stunnel-users

3306 discussions

SSL communication is unestablishable by stunnel.
by take＠kasaneiro.jp 24 Jan '14

24 Jan '14

stunnel is used in order to use SMTPs/POPs, when using the e-mail software Mew. However, the following logs come out, emacs solidifies and communication is impossible. How is it repaired if it carries out? Please let me know if you please. Computer environment Apple MacBook Pro (Mid 2012), Mac OS X 10.9.2 GNU (Cocoa)Emacs 24.3.50.1 (x86_64-apple-darwin13.0.0, NS apple-appkit- 1265.00) Mew 6.5 Stunnel 4.56 --- <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Clients allowed=125 2014.01.23 23:30:26 LOG5[15311:140735163843344]: stunnel 4.56 on x86_64- apple-darwin13.0.0 platform 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Compiled/running with OpenSSL 0.9.8y 5 Feb 2013 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Threading:PTHREAD Sockets:SELECT,IPv6 SSL:ENGINE,OCSP 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Reading configuration from file /var/folders/tc/0dm70kl977x3_rcfkldrzz3h0000gn/T/take15307AeS/ mew1530708i 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Compression not enabled 2014.01.23 23:30:26 LOG7[15311:140735163843344]: PRNG seeded successfully 2014.01.23 23:30:26 LOG6[15311:140735163843344]: Initializing service [ 8840] 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Verify directory set to /Users/take/.certs 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Added /Users/take/. certs revocation lookup directory 2014.01.23 23:30:26 LOG7[15311:140735163843344]: SSL options set: 0x00000004 2014. <SSL/TLS: > 01.23 23:30:26 LOG5[15311:140735163843344]: Configuration successful 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] (FD=7) bound to 127.0.0.1:8840 2014.01.23 23:30:26 LOG7[15311:140735163843344]: No pid file being created <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] accepted (FD=3) from 127.0.0.1:56364 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] started 2014.01.23 23:30:26 LOG5[15311:4558856192]: Service [8840] accepted connection from 127.0.0.1:56364 2014.01.23 23:30:26 LOG6[15311:4558856192]: connect_blocking: connecting 127.0.0.1:99 2014.01.23 23:30:26 LOG7[15311:4558856192]: connect_blocking: s_poll_ wait 127.0.0.1:995: waiting 10 seconds 2014.01.23 23:30:26 LOG3[15311:4558856192]: connect_blocking: connect 127.0.0.1:995: Connection refused (61) 2014.01.23 23:30:26 LOG5[15311:4558856192]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.01.23 23:30:26 LOG7[15311:4558856192]: Local socket (FD=3) closed 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] finished (0 left)

2 1

OCSP Responders in AIA extension
by Ender Erel 22 Jan '14

22 Jan '14

Hi All, Does stunnel check the OCSP responders found in a certificate's AIA field? I am asking this because in the following e-mail from back 2008, the sender mentions a patch that implements this functionality. The patch is included with the mail but I don't think it is included in the later versions of stunnel. Does this mean OCSP responders inside a certificate are ignored? I also want to ask another thing. When using verify = 3 in client mode, which file is used to check the received certificate? Is it the CAfile? If so, would it work like this: - I manually opened a connection to a server outside stunnel, downloaded the server's certificate, and closed the connection. - I saved this certificate to a file, and wrote the path of this file in the stunnel configuration file (CAfile = /mycerts/tmpcert.pem,verify=3). - I started stunnel and initiated a connection to the server. Would the connection be successful? Would it be the right way to use verify=3? Kind Regards, Ender Erel

2 3

disabling compression
by James Bardin 22 Jan '14

22 Jan '14

Hi, The stunnel man page states that compression is off by default, but It seems that is no longer the case. (the changelog states that version 4.5.1 sets compression as "not disabled by default") The config options don't seem to accept any parameters to disable compression. Is there any way to disable it via openssl options? Thanks! -jim

2 2

Question about 'delay = yes' and DNS cache
by John Chow 16 Jan '14

16 Jan '14

Hey Everyone, I have a question about the *delay = yes* config flag and whether or not it caches the resolved IP after the initial connection? To give context, I want my load balancer (Haproxy) to forward requests to an app on Heroku, and I'm using stunnel on my LB box to proxy to Heroku via HTTPS. Since the IP for my app's endpoint could potentially change (60s DNS TTL), stunnel caching resolved IPs would be a problem. Thanks, John -- John Chow Software Engineer Fundly

2 1

Silent install on windows ?
by Brian Ipsen 16 Jan '14

16 Jan '14

Hi I have been searching through google, and from the result there, it should be possible to install stunnel silently on Windows using a /S switch.... I have tried this with the stunnel-4.56-installer.exe package - but it doesn't seem to work..... Can anyone tell me how to install stunnel silently - with no user interaction at all ? Regards /Brian

2 1

Multiple OCPSs
by Ender Erel 16 Jan '14

16 Jan '14

Hi All, We want to use multiple OCSP servers, but the way I see it we can specify only one OCSP server in the configuration file. Is there any other way to do this? Regards, Ender

2 1

Extra listeneres running that loop back to each other.
by Keith Knapp 15 Jan '14

15 Jan '14

Hi, Every time I start stunnel two unexplainable things happen. 1. The settings in my .conf file are not implemented and I have checked them syntactically. 2. I use TCPView and can see two established connections associated with the stunnel process, but they are *not* in my .conf file - Every time I restart the service the two connections reappear but are associated with different ports. - Furthermore the connections loop back on each other; meaning that the remote port of the one connection is the local port of the other connection (and vice-versa). - Are these supposed to be there? I have done a fresh install of the newest version of stunnel. Keith

1 0

Re: connect error 0 running on ARM platform
by FX35 15 Jan '14

15 Jan '14

> Message: 1 > Date: Tue, 14 Jan 2014 12:19:47 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] Fwd: Re: connect error 0 running on ARM > platform > Message-ID: <52D51D53.5030106(a)mirt.net> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > FWX wrote: >> errno is not updated ... >> >> So errno doen't reflect the real value. >> >> Map file of stunnel programm shows _errno_localion(), as you wrote. >> >> Perhaps is there a bug in uClib ? > > Something like this one: > http://www.mail-archive.com/[email protected]/msg05640.html > http://www.mail-archive.com/[email protected]/msg05641.html > or: > http://www.mail-archive.com/[email protected]/msg09301.html > ? > > It indeed looks like uclibc and stunnel use a different errno... > > Mike > > Thank you, Mike, I think you're right. It's ok using mode fork rather than pthread. Regards, FWX.

1 0

newbie question
by Ted Roeloffzen 15 Jan '14

15 Jan '14

Hello All, I'm new to STunnel and installed and setup STunnel. When someone tried to connect I get the following items in the log. SSL accepted: new session negotiated Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 FD 8 in non-blocking mode SL-test>Instelling connecting 127.0.0.1:8890 connect_wait: waiting 10 seconds connect_wait: connected Remote FD=8 initialized SSL alert (read): warning: close notify SSL closed on SSL_read Socket write shutdown SSL write shutdown SSL alert (write): warning: close notify SSL_shutdown successfully sent close_notify Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket SL-test>Instelling finished (0 left) As I'm reading this, there was an established connection but the connection party disconnected, for some reason or another. There was no data sent, but there also was no real error. Is this assumption correct or am I missing something? kind regards, Ted

1 0

Re: [stunnel-users] connect error 0 running on ARM platform
by FX35 14 Jan '14

14 Jan '14

> Message: 3 > Date: Fri, 10 Jan 2014 15:27:10 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] connect error 0 running on ARM platform > Message-ID: <52D0033E.1060109(a)mirt.net> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > On 01/09/2014 06:02 PM, FX35 wrote: >> Running stunnel 4.56 or 5.00 on an ARM platform (ARM926EJ) with Linux >> 2.6.36.4, I encounter the following error : the call to connect() >> return -1, but errno is set to 0 ! >> >> If stunnel is configured to use fork mode instead of pthread mode, >> the problem disapear. >> >> So it seems there is a problem, cross-compiling the program, with >> errno or __errno_location() in the program generated with pthread. >> >> I add the definition of _REENTRANT, without success ... >> >> (See $H1 at http://pauillac.inria.fr/~xleroy/linuxthreads/faq.html) >> >> Is somebody meet the same error ? > > The errno definition in the Android framework (as an example of > Linux/ARM platform) is: > > /* internal function returning the address of the thread-specific > errno */ > extern volatile int* __errno(void); > > /* a macro expanding to the errno l-value */ > #define errno (*__errno()) > > > It seems okay. > > How do you reproduce this problem? What are the stunnel debug logs when > it happens? > > Mike Hello Mike, It seems that the errno variable is not correcly set/updated in C library, using pthread mode. Sample: errno = -1; ret = connect(...); if( ret == -1 ) { printf("errno=%d\n",errno); } will displays value -1 for errno, not EINPROGRESS or EWOULDBLOCK ! errno is not updated ... So errno doen't reflect the real value. Map file of stunnel programm shows _errno_localion(), as you wrote. Perhaps is there a bug in uClib ? Here is the result of ldd command: # ldd stunnel libssl.so.1.0.0 => /usr/lib/libssl.so.1.0.0 (0x400f3000) libcrypto.so.1.0.0 => /usr/lib/libcrypto.so.1.0.0 (0x4013d000) libz.so.1 => /usr/lib/libz.so.1 (0x4027c000) libdl.so.0 => /lib/libdl.so.0 (0x4029b000) libutil.so.0 => /lib/libutil.so.0 (0x4009e000) libpthread.so.0 => /lib/libpthread.so.0 (0x400a7000) libc.so.0 => /lib/libc.so.0 (0x402a6000) libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x400c6000) ld-uClibc.so.0 => /lib/ld-uClibc.so.0 (0x4008f000) Thanks for help. Regards, FWX.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users