stunnel-users

3306 discussions

Stunnel 5.17 on AIX
by Eckert, Doug 12 May '15

12 May '15

I've gotten v5.17 compiled on AIX 5.3 & 6.1 with the following xlccmp.13.1.0 13.1.0.3 COMMITTED XL C compiler openssl.base 1.0.1.513 COMMITTED Open Secure Socket Layer IV71446m9a Ifix for Openssl CVE Everything seems to have compiled fine. I packaged it up, installed, and set up a quick config. The server side aborts on me. Debug output follows. Need some direction on where to look next. Thanks in advance! 2015.05.06 12:08:03 LOG7[ui]: Clients allowed=31999 2015.05.06 12:08:03 LOG5[ui]: stunnel 5.17 on powerpc-ibm-aix5.3.0.0 platform 2015.05.06 12:08:03 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.05.06 12:08:03 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2015.05.06 12:08:03 LOG7[ui]: errno: (*_Errno()) 2015.05.06 12:08:03 LOG5[ui]: Reading configuration from file /opt/freeware/etc/stunnel/stunnel.conf 2015.05.06 12:08:03 LOG5[ui]: UTF-8 byte order mark not detected 2015.05.06 12:08:03 LOG7[ui]: Compression disabled 2015.05.06 12:08:03 LOG7[ui]: Snagged 64 random bytes from //.rnd 2015.05.06 12:08:03 LOG7[ui]: Wrote 1024 new random bytes to //.rnd 2015.05.06 12:08:03 LOG7[ui]: PRNG seeded successfully 2015.05.06 12:08:03 LOG6[ui]: Initializing service [client] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-client-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-client-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01000004 (+0x03000000, -0x02000000) 2015.05.06 12:08:03 LOG6[ui]: Initializing service [server] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-server-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: DH initialization 2015.05.06 12:08:03 LOG7[ui]: Could not load DH parameters from /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG7[ui]: Using hardcoded DH parameters 2015.05.06 12:08:03 LOG7[ui]: DH initialized with 2048-bit key 2015.05.06 12:08:03 LOG7[ui]: ECDH initialization 2015.05.06 12:08:03 LOG7[ui]: ECDH initialized with curve prime256v1 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01004004 (+0x03004000, -0x02000000) 2015.05.06 12:08:03 LOG5[ui]: Configuration successful 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=7) 2015.05.06 12:08:03 LOG7[ui]: Service [client] (FD=7) bound to 127.0.0.1:22 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=8) 2015.05.06 12:08:03 LOG7[ui]: Service [server] (FD=8) bound to 172.26.85.13:2222 2015.05.06 12:08:04 LOG7[main]: Created pid file /var/pid/stunnel.pid 2015.05.06 12:08:29 LOG7[main]: Service [server] accepted (FD=3) from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: Service [server] started 2015.05.06 12:08:29 LOG5[0]: Service [server] accepted connection from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): before/accept initialization 2015.05.06 12:08:29 LOG7[0]: SNI: no virtual services defined 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 read client hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write server hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write certificate A INTERNAL ERROR: Bad magic at tls.c, line 182 --Doug

2 4

Stunnel4 not working?
by David H. Durgee 09 May '15

09 May '15

> Please see highlighted below: > > On Fri, May 8, 2015 at 5:27 PM, David H. Durgee <dhdurgee at verizon.net <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>> > wrote: > > >/ At some point in the near past stunnel stopped working on my laptop. The > />/ laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the > />/ repositories. I enabled debug=7, but I am not getting much from the log: > />/ > />/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500 > />/ > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: > />/ stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17 > />/ <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL > />/ 1.0.1e 11 Feb 2013 2015.05.08 17 <2015.05.08%2017>:12:06 > />/ LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014 > />/ 2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Update > />/ OpenSSL shared libraries or rebuild stunnel* > / > > Is there a reason that you're using libraries from a different compiled > Stunnel? In fact, isn't there another Stunnel package you can use that is > more up-to-date? If not, perhaps compile your own using the OpenSSL > libraries that comes with Mint. I am using the package from the Mint repository, which in this case is the Ubuntu Trusty repository. If you know of a repository I can add with a more current package I will do so. If necessary I guess I could build from source, but I don't do that often and would prefer to locate a binary. > >/ > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD > />/ SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration > />/ from file /etc/stunnel/stunnel.conf > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [telnets] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Warning: the permissions may be too wide-open (should be 700 I assume) > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [dsp3270s] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Same as above, perhaps too wide open, permissions should be 700 I assume. > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets] > />/ (FD=12) bound to 0.0.0.0:3141 > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s] > />/ (FD=13) bound to 0.0.0.0:7490 > />/ 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file > />/ /stunnel4.pid > />/ 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets] > />/ accepted (FD=3) from 127.0.0.1:40090 > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #0 > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:31 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking) 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed* > / > > that sounds like SELinux permissions perhaps? Have you tried temporarily > disabling SELinux, or perhaps you have a firewall (iptables) set up? You'll > have to allow the incoming port and possibly an entry in /etc/services > IIRC. I don't know if this helps but this is what I found: > https://sites.google.com/site/easylinuxtipsproject/security > A link to "ufw" may prove useful, if your system has that installed. Most > systems have locked-down privileged ports (any port less than 1024, like in > your example). I do have ufw here, but I have the same problem with it enabled or disabled. The telnets service is listening on port 3141 and the dsp3270s on port 7490, so neither of them are privileged ports. > >/ > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] > />/ finished (0 left) > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s] > />/ accepted (FD=3) from 127.0.0.1:48534 > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ started > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #1 > />/ *2015.05.08 17 <2015.05.08%2017>:13:32 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking)* > />/ > / > That sounds like some kind of firewall issue (like above). As noted above, same behavior with ufw enabled or disabled. > >/ 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ finished (0 left) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ > />/ > / When in a situation like this, I would first try unprivileged ports with > localhost using iperf, just to generate some dummy traffic. A good > technique I use when debugging stunnel versus debugging networking or other > security issues is to do local traffic only like this: > > 1. iperf client connect to localhost port 5000 > 2. Stunnel client listen on port 5000, connect to localhost port 6000 > 3. Stunnel server listen on port 6000, connect to localhost port 7000 > 4. iperf server listening on localhost port 7000 > > As you can see from that, running iperf client for a few seconds, it should > be able to connect to the iperf server. If not, stunnel is not working. > Debug this FIRST before proceeding to working with non-localhost IP > addresses. The actual procedure would be as follows: > > 1. Download/install iperf > 2. Verify iperf works by having one shell run as server, listening on > localhost port 7000, and another shell setup iperf client sending on port > 7000. If that works, then proceed. Don't use iperf to connect to port 7000 > again. > 3. Set up two config files, one for stunnel client and one for stunnel > server, with different ports and the "client=yes" in the client config > file. For easier detection with "ps" or "top", you can copy the executable > file to another name (i.e., "s4client" for the stunnel 4 client, and > "s4server" for the stunnel 4 server). Similarly for iperf, you can copy the > exe to "iperfc" and "iperfs" for iperf server, for easier process detection. > 4. Start up the stunnel server first, then stunnel client, with the > appropriate config files per the port enumeration mentioned above. > 5. Start iperf server listening on port 7000. > 6. Start iperf client sending on port 5000. If you get some really large > value or nothing, then your stunnel config (client/server) needs to be > debugged first before proceeding to non-localhost IPs. I usually get > something like 3GB/sec when using a Windows 7 VM inside Windows 7 doing > this from DOS prompts with appropriate server/client configs set up. I > usually use four windows: two for iperf (c/s), two for stunnel (c/s). > > Hope that helps... > -Rob I have an stunnel server on another system on the LAN and that is the one I am having the client with the problem connect to while trying to find the problem. I know that server is working, as I have seen other incoming traffic handled by it. I suspect the problem is related to the message you pointed out that I missed about SSL libraries. I would very much appreciate a pointer to a more current package in a repository. Thanks for your response, Rob. Dave

1 0

Stunnel 5.17 build on AIX - libssp missing
by Rob Lockhart 09 May '15

09 May '15

I have AIX 6.1 (64-bit) with GCC 4.2.0. It has an older version of OpenSSL (0.9.8) installed from IBM but I'm trying to compile Stunnel 5.17 with OpenSSL 1.0.2a-fips as non-root. I proceed as follows: cd ~; [ -d openssl ] && rm -rf openssl; mkdir openssl cd ~/OpenSSL; [ -d openssl-fips-2.0.9 ] && rm -rf openssl-fips-2.0.9 gzip -dc openssl-fips-2.0.9.tar.gz | tar xvf - cd openssl-fips-2.0.9; chmod 755 Configure ./Configure aix64-gcc --openssldir=$HOME/openssl make make install NOTE: the above is just the FIPS canister (library), not the executable. cd ~/OpenSSL; [ -d openssl-1.0.2a ] && rm -rf openssl-1.0.2a gzip -dc openssl-1.0.2a.tar.gz | tar xvf - cd openssl-1.0.2a; chmod 755 Configure ./Configure aix64-gcc fips shared --openssldir=$HOME/openssl --with-fipsdir=$HOME/openssl make depend make make test make install cd ~/openssl/bin; ./openssl version; ./openssl speed NOTE: Look for "ALL OCSP TESTS SUCCESSFUL" after "make test" to verify the test build was successful, and it was. NOTE: "./openssl version" should show "OpenSSL 1.0.2a-fips 19 Mar 2015" NOTE: "./openssl speed" should take a while as it's measuring the speed for all algorithms Final test of OpenSSL 1.0.2a-fips: ./openssl sha1 -hmac etaonrishdlcupfm ~/OpenSSL/openssl-fips-2.0.9.tar.gz - should return: 54552e9a3ed8d1561341e8945fcdec55af961322 Now, I try to compile Stunnel: rm -rf $HOME/stunnel-bin; mkdir $HOME/stunnel-bin cd ~/Stunnel; [ -f stunnel-5.17 ] && rm -rf stunnel-5.17 gzip -dc stunnel-5.17.tar.gz | tar xvf - ; cd stunnel-5.17 ./configure --enable-fips --prefix=$HOME/stunnel-bin --with-ssl=$HOME/openssl make I get a failure at make for a library not found: /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -D_THREAD_SAFE -Wall -Wextra -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fstack-protector -fPIE -D_FORTIFY_SOURCE=2 -L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto -o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -lpthreads libtool: link: gcc -g -O2 -D_THREAD_SAFE -Wall -Wextra -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fstack-protector -fPIE -D_FORTIFY_SOURCE=2 -o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto -lpthreads collect2: library libssp_nonshared not found The interesting part is that doing a "grep -R libssp" of the source tree only shows one reference to libssp: $ grep -R libssp * stunnel-5.17/tools/stunnel.nsi: # MINGW builds requires libssp-0.dll instead of msvcr90.dll Googling showed some really old links that had libssp skipped for GCC on AIX: http://gcc.gnu.org/ml/gcc-patches/2005-09/msg01231.html and another that added it back in: http://marc.info/?l=gcc-patches&m=130168534803966 Can anyone who has compiled this for AIX give me a clue about what's going on? This looks like a reference to a non-existent library but I would think that if GCC needed that, it wouldn't allow the RPM for GCC to be installed. Thanks, -Rob

2 1

Stunnel4 not working?
by David H. Durgee 08 May '15

08 May '15

At some point in the near past stunnel stopped working on my laptop. The laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the repositories. I enabled debug=7, but I am not getting much from the log: 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500 2015.05.08 17:12:06 LOG5[10804:140318864611136]: stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL 1.0.1e 11 Feb 2013 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Update OpenSSL shared libraries or rebuild stunnel 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration from file /etc/stunnel/stunnel.conf 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service section [telnets] 2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file permissions on /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service section [dsp3270s] 2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file permissions on /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets] (FD=12) bound to 0.0.0.0:3141 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s] (FD=13) bound to 0.0.0.0:7490 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file /stunnel4.pid 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets] accepted (FD=3) from 127.0.0.1:40090 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap process 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process #0 2015.05.08 17:12:31 LOG3[10810:140318864770816]: Unexpected socket close (read_blocking) 2015.05.08 17:12:31 LOG5[10810:140318864770816]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) closed 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] finished (0 left) 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s] accepted (FD=3) from 127.0.0.1:48534 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] started 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap process 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process #1 2015.05.08 17:13:32 LOG3[10810:140318864770816]: Unexpected socket close (read_blocking) 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) closed 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] finished (0 left) 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) I don't even see the IP address for the outbound connection, so it seems as if it is hitting a problem even before it gets that far. Configuration is pretty simple: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 socket = l:TCP_KEEPCNT=5 socket = r:TCP_KEEPCNT=5 socket = l:TCP_KEEPIDLE=10 socket = r:TCP_KEEPIDLE=10 socket = l:TCP_KEEPINTVL=2 socket = r:TCP_KEEPINTVL=2 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [telnets] accept = 3141 ;connect = 192.168.80.11:992 ;connect = DurgeeEnterprises.publicvm.com:992 connect = 192.168.80.5:992 [dsp3270s] accept = 7490 ;connect = 192.168.80.11:246 ;connect = DurgeeEnterprises.publicvm.com:246 connect = 192.168.80.5:246 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Any thoughts on how to track this down and get this working? Dave

2 1

problem migrating from 4.54 to 5.x
by Scott Weisman 04 May '15

04 May '15

Hi there. I have a program I have used successfully with Stunnel for many years. A while back, I discovered that my program, which is a pure stdio console program, stopped working with 5.x versions of Stunnel. I have spent many hours but have been unable to solve the problem, so I regretfully continue to use the 4.x branch. I was wondering if anyone had similar experiences? Relevant data is pasted below. I comment in the log output where the problem occurs. Any help at all would be greatly appreciated. stunnel.conf: setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 foreground = no debug = 7 output = /var/log/stunnel.log [CF2] client = no accept = 21 verify = 3 sslVersion = all cert = /etc/stunnel/demo.pem key = /etc/stunnel/demo.pem CApath = /etc/stunnel/certs CRLpath = /etc/stunnel/crls TIMEOUTbusy = 60 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 60 exec = /opt/cmf/bin/cf-server execargs = /opt/cmf/bin/cf-server -p /opt/jail/stunnel/pipes/ Log of successful session with 4.54: 2015.05.01 15:39:39 LOG7[3080:140402563495680]: Starting certificate verification: depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress= demo(a)demo.com/CN=demo 2015.05.01 15:39:39 LOG6[3080:140402563495680]: CERT: Locally installed certificate matched 2015.05.01 15:39:39 LOG5[3080:140402563495680]: Certificate accepted: depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress= demo(a)demo.com/CN=demo 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read client certificate A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read client key exchange A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read certificate verify A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read finished A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write session ticket A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write change cipher spec A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write finished A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 flush data 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 items in the session cache 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects (SSL_connect()) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects that finished 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client renegotiations requested 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects (SSL_accept()) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects that finished 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 server renegotiations requested 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache hits 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 external session cache hits 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache misses 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache timeouts 2015.05.01 15:39:39 LOG6[3080:140402563495680]: SSL accepted: new session negotiated 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Compression: null, expansion: null 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Local mode child started (PID=3118) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: Remote socket (FD=11) initialized *** the connection is established and stable; i explicitly disconnect several seconds later 2015.05.01 15:39:45 LOG7[3080:140402563495680]: SSL socket closed on SSL_read 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Sent socket write shutdown 2015.05.01 15:39:45 LOG5[3080:140402563495680]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Remote socket (FD=11) closed 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Local socket (FD=3) closed 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Service [CF2] finished (0 left) Log of unsuccessful session with 5.16: 2015.05.01 15:37:33 LOG7[0]: Verification started at depth=0: C=US, L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo 2015.05.01 15:37:33 LOG7[0]: CERT: Pre-verification succeeded 2015.05.01 15:37:33 LOG6[0]: CERT: Locally installed certificate matched 2015.05.01 15:37:33 LOG5[0]: Certificate accepted at depth=0: C=US, L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read finished A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write change cipher spec A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write finished A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 flush data 2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) requested 2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) succeeded 2015.05.01 15:37:33 LOG7[0]: 0 server renegotiation(s) requested 2015.05.01 15:37:33 LOG7[0]: 0 session reuse(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache item(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache fill-up(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache miss(es) 2015.05.01 15:37:33 LOG7[0]: 0 external session cache hit(s) 2015.05.01 15:37:33 LOG7[0]: 0 expired session(s) retrieved 2015.05.01 15:37:33 LOG6[0]: SSL accepted: new session negotiated 2015.05.01 15:37:33 LOG7[0]: Peer certificate was cached (1610 bytes) 2015.05.01 15:37:33 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2015.05.01 15:37:33 LOG7[0]: Compression: null, expansion: null 2015.05.01 15:37:33 LOG6[0]: Local mode child started (PID=2899) 2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) initialized *** immediately after successful connection, something happens; my program has no log output either, which seems to indicate that stunnel is closing it 2015.05.01 15:37:33 LOG6[0]: Read socket closed (readsocket) 2015.05.01 15:37:33 LOG7[main]: Dispatching signals from the signal pipe 2015.05.01 15:37:33 LOG7[0]: Sending close_notify alert 2015.05.01 15:37:33 LOG7[main]: Processing SIGCHLD 2015.05.01 15:37:33 LOG7[0]: SSL alert (write): warning: close notify 2015.05.01 15:37:33 LOG6[main]: Child process 2899 terminated on signal 11 2015.05.01 15:37:33 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2015.05.01 15:37:33 LOG7[main]: Signal pipe is empty 2015.05.01 15:37:33 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2015.05.01 15:37:33 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) closed 2015.05.01 15:37:33 LOG7[0]: Local socket (FD=3) closed 2015.05.01 15:37:33 LOG7[0]: Service [CF2] finished (0 left)

2 2

Segfault in stunnel
by Miroslaw Pietrzyk 03 May '15

03 May '15

Hi, I have a problem with one of the stunnel installation (debian7). After some time of operation automatically turns itself off with the message: (...) Apr 24 21:03:45 routerpri kernel: [177332.400502] stunnel[34426]: segfault at 0 ip 00007f1f99ca9e20 sp 00007f1f99c16c68 error 4 in stunnel[7f1f99c94000+24000] (...) Apr 24 21:21:36 routerpri kernel: [178402.360532] stunnel[34795]: segfault at 0 ip 00007f84d6b8be20 sp 00007f84d6b49c68 error 4 in stunnel[7f84d6b76000+24000] (...) Apr 24 21:23:31 routerpri kernel: [178517.215345] stunnel[34908]: segfault at 0 ip 00007f150c5b3e20 sp 00007f150c58cc68 error 4 in stunnel[7f150c59e000+24000] (...) stunnel 5.15 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 stunnel.conf: pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log syslog = yes client = no fips = no verify = 0 CAfile = /etc/stunnel/SubCA2.crt CRLfile = /etc/stunnel/SubCA2_CRL.pem [service_1] accept = 192.168.1.10:1000 connect = 192.168.1.10:1234 cert = /etc/stunnel/cert1.crt key = /etc/stunnel/cert1_key.pem ciphers = HIGH:!SSLv2:!ADH:!Exp:!aNULL:!eNULL:!NULL sslVersion = TLSv1.2 When I use the lower level of encryption for example SSLv3, problem occurs after a longer period of normal operation. I will only add that the problem has also appeared on the previous version 4.54, which I was updating to the newest. Do you have any idea what could be causing the problem. Regards Mirek

2 2

HSM usage
by Vedat Nommaz 01 May '15

01 May '15

>> What would be the equivalent of below s_server command in stunnel? >> >> openssl s_server -accept 5003 -engine chil -keyform engine -key rsa-priv -cert public.pem -tls1_2 >> >> In this example "rsa-priv" references the private key inside a hardware security module, not a pem file. >> >> I saw an option for engineid in the documentation, but nothing for keyform parameter.

1 0

stunnel 5.17 release
by Michal Trojnara 29 Apr '15

29 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.17 of stunnel. The ChangeLog entry: Version 5.17, 2015.04.29, urgency: HIGH: * Bugfixes - Fixed a NULL pointer dereference causing the service to crash. This bug was introduced in stunnel 5.15. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c3e79e582621a0827125e35e1c00450190104fc02dc3c5274cb02b05859fd472 stunnel-5.17.tar.gz 07a508de3807663f71e4793fd5edb4c57b6c82b4c9008753f8f6c85a17acbeea stunnel-5.17-installer.exe 49d2cc11aefe2062576a0bbfafa3beb5ae541683d90972c6ed457b19a455c346 stunnel-5.17-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVQSIlAAoJEC78f/DUFuAU5XEP/R2d2gXCeKk7d/466dOYF//A YlXC6oDbs7OB8qEHH3u5u5hl8WIZJOmbPb79APSJKd7ESREoRk97UBJZYoH+QuEB CHOs0czty5IE2QyMibHJZ4Zed23q/QHrTRL9GpZd8EPkmiRG/dq7M+vC0gJJuF+N 4CPCNj464ATtjFB3mPju+wQinnWj8s57kNAazifAQNvM/jhdJOMH+BOvXIGEwUlt iZ8MBwO707j81UWkSFANxn1GMTOoJY2pTTAmJr/eKun9sLbuN7v4ec8Mtwdcj16P 5CeXD1g7gOK5q2FizIUWfBD38nPRVBXMqfSAkjtezwqZJb1K4bfa505E4SY3bKzL CJstbH206rQriqhpV4hrsuGVmb6M7lt57zAJZ746NQtlRm1gLdf/56JclsHqmkqo Z6zAuXRAiarkn88OsERp8r84Y4l8q/D8dkZwYPObSCT+SAMimPzLxhu9sjIKsb1I lSFNS2P9sEw/MhM9yQGfyC0GKzQWrQIONFHP2iCS8+ySEc+6/1b9tB9oiOcsAL1c edWV3m5SQzG7TbsbtApRy6Pvb30O7/5zAJOiBN6Yf5OQ8OyjL4M9+ZKd75qQxsQj IEZNJW/caVz9QwNWc2BQtaUVy7RC0CaTmbebsoQWlKQmzosXMU2QgC/WJ3jQdslz Vc3C3rKKvwGPw1DZLX95 =tC15 -----END PGP SIGNATURE-----

1 0

startup issues
by Coviello, Paul 24 Apr '15

24 Apr '15

Hi, Well I got it started on VMS and wanted to put it in debug mode, so I shut it down made my changes to the conf file and now well I can't start it with the command procedure. I even tried the old conf and same thing... $ @STUNNEL_STARTUP_SERVER Is the private key (in the PEM file) encrypted? [Y/N]: Y Enter the password to decrypt the key (please use paired double quotes with it): ""XXXXXXXXX"" Starting up a Stunnel %RUN-S-PROC_ID, identification of created process is 209FCA70 Stunnel server failed to start up-- check the configuration, etc. Nothing is logged... But if I do the following $ stunnel STUNNEL_SERVER.CONF And the output to the screen... 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Snagged 64 random bytes from sys$common:[sysmgr].rnd 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Wrote 1024 new random bytes to sys$common:[sysmgr].rnd 2015.04.24 10:35:24 LOG7[547326662:2071228096]: RAND_status claims sufficient entropy for the PRNG 2015.04.24 10:35:24 LOG7[547326662:2071228096]: PRNG seeded successfully 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Certificate: stunnel.pem 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Certificate loaded 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Key file: stunnel.pem Enter PEM pass phrase: 2015.04.24 10:35:31 LOG7[547326662:2071228096]: Private key loaded 2015.04.24 10:35:31 LOG7[547326662:2071228096]: SSL context initialized for service telnet This is where it sits unless I do a ctrl-c to cancel and get back to the system prompt. And when I do my telnet session I cannot connect. Well I connect but no prompts for me to login But now I have log output! :) 2015.04.24 10:08:31 LOG5[547326662:2071228096]: stunnel undefined on vax-openvms with OpenSSL 0.9.8h 28 May 2008 2015.04.24 10:08:31 LOG5[547326662:2071228096]: Threading:PTHREAD Sockets:POLL,IPv4 2015.04.24 10:08:31 LOG6[547326662:2071228096]: file ulimit = 512 (can be changed with 'ulimit -n') 2015.04.24 10:08:31 LOG6[547326662:2071228096]: poll() used - no FD_SETSIZE limit for file descriptors 2015.04.24 10:08:31 LOG5[547326662:2071228096]: 250 clients allowed 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 5 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 4 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 6 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: SO_REUSEADDR option set on accept socket 2015.04.24 10:08:31 LOG7[547326662:2071228096]: telnet bound to 0.0.0.0: 2015.04.24 10:15:00 LOG3[547326662:2071228096]: Received signal 2; terminating 2015.04.24 10:18:18 LOG5[547326662:2071228096]: stunnel undefined on vax-openvms with OpenSSL 0.9.8h 28 May 2008 2015.04.24 10:18:18 LOG5[547326662:2071228096]: Threading:PTHREAD Sockets:POLL,IPv4 2015.04.24 10:18:18 LOG6[547326662:2071228096]: file ulimit = 512 (can be changed with 'ulimit -n') 2015.04.24 10:18:18 LOG6[547326662:2071228096]: poll() used - no FD_SETSIZE limit for file descriptors 2015.04.24 10:18:18 LOG5[547326662:2071228096]: 250 clients allowed 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 5 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 4 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 6 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: SO_REUSEADDR option set on accept socket 2015.04.24 10:18:19 LOG7[547326662:2071228096]: telnet bound to 0.0.0.0: 2015.04.24 10:21:08 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:08 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59281 2015.04.24 10:21:08 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:08 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:08 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:08 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:08 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:08 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:30 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:30 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:30 LOG7[547326662:8966656]: telnet finished (0 left) 2015.04.24 10:21:31 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:31 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59283 2015.04.24 10:21:31 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:31 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:31 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:31 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:31 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:31 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:32 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:32 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:32 LOG7[547326662:8966656]: telnet finished (0 left) 2015.04.24 10:21:33 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:33 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59284 2015.04.24 10:21:33 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:33 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:33 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:33 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:33 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:33 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:34 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:34 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:34 LOG7[547326662:8966656]: telnet finished (0 left) Paul J Coviello Senior System Administrator CCS Corporate Headquarters Two Wells Avenue, Newton, MA 02459 617.965.2000, Ext. 4004 [cid:[email protected]] [cid:[email protected]] CCS Commercial, LLC | CCS Resources, Inc. | ClaimAssist, LLC | Credit Control Services, Inc. Customer Contact Solutions, LLC | Enterprise Associates, LLC

2 4

Fwd: Comments/questions to Debian patches
by Michal Trojnara 24 Apr '15

24 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Peter Pentchev, the Debian package maintainer for the "stunnel4" package, does not reply to my emails. I hope he is still alive and well, just too busy to maintain the package. I decided to share with you my comments to the patches that are applied to the Debian package. Hopefully, someone will find them useful. Mike - -------- Forwarded Message -------- Subject: Comments/questions to Debian patches Date: Tue, 28 Oct 2014 21:13:25 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: Peter Pentchev <roam(a)ringlet.net> Hi Peter, Just a few comments/questions to improve the quality of Debian package. I'll be glad to discuss if you disagree with my opinions. 01-fix-paths.patch The patch description is quite outdated. Translation from sbin to bin was performed upstream in stunnel 4.21 released 27 Oct 2007. 8-) I guess: /usr/bin/stunnel -fd 10 \ should be: /usr/bin/stunnel4 -fd 10 \ Probably this should be added to the next patch: 02-rename-binary.patch 05-logrotate-warning-in-sample-conf.patch Good idea. I'll add it to stunnel 5.07. 08-client-example.patch I've already added this example in stunnel 5.02. Your patch adds it once again. Just remove it. 10-no-zlib-compression.patch I'm completely confused by this patch. According to my tests it only makes stunnel reporting different errors when a user tries to enable compression on Debian. Why would anyone need this patch? 11-no-rle-compression.patch IMHO OpenSSL bugs should be fixed in OpenSSL, and not in stunnel. YMMV 12-restore-pidfile-default.patch I strongly disagree with this approach, as it breaks configuration file compatibility with the upstream. Debian should instead rewrite stunnel.conf when upgrading from stunnel 4.xx. 14-lsb-init-functions.patch 8-) 15-upstream-systemd-libs.patch This (and more) will be included in stunnel 5.07. 16-upstream-sslv23-method.patch This will be included in stunnel 5.07. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVNsCAAAoJEC78f/DUFuAUpfUP/j13koMgtnVLfsACIqUEaZw3 1uADOP/Dugqbn/QcwSqWAlcTrf7So98AQrB88xAhN8C3fwP375GmcNmPgJx4RRme fU/Wo0aFaCq0JOReiQkNiyj3pqf+J2NxZlZM5ZpzzpA80x8AlyLqBwPfBAtxgYNJ rb5AyIoGPkzfXM8OSz8YJXZtgXT4lrSCE5djlWHHBqy9ioUZCEuyVXeT5Y90sXOg wOA/EX3fTKEJZckoiNoTPAh9pLZ9M29lLM7wLEu5BFWwh/TtHk0ZFADo3Kzi/+4G Q6h9236DmH1NHA/FzMfFbKEYz/0yeOUMfet8LsRNNRRrFJEp+miMemSYajGMA3IT UVW4UNOa+CppVgkRpVMGfl/Lw53GP63xbLIRuZs17py03hNBHz2pyZneWWKTJEun xJQC4QJ3Z3YYXd71jpHIKjcDBXmIzcG8Z9QylaTywk8MBBBpjuRTXkIAlWWj2Iyk LVRsAgtooUKlQzUoAoseRygDv+Wbp/qVNL1Zogy7PmfORmqZOz08jRpDlXFgjPjR evGztgApTR+FSMO9f052z/Sql0chb5mhtdAtdBKpRE3CgtIrCHfcalSOyeCleHJK NMEbqfed9Oq2WA0/W89ilGtJWRH4v0GnYCfbYhbSoXp9DytdHPbhRUsiJL8LO34b 1cuMSsQ9LjF+3WyRie4m =SrZs -----END PGP SIGNATURE-----

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users