- stunnel-users - stunnel.org

Stunnel configure error
by hdf sdesdh 11 Aug '09

11 Aug '09

I have been receiving errors when configuring Stunnel, which I intend to cross compile for use with my Linksys WRT54GL router (Tomato firmware). When passing ./configure --host=mipsel-linux --with-ssl=/root/openssl --enable-static --enable-dh --libexecdir=/tmp the configure process stops with an error. Here is the complete output. ./configure --host=mipsel-linux --with-ssl=/root/openssl --enable-static --enable-dh --libexecdir=/tmp configure: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used. configure: **************************************** initialization checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking for mipsel-linux-strip... mipsel-linux-strip checking build system type... i686-pc-linux-gnu checking host system type... mipsel-unknown-linux-gnu checking for mipsel-linux-gcc... mipsel-linux-gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... yes checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether mipsel-linux-gcc accepts -g... yes checking for mipsel-linux-gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of mipsel-linux-gcc... gcc3 checking for a BSD-compatible install... /usr/bin/install -c checking whether make sets $(MAKE)... (cached) yes configure: **************************************** libtool checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ld used by mipsel-linux-gcc... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking for /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld option to reload object files... -r checking for BSD-compatible nm... /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B checking whether ln -s works... yes checking how to recognize dependent libraries... pass_all checking how to run the C preprocessor... mipsel-linux-gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for mipsel-linux-g++... mipsel-linux-g++ checking whether we are using the GNU C++ compiler... yes checking whether mipsel-linux-g++ accepts -g... yes checking dependency style of mipsel-linux-g++... gcc3 checking how to run the C++ preprocessor... mipsel-linux-g++ -E checking for mipsel-linux-g77... no checking for mipsel-linux-xlf... no checking for mipsel-linux-f77... no checking for mipsel-linux-frt... no checking for mipsel-linux-pgf77... no checking for mipsel-linux-cf77... no checking for mipsel-linux-fort77... no checking for mipsel-linux-fl32... no checking for mipsel-linux-af77... no checking for mipsel-linux-xlf90... no checking for mipsel-linux-f90... no checking for mipsel-linux-pgf90... no checking for mipsel-linux-pghpf... no checking for mipsel-linux-epcf90... no checking for mipsel-linux-gfortran... no checking for mipsel-linux-g95... no checking for mipsel-linux-xlf95... no checking for mipsel-linux-f95... no checking for mipsel-linux-fort... no checking for mipsel-linux-ifort... no checking for mipsel-linux-ifc... no checking for mipsel-linux-efc... no checking for mipsel-linux-pgf95... no checking for mipsel-linux-lf95... no checking for mipsel-linux-ftn... no checking for g77... no checking for xlf... no checking for f77... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for xlf90... no checking for f90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for xlf95... no checking for f95... no checking for fort... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 1572864 checking command to parse /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B output from mipsel-linux-gcc object... ok checking for objdir... .libs checking for mipsel-linux-ar... mipsel-linux-ar checking for mipsel-linux-ranlib... mipsel-linux-ranlib checking for mipsel-linux-strip... (cached) mipsel-linux-strip checking if mipsel-linux-gcc supports -fno-rtti -fno-exceptions... yes checking for mipsel-linux-gcc option to produce PIC... -fPIC checking if mipsel-linux-gcc PIC flag -fPIC works... yes checking if mipsel-linux-gcc static flag -static works... yes checking if mipsel-linux-gcc supports -c -o file.o... yes checking whether the mipsel-linux-gcc linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure: creating libtool appending configuration tag "CXX" to libtool checking for ld used by mipsel-linux-g++... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking for mipsel-linux-g++ option to produce PIC... -fPIC checking if mipsel-linux-g++ PIC flag -fPIC works... yes checking if mipsel-linux-g++ static flag -static works... yes checking if mipsel-linux-g++ supports -c -o file.o... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... GNU/Linux ld.so (cached) (cached) checking how to hardcode library paths into programs... immediate appending configuration tag "F77" to libtool configure: **************************************** types checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 checking for socklen_t... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... configure: error: cannot check for file existence when cross compiling. Give me your suggestions. Thank you -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com!

2 1

running more than 1 stunnel as windows service
by Franjo Stipanovic 04 Aug '09

04 Aug '09

Hi guys, is there a way to install multiple stunnel instances as windows service? Where could I change service name? I get error: CreateService : the specified service already exists -- best wishes, Franjo Stipanovic

1 1

stunnel, haproxy and ssl cert
by Maxim 04 Aug '09

04 Aug '09

Hello dear community. I faced some troubles for iphone: I moved separate server from hardware to AWS Cloud with SSL certificate from Register.com. It moved well, and phone application continue work with new server without any problems. Then I installed LoadBalancer (HAProxy and Stunnel) for it and moved certificate with key from configs of Apache to config of stunnel. In PC browser it continue works well, and shows me blue field near the URL as trusted. But on iPhone browser it shows just "Untrusted server certificate". Is there any difference for ssl certificate for stunnel and Apache? I understand that there is very specific question, but would you have any ideas about it? *Config of stunnel:* cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log [https] accept = 443 connect = 80 xforwardedfor=yes TIMEOUTclose = 0 *Patch for stunnel* http://haproxy.1wt.eu/download/patches/stunnel-4.22-xforwarded-for.diff need to make work "xforwardedfor=yes" *# stunnel -version* stunnel 4.22 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none * # uname -a* Linux domU-12-31-38-00-35-07 2.6.18-xenU-ec2-v1.0 #2 SMP Tue Feb 19 10:51:53 EST 2008 i686 athlon i386 GNU/Linux * # openssl version* OpenSSL 0.9.8b 04 May 2006 *And logs from stunnel when iphone tryed to conenct* 2009.08.04 08:20:16 LOG7[31023:3081598672]: https accepted FD=15 from 24.5.77.143:58019 2009.08.04 08:20:16 LOG7[31023:3081550736]: https started 2009.08.04 08:20:16 LOG7[31023:3081550736]: FD 15 in non-blocking mode 2009.08.04 08:20:16 LOG7[31023:3081550736]: TCP_NODELAY option set on local socket 2009.08.04 08:20:16 LOG7[31023:3081550736]: Waiting for a libwrap process 2009.08.04 08:20:16 LOG7[31023:3081550736]: Acquired libwrap process #0 2009.08.04 08:20:16 LOG7[31023:3081550736]: Releasing libwrap process #0 2009.08.04 08:20:16 LOG7[31023:3081550736]: Released libwrap process #0 2009.08.04 08:20:16 LOG7[31023:3081550736]: https permitted by libwrap from 24.5.77.143:58019 2009.08.04 08:20:16 LOG5[31023:3081550736]: https accepted connection from 24.5.77.143:58019 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): before/accept initialization 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 read client hello A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write server hello A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write certificate A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write server done A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 flush data 2009.08.04 08:20:16 LOG3[31023:3081550736]: SSL_accept: Peer suddenly disconnected 2009.08.04 08:20:16 LOG5[31023:3081550736]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.08.04 08:20:16 LOG7[31023:3081550736]: https finished (0 left) Thank you in advance, Max

1 0

write client hello hang/timeout
by . 01 Aug '09

01 Aug '09

stunnel4 config 2009.08.01 05:09:29 LOG7[4856:0]: Snagged 64 random bytes from /home/c7a71k/.rnd 2009.08.01 05:09:29 LOG7[4856:0]: Wrote 1024 new random bytes to /home/c7a71k/.rnd 2009.08.01 05:09:29 LOG7[4856:0]: RAND_status claims sufficient entropy for the PRNG 2009.08.01 05:09:29 LOG7[4856:0]: PRNG seeded successfully 2009.08.01 05:09:29 LOG7[4856:0]: Certificate: /etc/stunnel/stunnel.pem 2009.08.01 05:09:29 LOG7[4856:0]: Certificate loaded 2009.08.01 05:09:29 LOG7[4856:0]: Key file: /etc/stunnel/stunnel.pem 2009.08.01 05:09:29 LOG7[4856:0]: Private key loaded 2009.08.01 05:09:29 LOG7[4856:0]: SSL context initialized for service stunnel 2009.08.01 05:09:29 LOG5[4856:0]: stunnel 4.22 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2009.08.01 05:09:29 LOG5[4856:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv6 2009.08.01 05:09:29 LOG7[4856:0]: stunnel started 2009.08.01 05:09:29 LOG7[4856:0]: FD 0 in non-blocking mode 2009.08.01 05:09:29 LOG7[4856:0]: FD 1 in non-blocking mode 2009.08.01 05:09:29 LOG7[4856:0]: FD 4 in non-blocking mode 2009.08.01 05:09:29 LOG7[4856:0]: stunnel connecting 212.93.193.72:443 2009.08.01 05:09:29 LOG7[4856:0]: connect_wait: waiting 10 seconds 2009.08.01 05:09:29 LOG7[4856:0]: connect_wait: connected 2009.08.01 05:09:29 LOG5[4856:0]: stunnel connected remote server from 192.168.2.100:47406 2009.08.01 05:09:29 LOG7[4856:0]: Remote FD=4 initialized 2009.08.01 05:09:29 LOG7[4856:0]: SSL state (connect): before/connect initialization 2009.08.01 05:09:29 LOG7[4856:0]: SSL state (connect): SSLv2 write client hello A # (hangs indefinitely) #here's the config: client = yes foreground = yes debug = 7 cert = /etc/stunnel/stunnel.pem sslVersion = SSLv2 connect = 212.93.193.72:443 execargs = iceweasel # I think I'm supposed to get a "read server hello A" back?... But I get nothing, and iceweasel is *not* launched. # Anyone know how to overcome this?

1 0

[patch] Redirect to a fake destination if client's certificate couldn't be verified
by Jeremie Le Hen 29 Jul '09

29 Jul '09

Hi list, I've written a patch to bring in the following directives: - evilconnect - evilexec/evilexecargs The idea is when stunnel works in server mode and is asked to verify the client's certificate, it normally shuts the connection down when the latter is invalid. With these options, when the certificate can't be verified, stunnel redirects the "evil" connection to another destination. What is the purpose of this new feature ? For instance, if your company does not allow SSH connections out, you may use the following configuation: % connect = yourdomain.com:22 % evilconnect = www.yourdomain.com:80 So you will access your SSH server with your valid user certificate. On the other hand, if an over-zealous sneaky admin looks at the proxy logs and tries to connect to your stunnel, it will be redirected to an uninteresting website ;). Here is the documentation: % evilconnect = [host:]port % connect to a remote host:port when the client's certificate cannot % be verified % % This is only meaningful in server mode when connect and verify are % used. Otherwise it has the same properties as the connect option. % % evilexec = executable_path (Unix only) % execute local inetd-type program when the client's certificate can- % not be verified % % This is only meaningful in server mode when exec and verify are % used. Otherwise it has the same properties as the exec option. % % execargs = $0 $1 $2 ... (Unix only) % arguments for evilexec including program name ($0) % % Quoting is currently not supported. Arguments are separated with % arbitrary number of whitespaces. I'd like to thank Mathieu CHOUQUET-STRINGER who actually had this very good idea and implemented a proof of concept code with GnuTLS. Also, thank to Vin0x64 <vincent vin0x64 fr> who tested this patch and verified that it works. Looking forward for your remarks... thanks! Best regards, -- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org >

1 1

Stunnel listen on different ports
by Noel Sanchez 21 Jul '09

21 Jul '09

I have had a working stunnel conf for much time, very happy with it. [stunnel] accept = 0.0.0.0:30000 connect = 192.168.27.102:8000 I have stunnel listening on port 30000 and then sending to 192.168.27.102 on port 8000. Works good. I now want to add more listening ports to stunnel, like so: [stunnel] accept = 0.0.0.0:30000 connect = 192.168.27.102:8000 accept = 0.0.0.0:30006 connect = 192.168.27.102:8006 When I do this, stunnel only binds to 30006, per my log file: stunnel bound to 0.0.0.0:30006 And when I do a netstat -vatn: tcp 0 0 0.0.0.0:30006 0.0.0.0:* LISTEN It is not listening on port 30000 anymore. I'd like to accepts connections on many different ports, then send accordingly. Can I do this? Why does stunnel only listen to one port when I add more accept lines in its config? Noel

2 2

Re: [stunnel-users] using webdav: YES IT WORKS WITH NET USE
by delaage.pierre＠free.fr 18 Jul '09

18 Jul '09

Well after some more tests I achieve net use to work: UseBasicAuth is VITAL on the xp client (reboot) Accordingly configure apache with basic plain text auth stunnel routing localhost:80 to remote:443 (as you did) to pass your credentials use EXACTLY this command line : net use y: \\localhost\davfolder (with no extra \) YOURPASSWORD /USER:YOURUSERNAME (this in the only way to have hhtp credentials sent to the server). tested on client: xpsp2 + kb892211 + kb911927 (IMPORTANT ALSO, needs reboot) + stunnel 427 and server apache 2.2.6/Mandriva 2008. kb907306 replaces 892211, but I have not tested with it (I think it should work). If you cannot achieve it to work please let me know the exact error message you receive from windows. Again your problem is only related to windows issue, not stunnel. Pierre Quoting Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > yes, i am the admin. have pulled it back to basic auth. > okay i have installed Webfldrs-KB907306-ENU.exe and checked for its listing > in systemcontrol -> software (show updates) - it does not appear there! :-( > add network location: > it is running directly to the server and through stunnel, too :-) > > wtf? i have to install office2003 for such a problem? mh okay, i did so - no > change in behaviour - mh the failures of net use are changing - now it is a > systemfailure 67. networkname not found > syntax: net use x: \\127.0.0.1\user /user:user > > thank you - flo > > > 2009/7/18 <delaage.pierre(a)free.fr> > > > A question : > > Are you the administrator of your web server ? > > if yes : set up apache with "basic authentication", not digest (this will > > not be > > a problem later with ssl) and setup the registry key usebasicauth to 1 on > > your > > client. > > SP3 does NOT contain kb907306 : so install it (you will not damage your > > system > > if this patch is already in it). > > Forget net use for the moment : "add network location" should work first. > > > > IMPORTANT : "add network location" supports SSL WITHOUT the need of > > stunnel, so > > try to setup directly a "location" pointing to " > > https://yourserver/yourfolder". > > of course you will need to install first your own certificate with > > "internet > > explorer", so that windows can use it to connect to your ssl server. > > > > Something else : check this http://support.microsoft.com/KB/942392 > > ...ie be sure that your server allow browsing dav space FROM the root url. > > Moreover, always according to kb942392, to have net use working one must > > have > > ...MS office installed! > > > > Pierre > > > > > > Quoting Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > > > > > ok, i thought that i've sp3 in my virtualbox... but it is installed now - > > > and all other updates too! > > > i've tested with digest authentification now - but it isn't running. > > > the remote server is a debian lenny with apache2.2. > > > the ssl certificate is validated by Equifax Secure Inc. > > > ie7: sure :) and i am confused in the moment the mapping in networkarea > > as > > > addition web ressource isn't running. tried it with ssl in the past (was > > > running) and now without ssl, there appears this log in apache: > > > [Sat Jul 18 00:30:33 2009] [error] [client ip] user > > > subdomain.example.de\user > > > not found: / > > > for the digest method the same with "realm" > > > however there is no preview for the files with this method, and that is > > what > > > i need :( > > > > > > i think i haven't installed kb907306 in the moment(mh ok maybe it is in > > > servicepack 3 ?), but i don't know what you mean with dbl click feature > > :-( > > > > > > i'm really pleased for your help :-) > > > > > > 2009/7/17 <delaage.pierre(a)free.fr> > > > > > > > Next step : > > > > be sure to have kb892211 (preferred) or more recent kb907306 (suppress > > dbl > > > > click > > > > feature!) installed on your system and retry. > > > > Yes you have to create the registry key by hand on your client system, > > > > but you really have to know more about your server authentication > > process. > > > > About ie7 : have you been able to browse in your webfolders, via a > > folder > > > > view? > > > > > > > > Try also adding your web folder to windows explorer by using "Add > > Network > > > > location", which is another mechanism than mapping a drive letter, and > > more > > > > often works. > > > > > > > > See you soon, > > > > Pierre Delaage > > > > > > > > > > > > > > > > Quoting Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > > > > > > > > > wow thank you, some really good tips :) > > > > > i tested it with ie 7 and it is running fine. > > > > > then i've set the regkey, is it right that i have to create it by > > myself? > > > > > rebooted - and no, there is the same error :-( > > > > > the gui for the net use command ( explorer/tools/ map networkdrive) > > isn't > > > > > running, too! > > > > > > > > > > i really hope, that any body could help me > > > > > thank you > > > > > > > > > > > > > > > 2009/7/17 <delaage.pierre(a)free.fr> > > > > > > > > > > > Hello, > > > > > > There are many things to check on Windows configuration before > > > > > > checking potential issues in stunnel. > > > > > > > > > > > > At first you should check what is the HTTP authentication mechanism > > > > used by > > > > > > your > > > > > > webdav server : > > > > > > if this server is using "basic plain text authentication", this > > WILL > > > > NOT BE > > > > > > supported by the windows "webdav redirector" (the system component > > that > > > > > > allows > > > > > > you to map a webdav folder to a virtual system drive)...unless you > > set > > > > up > > > > > > this > > > > > > registry key : > > > > > > > > > > > > > > > > [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWebClientParameters] > > > > > > "UseBasicAuth"=dword:00000001 > > > > > > > > > > > > Check this page for some MS explanations: > > > > > > > > http://technet.microsoft.com/en-us/library/cc787023%28WS.10%29.aspx > > > > > > > > > > > > Something else to check : try to open your webdav location by using > > > > > > "internet > > > > > > explorer 6 or 7"/file-open/check "web folder" checkbox. let us know > > > > whether > > > > > > it > > > > > > works. > > > > > > Try also by "Explorer/Tools/Map network drive", but it is very > > painful > > > > by > > > > > > asking > > > > > > many times for credentials. > > > > > > > > > > > > Yours sincerely, > > > > > > Pierre Delaage > > > > > > > > > > > > Selon Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > > > > > > > > > > > > > > > > > > > hi - i want to use webdav through stunnel to provide a > > drive(letter). > > > > > > > system: winxp sp3 > > > > > > > net use http://127.0.0.1/dirname /user:someuser > > > > > > > offers a systemfailure 64... stunnel log said SSL_connect: > > 1408F06B: > > > > > > > error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression > > > > > > > but a connection with firefox is running fine. > > > > > > > i am doing try&error for about a week and i am sick now :( > > > > > > > i hope you can help me - thank you > > > > > > > > > > > > > > client=yes > > > > > > > verify=0 > > > > > > > [psuedo-https] > > > > > > > accept = 80 > > > > > > > connect = ssl.studenten-wg-halle.de:443 > > > > > > > TIMEOUTclose = > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >

1 0

using webdav
by Jan-Florian Hilgenberg 17 Jul '09

17 Jul '09

hi - i want to use webdav through stunnel to provide a drive(letter). system: winxp sp3 net use http://127.0.0.1/dirname /user:someuser offers a systemfailure 64... stunnel log said SSL_connect: 1408F06B: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression but a connection with firefox is running fine. i am doing try&error for about a week and i am sick now :( i hope you can help me - thank you client=yes verify=0 [psuedo-https] accept = 80 connect = ssl.studenten-wg-halle.de:443 TIMEOUTclose =

2 1

Common Name checking
by Mark Bolton 15 Jul '09

15 Jul '09

Hi, I believe this has been discussed before on the list but I wanted to get a better understanding and confirm the current situation. Is it still correct that when using verify=2, the peer's hostname is not checked (via a name service lookup) to match the Common Name in the presented certificate? With the main reason being that you cannot necessarily trust the name service? I am asking because we have a closed network in which we do trust our dns servers, and Common Name checking would be advantageous to us given the following scenario: We have is that a single (central) host that connects to multiple 'client' hosts via stunnel. The central host presents a certificate signed by our own CA. Each client has a copy of our CA's certificate and has verify=2. So when the central server connects, the client checks that the certificate presented has really been signed by our own CA. So using this mechanism, only servers (i.e. the central server) with a signed certificate are allowed to connect. All good so far, however the problem is if the signed certificate is copied (stolen) to another server. This 'other' server can connect to all the clients also. With Common Name checking, the clients could as well as checking the signature, check the presenting host has the same hostname as in the certificate. Is there anyway we can use stunnel to help us guard against this 'stolen cert' situation or if not what else could we do? Thanks, Mark

2 3

[patch] add new option send_client_info
by Henrik Riomar 13 Jul '09

13 Jul '09

Hi, The attached patch adds a new option that allows stunnel to pass on some client information to for instance a web service that uses stunnel for it's encryption. The first line of data contains the client info and if the new option is not enabled the patch does nothing. Regards, Henrik Riomar P.S. public domain.

1 0