > >Hash: SHA1 > > > >On Tue, Jun 21, 2005 at 10:29:37PM -0700, Peter > Pentes wrote: > > > > > >>Sorry, what I am referring to here is actually the > >>passphrase for the private keys, and how Stunnel > does > >>not support encrypted private keys. > >> > >> > > > >This would be useless. How do you expect the > passphrase for the > >encrypted private key to be obtained at stunnel > startup? > > > > > By prompting the user, or by reading it from a > configuration file. > > On the client side, prompting the user isn't > necessarily bad or even > difficult. > > I'll grant you that on the server side, or for > unattended client-side > operation, there is little (if any) actual security > benefit from using a > non-null passphrase and storing it in a separate > file; however, some > software (e.g., Java) does work that way, and I > don't see any harm in > having that possibility. There may also be some > non-security benefits: > I've seen at least one CA policy that requires > private keys to be stored > encrypted while not active, and if you want to > comply with the letter > of such a policy you may have to use a non-null > passphrase. > ____________________________________________________ Yahoo! Sports Rekindle the Rivalries. Sign up for Fantasy Football http://football.fantasysports.yahoo.com

1 0

GUI for openssl certificate generation
by Paul Jones 22 Jun '05

22 Jun '05

Hi all, I'm looking at building a small GUI app (possibly in VB6) on a Windows platform for generating certificates using OpenSSL. How can I do this? The command-line call to the openssl EXE does not seem to take things such as the Common Name, Organizational Unit, etc as parameters. Any help would be appreciated. Thanks in advance. Paul _________________________________________________________________ SEEK: Over 80,000 jobs across all industries at Australia's #1 job site. http://ninemsn.seek.com.au?hotmail

1 1

a suggestion for release announcement
by Lu Wei 22 Jun '05

22 Jun '05

Hello Michal, thank you for your excellent software! I have a little suggestion: Could you include release files' MD5 and SHA hash codes or your pgp signature in the release announcement? That should be more reliable, should it? -- Regards Lu Wei

1 0

Stunnel for QNX4
by hazael martinez 21 Jun '05

21 Jun '05

Hi, Does anybody know if stunnel would work under QNX4? Or has anybody seen a port to QNX4? I downloaded the sources but I haven't been able to compile them. Thank you ____________________________________________________ Yahoo! Sports Rekindle the Rivalries. Sign up for Fantasy Football http://football.fantasysports.yahoo.com

1 0

Stunnel crashing
by David Gomel 21 Jun '05

21 Jun '05

I have been having some major problems trying to secure pop3 and imap with stunnel. I am running a RHEL3 box with Cpanel. I first started off by installing a clean copy of stunnel 4.10 but it was causing numerous bizarre problems. 1) it would crash after a few hours of the daemon operating, 2) before it would crash I would be getting tons of 'mailbox locked' errors and 3) the occasional timeout connecting. I eventually gave up with 4.10 and decided to try to use the stunnel 4.04 that was already doing https for cpanel/whm. I created a separate config file and ran a separate daemon just for pop/imap (I did this because I want them to be using different SSL certs). This seemed to be working perfectly as there were no timeouts, no locked mailbox errors and it didn't seem to be crashing. After about 24 hours however, the process had shut down. I tried a few more times and again after about 12-24 hours of running my pop/imap only stunnel daemon crashes. I should also mention 2 other things: 1) prior to having set up 4.10 on my box, stunnel 4.04 was listening for pop/imap without crashing (it just wasn't being used however). 2) The other daemon running https for cpanel/whm hasn't crashed at all. I've included the log (level 7) for everything that happened in the 1-2 seconds before it crashed. If anyone could offer any advice, it would be greatly appreciated! Thanks! David Info needed: 1) Running stunnel by executing "/usr/bin/stunnel-4.04local /usr/local/cpanel/etc/stunnel/my/stunnel2.conf" 2) Output of "stunnel -version": stunnel 4.04 on i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds 3) Output of "uname -a": Linux MY.HOSTNAME.COM 2.4.21-15.0.3.EL #1 Tue Jun 29 18:17:52 EDT 2004 i686 i686 i386 GNU/Linux 4) Your libc version: Version 6 5) Output of "gcc -v": Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --host=i386-redhat-linux Thread model: posix gcc version 3.2.3 20030502 (Red Hat Linux 3.2.3-52) 6) Output of "openssl version": OpenSSL 0.9.7a Feb 19 2003 7) Log before crash: 2005.06.19 05:10:30 LOG7[7052:3209298656]: pop3s accepted FD=8 from 82.123.194.23:63627 2005.06.19 05:10:30 LOG7[7052:3209298656]: FD 8 in non-blocking mode 2005.06.19 05:10:30 LOG7[7052:3200814000]: pop3s started 2005.06.19 05:10:30 LOG5[7052:3200814000]: pop3s connected from 82.123.194.23:63627 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): before/accept initialization 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: FD=8, DIR=read 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: ok 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 read client hello A 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 write server hello A 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 write certificate A 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 write server done A 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 flush data 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: FD=8, DIR=read 2005.06.19 05:10:30 LOG7[7052:3209298656]: pop3s accepted FD=9 from 82.123.194.23:63628 2005.06.19 05:10:30 LOG7[7052:3209298656]: FD 9 in non-blocking mode 2005.06.19 05:10:30 LOG7[7052:3209206704]: pop3s started 2005.06.19 05:10:30 LOG5[7052:3209206704]: pop3s connected from 82.123.194.23:63628 2005.06.19 05:10:30 LOG7[7052:3209206704]: SSL state (accept): before/accept initialization 2005.06.19 05:10:30 LOG7[7052:3209206704]: waitforsocket: FD=9, DIR=read 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: ok 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 read client key exchange A 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: FD=8, DIR=read 2005.06.19 05:10:30 LOG7[7052:3209206704]: waitforsocket: ok 2005.06.19 05:10:30 LOG7[7052:3209206704]: SSL state (accept): SSLv3 read client hello A 2005.06.19 05:10:30 LOG7[7052:3209206704]: SSL state (accept): SSLv3 write server hello A 2005.06.19 05:10:30 LOG7[7052:3209206704]: SSL state (accept): SSLv3 write certificate A 2005.06.19 05:10:30 LOG7[7052:3209206704]: SSL state (accept): SSLv3 write server done A 2005.06.19 05:10:30 LOG7[7052:3209206704]: SSL state (accept): SSLv3 flush data 2005.06.19 05:10:30 LOG7[7052:3209206704]: waitforsocket: FD=9, DIR=read 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: ok 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: FD=8, DIR=read 2005.06.19 05:10:30 LOG7[7052:3209206704]: waitforsocket: ok 2005.06.19 05:10:30 LOG7[7052:3209206704]: SSL state (accept): SSLv3 read client key exchange A 2005.06.19 05:10:30 LOG7[7052:3209206704]: waitforsocket: FD=9, DIR=read 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: ok 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 read finished A 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 write finished A 2005.06.19 05:10:30 LOG7[7052:3200814000]: SSL state (accept): SSLv3 flush data 2005.06.19 05:10:30 LOG7[7052:3200814000]: 113 items in the session cache 2005.06.19 05:10:30 LOG7[7052:3200814000]: 0 client connects (SSL_connect()) 2005.06.19 05:10:30 LOG7[7052:3200814000]: 0 client connects that finished 2005.06.19 05:10:30 LOG7[7052:3200814000]: 0 client renegotiatations requested 2005.06.19 05:10:30 LOG7[7052:3200814000]: 622 server connects (SSL_accept()) 2005.06.19 05:10:30 LOG7[7052:3200814000]: 621 server connects that finished 2005.06.19 05:10:30 LOG7[7052:3200814000]: 0 server renegotiatiations requested 2005.06.19 05:10:30 LOG7[7052:3200814000]: 0 session cache hits 2005.06.19 05:10:30 LOG7[7052:3200814000]: 0 session cache misses 2005.06.19 05:10:30 LOG7[7052:3200814000]: 0 session cache timeouts 2005.06.19 05:10:30 LOG6[7052:3200814000]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.06.19 05:10:30 LOG7[7052:3200814000]: FD 10 in non-blocking mode 2005.06.19 05:10:30 LOG7[7052:3200814000]: pop3s connecting 127.0.0.1:110 2005.06.19 05:10:30 LOG7[7052:3200814000]: remote connect #1: EINPROGRESS: retrying 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: FD=10, DIR=write 2005.06.19 05:10:30 LOG7[7052:3200814000]: waitforsocket: ok 2005.06.19 05:10:30 LOG7[7052:3200814000]: Remote FD=10 initialized 2005.06.19 05:10:30 LOG7[7052:3209298656]: pop3s accepted FD=11 from 82.123.194.23:63631 2005.06.19 05:10:30 LOG7[7052:3209298656]: FD 11 in non-blocking mode 2005.06.19 05:10:30 LOG7[7052:3192421296]: pop3s started 2005.06.19 05:10:30 LOG5[7052:3192421296]: pop3s connected from 82.123.194.23:63631 2005.06.19 05:10:30 LOG7[7052:3192421296]: SSL state (accept): before/accept initialization 2005.06.19 05:10:30 LOG7[7052:3192421296]: waitforsocket: FD=11, DIR=read 2005.06.19 05:10:31 LOG7[7052:3192421296]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 read client hello A 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 write server hello A 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 write certificate A 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 write server done A 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 flush data 2005.06.19 05:10:31 LOG7[7052:3192421296]: waitforsocket: FD=11, DIR=read 2005.06.19 05:10:31 LOG7[7052:3209206704]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3209206704]: waitforsocket: FD=9, DIR=read 2005.06.19 05:10:31 LOG7[7052:3209298656]: pop3s accepted FD=12 from 82.123.194.23:63632 2005.06.19 05:10:31 LOG7[7052:3209298656]: FD 12 in non-blocking mode 2005.06.19 05:10:31 LOG7[7052:3184028592]: pop3s started 2005.06.19 05:10:31 LOG5[7052:3184028592]: pop3s connected from 82.123.194.23:63632 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): before/accept initialization 2005.06.19 05:10:31 LOG7[7052:3184028592]: waitforsocket: FD=12, DIR=read 2005.06.19 05:10:31 LOG7[7052:3209206704]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3209206704]: SSL state (accept): SSLv3 read finished A 2005.06.19 05:10:31 LOG7[7052:3209206704]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.19 05:10:31 LOG7[7052:3209206704]: SSL state (accept): SSLv3 write finished A 2005.06.19 05:10:31 LOG7[7052:3209206704]: SSL state (accept): SSLv3 flush data 2005.06.19 05:10:31 LOG7[7052:3209206704]: 114 items in the session cache 2005.06.19 05:10:31 LOG7[7052:3209206704]: 0 client connects (SSL_connect()) 2005.06.19 05:10:31 LOG7[7052:3209206704]: 0 client connects that finished 2005.06.19 05:10:31 LOG7[7052:3209206704]: 0 client renegotiatations requested 2005.06.19 05:10:31 LOG7[7052:3209206704]: 624 server connects (SSL_accept()) 2005.06.19 05:10:31 LOG7[7052:3209206704]: 622 server connects that finished 2005.06.19 05:10:31 LOG7[7052:3209206704]: 0 server renegotiatiations requested 2005.06.19 05:10:31 LOG7[7052:3209206704]: 0 session cache hits 2005.06.19 05:10:31 LOG7[7052:3209206704]: 0 session cache misses 2005.06.19 05:10:31 LOG7[7052:3209206704]: 0 session cache timeouts 2005.06.19 05:10:31 LOG6[7052:3209206704]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.06.19 05:10:31 LOG7[7052:3209206704]: FD 13 in non-blocking mode 2005.06.19 05:10:31 LOG7[7052:3209206704]: pop3s connecting 127.0.0.1:110 2005.06.19 05:10:31 LOG7[7052:3209206704]: remote connect #1: EINPROGRESS: retrying 2005.06.19 05:10:31 LOG7[7052:3209206704]: waitforsocket: FD=13, DIR=write 2005.06.19 05:10:31 LOG7[7052:3209206704]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3209206704]: Remote FD=13 initialized 2005.06.19 05:10:31 LOG7[7052:3192421296]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 read client key exchange A 2005.06.19 05:10:31 LOG7[7052:3192421296]: waitforsocket: FD=11, DIR=read 2005.06.19 05:10:31 LOG7[7052:3184028592]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 read client hello A 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 write server hello A 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 write certificate A 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 write server done A 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 flush data 2005.06.19 05:10:31 LOG7[7052:3184028592]: waitforsocket: FD=12, DIR=read 2005.06.19 05:10:31 LOG7[7052:3192421296]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 read finished A 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 write finished A 2005.06.19 05:10:31 LOG7[7052:3192421296]: SSL state (accept): SSLv3 flush data 2005.06.19 05:10:31 LOG7[7052:3192421296]: 115 items in the session cache 2005.06.19 05:10:31 LOG7[7052:3192421296]: 0 client connects (SSL_connect()) 2005.06.19 05:10:31 LOG7[7052:3192421296]: 0 client connects that finished 2005.06.19 05:10:31 LOG7[7052:3192421296]: 0 client renegotiatations requested 2005.06.19 05:10:31 LOG7[7052:3192421296]: 624 server connects (SSL_accept()) 2005.06.19 05:10:31 LOG7[7052:3192421296]: 623 server connects that finished 2005.06.19 05:10:31 LOG7[7052:3192421296]: 0 server renegotiatiations requested 2005.06.19 05:10:31 LOG7[7052:3192421296]: 0 session cache hits 2005.06.19 05:10:31 LOG7[7052:3192421296]: 0 session cache misses 2005.06.19 05:10:31 LOG7[7052:3192421296]: 0 session cache timeouts 2005.06.19 05:10:31 LOG6[7052:3192421296]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.06.19 05:10:31 LOG7[7052:3192421296]: FD 14 in non-blocking mode 2005.06.19 05:10:31 LOG7[7052:3192421296]: pop3s connecting 127.0.0.1:110 2005.06.19 05:10:31 LOG7[7052:3192421296]: remote connect #1: EINPROGRESS: retrying 2005.06.19 05:10:31 LOG7[7052:3192421296]: waitforsocket: FD=14, DIR=write 2005.06.19 05:10:31 LOG7[7052:3192421296]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3192421296]: Remote FD=14 initialized 2005.06.19 05:10:31 LOG7[7052:3184028592]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 read client key exchange A 2005.06.19 05:10:31 LOG7[7052:3184028592]: waitforsocket: FD=12, DIR=read 2005.06.19 05:10:31 LOG7[7052:3184028592]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 read finished A 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 write finished A 2005.06.19 05:10:31 LOG7[7052:3184028592]: SSL state (accept): SSLv3 flush data 2005.06.19 05:10:31 LOG7[7052:3184028592]: 116 items in the session cache 2005.06.19 05:10:31 LOG7[7052:3184028592]: 0 client connects (SSL_connect()) 2005.06.19 05:10:31 LOG7[7052:3184028592]: 0 client connects that finished 2005.06.19 05:10:31 LOG7[7052:3184028592]: 0 client renegotiatations requested 2005.06.19 05:10:31 LOG7[7052:3184028592]: 624 server connects (SSL_accept()) 2005.06.19 05:10:31 LOG7[7052:3184028592]: 624 server connects that finished 2005.06.19 05:10:31 LOG7[7052:3184028592]: 0 server renegotiatiations requested 2005.06.19 05:10:31 LOG7[7052:3184028592]: 0 session cache hits 2005.06.19 05:10:31 LOG7[7052:3184028592]: 0 session cache misses 2005.06.19 05:10:31 LOG7[7052:3184028592]: 0 session cache timeouts 2005.06.19 05:10:31 LOG6[7052:3184028592]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.06.19 05:10:31 LOG7[7052:3184028592]: FD 15 in non-blocking mode 2005.06.19 05:10:31 LOG7[7052:3184028592]: pop3s connecting 127.0.0.1:110 2005.06.19 05:10:31 LOG7[7052:3184028592]: remote connect #1: EINPROGRESS: retrying 2005.06.19 05:10:31 LOG7[7052:3184028592]: waitforsocket: FD=15, DIR=write 2005.06.19 05:10:31 LOG7[7052:3184028592]: waitforsocket: ok 2005.06.19 05:10:31 LOG7[7052:3184028592]: Remote FD=15 initialized 2005.06.19 05:10:33 LOG7[7052:3200814000]: Socket closed on read 2005.06.19 05:10:33 LOG7[7052:3200814000]: SSL alert (write): warning: close notify 2005.06.19 05:10:33 LOG7[7052:3200814000]: SSL write shutdown (output buffer empty) 2005.06.19 05:10:34 LOG7[7052:3209206704]: Socket closed on read 2005.06.19 05:10:34 LOG7[7052:3209206704]: SSL alert (write): warning: close notify 2005.06.19 05:10:34 LOG7[7052:3209206704]: SSL write shutdown (output buffer empty) 2005.06.19 05:10:34 LOG7[7052:3192421296]: Socket closed on read 2005.06.19 05:10:34 LOG7[7052:3192421296]: SSL alert (write): warning: close notify 2005.06.19 05:10:34 LOG7[7052:3192421296]: SSL write shutdown (output buffer empty) 2005.06.19 05:10:34 LOG7[7052:3200814000]: SSL socket closed on SSL_read 2005.06.19 05:10:34 LOG5[7052:3200814000]: Connection closed: 3470 bytes sent to SSL, 42 bytes sent to socket 2005.06.19 05:10:34 LOG7[7052:3200814000]: pop3s finished (3 left) 2005.06.19 05:10:34 LOG7[7052:3209206704]: SSL socket closed on SSL_read 2005.06.19 05:10:34 LOG5[7052:3209206704]: Connection closed: 3342 bytes sent to SSL, 53 bytes sent to socket 2005.06.19 05:10:34 LOG7[7052:3209206704]: pop3s finished (2 left) 2005.06.19 05:10:34 LOG7[7052:3192421296]: SSL socket closed on SSL_read 2005.06.19 05:10:34 LOG5[7052:3192421296]: Connection closed: 480 bytes sent to SSL, 47 bytes sent to socket 2005.06.19 05:10:34 LOG7[7052:3192421296]: pop3s finished (1 left) 2005.06.19 05:10:34 LOG7[7052:3184028592]: Socket closed on read 2005.06.19 05:10:34 LOG7[7052:3184028592]: SSL alert (write): warning: close notify 2005.06.19 05:10:34 LOG7[7052:3184028592]: SSL write shutdown (output buffer empty) 2005.06.19 05:10:34 LOG7[7052:3184028592]: SSL socket closed on SSL_read 2005.06.19 05:10:34 LOG5[7052:3184028592]: Connection closed: 1934 bytes sent to SSL, 51 bytes sent to socket 2005.06.19 05:10:34 LOG7[7052:3184028592]: pop3s finished (0 left)

2 3

Re: [stunnel-users] stunnel 4.10 on Suse 8.2
by Ionut Turturica 18 Jun '05

18 Jun '05

I use stunnel for testing and compare results with our products. I made a script to monitor the number of threads and memory per process, now it always show 1 thread. On Fri, 17 Jun 2005 23:55:57 +0300, Michal Trojnara <Michal.Trojnara(a)mirt.net> wrote: >> Now it's ok, but I want the pthreads back :) > > Why? > > Mike -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

2 1

Re: [stunnel-users] stunnel 4.10 on Suse 8.2
by Ionut Turturica 17 Jun '05

17 Jun '05

eh..I've missed that, it looks like a workaroud. Now it's ok, but I want the pthreads back :) On Fri, 17 Jun 2005 22:02:05 +0300, Michal Trojnara <Michal.Trojnara(a)mirt.net> wrote: > Did you try this one: > http://stunnel.mirt.net/pipermail/stunnel-users/2005-June/000532.html > ? > > Best regards, > Mike

1 0

stunnel 4.10 on Suse 8.2
by Ionut Turturica 17 Jun '05

17 Jun '05

I get a segmentation fault on first connect. To the default config, i've added the debug = 7 and foreground = yes. I have used for comparison 2 versions 4.09 and 4.10 compiled with default options (./configure, make, make install) It seems like UCONTEXT is not welcome on my machine. linux:~ # uname -a Linux linux 2.4.20-4GB #1 Mon Mar 17 17:54:44 UTC 2003 i686 unknown unknown GNU/Linux linux:~ # gcc -v Reading specs from /usr/lib/gcc-lib/i486-suse-linux/3.3/specs Configured with: ../configure --enable-threads=posix --prefix=/usr --with-local-prefix=/usr/local --infodir=/usr/share/info --mandir=/usr/share/man --libdir=/usr/lib --enable-languages=c,c++,f77,objc,java,ada --disable-checking --enable-libgcj --with-gxx-include-dir=/usr/include/g++ --with-slibdir=/lib --with-system-zlib --enable-shared --enable-__cxa_atexit i486-suse-linux Thread model: posix gcc version 3.3 20030226 (prerelease) (SuSE Linux) linux:~ # openssl version OpenSSL 0.9.7g 11 Apr 2005 linux:/usr/src/stunnel-4.10 # /usr/local/sbin/stunnel 2005.06.17 11:44:17 LOG5[10371:1]: stunnel 4.10 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.06.17 11:44:17 LOG7[10371:1]: RAND_status claims sufficient entropy for the PRNG 2005.06.17 11:44:17 LOG6[10371:1]: PRNG seeded successfully 2005.06.17 11:44:17 LOG7[10371:1]: Certificate: /usr/local/etc/stunnel/server.pem 2005.06.17 11:44:17 LOG7[10371:1]: Key file: /usr/local/etc/stunnel/server.pem 2005.06.17 11:44:17 LOG6[10371:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.06.17 11:44:17 LOG6[10371:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.06.17 11:44:17 LOG5[10371:1]: 500 clients allowed 2005.06.17 11:44:17 LOG7[10371:1]: FD 3 in non-blocking mode 2005.06.17 11:44:17 LOG7[10371:1]: FD 4 in non-blocking mode 2005.06.17 11:44:17 LOG7[10371:1]: FD 5 in non-blocking mode 2005.06.17 11:44:17 LOG7[10371:1]: SO_REUSEADDR option set on accept socket 2005.06.17 11:44:17 LOG7[10371:1]: pop3s bound to 0.0.0.0:995 2005.06.17 11:44:17 LOG7[10371:1]: FD 6 in non-blocking mode 2005.06.17 11:44:18 LOG7[10371:1]: SO_REUSEADDR option set on accept socket 2005.06.17 11:44:18 LOG7[10371:1]: https bound to 0.0.0.0:443 2005.06.17 11:44:18 LOG7[10371:1]: Created pid file /stunnel.pid 2005.06.17 11:44:18 LOG7[10371:0]: Waiting -1 second(s) for 3 file descriptor(s) 2005.06.17 11:44:20 LOG7[10371:0]: CONTEXT 1, FD=3, (IN)->() 2005.06.17 11:44:20 LOG7[10371:0]: CONTEXT 1, FD=5, (IN)->(IN) 2005.06.17 11:44:20 LOG7[10371:0]: CONTEXT 1, FD=6, (IN)->() 2005.06.17 11:44:20 LOG7[10371:1]: pop3s accepted FD=7 from 172.16.203.52:2148 2005.06.17 11:44:20 LOG7[10371:1]: Creating a new context 2005.06.17 11:44:20 LOG7[10371:1]: Context 2 created Segmentation fault linux:/usr/src/stunnel-4.09 # /usr/local/sbin/stunnel 2005.06.17 11:45:13 LOG5[10773:16384]: stunnel 4.09 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.06.17 11:45:13 LOG7[10773:16384]: RAND_status claims sufficient entropy for the PRNG 2005.06.17 11:45:13 LOG6[10773:16384]: PRNG seeded successfully 2005.06.17 11:45:13 LOG7[10773:16384]: Certificate: /usr/local/etc/stunnel/server.pem 2005.06.17 11:45:13 LOG7[10773:16384]: Key file: /usr/local/etc/stunnel/server.pem 2005.06.17 11:45:13 LOG6[10773:16384]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.06.17 11:45:13 LOG6[10773:16384]: poll() used - no FD_SETSIZE limit for file descriptors 2005.06.17 11:45:13 LOG5[10773:16384]: 500 clients allowed 2005.06.17 11:45:13 LOG7[10773:16384]: FD 3 in non-blocking mode 2005.06.17 11:45:13 LOG7[10773:16384]: FD 4 in non-blocking mode 2005.06.17 11:45:13 LOG7[10773:16384]: FD 5 in non-blocking mode 2005.06.17 11:45:13 LOG7[10773:16384]: SO_REUSEADDR option set on accept socket 2005.06.17 11:45:13 LOG7[10773:16384]: pop3s bound to 0.0.0.0:995 2005.06.17 11:45:13 LOG7[10773:16384]: FD 6 in non-blocking mode 2005.06.17 11:45:13 LOG7[10773:16384]: SO_REUSEADDR option set on accept socket 2005.06.17 11:45:13 LOG7[10773:16384]: https bound to 0.0.0.0:443 2005.06.17 11:45:13 LOG7[10773:16384]: Created pid file /stunnel.pid 2005.06.17 11:45:15 LOG7[10773:16384]: pop3s accepted FD=7 from 172.16.203.52:2150 2005.06.17 11:45:15 LOG7[10773:16384]: FD 7 in non-blocking mode 2005.06.17 11:45:15 LOG7[10779:16386]: pop3s started 2005.06.17 11:45:15 LOG7[10779:16386]: TCP_NODELAY option set on local socket 2005.06.17 11:45:15 LOG5[10779:16386]: pop3s connected from 172.16.203.52:2150 2005.06.17 11:45:15 LOG7[10779:16386]: SSL state (accept): before/accept initialization 2005.06.17 11:45:18 LOG3[10779:16386]: SSL_accept: Peer suddenly disconnected 2005.06.17 11:45:18 LOG7[10779:16386]: pop3s finished (0 left) -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

1 0

Stunnel and Sun Calendar 5
by Michael Chanudet 17 Jun '05

17 Jun '05

Hi, I'm using stunnel with Sun Calendar on a Windows 2003 server. Everything works well until I'v move Sun Calendar on an other server. Now, when I go to my Sun Calendar, I need to refresh the page after having accepted the certificat. You can see the problem here => https://frodon.atnweb.com I'm using stunnel 4.10 libeay32.dll and libssl.dll version 0.9.7.3 (from openssl.org) My conf file looks like this: ------------------------------- key = E:\stunnel\stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 3 output = E:\stunnel\stunnel.log [https] accept = 443 connect = 80 TIMEOUTclose = 0 -------------------------------- If someone can see where is the problem, I will be pleased to know the answer :) Thanks, Regards, Michaël CHANUDET atn groupe sa 2 allée des Mitaillères - 38240 Meylan - France Tél. : +33 (0)4.76.41.17.17 - Fax : +33 (0)4.76.41.05.45 www.atngroupe.fr

2 1

Re: They are also making changes in client.c (Tuc at T-B-O-H)
by Vasil Dimov 16 Jun '05

16 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is a reply to http://stunnel.mirt.net/pipermail/stunnel-users/2005-June/000541.html but it has nothing to do with oritignal subject, so I send it separately. CVS version of the FreeBSD port of stunnel can be found at: http://www.freebsd.org/cgi/cvsweb.cgi/ports/security/stunnel/ the files/ subdir contains some changes to the original source. Some of them are FreeBSD specific and need only be applied on FreeBSD, but some are not. Changes to client.c are related to execvp problems. http://www.freebsd.org/cgi/cvsweb.cgi/ports/security/stunnel/files/patch-sr… can be useful. Changes to common.h are a hack to make it possible for the user to choose ucontext/pthread/fork model at compile time. Log message can be found at: http://www.freebsd.org/cgi/cvsweb.cgi/ports/security/stunnel/files/patch-sr… It was invented as a workaround to the ucontext-problems, but is a good feature anyway. I think it will be great if someday we can use ./configure options like - --with-ucontext, --with-pthread, --with-fork, instead of using this ugly hack :) Regards, Vasil -----BEGIN PGP SIGNATURE----- iD8DBQFCsQ7pFw6SP/bBpCARAo3wAKDbu0lXx0+LMW31dksb4S8M74PukQCgwmwx KH0/Ohi+GtUwBSbYv8RkLsg= =wzW2 -----END PGP SIGNATURE-----

1 0

stunnel segfaulting on connection with 4.10
by brianmas＠highstream.net 15 Jun '05

15 Jun '05

Hello having a problem with stunnel sigsegv'ing on a machine answers to list questions below: 1. https to/from IPs bound on same machine the contents of my config file: cert = /usr/local/etc/poundcert.pem foreground = yes [poundssl] connect = xx.xx.xx.xx:80 accept = xx.xx.xx.xx:443 foreground option because I was debugging, does it with or without this option. 2. 4.10 3. standalone, /usr/local/sbin/stunnel /usr/local/etc/stunnel.cfg 4. -D and -f aren't flags in version I am using apparently. assume -D 7 is debug level debug (7) I'll add the log from a single session, all I am doing is connecting from a mozilla client and it instantly segfaults: # /usr/local/sbin/stunnel /usr/local/etc/stunnel.cfg 2005.06.15 10:02:21 LOG5[1245:1]: stunnel 4.10 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.06.15 10:02:21 LOG7[1245:1]: Snagged 64 random bytes from /root/.rnd 2005.06.15 10:02:21 LOG7[1245:1]: Wrote 1024 new random bytes to /root/.rnd 2005.06.15 10:02:21 LOG7[1245:1]: RAND_status claims sufficient entropy for the PRNG 2005.06.15 10:02:21 LOG6[1245:1]: PRNG seeded successfully 2005.06.15 10:02:21 LOG7[1245:1]: Certificate: /usr/local/etc/poundcert.pem 2005.06.15 10:02:21 LOG7[1245:1]: Key file: /usr/local/etc/poundcert.pem 2005.06.15 10:02:21 LOG6[1245:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.06.15 10:02:21 LOG6[1245:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.06.15 10:02:21 LOG5[1245:1]: 500 clients allowed 2005.06.15 10:02:21 LOG7[1245:1]: FD 3 in non-blocking mode 2005.06.15 10:02:21 LOG7[1245:1]: FD 4 in non-blocking mode 2005.06.15 10:02:21 LOG7[1245:1]: FD 5 in non-blocking mode 2005.06.15 10:02:21 LOG7[1245:1]: SO_REUSEADDR option set on accept socket 2005.06.15 10:02:21 LOG7[1245:1]: poundssl bound to xx.xx.xx.xx:443 2005.06.15 10:02:21 LOG7[1245:1]: Created pid file /usr/local/var/run/stunnel.pid 2005.06.15 10:02:21 LOG7[1245:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.06.15 10:02:39 LOG7[1245:0]: CONTEXT 1, FD=3, (IN)->() 2005.06.15 10:02:39 LOG7[1245:0]: CONTEXT 1, FD=5, (IN)->(IN) 2005.06.15 10:02:39 LOG7[1245:1]: poundssl accepted FD=6 from xx.xx.xx.xx:3939 2005.06.15 10:02:39 LOG7[1245:1]: Creating a new context 2005.06.15 10:02:39 LOG7[1245:1]: Context 2 created Segmentation fault 5. /usr/local/sbin/stunnel -version stunnel 4.10 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds 6. uname -a Linux hsc14 2.4.27 #1 SMP Fri Feb 11 09:13:33 EST 2005 i686 i686 i386 GNU/Linux 7. # /lib/libc.so.6 GNU C Library stable release version 2.3.2, by Roland McGrath et al. Copyright (C) 2003 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled by GNU CC version 3.2.2 20030222 (Red Hat Linux 3.2.2-5). Compiled on a Linux 2.4.20 system on 2003-02-27. Available extensions: GNU libio by Per Bothner crypt add-on version 2.1 by Michael Glad and others linuxthreads-0.10 by Xavier Leroy BIND-8.2.3-T5B libthread_db work sponsored by Alpha Processor Inc NIS(YP)/NIS+ NSS modules 0.19 by Thorsten Kukuk Thread-local storage support included. 8.]# gcc -v Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --host=i386-redhat-linux Thread model: posix gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5) 9. ok maybe this is a problem? # ]# openssl version OpenSSL 0.9.7a Feb 19 2003 but: [root@hsc14 etc]# grep "OpenSSL 0.9.7a" /usr/local/sbin/stunnel [root@hsc14 etc]# grep "OpenSSL 0.9.7g" /usr/local/sbin/stunnel Binary file /usr/local/sbin/stunnel matches which -a openssl only shows one binary and it's that old one. additionally here is the output of gdb: [root@hsc14 etc]# gdb /usr/local/sbin/stunnel GNU gdb Red Hat Linux (5.3post-0.20021129.18rh) Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"... (gdb) set arg /usr/local/etc/stunnel.cfg (gdb) run Starting program: /usr/local/sbin/stunnel /usr/local/etc/stunnel.cfg [New Thread 16384 (LWP 20866)] 2005.06.15 09:44:11 LOG5[20866:1]: stunnel 4.10 on i686-pc-linux-gnu UCONTEXT+PO LL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.06.15 09:44:11 LOG5[20866:1]: 500 clients allowed Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 20866)] 0x40026f0c in __pthread_internal_tsd_get () from /lib/libpthread.so.0 (gdb) bt #0 0x40026f0c in __pthread_internal_tsd_get () from /lib/libpthread.so.0 #1 0x40105edd in malloc () from /lib/libc.so.6 #2 0x400f59e3 in __fopen_internal () from /lib/libc.so.6 #3 0x400f5aae in fopen@@GLIBC_2.1 () from /lib/libc.so.6 #4 0x4008c28b in hosts_access () from /usr/lib/libwrap.so.0 #5 0x4008c207 in hosts_access () from /usr/lib/libwrap.so.0 #6 0x0804b9d9 in auth_libwrap (c=0x4009225c) at client.c:706 #7 0x0804a535 in init_local (c=0x811d638) at client.c:196 #8 0x0804a3b1 in do_client (c=0x811d638) at client.c:143 #9 0x0804a338 in client (arg=0x811d638) at client.c:120 #10 0x400d84b4 in __makecontext () from /lib/libc.so.6 any help is much appreciated. let me know if you need any more information. Thank you, brian

3 5

Fix unexpected stunnel-4.10 exits on FreeBSD
by Vasil Dimov 15 Jun '05

15 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The problem has been reported in the stunnel-users mailing list: http://stunnel.mirt.net/pipermail/stunnel-users/2005-May/000482.html http://stunnel.mirt.net/pipermail/stunnel-users/2005-May/000484.html http://stunnel.mirt.net/pipermail/stunnel-users/2005-May/000490.html on freebsd-ports mailing list: http://lists.FreeBSD.org/pipermail/freebsd-ports/2005-May/023344.html and has several FreeBSD problem reports submitted: http://www.FreeBSD.org/cgi/query-pr.cgi?pr=81001 http://www.FreeBSD.org/cgi/query-pr.cgi?pr=81162 http://www.FreeBSD.org/cgi/query-pr.cgi?pr=81289 Patch that fixes this problem can be found here: http://www.FreeBSD.org/cgi/query-pr.cgi?pr=82202 It does not break anything if applied with Linux stunnel, so it can be considered "universal". It will be good if we see this (or similar) fix in the next version of stunnel. The problem is that we cannot (at least on FreeBSD): 1. create context A (cleanup context) 2. create context B and set B's uc_link to point to A 3. swapcontext(3) to B What happens is that B's function returns, A's function passes control to the main thread of execution 4. create context C and set C's uc_link to point to A What happens is that A is exhausted and this will not work as expected 5. swapcontext(3) to C We expect A's function to be executed after C's function returns, but instead exit(3) is called when A's function returns and the whole program terminates normally after serving its second request. -----BEGIN PGP SIGNATURE----- iD8DBQFCrcgJFw6SP/bBpCARAll9AKCPTyMK23v28h8eGKW0LQw7RjrWFgCfWHjR BQEEDOOx/mGG7S38QhqLIW8= =yB1z -----END PGP SIGNATURE-----

3 8

linuxthreads + ucontext = crash
by Michal Trojnara 15 Jun '05

15 Jun '05

Dear Users, It looks like a well known problem: https://listman.redhat.com/archives/phil-list/2003-January/msg00097.html Nice to know. 8-) Best regards, Mike

1 0

Follow up to stunnel w/ zlib not working under windows.
by comsatcat 15 Jun '05

15 Jun '05

Just curious if anyone has stunnel working with zlib compression under windows? Please see my other post titled "Compression (zlib) does not work under windows" for more information. Thanks, Ben

1 0

Setting up Stunnel on Server AND Clients
by Peter Pentes 14 Jun '05

14 Jun '05

G'Day all, I'm having trouble understanding how to incorporate Stunnel into a client/server environment. There is a application running on the server which receives and sends data to various clients. The clients also have a communications application running. None of the apps (on both server and clients) support any form of encryption. So I want to use Stunnel for this. How would I set Stunnel up on the server and also the clients? I can't find an example on stunnel.org that discusses such a scenario. Any help would be great. Cheers. Peter __________________________________ Yahoo! Mail Stay connected, organized, and protected. Take the tour: http://tour.mail.yahoo.com/mailtour.html

2 2

Registering other dlls after running Stunnel
by andym＠rhotrading.com 13 Jun '05

13 Jun '05

I'm having a problem registering other dlls that depend on tibco and ws2_32. I could register them fine prior to putting stunnel on and now they are problematic. Trying regsvr32 returns nothing; not an error or a success. I can successfully install and uninstall this same dll on a different system that does not have Stunnel on it. Windows platform (XP). Has anyone else run into behavior like this and/or does anyone have any suggestions to troubleshoot. I've verified that the dll is not being registered silently by searching the registry. I spoke with a developer who said that Stunnel might be hooking in on my dlls registry attempt and causing it to blow up. Any thoughts? Thank you, Andy

1 0

How to Remove Stunnel From Start-Up?
by mhrtmhd94＠att.net 13 Jun '05

13 Jun '05

I have finally been able to delete and successfully re-install Stunnel, which I am using in conjunction with Agent. There are still some problems, which I think are more related to Agent, and I am consulting with Agent tech support. However, there is one problem with Stunnel. It starts when I boot into Windows (XP SP2). I did not intend for Stunnel to run except when I launch it along with Agent. How can I remove it from Start-Up? Stunnel DOES NOT appear under the Start-up tab when I run msconfig. If it is necessary to uninstall Stunnel and reinstall it, is there a convenient way of doing so? I had a helluva time doing this and eventually was able to accomplish it by deleting as many Stunnel entries as I could from the registry. Thanks. Mort Middleman

1 0

Stunnel and Gmail: 'Server is down' error
by John Latter 12 Jun '05

12 Jun '05

2 1

RE: [stunnel-users] stunnel on HP-UX
by Stephen Tanner 12 Jun '05

12 Jun '05

The PRNG in HP-UX does not start until rc3. The normal place for syslog to start is in rc2, so I had placed stunnel and syslog-ng in rc2 for startup. I simply moved the startup script for PRNG to rc2. -----Original Message----- From: Dan Langille [mailto:[email protected]] Sent: Friday, June 10, 2005 10:08 AM To: Stephen Tanner Cc: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] stunnel on HP-UX On 10 Jun 2005 at 10:04, Stephen Tanner wrote: > Please disregard, I have located the issue. And it was solved how? -- Dan Langille : http://www.langille.org/ BSDCan - The Technical BSD Conference - http://www.bsdcan.org/

2 1

Stunnel --- communication + encryption in both directions
by Paul Jones 12 Jun '05

12 Jun '05

Hi, I am interested in using Stunnel, but I am a little confused currently. The "Forwarding an insecure port securely from one machine to another" (http://www.stunnel.org/examples/generic_tunnel.html) example only discusses the situation for sending data from the server to the client (i.e. a single direction). How would stunnel have to be set up so that encrypted communication is achieve in both directions? That is, from server to client and also from client to server? Imagine that there is an application running on one end, and an identical app running on the other end and neither supports encryption. So I want to bring stunnel into the picture, so that communication is encrypted/decrypted on both ends. Cheers. Paul _________________________________________________________________ Free wallpapers on Level 9 http://level9.ninemsn.com.au/default.aspx

2 1

configure fails when cross compiling
by Paul Kramer 10 Jun '05

10 Jun '05

Hi Folks, I'm trying to run configure to cross compile, my host machine is linux and my target is mips hardard (mvista) I get the following configure errors: checking for /dev/ptmx and /dev/ptc cannnot check for file existence when cross compiling I poked around in the configure.ac and see there these are defined. What is the purpose for checking for the existence of this files? And... what flags should I be providing to configure? Thanks! Kramer

1 0

RE: [stunnel-users] stunnel on HP-UX
by Stephen Tanner 10 Jun '05

10 Jun '05

Please disregard, I have located the issue. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Stephen Tanner Sent: Friday, June 10, 2005 9:50 AM To: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] stunnel on HP-UX This is what I am getting from stunnel when it starts: 2005.06.09 16:14:36 LOG5[1409:1]: stunnel 4.08 on hppa2.0w-hp-hpux11.11 PTHREAD+POLL+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.06.09 16:14:37 LOG4[1409:1]: PRNG may not have been seeded with enough random bytes 2005.06.09 16:14:37 LOG5[1409:1]: 27 clients allowed 2005.06.09 16:14:37 LOG5[1410:2]: 5140 connected from 127.0.0.1:49153 2005.06.09 16:14:37 LOG3[1410:2]: SSL_connect: Peer suddenly disconnected 2005.06.09 16:14:47 LOG5[1410:3]: 5140 connected from 127.0.0.1:49156 2005.06.09 16:14:47 LOG3[1410:3]: SSL_connect: Peer suddenly disconnected If I restart stunnel it establishes the connection fine, and does not receive the PRNG error. What can I do to generate enough random bytes to get this running properly, without starting stunnel later in the boot process? -----Original Message----- From: Stephen Tanner Sent: Tuesday, June 07, 2005 8:36 AM To: 'Jan Meijer' Subject: RE: [stunnel-users] stunnel on HP-UX Negative, the private key is not protected with a passphrase. If I use the startup script to start stunnel and syslog-ng manually, everything works. But on boot stunnel does not seem to properly establish a connection, and I must stop it and restart it to resolve the issue. Stephen -----Original Message----- From: Jan Meijer [mailto:[email protected]] Sent: Tuesday, June 07, 2005 3:08 AM To: Stephen Tanner Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel on HP-UX On Tue, 31 May 2005, Stephen Tanner wrote: > I'm running stunnel on a HP-UX 11.11 system so that I can securely > transfer logs with syslog-ng. I have stunnel and syslog-ng both > starting in rc2.d at S537. Every time I have rebooted the server I get > a broken pipe as if stunnel is having an issue establishing a tunnel, > and I am forced to restart stunnel and syslog-ng. Are there any > specific daemons that need to be running before stunnel starts? I'm > trying to avoid having this start too late, so that I don't miss logs on > some daemons. There are no specific daemons that need to run. Network is practical for DNS resolving if that's needed. To rule out the obvious: you would not have protected your stunnel private key with a passphrase would you? Jan -- http://www.surfnet.nl/organisatie/jame _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

RE: [stunnel-users] stunnel on HP-UX
by Stephen Tanner 10 Jun '05

10 Jun '05

This is what I am getting from stunnel when it starts: 2005.06.09 16:14:36 LOG5[1409:1]: stunnel 4.08 on hppa2.0w-hp-hpux11.11 PTHREAD+POLL+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.06.09 16:14:37 LOG4[1409:1]: PRNG may not have been seeded with enough random bytes 2005.06.09 16:14:37 LOG5[1409:1]: 27 clients allowed 2005.06.09 16:14:37 LOG5[1410:2]: 5140 connected from 127.0.0.1:49153 2005.06.09 16:14:37 LOG3[1410:2]: SSL_connect: Peer suddenly disconnected 2005.06.09 16:14:47 LOG5[1410:3]: 5140 connected from 127.0.0.1:49156 2005.06.09 16:14:47 LOG3[1410:3]: SSL_connect: Peer suddenly disconnected If I restart stunnel it establishes the connection fine, and does not receive the PRNG error. What can I do to generate enough random bytes to get this running properly, without starting stunnel later in the boot process? -----Original Message----- From: Stephen Tanner Sent: Tuesday, June 07, 2005 8:36 AM To: 'Jan Meijer' Subject: RE: [stunnel-users] stunnel on HP-UX Negative, the private key is not protected with a passphrase. If I use the startup script to start stunnel and syslog-ng manually, everything works. But on boot stunnel does not seem to properly establish a connection, and I must stop it and restart it to resolve the issue. Stephen -----Original Message----- From: Jan Meijer [mailto:[email protected]] Sent: Tuesday, June 07, 2005 3:08 AM To: Stephen Tanner Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel on HP-UX On Tue, 31 May 2005, Stephen Tanner wrote: > I'm running stunnel on a HP-UX 11.11 system so that I can securely > transfer logs with syslog-ng. I have stunnel and syslog-ng both > starting in rc2.d at S537. Every time I have rebooted the server I get > a broken pipe as if stunnel is having an issue establishing a tunnel, > and I am forced to restart stunnel and syslog-ng. Are there any > specific daemons that need to be running before stunnel starts? I'm > trying to avoid having this start too late, so that I don't miss logs on > some daemons. There are no specific daemons that need to run. Network is practical for DNS resolving if that's needed. To rule out the obvious: you would not have protected your stunnel private key with a passphrase would you? Jan -- http://www.surfnet.nl/organisatie/jame _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Compression (zlib) does not work under windows
by Ben 09 Jun '05

09 Jun '05

Hello, Enabling zlib compression in stunnel (versions 4.06 - 4.10) does not work under windows. I have tried a combination of the following, all of which have failed in either two ways. The first way being disconnection with the following messages in the stunnel console: 2005.06.09 11:43:10 LOG7[4072:3088]: SSL alert (write): fatal: decompression failure 2005.06.09 11:43:10 LOG3[4072:3088]: SSL_read: 1408F06B: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression Or stunnel crashes all together. Here are the following combinations I've used with stunnel and openssl. stunnel 4.06 w/ all zlib binary openssl libraries stunnel 4.07 w/ all zlib binary enabled openssl libraries stunnel 4.08 w/ all zlib binary enabled openssl libraries stunnel 4.09 w/ all zlib enabled openssl libraries stunnel 4.10 w/ all zlib enabled openssl libraries stunnel 4.06 w/ custom compiled openssl 0.9.7g w/ zlib library under vc++ stunnel 4.07 w/ custom compiled openssl 0.9.7g w/ zlib library under vc++ stunnel 4.08 w/ custom compiled openssl 0.9.7g w/ zlib library under vc++ stunnel 4.09 w/ custom compiled openssl 0.9.7g w/ zlib library under vc++ stunnel 4.10 w/ custom compiled openssl 0.9.7g w/ zlib library under vc++ Under linux, using stunnel as a client, compression works correctly. On the server I have tried stunnel versions: stunnel 4.06 w/ zlib openssl 0.9.7g and openssl 0.9.7f stunnel 4.09 w/ zlib openssl 0.9.7g and openssl 0.9.7f stunnel 4.10 w/ zlib openssl 0.9.7g and openssl 0.9.7f Any help would be appreciated. We offer stunnel connections as a service to our clients to reduce the overhead of NNTP traffic and we would very much like to get compression working. Thanks for your time, Ben

1 0

RE: Re-Installing Stunnel
by mhrtmhd94＠att.net 08 Jun '05

08 Jun '05

On 2005-06-07, at 23:45:35, Michal.Trojnara(a)mirt.net wrote: > On 2005-06-06, at 22:56, mhrtmhd94(a)att.net wrote: > > The only way I could do this was to delete all of the programs in the > > Stunnel directory > > You should stop and uninstall stunnel service first. 8-) > AFAIK it's also possible to remove a service from Control > Panel/Services. > > Best regards, > Mike > There doesn't appear to be any Services option under Control Panel on my system (WinXp Home SP2) Thanks. Mort

2 1

Reinstalling Stunnel
by mhrtmhd94＠att.net 07 Jun '05

07 Jun '05

I followed the Agent/Stunnel instructions on WURD. I reached the point where I added a space, followed by -install to the shortcut target path. When I attempted to execute this, a message appeared: "Failed to create a new service." I want to thank all those who answered my previous request. I am hoping that someone with experience using Stunnel in conjunction with Agent might be able to help me. I can't for the life of me figure out what I did differently from the first time I installed Stunnel to run with Agent. One person who replied to my previous request asked if I had uninstalled the previous installation of Stunnel. The only way I could do this was to delete all of the programs in the Stunnel directory, because Stunnel does not appear on the list of programs under Add and Delete Programs via Control Panel. Note: I originally was using version 4.07. I am now attempting to use version 4.10. Could this be the problem? Thanks in advance to anyone who can help.

2 1

FW: [stunnel-users] stunnel on HP-UX
by Stephen Tanner 07 Jun '05

07 Jun '05

I forgot to make sure this went to the list. -----Original Message----- From: Stephen Tanner Sent: Tuesday, June 07, 2005 8:36 AM To: 'Jan Meijer' Subject: RE: [stunnel-users] stunnel on HP-UX Negative, the private key is not protected with a passphrase. If I use the startup script to start stunnel and syslog-ng manually, everything works. But on boot stunnel does not seem to properly establish a connection, and I must stop it and restart it to resolve the issue. Stephen -----Original Message----- From: Jan Meijer [mailto:[email protected]] Sent: Tuesday, June 07, 2005 3:08 AM To: Stephen Tanner Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel on HP-UX On Tue, 31 May 2005, Stephen Tanner wrote: > I'm running stunnel on a HP-UX 11.11 system so that I can securely > transfer logs with syslog-ng. I have stunnel and syslog-ng both > starting in rc2.d at S537. Every time I have rebooted the server I get > a broken pipe as if stunnel is having an issue establishing a tunnel, > and I am forced to restart stunnel and syslog-ng. Are there any > specific daemons that need to be running before stunnel starts? I'm > trying to avoid having this start too late, so that I don't miss logs on > some daemons. There are no specific daemons that need to run. Network is practical for DNS resolving if that's needed. To rule out the obvious: you would not have protected your stunnel private key with a passphrase would you? Jan -- http://www.surfnet.nl/organisatie/jame

1 0

stunnel on HP-UX
by Stephen Tanner 07 Jun '05

07 Jun '05

I'm running stunnel on a HP-UX 11.11 system so that I can securely transfer logs with syslog-ng. I have stunnel and syslog-ng both starting in rc2.d at S537. Every time I have rebooted the server I get a broken pipe as if stunnel is having an issue establishing a tunnel, and I am forced to restart stunnel and syslog-ng. Are there any specific daemons that need to be running before stunnel starts? I'm trying to avoid having this start too late, so that I don't miss logs on some daemons. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

2 1

Reinstalling Stunnel
by mxrtmxd72＠att.net 06 Jun '05

06 Jun '05

I followed the Agent/Stunnel instructions on WURD. I reached the point where I added a space, followed by -install to the shortcut target path. When I attempted to execute this, a message appeared: "Failed to create a new service." I want to thank all those who answered my previous request. I am hoping that someone with experience using Stunnel in conjunction with Agent might be able to help me. I can't for the life of me figure out what I did differently from the first time I installed Stunnel to run with Agent. One person who replied to my previous request asked if I had uninstalled the previous installation of Stunnel. The only way I could do this was to delete all of the programs in the Stunnel directory, because Stunnel does not appear on the list of programs under Add and Delete Programs via Control Panel. Note: I originally was using version 4.07. I am now attempting to use version 4.10. Could this be the problem? Thanks in advance to anyone who can help. Mort Middleman

1 0

[PATCH] Fix inetd mode
by Miloslav Trmac 05 Jun '05

05 Jun '05

Hello, the attached patch fixes inetd mode. signal_pipe[] is not used in inetd mode, so it was left default-initialized to {0, 0}. Emptying "the pipe" would eat all input data. The second hunk was already posted here by Michal Trojnara. Mirek

2 1

slightly OT: starting up multiple instances
by Colin McKinnon 01 Jun '05

01 Jun '05

Hi all, I realise this is slightly OT (the problem seems to be in a different program) but thought that someobdy out there may have solved this one already. I'm trying to run a second instance of stunnel (different 'verify' level) on a SuSE 8.2 box. The second instance just doesn't start. What I did was to copy the supplied /etc/init.d/stunnel script to 'stunnelv' and referenced different config and PID files. After I had fixed bug in the startup script (the line which started the process - using startproc - didn't pass the conf file, and didn't get told to use the PID file) I still got the same error. Now, if I run '/etc/init.d/stunnel start' I get /var/run/stunnel.pid. If I then run '/etc/init.d/stunnelv start' it reports 'OK' but didn't really start. If I start them the other way around 'stunnelv' works and I get /var/run/stunnelv.pid but then 'stunnel' won't start. Thinking that 'startproc' is seeing 'stunnel' already running in the processlist, I tried creating a symbolic link '/usr/sbin/stunelv' to /usr/bin/stunnel and changed '/etc/init.d/stunnelv' to run that instead of '/usr/sbin/stunnel'. Looking in 'ps' it is reported as 'stunnelv' but I still can't get the second instance to start. The error seems to be with 'startproc' - it seems to think that the intended process is running when it's not. If I just type in the line which starts up stunnel as shown below I get the same behaviour. startproc -v -l /var/log/rc.stunnelv.log -p /var/run/stunnelv.pid /usr/sbin/stunnelv /etc/stunnel/verified_clients.conf Unfortunately, the '-v' option doesn't seem to work. Anybody any suggestions? TIA, Colin

2 1

[PATCH] Reject inetd mode with no client specification
by Miloslav Trmac 01 Jun '05

01 Jun '05

Hello, when stunnel is started in inetd mode without specifying connect = nor exec =, it attempts to execl(NULL) and the child SIGSEGVs. The attached patch adds a check to reject such configurations. Mirek

1 0

Problems with Stunnel4.05 on Linux Servers
by vasudha.upadhyaya＠convergys.com 27 May '05

27 May '05

Hi, We have been using stunnel 4.05 with OpenSSL 0.97d for quite sometime on Linux Servers and now suddenly we have been getting this error: 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 8506606B : error:8506606B:lib(133):AEP_GET_CONNECTION:init failure 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 85068069 : error:85068069:lib(133):AEP_MOD_EXP:get handle failed 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 8506606B : error:8506606B:lib(133):AEP_GET_CONNECTION:init failure 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 85068069 : error:85068069:lib(133):AEP_MOD_EXP:get handle failed 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 8506606B : error:8506606B:lib(133):AEP_GET_CONNECTION:init failure 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 85068069 : error:85068069:lib(133):AEP_MOD_EXP:get handle failed 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 8506606B : error:8506606B:lib(133):AEP_GET_CONNECTION:init failure 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 85069069 : error:85069069:lib(133):AEP_MOD_EXP_CRT:get handle failed Attached is the stunnel.conf file. (See attached file: stunnel.conf) Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0

Stunnel - Transfer loop executes not transferring any data.
by Glenn Stowe 27 May '05

27 May '05

Hi, did you find a resolution to this problem? I'm getting the same thing, and found your post while googling the user group.. Thx, Glenn -- CubeWerx Inc. | It's never too late to Glenn Stowe - Sales Techie Guy, | have a happy childhood. gstowe(a)cubewerx.com www.cubewerx.com | -- Tom Robbins, "Still Ph:(819) 771-6552 Fax:(819) 772-4838 | Life with Woodpecker"

1 0

stunnel terminates unexpectedly on FreeBSD 5.4
by Christian Wittenhorst 26 May '05

26 May '05

Bug Report: description: stunnel just terminated after exactly two incoming SSL connections. No error is logged, no core dump. affected versions: (plain ./configure) stunnel-4.04: works fine stunnel-4.05: crashes stunnel-4.08: crashes stunnel-4.10: crashes uname -a: FreeBSD db.kanti-zug.ch 5.4-RELEASE-p1 FreeBSD 5.4-RELEASE-p1 #0: Thu May 26 15:36:18 CEST 2005 [email protected]:/usr/src/sys/i386/compile/db i386 log: 2005.05.26 16:28:43 LOG5[20644:1]: stunnel 4.10 on i386-unknown-freebsd5.4 UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 2005.05.26 16:28:43 LOG7[20644:1]: RAND_status claims sufficient entropy for the PRNG 2005.05.26 16:28:43 LOG6[20644:1]: PRNG seeded successfully 2005.05.26 16:28:43 LOG7[20644:1]: Certificate: /db/server.crt 2005.05.26 16:28:43 LOG7[20644:1]: Key file: /db/server.key 2005.05.26 16:28:43 LOG6[20644:1]: file ulimit = 11095 (can be changed with 'ulimit -n') 2005.05.26 16:28:43 LOG6[20644:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.05.26 16:28:43 LOG5[20644:1]: 5417 clients allowed 2005.05.26 16:28:43 LOG7[20644:1]: FD 4 in non-blocking mode 2005.05.26 16:28:43 LOG7[20644:1]: FD 5 in non-blocking mode 2005.05.26 16:28:43 LOG7[20644:1]: FD 6 in non-blocking mode 2005.05.26 16:28:43 LOG7[20644:1]: SO_REUSEADDR option set on accept socket 2005.05.26 16:28:43 LOG7[20644:1]: postgres bound to 85.158.25.7:5430 2005.05.26 16:28:43 LOG7[20644:1]: No pid file being created 2005.05.26 16:28:43 LOG7[20644:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:1]: postgres accepted FD=7 from 212.203.73.19:55038 2005.05.26 16:28:46 LOG7[20644:1]: Creating a new context 2005.05.26 16:28:46 LOG7[20644:1]: Context 2 created 2005.05.26 16:28:46 LOG7[20644:2]: postgres started 2005.05.26 16:28:46 LOG7[20644:2]: FD 7 in non-blocking mode 2005.05.26 16:28:46 LOG5[20644:2]: postgres connected from 212.203.73.19:55038 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): before/accept initialization 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 read client hello A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write server hello A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write certificate A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write certificate request A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 flush data 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:2]: SSL alert (read): warning: no certificate 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 read client key exchange A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 read finished A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write change cipher spec A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write finished A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 flush data 2005.05.26 16:28:46 LOG7[20644:2]: 1 items in the session cache 2005.05.26 16:28:46 LOG7[20644:2]: 0 client connects (SSL_connect()) 2005.05.26 16:28:46 LOG7[20644:2]: 0 client connects that finished 2005.05.26 16:28:46 LOG7[20644:2]: 0 client renegotiatations requested 2005.05.26 16:28:46 LOG7[20644:2]: 1 server connects (SSL_accept()) 2005.05.26 16:28:46 LOG7[20644:2]: 1 server connects that finished 2005.05.26 16:28:46 LOG7[20644:2]: 0 server renegotiatiations requested 2005.05.26 16:28:46 LOG7[20644:2]: 0 session cache hits 2005.05.26 16:28:46 LOG7[20644:2]: 1 session cache misses 2005.05.26 16:28:46 LOG7[20644:2]: 0 session cache timeouts 2005.05.26 16:28:46 LOG6[20644:2]: SSL accepted: new session negotiated 2005.05.26 16:28:46 LOG6[20644:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.05.26 16:28:46 LOG7[20644:2]: FD 8 in non-blocking mode 2005.05.26 16:28:46 LOG7[20644:2]: postgres connecting 127.0.0.1:5432 2005.05.26 16:28:46 LOG7[20644:2]: connect_wait: waiting 10 seconds 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:2]: connect_wait: connected 2005.05.26 16:28:46 LOG7[20644:2]: Remote FD=8 initialized 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:2]: Socket closed on read 2005.05.26 16:28:46 LOG7[20644:2]: SSL write shutdown 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 60 second(s) for 3 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:2]: SSL alert (write): warning: close notify 2005.05.26 16:28:46 LOG7[20644:2]: SSL_shutdown retrying 2005.05.26 16:28:46 LOG7[20644:2]: SSL doesn't need to read or write 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 60 second(s) for 3 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:2]: SSL alert (read): warning: close notify 2005.05.26 16:28:46 LOG7[20644:2]: SSL closed on SSL_read 2005.05.26 16:28:46 LOG7[20644:2]: Socket write shutdown 2005.05.26 16:28:46 LOG5[20644:2]: Connection closed: 550 bytes sent to SSL, 446 bytes sent to socket 2005.05.26 16:28:46 LOG7[20644:2]: postgres finished (0 left) 2005.05.26 16:28:46 LOG7[20644:2]: Context 2 closed 2005.05.26 16:28:46 LOG7[20644:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:1]: postgres accepted FD=7 from 212.203.73.19:55040 2005.05.26 16:28:48 LOG7[20644:1]: Creating a new context 2005.05.26 16:28:48 LOG7[20644:1]: Context 3 created 2005.05.26 16:28:48 LOG7[20644:3]: postgres started 2005.05.26 16:28:48 LOG7[20644:3]: FD 7 in non-blocking mode 2005.05.26 16:28:48 LOG5[20644:3]: postgres connected from 212.203.73.19:55040 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): before/accept initialization 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 read client hello A 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 write server hello A 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 write change cipher spec A 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 write finished A 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 flush data 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 read finished A 2005.05.26 16:28:48 LOG7[20644:3]: 1 items in the session cache 2005.05.26 16:28:48 LOG7[20644:3]: 0 client connects (SSL_connect()) 2005.05.26 16:28:48 LOG7[20644:3]: 0 client connects that finished 2005.05.26 16:28:48 LOG7[20644:3]: 0 client renegotiatations requested 2005.05.26 16:28:48 LOG7[20644:3]: 2 server connects (SSL_accept()) 2005.05.26 16:28:48 LOG7[20644:3]: 2 server connects that finished 2005.05.26 16:28:48 LOG7[20644:3]: 0 server renegotiatiations requested 2005.05.26 16:28:48 LOG7[20644:3]: 1 session cache hits 2005.05.26 16:28:48 LOG7[20644:3]: 1 session cache misses 2005.05.26 16:28:48 LOG7[20644:3]: 0 session cache timeouts 2005.05.26 16:28:48 LOG6[20644:3]: SSL accepted: previous session reused 2005.05.26 16:28:48 LOG7[20644:3]: FD 8 in non-blocking mode 2005.05.26 16:28:48 LOG7[20644:3]: postgres connecting 127.0.0.1:5432 2005.05.26 16:28:48 LOG7[20644:3]: connect_wait: waiting 10 seconds 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:3]: connect_wait: connected 2005.05.26 16:28:48 LOG7[20644:3]: Remote FD=8 initialized 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:3]: Socket closed on read 2005.05.26 16:28:48 LOG7[20644:3]: SSL write shutdown 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 60 second(s) for 3 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:3]: SSL alert (write): warning: close notify 2005.05.26 16:28:48 LOG7[20644:3]: SSL_shutdown retrying 2005.05.26 16:28:48 LOG7[20644:3]: SSL doesn't need to read or write 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 60 second(s) for 3 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:3]: SSL alert (read): warning: close notify 2005.05.26 16:28:48 LOG7[20644:3]: SSL closed on SSL_read 2005.05.26 16:28:48 LOG7[20644:3]: Socket write shutdown 2005.05.26 16:28:48 LOG5[20644:3]: Connection closed: 550 bytes sent to SSL, 446 bytes sent to socket 2005.05.26 16:28:48 LOG7[20644:3]: postgres finished (0 left)

2 2

Installing Stunnel
by mhrtmhd94＠att.net 26 May '05

26 May '05

I installed (actually re-installed) Stunnel. I got as far as creating the shortcut as follows: c:\stunnel\stunnel-4.10.exe -install. The message "Failed to Create a New Service" appeared. I need some help. Thanks.

2 1

Patch: verify_depth and remote_subj
by Michael Smith 26 May '05

26 May '05

Hi, I've attached a patch against stunnel 4.10. It adds two verification options to the global configuration: === remote_subj = expected subject for the remote certificate If set, the remote certificate's subject must match this string. You can obtain the subject in the proper format by running openssl x509 -in servercert.pem -noout -subject Example: remote_subj = /C=CA/ST=Ontario/CN=gw Requires verify=2 or greater. verify_depth = maximum number of CA certificates in chain Specifies the maximum certificate chain depth when verifying the peer certificate: 0: peer certificate must be self-signed 1: peer certificate must be signed by a root CA 2: peer certificate can be signed by at most one intermediate CA The stunnel default depth is 9 for backwards compatibility. Please note that Apache/SSL defaults to 1. If your non-CA certificates are marked with the X509v3 basic constraint "CA:FALSE", you probably do not need to worry about chain depth. This is the default behaviour for most CA tools, including the scripts that ship with OpenSSL. === remote_subj probably belongs in per-service config, not global, but the SSL verification setup is global and I didn't want to start messing with it. Mike

1 0

Upstream Connect
by Justin Alexander 25 May '05

25 May '05

Is there a way with stunnel for a client to connect to a server (hopping a firewall), forming a secured SSL/TCP connection, that will allow the server to connect back to the client machine over that tunnel? So far, all I've read is that stunnel only allows connections to start on the client and connect down stream (through the tunnel) to the server. I need to reverse this pattern.

1 0

How to install Intermediate certificate on Stunnel
by Srinivas B 19 May '05

19 May '05

Hi, Can any one help me how to register the Intermediate.cer certificate, which i have obtain from verisign on Stunnel 3.8 i have used openssl 0.9.6 for creation of the certificate on windows NT4.0 Thanks.... Srinivas Yahoo! India Matrimony: Find your life partneronline.

2 1

Re: unexpected shutdown of stunnel
by Paul Dekkers 18 May '05

18 May '05

Hi, For what it's worth: >I use Freebsd and made an update from stunnel 4.8 to stunnel 4.10 from >the ports today. Now I noticed that stunnel stops after a while. > > I experienced the same, only my configuration ran in server- instead of client-mode. The only thing that I did while building the port was using -DWITH_IPV6, but I assume that shouldn't be a problem. >And these are the last lines of the log:005.05.15 10:34:00 > > I used debug = 5, and I didn't see anything usefull in the logs. I'm glad someone has the same problem and has better logging then I have ;-) The last log line was the incoming session, that's it. >Everything went fine with 4.8, now stunnel is not running anymore after >a short period of time (few minutes). > > I'm back to the 4.7 we had previously. We're using this in production, so I couldn't really experiment much with the 4.10. Regards, Paul

1 0

CN field of server cert
by spambox＠poczta.onet.pl 16 May '05

16 May '05

Hi stunnel-users, There is example configuration:  I don't know how to enforce stunnel to verify CN field from server provided certificate. Even if i change "connect" field to next one stunnel will not complain. So, am I wrong that when someone hijack (mitm) this connection and provide any server cert signed by ThawteServerCA then I loose? Please add this verification to stunnel when verify is set to 2 or better as an separate option "verify_cn?" which could be used in service-level context. Usting this option with that described below I can drop 'verify' and 'CAfile' at all and feel much better. :) There is another verification method that could be added - not related to verify option. In most cases I know public cert of remote server. So I also know sha1/md5 fingerprint of that cert. Security could improve v.much by just adding these lines to my example configuration: fingerprint_md5=F5:BD:C3:C8:D5:4B:03:EA:57:BB:81:72:46:6B:26:54 fingerprint_sha1=CE:3A:0D:3E:DA:4B:77:A3:53:C0:9E:A8:65:B7:F8:C2:09:71:43:41 Another good service-level option? There are some other good options that could be ported from openssl/s_client: "-ssl2, -ssl3, -tls1, -no_ssl2, -no_ssl3, -no_tls1" Regards.

3 3

unexpected shutdown of stunnel
by Daniel Graupner 15 May '05

15 May '05

Hello, I use Freebsd and made an update from stunnel 4.8 to stunnel 4.10 from the ports today. Now I noticed that stunnel stops after a while. Here is my conf: chroot = /usr/local/stunnel pid = /stunnel.pid setuid = stunnel setgid = stunnel debug = 7 output = /usr/local/stunnel/stunnel.log client = yes [https] accept = localhost:9999 connect = <ssl-apache>:443 TIMEOUTclose = 0 And these are the last lines of the log:005.05.15 10:34:00 LOG7[60990:0]: Waiting 0 second(s) for 3 file descriptor(s) 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.15 10:34:00 LOG7[60990:3]: SSL alert (write): warning: close notify 2005.05.15 10:34:00 LOG7[60990:3]: SSL_shutdown retrying 2005.05.15 10:34:00 LOG7[60990:3]: SSL doesn't need to read or write 2005.05.15 10:34:00 LOG7[60990:0]: Waiting 0 second(s) for 3 file descriptor(s) 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.15 10:34:00 LOG7[60990:3]: SSL alert (read): warning: close notify 2005.05.15 10:34:00 LOG7[60990:3]: SSL closed on SSL_read 2005.05.15 10:34:00 LOG7[60990:3]: Socket write shutdown 2005.05.15 10:34:00 LOG5[60990:3]: Connection closed: 197 bytes sent to SSL, 784 bytes sent to socket 2005.05.15 10:34:00 LOG7[60990:3]: https finished (0 left) 2005.05.15 10:34:00 LOG7[60990:3]: removing pid file /stunnel.pid Everything went fine with 4.8, now stunnel is not running anymore after a short period of time (few minutes). Regards, Daniel.

1 0

Problems with stunnel 4.10 compilation
by Oleg Ivanov 14 May '05

14 May '05

Hello. I've compiled stunnel 4.10 without any problems on my Gentoo workstation and RedHat server. But now I need to install it into my old legacy Mandrake 8.2 server and here I've got into troubles. I've updated zlib and openssl (configuring it with "zlib" option) to their latest versions, then tried to make stunnel and got following errors: --- /usr/lib/libcrypto.a(c_zlib.o): In function `zlib_compress_block': c_zlib.o(.text+0x48): undefined reference to `compress' /usr/lib/libcrypto.a(c_zlib.o): In function `zz_uncompress': c_zlib.o(.text+0x145): undefined reference to `inflateInit_' c_zlib.o(.text+0x159): undefined reference to `inflate' c_zlib.o(.text+0x16c): undefined reference to `inflateEnd' c_zlib.o(.text+0x18b): undefined reference to `inflateEnd' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make: *** [all-recursive] Error 1 --- It seems like problems with zlib so I've double-checked it - but zlib 1.2.2 is really installed. If I recompile openssl without "zlib" option then I can make stunnel but it can't initialize zlib compression algorithm that I really need. And if I compile openssl with zlib - stunnel fails on make with errors. Can anyone help with it please? I really stuck 8( PS: My system's parameters according to support page requirements: # uname -a Linux localhost 2.4.27-vs1.29 #2 SMP Tue Oct 5 15:51:37 CDT 2004 i686 unknown glibc version: 2.2.4 # gcc -v Reading specs from /usr/lib/gcc-lib/i586-mandrake-linux-gnu/2.96/specs gcc version 2.96 20000731 (Mandrake Linux 8.2 2.96-0.76mdk) # openssl version OpenSSL 0.9.7g 11 Apr 2005 Best Regards, Oleg Ivanov. -- Oleg Ivanov mailto: saruman(a)unigsm.com

1 1

Connection details patch for 4.10
by Oleg Ivanov 14 May '05

14 May '05

Hello. I've modified the old "conndetails_peter" patch by Peter D. Gray to let it work with stunnel 4.10. I've also added to it information about compression (available compression methods and negotiated method). Patch creates a file "conn.LOCAL_HOST:LOCAL_PORT" in a configurable temp directory (config file: "infodir" option). The file is deleted when the client disconnects. Full description of original can be found at: http://www.stunnel.org/patches/desc/conndetails_peter.html Hope it will be useful for someone. Best Regards, Oleg Ivanov. -- Oleg Ivanov mailto: saruman(a)unigsm.com diff -cr ../stunnel-4.10.orig/src/client.c src/client.c *** ../stunnel-4.10.orig/src/client.c 2005-05-13 00:43:24.000000000 -0200 --- src/client.c 2005-05-13 01:34:36.000000000 -0200 *************** *** 94,99 **** --- 94,114 ---- c->opt=opt; c->local_rfd.fd=rfd; c->local_wfd.fd=wfd; + + if(options.info_dir) { + sprintf(c->info_fname, "%s/pid.%d", options.info_dir, getpid()); + c->info_file = fopen(c->info_fname, "w"); + if(!c->info_file) { + s_log(LOG_ERR, "failed to create: %s (continuing)", c->info_fname); + c->info_fname[0] = 0; + } else { + s_log(LOG_DEBUG, "connection detail to be written to: %s", + c->info_fname); + fprintf(c->info_file, "# connection details\n" + "STUNNEL_PID=%d\n", getpid()); + } + } + return c; } *************** *** 203,208 **** --- 218,228 ---- s_log(LOG_NOTICE, "%s connected from %s", c->opt->servname, c->accepting_address); } + if(c->info_file) { + fprintf(c->info_file, "SERVICE=\"%s\"\n", c->opt->servname); + fprintf(c->info_file, "REMOTE_HOST=\"%s\"\nREMOTE_PORT=%d\n", + c->accepting_address, ntohs(c->peer_addr.addr[0].in.sin_port)); + } return 0; /* OK */ } *************** *** 237,242 **** --- 257,289 ---- } #endif s_log(LOG_DEBUG, "Remote FD=%d initialized", fd); + if(c->info_file) { + struct sockaddr_in addr; + int addrlen = sizeof(addr); + if(getsockname(fd, (struct sockaddr *)&addr, &addrlen)) { + // ignore error + } else { + char newname[STRLEN]; + + /* record our end of the tunnel, and change name of file to match */ + enter_critical_section(CRIT_NTOA); /* inet_ntoa is not mt-safe */ + fprintf(c->info_file, "LOCAL_HOST=\"%s\"\nLOCAL_PORT=%d\n", + inet_ntoa(addr.sin_addr), ntohs(addr.sin_port)); + sprintf(newname, "%s/conn.%s:%d", + options.info_dir, + inet_ntoa(addr.sin_addr), ntohs(addr.sin_port)); + leave_critical_section(CRIT_NTOA); + + /* done with file, close it now */ + fprintf(c->info_file, "# EOF\n"); + fclose(c->info_file); + c->info_file = NULL; + + /* rename so it's easy for the client to find */ + rename(c->info_fname, newname); + strcpy(c->info_fname, newname); + } + } c->remote_fd.fd=fd; c->remote_fd.is_socket=1; /* Always! */ if(set_socket_options(fd, 2)<0) *************** *** 674,679 **** --- 721,737 ---- reset(c->local_wfd.fd, "linger (local_wfd)"); } } + /* Cleanup connection info file which isn't useful anymore */ + if(options.info_dir) { + if(c->info_file) { + fclose(c->info_file); + c->info_file = NULL; + } + if(c->info_fname) { + unlink(c->info_fname); /* ignore errors */ + s_log(LOG_INFO, "removed info file: %s", c->info_fname); + } + } } static void print_cipher(CLI *c) { /* print negotiated cipher */ *************** *** 683,689 **** #else SSL_CIPHER *cipher; char buf[STRLEN]; ! int len; cipher=SSL_get_current_cipher(c->ssl); SSL_CIPHER_description(cipher, buf, STRLEN); --- 741,748 ---- #else SSL_CIPHER *cipher; char buf[STRLEN]; ! int len, cnt; ! SSL_COMP *comp=NULL; cipher=SSL_get_current_cipher(c->ssl); SSL_CIPHER_description(cipher, buf, STRLEN); *************** *** 691,696 **** --- 750,809 ---- if(len>0) buf[len-1]='\0'; s_log(LOG_INFO, "Negotiated ciphers: %s", buf); + + if(c->info_file) { + X509 *peer; + + fprintf(c->info_file, "CIPHER_DESC=\"%s\"\n", buf); + fprintf(c->info_file, "CIPHER_ALGO=\"%s\"\n", + SSL_CIPHER_get_name(cipher)); + fprintf(c->info_file, "CIPHER_BITS=%d\n", + SSL_CIPHER_get_bits(cipher, NULL)); + // Show compression info + if (c->ssl->ctx->comp_methods == NULL) { + // No compression methods available + fprintf(c->info_file, "No compression methods available\n"); + } else { + int cntMethods = sk_SSL_COMP_num(c->ssl->ctx->comp_methods); + fprintf(c->info_file, "%d compression method(s) available:\n", cntMethods); + for (cnt=0; cnt<cntMethods; cnt++) { + comp=sk_SSL_COMP_value(c->ssl->ctx->comp_methods, cnt); + fprintf(c->info_file, "%d\t%s ", comp->id, comp->name); + switch (comp->id) { + case 0xe0: + fprintf(c->info_file, "(zlib)\n"); break; + case 0xe1: + fprintf(c->info_file, "(rle)\n"); break; + default: + fprintf(c->info_file, "(unknown)\n"); break; + } + } + } + if (c->ssl->s3->tmp.new_compression == NULL) { + fprintf(c->info_file, "SSL_COMP=NULL\n"); + } else { + fprintf(c->info_file, "SSL_COMP.id=%d ", + c->ssl->s3->tmp.new_compression->id); + switch (comp->id) { + case 0xe0: + fprintf(c->info_file, "(zlib)\n"); break; + case 0xe1: + fprintf(c->info_file, "(rle)\n"); break; + default: + fprintf(c->info_file, "(unknown)\n"); break; + } + } + peer = SSL_get_peer_certificate(c->ssl); + if(peer) { + X509_NAME_oneline(X509_get_subject_name(peer), buf, STRLEN); + fprintf(c->info_file, "SSL_CLIENT_DN=\"%s\"\n", buf); + + X509_NAME_oneline(X509_get_issuer_name(peer), buf, STRLEN); + fprintf(c->info_file, "SSL_CLIENT_I_DN=\"%s\"\n", buf); + + X509_free(peer); + } + } #endif } *************** *** 953,958 **** --- 1066,1075 ---- s_ntop(c->connecting_address, &addr); s_log(LOG_DEBUG, "%s connecting %s", c->opt->servname, c->connecting_address); + if(c->info_file) { + fprintf(c->info_file, "TUNNEL_HOST=\"%s\"\nTUNNEL_PORT=%d\n", + c->connecting_address, ntohs(addr.in.sin_port)); + } if(!connect(s, &addr.sa, addr_len(addr))) return s; /* no error -> success (should not be possible) */ error=get_last_socket_error(); Only in src: client.c.orig Only in src: client.c~ diff -cr ../stunnel-4.10.orig/src/options.c src/options.c *** ../stunnel-4.10.orig/src/options.c 2005-05-13 00:43:24.000000000 -0200 --- src/options.c 2005-05-13 00:44:16.000000000 -0200 *************** *** 664,669 **** --- 664,693 ---- break; } + /* infodir */ + switch(cmd) { + case CMD_INIT: + options.info_dir=NULL; + break; + case CMD_EXEC: + if(strcasecmp(opt, "infodir")) + break; + if(arg[0]) { /* not empty */ + if(strlen(arg) > STRLEN - 20) return "infodir pathname too long"; + options.info_dir=stralloc(arg); + } else { + options.info_dir=NULL; + } + return NULL; /* OK */ + case CMD_DEFAULT: + break; + case CMD_HELP: + log_raw("%-15s = writable directory to store connection info into", + "infodir"); + break; + } + + if(cmd==CMD_EXEC) return option_not_found; return NULL; /* OK */ diff -cr ../stunnel-4.10.orig/src/prototypes.h src/prototypes.h *** ../stunnel-4.10.orig/src/prototypes.h 2005-05-13 00:43:24.000000000 -0200 --- src/prototypes.h 2005-05-13 00:47:03.000000000 -0200 *************** *** 113,118 **** --- 113,119 ---- int verify_level; int verify_use_only_my; long ssl_options; + char *info_dir; /* directory for connection info */ /* some global data for stunnel.c */ #ifndef USE_WIN32 *************** *** 264,269 **** --- 265,272 ---- FD *ssl_rfd, *ssl_wfd; /* Read and write SSL descriptors */ int sock_bytes, ssl_bytes; /* Bytes written to socket and ssl */ s_poll_set fds; /* File descriptors */ + FILE *info_file; /* text file with connection information */ + char info_fname[STRLEN]; /* file name (full path) for info_file */ } CLI; extern int max_clients; *************** *** 305,311 **** /**************************************** Prototypes for sthreads.c */ typedef enum { ! CRIT_KEYGEN, CRIT_INET, CRIT_CLIENTS, CRIT_WIN_LOG, CRIT_SESSION, CRIT_SECTIONS } SECTION_CODE; --- 308,314 ---- /**************************************** Prototypes for sthreads.c */ typedef enum { ! CRIT_KEYGEN, CRIT_INET, CRIT_CLIENTS, CRIT_WIN_LOG, CRIT_SESSION, CRIT_NTOA, CRIT_SECTIONS } SECTION_CODE;

1 0

syslog on Solaris2.9
by Geoff LeBoldus 13 May '05

13 May '05

I can't seem to get stunnel-4.10 to log properly to syslog. Stunnel logs the startup, but doesn't log any individual tunnel information. If I specify its own file and debug = 7, it logs everything as expected. I've tried a number of different configuration combinations without success. Any thoughts? Here's my current config snippets - stunnel.conf debug = local0.debug -syslog.conf local0.debug /var/log/syslog Stunnel startup from /var/log/syslog May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] stunnel 4.10 on sparc-sun-solaris2.9 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] stunnel 4.10 on sparc-sun-solaris2.9 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Snagged 64 random bytes from /home/geoff/.rnd May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Wrote 1024 new random bytes to /home/geoff/.rnd May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] RAND_status claims sufficient entropy for the PRNG May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.info] PRNG seeded successfully May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Certificate: /opt/local/etc/stunnel/stunnel.pem May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Key file: /opt/local/etc/stunnel/stunnel.pem May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.info] file ulimit = 1024 (can be changed with 'ulimit -n') May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.info] poll() used - no FD_SETSIZE limit for file descriptors May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] 500 clients allowed May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] 500 clients allowed May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] FD 5 in non-blocking mode May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] FD 6 in non-blocking mode May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] FD 7 in non-blocking mode May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] SO_REUSEADDR option set on accept socket May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] ldaps bound to 0.0.0.0:1212 May 13 15:31:31 server_name stunnel[4577]: [ID 702911 local0.debug] Created pid file /stunnel.pid May 13 15:31:31 server_name stunnel[4577]: [ID 702911 local0.debug] Waiting -1 second(s) for 2 file descriptor(s) -- Geoff LeBoldus Systems Programmer Information Technology Services

1 0

Session Reuse Information for Stunnel
by vasudha.upadhyaya＠convergys.com 11 May '05

11 May '05

I know that Stunnel reuses sessions. Can anyone tell me the default time that stunnel reuses the old session. And to set a value for session timeout do I use the option: session = timeout session cache timeout Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

2 1

zlib compression
by Oleg Ivanov 09 May '05

09 May '05

Hello. I have installed stunnel 4.09 both as client (on my computer) and as server (on server). Both has zlib compression enabled and I can see that zlib initializes properly in the logs (it says "Compression enabled using zlib method"). But when I send any data over that tunnel I can't see any signs of compression - amount of traffic is almost the same as over plain connection. Am I doing something wrong? Or I'm misunderstanding the purpose of this compression ability? And if the traffic indeed must be reduced - why I can't see that and how can I make it work properly? Thank you for your answers. Best Regards, Oleg Ivanov. -- Oleg Ivanov mailto: saruman(a)unigsm.com

2 2

connect ip = accept ip on multihomed server ?
by Dennis Spreen 09 May '05

09 May '05

hi all, with a configuration (stunnel4.10) like this [conc1] accept = 100 connect = 99 stunnel accepts all requests on all ips on port 100 but connects with the localhost to port 99. is it possible to configure stunnel that if it accepts a connection on 1.2.3.4:100 it connects to 1.2.3.4:99 ? I know it is possible to use accept = 1.2.3.4:100 connect = 1.2.3.4:99 .... accept = 1.2.3.250:100 connect = 1.2.3.250:99 but i'm on a c-class and that would require about 250 entries in the config file. Is there a better way to do this? regards dennis

1 0

Problems in Stunnel4.10
by vasudha.upadhyaya＠convergys.com 06 May '05

06 May '05

Hi, We have been using stunnel 4.05 and recently downloded the stunnel 4.10 and deployed in our environmrnt. All the traffice is going via the Load Balancer Cisco CSS with SSL Module to the unix server(with stunnel4.10 on them). We also 4.10 deployed on the Windows2000 as a client. The CSS sends keep Alives to check the health of the servers(whether they are up or not).And I guess due to this the stunnel on unix servers crashes immediately and there is a access violation error. Attached is the truss output for one of the unix servers.Stunnel4.10 was compiled using OpenSSL0.97d and OpenSSL0.97g, and still we get the same problem.Attached is the stunnel.conf also.[attachment "stunnel.conf" deleted by Vasudha Upadhyaya/CCMG/CVG] (See attached file: truss.out) (See attached file: stunnel.conf) Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0

qmail+tcpserver+stunnel-4.x
by Scott Geiger 06 May '05

06 May '05

Does anyone have a good link to setting up qmail to use stunnel for pop3s? I have found a few, but so far nothing seems to work from me. When I test with telnet it closes the connection immediately and tcpserver exits with status 11. tcpserver: status: 0/20 tcpserver: status: 1/20 tcpserver: pid 32660 from 128.226.61.66 tcpserver: ok 32660 242.70-84-9.reverse.theplanet.com:70.84.9.242:995 :128.226.61.66::26733 2005.05.06 15:37:18 LOG5[32660:1]: stunnel 4.10 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.05.06 15:37:18 LOG7[32660:1]: Snagged 64 random bytes from /root/.rnd 2005.05.06 15:37:18 LOG7[32660:1]: Wrote 1024 new random bytes to /root/.rnd 2005.05.06 15:37:18 LOG7[32660:1]: RAND_status claims sufficient entropy for the PRNG 2005.05.06 15:37:18 LOG6[32660:1]: PRNG seeded successfully 2005.05.06 15:37:18 LOG7[32660:1]: Configuration SSL options: 0x01000000 2005.05.06 15:37:18 LOG7[32660:1]: SSL options set: 0x01000000 2005.05.06 15:37:18 LOG7[32660:1]: Certificate: /etc/stunnel/stunnel.pem 2005.05.06 15:37:18 LOG7[32660:1]: Key file: /etc/stunnel/stunnel.pem 2005.05.06 15:37:18 LOG7[32660:1]: stunnel started 2005.05.06 15:37:18 LOG7[32660:1]: FD 0 in non-blocking mode 2005.05.06 15:37:18 LOG7[32660:1]: FD 1 in non-blocking mode 2005.05.06 15:37:18 LOG6[32660:1]: Local mode child started (PID=32661) 2005.05.06 15:37:18 LOG5[32660:1]: stunnel connected from 127.0.0.1:41860 2005.05.06 15:37:18 LOG7[32660:1]: FD 3 in non-blocking mode 2005.05.06 15:37:18 LOG7[32660:1]: stunnel connecting 127.0.0.1:110 2005.05.06 15:37:18 LOG7[32660:1]: connect_wait: waiting 10 seconds 2005.05.06 15:37:18 LOG7[32660:0]: Waiting 10 second(s) for 1 file descriptor(s) tcpserver: end 32660 status 11 tcpserver: status: 0/20 If is use openssl's s_client (openssl s_client -connect mail.bcmediagroup.com:995 -state) I get: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:error in SSLv2/v3 read server hello A write:errno=104 Scott Geiger

1 0

Newbie windows user needs help patching/compiling with mingw
by Geoff Elmer 04 May '05

04 May '05

Can anyone point me to some documentation on how to use mingw to patch and make stunnel? Specifically, I want to apply connect-proxy_dunbar.patch to v4.05 source and compile it. As I am not really a coder (yet) and am not yet very *nix knowledgeable, any help would be much appreciated. Situation is: I am trying to traverse a MS ISA server (running as a proxy) and the v4.10 stunnel doesn't allow me to specify a proxy to route thru. Thanks in advance, Geoff __________________________________ Do you Yahoo!? Yahoo! Mail - Find what you need with new enhanced search. http://info.mail.yahoo.com/mail_250

1 0

[Newbie] Set up question
by Geoff Sheridan 02 May '05

02 May '05

I have compiled and installed stunnel 4.10 under Mac OS X 10.3. I want to set up stunnel to connect a non-ssl newsreader client to an ssl nntp server. The newsreader client is Unison and the server is Easynews SSL server. I don't really know how to do this. I wonder if anyone can point me in the right direction. Thanks Geoff ___________ PS I did various searches of the list archive and read TFM, but still need guidance! I am asked to include some details: $ /usr/local/sbin/stunnel -version stunnel 4.10 on powerpc-apple-darwin7.7.0 PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7b 10 Apr 2003 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds $ uname -a Darwin My-Computer.local 7.7.0 Darwin Kernel Version 7.7.0: Sun Nov 7 16:06:51 PST 2004; root:xnu/xnu-517.9.5.obj~1/RELEASE_PPC Power Macintosh powerpc $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1640)

2 1

[Newbie] Set up question
by retrocool 30 Apr '05

30 Apr '05

I have compiled and installed stunnel 4.10 under Mac OS X 10.3. I want to set up stunnel to connect a non-ssl newsreader client to an ssl nntp server. The newsreader client is Unison and the server is Easynews SSL server. I don't really know how to do this. I wonder if anyone can point me in the right direction. Thanks Geoff ___________ PS I did various searches of the list archive and read TFM, but still need guidance! I am asked to include some details: $ /usr/local/sbin/stunnel -version stunnel 4.10 on powerpc-apple-darwin7.7.0 PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7b 10 Apr 2003 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds $ uname -a Darwin My-Computer.local 7.7.0 Darwin Kernel Version 7.7.0: Sun Nov 7 16:06:51 PST 2004; root:xnu/xnu-517.9.5.obj~1/RELEASE_PPC Power Macintosh powerpc $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1640)

1 0

ldaps error "unknown protocol"
by Mike Partyka 29 Apr '05

29 Apr '05

Hello, Description of problem is as follows: I have a email server package called Scalix, which when installed came with openldap. On the same server i am also running Stunnel, which is already successfully ssl wrapping imap,pop, and smtp protocols. The ldap directory is very handy for an address book internally but we also have people that will be outside the corporate lan and to provide the directory securely would be desirable so i added the lines in the stunnel.conf to wrap ldap as well. I can see the stunnel daemon listening on port 636. But when i try to connect from any ssl aware mail client, such as evolution, or entourage, i get an error indicating failure to authenticate, which i know is not really the problem because the ldap directory is anonymous read access enabled. Debug logging gives more information about what is occurring, here is the conversion when attempting to connect: 2005.04.28 12:15:05 LOG5[27926:1076812720]: ldaps connected from 71.4.124.200:43012 2005.04.28 12:15:05 LOG7[27926:1076812720]: SSL state (accept): before/accept initialization 2005.04.28 12:15:05 LOG7[27926:1076812720]: waitforsocket: FD=14, DIR=read 2005.04.28 12:15:05 LOG7[27926:1076812720]: waitforsocket: ok 2005.04.28 12:15:05 LOG3[27926:1076812720]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2005.04.28 12:15:05 LOG7[27926:1076812720]: ldaps finished (6 left) Searching the archive is saw someone suggesting that either the ldap server or ldap client was not compiled with ssl support. I know the email clients i am trying to connect with are ssl compatible and maybe someone can set me straight here but i didn't think that the ldap server had to be ssl aware and that was the advantage of stunnel is that it can wrap services that are do not have ssl support? At any rate i believe the ldap server does have ssl support becuase i can see the binary omslapd (provided by Scalix, preceding "om" is there because Scalix is based on HP's Open Mail) links to the ssl library using the ldd command, here is the output, note the bolded line: msp1intmx01:~ # ldd /opt/scalix/bin/omslapd linux- gate.so.1 => (0xffffe000) libom_er.so => /opt/scalix/lib/libom_er.so (0x40018000) libom_ext.so => /opt/scalix/lib/libom_ext.so (0x40023000) libom_ldapth.so => /opt/scalix/lib/libom_ldapth.so (0x4002d000) libom_mdc.so => /opt/scalix/lib/libom_mdc.so (0x4004f000) libom_omldap.so => /opt/scalix/lib/libom_omldap.so (0x4005c000) libom_os.so => /opt/scalix/lib/libom_os.so (0x40079000) libom_sdl.so => /opt/scalix/lib/libom_sdl.so (0x40087000) libom_str.so => /opt/scalix/lib/libom_str.so (0x4008e000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x400a9000) libc.so.6 => /lib/tls/libc.so.6 (0x400b9000) libom_cvc.so => /opt/scalix/lib/libom_cvc.so (0x401ce000) libom_go.so => /opt/scalix/lib/libom_go.so (0x401e2000) libom_t61.so => /opt/scalix/lib/libom_t61.so (0x401e6000) libom_tfl.so => /opt/scalix/lib/libom_tfl.so (0x401eb000) libom_gcl.so => /opt/scalix/lib/libom_gcl.so (0x401f1000) libom_ccs.so => /opt/scalix/lib/libom_ccs.so (0x401f5000) libdl.so.2 => /lib/libdl.so.2 (0x40203000) libom_cl.so => /opt/scalix/lib/libom_cl.so (0x40206000) libom_cust.so => /opt/scalix/lib/libom_cust.so (0x40215000) libom_da.so => /opt/scalix/lib/libom_da.so (0x4021c000) libom_dit.so => /opt/scalix/lib/libom_dit.so (0x40244000) libom_dr.so => /opt/scalix/lib/libom_dr.so (0x4024a000) libom_hash.so => /opt/scalix/lib/libom_hash.so (0x4027b000) libom_lng.so => /opt/scalix/lib/libom_lng.so (0x4027e000) libom_mes.so => /opt/scalix/lib/libom_mes.so (0x40282000) libom_mim.so => /opt/scalix/lib/libom_mim.so (0x4028a000) libom_ml.so => /opt/scalix/lib/libom_ml.so (0x4029d000) libom_pam.so => /opt/scalix/lib/libom_pam.so (0x402a6000) libom_pwdl.so => /opt/scalix/lib/libom_pwdl.so (0x402b4000) libom_ul.so => /opt/scalix/lib/libom_ul.so (0x402b9000) libom_uni.so => /opt/scalix/lib/libom_uni.so (0x402cc000) libom_im.so => /opt/scalix/lib/libom_im.so (0x402e3000) libom_sfl.so => /opt/scalix/lib/libom_sfl.so (0x402ee000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x4030c000) libom_sml.so => /opt/scalix/lib/libom_sml.so (0x4033d000) libom_tfo.so => /opt/scalix/lib/libom_tfo.so (0x40340000) libom_enc.so => /opt/scalix/lib/libom_enc.so (0x40343000) libom_lkf.so => /opt/scalix/lib/libom_lkf.so (0x40347000) libom_nm.so => /opt/scalix/lib/libom_nm.so (0x4034b000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) libom_uscv.so => /opt/scalix/lib/libom_uscv.so (0x40352000) libom_fstr.so => /opt/scalix/lib/libom_fstr.so (0x4035a000) libom_gen.so => /opt/scalix/lib/libom_gen.so (0x4035c000) libom_xdse.so => /opt/scalix/lib/libom_xdse.so (0x40362000) libom_acl.so => /opt/scalix/lib/libom_acl.so (0x40365000) libom_cdl.so => /opt/scalix/lib/libom_cdl.so (0x4036c000) libom_drsc.so => /opt/scalix/lib/libom_drsc.so (0x40374000) libom_inet.so => /opt/scalix/lib/libom_inet.so (0x40379000) libom_vi.so => /opt/scalix/lib/libom_vi.so (0x40388000) libom_akt.so => /opt/scalix/lib/libom_akt.so (0x40399000) libom_q.so => /opt/scalix/lib/libom_q.so (0x403a1000) libom_date.so => /opt/scalix/lib/libom_date.so (0x403a6000) libom_ssn.so => /opt/scalix/lib/libom_ssn.so (0x403a8000) libom_orname.so => /opt/scalix/lib/libom_orname.so (0x403ac000) libom_culb.so => /opt/scalix/lib/libom_culb.so (0x403af000) libom_dstring.so => /opt/scalix/lib/libom_dstring.so (0x403b3000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0x403b6000) libom_ufcv.so => /opt/scalix/lib/libom_ufcv.so (0x403e7000) libom_vista.so => /opt/scalix/lib/libom_vista.so (0x4040d000) libom_rda.so => /opt/scalix/lib/libom_rda.so (0x40439000) libom_rdudp.so => /opt/scalix/lib/libom_rdudp.so (0x4043e000) libom_rsl.so => /opt/scalix/lib/libom_rsl.so (0x40444000) libom_mp.so => /opt/scalix/lib/libom_mp.so (0x40456000) libom_mpl.so => /opt/scalix/lib/libom_mpl.so (0x4045e000) libom_msg.so => /opt/scalix/lib/libom_msg.so (0x40466000) libom_qml.so => /opt/scalix/lib/libom_qml.so (0x4046c000) libom_tf.so => /opt/scalix/lib/libom_tf.so (0x40471000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0x4047b000) libom_fmem.so => /opt/scalix/lib/libom_fmem.so (0x4056b000) libom_acf.so => /opt/scalix/lib/libom_acf.so (0x40570000) libom_cvr.so => /opt/scalix/lib/libom_cvr.so (0x40575000) libom_ct.so => /opt/scalix/lib/libom_ct.so (0x40589000) libom_bb.so => /opt/scalix/lib/libom_bb.so (0x405cc000) libom_rtfl.so => /opt/scalix/lib/libom_rtfl.so (0x405e1000) libom_isl.so => /opt/scalix/lib/libom_isl.so (0x405f2000) libom_nf.so => /opt/scalix/lib/libom_nf.so (0x405fc000) libom_nfda.so => /opt/scalix/lib/libom_nfda.so (0x40602000) libom_nsl.so => /opt/scalix/lib/libom_nsl.so (0x40607000) libom_exual.so => /opt/scalix/lib/libom_exual.so (0x4060d000) Stunnel version information is as follows: stunnel 4.05 on i686-suse-linux-gnu PTHREAD with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Stunnel is running in stand-alone mode and is being started without any parameters that i am aware of, i just used the init script supplied SuSE for their Enterprise 9 server product. Output of "stunnel -f -D 7 is: msp1intmx01:~ # stunnel -f -D 7 2005.04.29 08:27:24 LOG3[3326:1076392064]: -f: No such file or directory (2) Output of "stunnel -V is: msp1intmx01:~ # stunnel -V 2005.04.29 08:30:49 LOG3[3368:1076392064]: -V: No such file or directory (2) Output of "uname -a" msp1intmx01:~ # uname -a Linux msp1intmx01 2.6.5-7.151-smp #1 SMP Fri Mar 18 11:31:21 UTC 2005 i686 i686 i386 GNU/Linux Libc version is 2.3.3 Output of "gcc -v" msp1intmx01:~ # gcc -v Reading specs from /usr/lib/gcc-lib/i586-suse-linux/3.3.3/specs Configured with: ../configure --enable-threads=posix -- prefix=/usr --with-local-prefix=/usr/local -- infodir=/usr/share/info --mandir=/usr/share/man --enable- languages=c,c++,f77,objc,java,ada --disable-checking -- libdir=/usr/lib --enable-libgcj --with-gxx-include- dir=/usr/include/g++ --with-slibdir=/lib --with-system-zlib -- enable-shared --enable-__cxa_atexit i586-suse-linux Thread model: posix gcc version 3.3.3 (SuSE Linux) Openssl version is: msp1intmx01:~ # openssl version OpenSSL 0.9.7d 17 Mar 2004 Regards, -- Michael W. Partyka Jumpnode Systems, LLC Systems Administrator 612.605.5056 Desk 651.208.5734 Cell

1 0

stunnel with pop-3 over SSL, port 995?
by conover＠rahul.net 27 Apr '05

27 Apr '05

Can stunnel be used to connect to a pop-3 over SSL server on port 995? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

1 0

SIGSEGV in init_ssl stunnel 4.10 on solaris 8
by Toni Schmidbauer 27 Apr '05

27 Apr '05

hi, we've got the following problem: - compiled stunnel 4.10 with openssl-0.9.7g - stunnel receives a SIGSEGV when connecting i am really not a C or gdb guru, but running stunnel 4.10 under gdb shows this: # gdb src/stunnel GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.8"... (gdb) set args /usr/local/stunnel-4.10/etc/stunnel/stunnel.conf (gdb) run Starting program: /usr/local/src/stunnel-4.10/src/stunnel /usr/local/stunnel-4.10/etc/stunnel/stunnel.conf [New LWP 1] [New LWP 2] [New LWP 3] [New LWP 4] Program received signal SIGSEGV, Segmentation fault. 0x0002a32c in init_ssl (c=0x11e008) at client.c:298 298 s_poll_add(&c->fds, c->ssl_rfd->fd, (gdb) bt #0 0x0002a32c in init_ssl (c=0x11e008) at client.c:298 #1 0x00029f30 in do_client (c=0x11e008) at client.c:147 #2 0x00029dd8 in client (arg=0x126270) at client.c:120 (gdb) p c->ssl_rfd $1 = (FD *) 0x1 (gdb) so it seems c->ssl_rfd points to nowhere. further investigation reveals that c->ssl_rfd gets overwritten after the call to SSL_accept. stunnel 4.09 works. is this a problem with UCONTEXT? ************************************************************************ information as request on the support page: openssl version: OpenSSL 0.9.7g 11 Apr 2005 uname -a: SunOS coti 5.8 Generic_117350-05 sun4u sparc SUNW,UltraAX-i2 gcc -v: Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.8/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls --disable-libgcj --enable-languages=c,c++ Thread model: posix gcc version 3.3.2 stunnel log with debug=7: 2005.04.27 08:41:33 LOG5[24386:1]: stunnel 4.10 on sparc-sun-solaris2.8 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.04.27 08:41:33 LOG7[24386:1]: RAND_status claims sufficient entropy for the PRNG 2005.04.27 08:41:33 LOG6[24386:1]: PRNG seeded successfully 2005.04.27 08:41:33 LOG7[24386:1]: Configuration SSL options: 0x00000FFF 2005.04.27 08:41:33 LOG7[24386:1]: SSL options set: 0x00000FFF 2005.04.27 08:41:33 LOG7[24386:1]: Certificate: /usr/local/stunnel-4.10/etc/stunnel/stunnel.pem 2005.04.27 08:41:33 LOG7[24386:1]: Key file: /usr/local/stunnel-4.10/etc/stunnel/stunnel.pem 2005.04.27 08:41:33 LOG6[24386:1]: file ulimit = 256 (can be changed with 'ulimit -n') 2005.04.27 08:41:33 LOG6[24386:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.04.27 08:41:33 LOG5[24386:1]: 125 clients allowed 2005.04.27 08:41:33 LOG7[24386:1]: FD 5 in non-blocking mode 2005.04.27 08:41:33 LOG7[24386:1]: FD 6 in non-blocking mode 2005.04.27 08:41:33 LOG7[24386:1]: FD 7 in non-blocking mode 2005.04.27 08:41:33 LOG7[24386:1]: SO_REUSEADDR option set on accept socket 2005.04.27 08:41:33 LOG7[24386:1]: https bound to 0.0.0.0:443 2005.04.27 08:41:33 LOG7[24386:1]: Created pid file /usr/local/stunnel-4.10/var/stunnel/stunnel.pid 2005.04.27 08:41:33 LOG7[24386:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.04.27 08:41:35 LOG7[24386:0]: CONTEXT 1, FD=5, (IN)->() 2005.04.27 08:41:35 LOG7[24386:0]: CONTEXT 1, FD=7, (IN)->(IN) 2005.04.27 08:41:35 LOG7[24386:1]: https accepted FD=9 from 162.25.222.252:35728 2005.04.27 08:41:35 LOG7[24386:1]: Creating a new context 2005.04.27 08:41:35 LOG7[24386:1]: Context 2 created 2005.04.27 08:41:35 LOG7[24386:2]: https started 2005.04.27 08:41:35 LOG7[24386:2]: FD 9 in non-blocking mode 2005.04.27 08:41:35 LOG5[24386:2]: https connected from 162.25.222.252:35728 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): before/accept initialization 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 read client hello A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 write server hello A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 write certificate A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 write server done A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 flush data ************************************************************************ thanks for your time and help regards toni -- Wer es einmal so weit gebracht hat, dass er nicht | toni at stderror dot at mehr irrt, der hat auch zu arbeiten aufgehoert | Toni Schmidbauer -- Max Planck |

1 1

stunnel crash when multiple connections
by Debin Chen 27 Apr '05

27 Apr '05

Hi, I will appreciate greatly if you can diagnose the following crash problem: I am using stunnel 4.05, working with webserver thttpd to provide a https solution, in linux environment. First I wrote down some noticeable behavior of stunnel. 1) stunnel each time spawns a thread to handle the https connection then destroy the thread. If I browse a lot of pages, then internally a lot of thread ( or process) got created and destroyed. 2) Sometimes after a https request is completed, the thread is still there. Only following request will trigger the thread got destroyed. Normally if there is no activity, just 2 threads left. The problem: During some stress testing, such as multiple ( in my case, actually just 2 or 3) web browser simultaneously issues request to the web server in https, I found out in certain moment stunnel spawns more than 5 or 6 threads to handle the connections, sometimes it crashed without giving out any serious debug error messages. When it crashed, system resource of CPU and memory is still sufficient. Note than I already set timeoutclose=0, that should be done. Best Regards Debin Chen ======================================== Advanced Storage Division Promise Technology, Inc. 580 Cottonwood Drive, Milpitas, CA 95035 Tel: 408-228-1529 CONFIDENTIALITY NOTICE: The information contained in or attached to this email message is either proprietary and/or confidential information, or information intended solely for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by email and delete the original message from your computer/server with confirmation to us that you have done so. Thank you.

1 0

connect directly to unix domain socket?
by Marty Lamb 25 Apr '05

25 Apr '05

Hello, Sorry for the newb question, but I've done quite a bit of searching and haven't found a definitive answer either way - and I doubt I'm the first to ask about this. Is there any way to connect an incoming connection directly to a unix domain socket? Some sort of service level option like: connect = /path/to/socket would be ideal, and hopefully I'm just missing something in the docs. If this is not available, I can just exec socat - but that seems like an unnecessary step. Thanks much, Marty

1 0

Newbie question
by Rick Kubowic 25 Apr '05

25 Apr '05

I'm trying to implement a secure TCP tunnel from one PC to another. I've been looking for quite some time and can't seem to find the problem. I've been following the following example of how to start a server service: stunnel -p /path/to/stunnel.pem -d pop3s -r bar:pop3 I've created a generic certificate, but I get the error: Failed to open configuration file -p What am I doing wrong?? Rick Kubowicz ITG Canada Corp. 416-874-0834

2 1

Mailing list web interface
by Michal Trojnara 24 Apr '05

24 Apr '05

Dear Users, I'm glad to announce that mirt.net server is now fully moved to the new location. I hope you'll enjoy the speed. 8-) The mailing list management web interface is operational, again. Best regards, Mike

1 0

Stunnel 4.10 released
by Michal Trojnara 23 Apr '05

23 Apr '05

Here is the ChangeLog entry: Version 4.10, 2005.04.23, urgency: LOW/EXPERIMENTAL: * DLLs for OpenSSL 0.9.7g. * Bugfixes - Missing locking on Win32 platform was added (thx to Yi Lin <yi.lin(a)convergys.com>) - Some problems with closing SSL fixed. * New features - New UCONTEXT user-level non-preemptive threads model is used on systems that support SYSV-compatible ucontext.h. - Improved stunnel3 script with getopt-compatible syntax. * Release notes - This version should be thoroughly tested before using it in the mission-critical environment. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

Patch: Windows version of stunnel 4.09 is not thread-safe
by yi.lin＠convergys.com 23 Apr '05

23 Apr '05

We have been using stunnel on Windows as a SSL proxy to connect to HTTPS server but stunnel kept crashing randomly under load. After some investigation, we found the following: according to OpenSSL document (http://www.openssl.org/docs/crypto/threads.html) "OpenSSL can safely be used in multi-threaded applications provided that at least two callback functions are set. locking_function(int mode, int n, const char *file, int line) is needed to perform locking on shared data structures. (Note that OpenSSL uses a number of global data structures that will be implicitly shared whenever multiple threads use OpenSSL.) Multi-threaded applications will crash at random if it is not set. " The original stunnel package only implements a POSIX Pthread version of locking callback functions, but doesn't provide any implementation for Windows. This has caused random crashes during our testing because the way we use stunnel requires frequent creation/destruction of threads and stunnel is not thread-safe without the locking callbacks. The attached fix attempts to address the problem by implementing the Windows version of locking callbacks using Windows native CRITICAL_SECTION object. =============================================================================================================================== *** sthreads.c Fri Dec 31 02:55:40 2004 --- sthreads_w32.c Thu Apr 14 08:29:07 2005 *************** *** 121,126 **** --- 121,127 ---- #ifdef USE_WIN32 CRITICAL_SECTION stunnel_cs[CRIT_SECTIONS]; + static CRITICAL_SECTION lock_cs[CRYPTO_NUM_LOCKS]; void enter_critical_section(SECTION_CODE i) { EnterCriticalSection(stunnel_cs+i); *************** *** 130,141 **** --- 131,161 ---- LeaveCriticalSection(stunnel_cs+i); } + static void locking_callback(int mode, int type, + #ifdef HAVE_OPENSSL + const /* Callback definition has been changed in openssl 0.9.3 */ + #endif + char *file, int line) { + if(mode&CRYPTO_LOCK) + EnterCriticalSection(lock_cs+type); + else + LeaveCriticalSection(lock_cs+type); + } + + void sthreads_init(void) { int i; /* Initialize stunnel critical sections */ for(i=0; i<CRIT_SECTIONS; i++) InitializeCriticalSection(stunnel_cs+i); + + /* Initialize OpenSSL locking callback */ + for(i=0; i<CRYPTO_NUM_LOCKS; i++) + InitializeCriticalSection(lock_cs+i); + CRYPTO_set_locking_callback(locking_callback); + + } unsigned long stunnel_process_id(void) { (See attached file: sthread_diff) Yi Lin Convergys Corporation yi.lin(a)convergys.com (703)885-5767 -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

2 1

connection refsed (111)
by RAJADURAI D 20 Apr '05

20 Apr '05

hi I am trying to connect using mysql, there are no fw between the 2 boxes. I tested with stunnel latest version 4.08 in red hat 9,it shows the last message as connection refused (111) after the cipher negotiation Any ideas on how to solve this error plz help me, to short out this problem ? i am using ==> Stunnel 4.08 redhat 9 Kernel 2.4.20-8 mysql Ver 11.18 Distrib 3.23.54,for redhat-linux-gnu(i386) I am using stunnel.pem generated while installing stunnel 4.08 SERVER SIDE [root@scorpion src]# ./stunnel 2005.03.30 12:23:19 : stunnel with OpenSSL 0.9.7a Feb 19 2003 2005.03.30 12:23:19 : Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.03.30 12:23:19 : Key file: /usr/local/etc/stunnel/stunnel.pem 2005.03.30 12:23:19 : 500 clients allowed 2005.03.30 12:23:19 : SO_REUSEADDR option set on accept socket 2005.03.30 12:23:19 : mysqls bound to 0.0.0.0:3307 2005.03.30 12:23:19 : Created pid file /stunnel.pid 2005.03.30 12:27:01 : mysqls accepted FD=7 from 192.168.2.175:33091 2005.03.30 12:27:01 : mysqls started 2005.03.30 12:27:01 : mysqls connected from 192.168.2.175:33091 2005.03.30 12:27:01 : SSL state (accept): before/accept initialization 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read client hello A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write server hello A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write certificate A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write server done A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 flush data 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read client key exchange A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read finished A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write change cipher spec A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write finished A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 flush data 2005.03.30 12:27:01 : 1 items in the session cache 2005.03.30 12:27:01 : 0 client connects (SSL_connect()) 2005.03.30 12:27:01 : 0 client connects that finished 2005.03.30 12:27:01 : 0 client renegotiatations requested 2005.03.30 12:27:01 : 1 server connects (SSL_accept()) 2005.03.30 12:27:01 : 1 server connects that finished 2005.03.30 12:27:01 : 0 server renegotiatiations requested 2005.03.30 12:27:01 : 0 session cache hits 2005.03.30 12:27:01 : 0 session cache misses 2005.03.30 12:27:01 : 0 session cache timeouts 2005.03.30 12:27:01 : SSL accepted: new session negotiated 2005.03.30 12:27:01 : Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.30 12:27:01 : mysqls connecting 127.0.0.1:3306 2005.03.30 12:27:01 : connect_wait: waiting 10 seconds 2005.03.30 12:27:01 : connect_wait: getsockopt: Connection refused (111) 2005.03.30 12:27:01 : Failed to initialize remote connection 2005.03.30 12:27:01 : mysqls finished (0 left) ====================================================== CLIENT SIDE [root@redhat src]# ./stunnel 2005.03.30 23:24:42 LOG5[7383:1075999904]: stunnel 4.08 on i686-pc-linux-gnu PTH READ+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2005.03.30 23:24:42 LOG7[7383:1075999904]: RAND_status claims sufficient entropy for the PRNG 2005.03.30 23:24:42 LOG6[7383:1075999904]: PRNG seeded successfully 2005.03.30 23:24:42 LOG7[7383:1075999904]: Certificate: /usr/local/etc/stunnel/s tunnel.pem 2005.03.30 23:24:42 LOG7[7383:1075999904]: Key file: /usr/local/etc/stunnel/stun nel.pem 2005.03.30 23:24:42 LOG6[7383:1075999904]: file ulimit = 1024 (can be changed wi th 'ulimit -n') 2005.03.30 23:24:42 LOG6[7383:1075999904]: poll() used - no FD_SETSIZE limit for file descriptors 2005.03.30 23:24:42 LOG5[7383:1075999904]: 500 clients allowed 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 4 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 5 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 6 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: SO_REUSEADDR option set on accept soc ket 2005.03.30 23:24:42 LOG7[7383:1075999904]: mysqls bound to 0.0.0.0:3306 2005.03.30 23:24:42 LOG7[7383:1075999904]: Created pid file /stunnel.pid 2005.03.30 23:32:19 LOG7[7383:1075999904]: mysqls accepted FD=7 from 127.0.0.1:3 3090 2005.03.30 23:32:19 LOG7[7383:1075999904]: FD 7 in non-blocking mode 2005.03.30 23:32:19 LOG7[7383:1076067520]: mysqls started 2005.03.30 23:32:20 LOG5[7383:1076067520]: mysqls connected from 127.0.0.1:33090 2005.03.30 23:32:20 LOG7[7383:1076067520]: FD 8 in non-blocking mode 2005.03.30 23:32:20 LOG7[7383:1076067520]: mysqls connecting 192.168.2.210:3307 2005.03.30 23:32:20 LOG7[7383:1076067520]: connect_wait: waiting 10 seconds 2005.03.30 23:32:20 LOG7[7383:1076067520]: connect_wait: connected 2005.03.30 23:32:20 LOG7[7383:1076067520]: Remote FD=8 initialized 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): before/connect initialization 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write client hello A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server hello A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server certificate A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server done A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write client key exchange A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write finished A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 flush data 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read finished A 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 items in the session cache 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 client connects (SSL_connect()) 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 client connects that finished 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 client renegotiatations requeste d 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server connects (SSL_accept()) 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server connects that finished 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server renegotiatiations request ed 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache hits 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache misses 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache timeouts 2005.03.30 23:32:20 LOG6[7383:1076067520]: SSL connected: new session negotiated 2005.03.30 23:32:20 LOG6[7383:1076067520]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.30 23:32:20 LOG3[7383:1076067520]: SSL_read: Connection reset by peer (1 04) 2005.03.30 23:32:20 LOG5[7383:1076067520]: Connection reset: 0 bytes sent to SSL , 0 bytes sent to socket 2005.03.30 23:32:20 LOG7[7383:1076067520]: mysqls finished (0 left) RUNNING mysqL IN AN SEPARATE TERMINAL [root@redhat bharathi]# mysql -h 127.0.0.1 -u anirudh -p Enter password: ERROR 2013: Lost connection to MySQL server during query

2 2