- stunnel-users - stunnel.org

Solaris9/Sparc runtime library problems
by Dave Hinz 23 Jun '06

23 Jun '06

This is probably a very basic problem, but I've checked the FAQ and googled through the mailing list's archives and I'm not seeing what appears to be a match for this problem. I'm completely new to stunnel. It built and runs just fine on one of my linux dev boxes, but on Solaris, I can't get it to run. Attempting to run /usr/local/sbin/stunnel, I get the following: ---begin output--- jabba% ./stunnel ld.so.1: ./stunnel: fatal: libssl.so.0.9.7: open failed: No such file or directory Killed ---end output--- The various debug switches to stunnel give the same output - it's dying before anything can be started, apparently. libssl.so.0.9.7 is located on that box at /usr/local/ssl/lib/libssl.so.0.9.7and other ssl functions of the system appear to work normally. I suspect that stunnel just doesn't know how to find it, but I'm at a loss as to how to tell it where to look. Can someone suggest my next steps please? Thank you, Dave Hinz

2 1

Patch for stunnel 4.15 to support pgsql protocol
by Peter Kuma 23 Jun '06

23 Jun '06

Hi I've written a short patch for stunnel 4.15 adding support for PostgreSQL SSL negotiation. I hope it'll be useful. http://vcielka.rec.uniba.sk/~peter/stunnel-pgsql.patch PostgreSQL documentation explaining how to establish SSL connection: http://www.postgresql.org/docs/8.1/interactive/protocol-flow.html#AEN60652 http://www.postgresql.org/docs/8.1/interactive/protocol-message-formats.html Regards Peter Kuma

1 0

enabling zlib compression
by ahall＠madasafish.com 23 Jun '06

23 Jun '06

Hi there, When I try to enable zlib compression at the server I get this error when starting it up... 2006.06.23 15:44:39 LOG3[3426:3086293504]: Failed to add zlib compression method How do I get zlib to work? Do I need to compile OpenSSL with zlib? I'm using Fedora Core 3 with stunnel-4.15, and OpenSSL and zlib are from RPM's. Thanks very much. ---- - Madasafish - Voted Best Heavy Consumer Broadband Provider in the 2006 Internet Industry Awards http://www.madasafish.com/

1 0

Re: CRLPath not working (Michal Trojnara)
by Nagasundaram, Sekhar 15 Jun '06

15 Jun '06

Michael: We will give this also a shot. The workaround worked however. Much thanks Sekhar ---------------- Message: 4 Date: Tue, 13 Jun 2006 23:44:50 +0200 From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> Subject: Re: [stunnel-users] CRLPath not working To: stunnel-users(a)mirt.net Message-ID: <200606132344.53413.Michal.Trojnara(a)mobi-com.net> Content-Type: text/plain; charset="utf-8" On Tuesday 13 June 2006 02:14, Nagasundaram, Sekhar wrote: > Here are the configuration and the log files as you requested.... Thank you. Please try the following change: --- ctx.old 2006-06-13 23:33:29.000000000 +0200 +++ ctx.c 2006-06-13 23:35:33.000000000 +0200 @@ -460,6 +460,7 @@ s_log(LOG_DEBUG, "Loaded CRLs from %s", section->crl_file); } if(section->crl_dir) { + section->revocation_store->cache=0; lookup=X509_STORE_add_lookup(section->revocation_store, X509_LOOKUP_hash_dir()); if(!lookup) { BTW: Did my workaround work? Best regards, Mike

1 0

RE: [stunnel-users] Is there a limit to the number of services youcanhave defined on a client?
by Lund, Claus 14 Jun '06

14 Jun '06

Well, we need about 100+ in our current environment. So how about increasing it to maybe 256? -Claus -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Wednesday, June 14, 2006 4:23 PM To: <stunnel-users(a)mirt.net> <stunnel-users(a)mirt.net> Subject: Re: [stunnel-users] Is there a limit to the number of services youcanhave defined on a client? On 2006-06-14, at 22:18, Lund, Claus wrote: > Any chance the default could be increased? Really, what's 4MB of RAM > between friends (for the example in your answer)? :-) Okay. What value do you recommend? > And maybe implement an error/warning message when the limit is > exceeded? Good idea. I'll do it. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

RE: [stunnel-users] Is there a limit to the number of services youcan have defined on a client?
by Lund, Claus 14 Jun '06

14 Jun '06

Thanks Mike. Any chance the default could be increased? Really, what's 4MB of RAM between friends (for the example in your answer)? :-) And maybe implement an error/warning message when the limit is exceeded? -Claus -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Wednesday, June 14, 2006 4:11 PM To: <stunnel-users(a)mirt.net> <stunnel-users(a)mirt.net> Subject: Re: [stunnel-users] Is there a limit to the number of services youcan have defined on a client? On 2006-06-14, at 21:20, Lund, Claus wrote: > I ran > some quick tests and it looks like it's impossible to have more than > 64 services defined? Here is your answer: http://stunnel.mirt.net/pipermail/stunnel-users/2006-April/001099.html Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Is there a limit to the number of services you can have defined on a client?
by Lund, Claus 14 Jun '06

14 Jun '06

We have a bunch of middle-tier servers for an application and we're using stunnel to encrypt the traffic between the windows clients and those middle-tier servers. The clients have stunnel.conf files with a large number of services defined and it seems like we're hitting some limit in stunnel. I ran some quick tests and it looks like it's impossible to have more than 64 services defined? If I have a config file with about 100 services defined then everything works fine up until I try to connect to service number 65. When I try to connect to that service then the client just hangs forever (and there's no output in the log file on the client). We are using version 4.14 but I tested this on 4.15 as well and I am getting the same result there. Here's a piece of the config file I am using for testing: "client = yes ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log [blah] accept = 13806 connect = tax187a:13806 [blah1] accept = 13807 connect = tax187a:13806" Then followed by blah2 - blah100. Things work fine when connect to "blah63" and lower. Anything higher than that cause the stunnel client to just hang. Thank you in advance, Claus ____________________________________________ Claus Lund Systems Developer NEW EMAIL ADDRESS: Claus.Lund(a)state.vt.us Department of Taxes Information Systems 133 State Street Montpelier, Vermont 05633-1401 (802) 828-3735

2 1

CRLPath not working
by Nagasundaram, Sekhar 13 Jun '06

13 Jun '06

Mike: Here are the configuration and the log files as you requested.... ---------------------------------------------BEGIN CONFIG --------------------------------- # switch-simulator stunnel configuration file # Copyright by Michal Trojnara 2002 # Certs and keys cert = /etc/certs/demoedge2-cert.pem key = /etc/keys/demoedge2-key.pem # PID is created inside chroot jail pid = /var/opt/stunnel/stunnel_server.pid # Authentication stuff verify = 2 options = NO_SSLv2 # don't forget about c_rehash CApath # it is located inside chroot jail: CApath = /etc/CApath # CRL path or file (inside chroot jail): CRLpath = /etc/crl # Some debugging stuff debug = local4.5 output = /var/opt/log/pras_test_server.log # Use it for client mode #client = no # Service-level configuration [APF] accept = 10.172.86.128:51101 connect = 127.0.0.1:50111 ----------------------------------------------END CONFIG ---------------------------------- --------------------------------------------- BEGIN LOG FILE ------------------------------- 2006.06.11 19:27:25 LOG5[8839:7]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, lastUpdate: Jun 9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT 2006.06.11 19:27:25 LOG4[8839:7]: Found CRL is expired - revoking all certificates until you get updated CRL 2006.06.11 19:27:25 LOG3[8839:7]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.11 19:27:25 LOG5[8839:7]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.12 17:41:52 LOG5[8839:8]: APF connected from 10.172.86.96:35225 2006.06.12 17:41:52 LOG5[8839:8]: VERIFY OK: depth=2, /C=US/O=VISA/OU=Visa International Service Association/CN=TEST Visa Info Delivery Root CA 2006.06.12 17:41:52 LOG5[8839:8]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, , lastUpdate: Jun 9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT 2006.06.12 17:41:52 LOG4[8839:8]: Found CRL is expired - revoking all certificates until you get updated CRL 2006.06.12 17:41:52 LOG3[8839:8]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.12 17:41:52 LOG5[8839:8]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.12 23:01:08 LOG5[8839:9]: APF connected from 10.172.86.96:35371 2006.06.12 23:01:08 LOG5[8839:9]: VERIFY OK: depth=2, <VISA CA> 2006.06.12 23:01:08 LOG5[8839:9]: CA CRL: Issuer: /C=US/O=VISA CRL ISSUER>, lastUpdate: Jun 9 07:00:02 2006 GMT, nextUpdate: Jun 10 08:00:02 2006 GMT 2006.06.12 23:01:08 LOG4[8839:9]: Found CRL is expired - revoking all certificates until you get updated CRL 2006.06.12 23:01:08 LOG3[8839:9]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.12 23:01:08 LOG5[8839:9]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ------------------------------------------- END LOG FILE -------------------------------------- On 2006-06-12, at 22:17, Nagasundaram, Sekhar wrote: > We download crls everyday from a CRL server using LDAP and a cronjob. > These CRLs are stored in the CRLpath directory along with its hash. > It appears that the stunnel is not refreshing its cache, and it > still shows "Found CRL is expired - revoking all certificates until > you get updated CRL" when we try to connect to it even though there is > a > New and valid CRL in the CRLPath folder. Is there a special option > In Stunnel configuration for it to recognize/cache/add the new hash > file Just to make sure: the problem disappears after restarting stunnel, right? The simple workaround could be disabling all SSL caches: ./configure --with-threads=fork make clean make make install Can you send your stunnel.conf and debug log? TIA, Mike Sekhar Nagasundaram <<Nagasundaram, Sekhar.vcf>>

2 1

Modifying STunnel to use OpenSSL FIPS
by David Gillingham 13 Jun '06

13 Jun '06

As part of an internal project at work, I'm investigating a Windows tunneling solution using STunnel. As a requirement of my work, I am to modify STunnel to use OpenSSL's FIPS APIs. And, with only a couple of speedbumps, I was able to achieve this. However I'd like to make my code a little more robust--to provide some notification to the user if OpenSSL's FIPS mode is active or not. To this point I've not been able to figure out a way to do this. In my copy of the STunnel source, I've modified the routine ssl_init() in ssl.c to make a call to FIPS_mode_set(1) (as demonstrated on page 33 of http://www.openssl.org/docs/fips/UserGuide-1.0.pdf). Below is a copy of my current copy of ssl_init(): void ssl_init(void) { /* to keep CLI structure for verify callback */ #if defined(OPENSSL_FIPS) && defined(USE_FIPS) if (!FIPS_mode_set(1)) { s_log(LOG_CRIT, "Could not set FIPS mdoe!"); } else { s_log(LOG_INFO, "In FIPS mode."); } #endif /* rest of ssl_init() from original source */ } As I've found out, the s_log calls do nothing because the STunnel window has not been displayed yet. Ideally, in the case where the FIPS_mode_set() call fails, I'd like to invoke an error handler to cause the STunnel service to fail to start. But trying to make a call to something like sslerror() caused a program crash. Any ideas on how to make these changes?

2 3

RE: [stunnel-users] socket closed after SSL_write
by Srilalitha Muralidhara(HCL Capital Market Services) 13 Jun '06

13 Jun '06

Thanks Michal. How do I disable the socket from sending TCP RST and instead make it send TCP FIN? It might be a very basic question. Sorry about that. Thanks Sri Srilalitha Muralidhara Rates IT Report Server HCL Capital Market Services ( 91.80.4190.6689 + 33/1,The Senate, Ulsoor Road, Bangalore. India. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Monday, June 12, 2006 11:08 PM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] socket closed after SSL_write On Monday 12 June 2006 12:01, Srilalitha Muralidhara wrote: > 2006.06.12 10:47:45 LOG7[19699:28]: SSL alert (write): warning: close > notify Clean SSL shutdown alert was received. > 2006.06.12 10:47:50 LOG3[19699:28]: SSL_read: Connection reset by peer > (131) ... and then TCP RST! Strange. It looks like your application has set SO_LINGER option on its socket, so it sends TCP RST instead of TCP FIN packet. Best regards, Mike Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

2 1

CRLPath not working
by Nagasundaram, Sekhar 12 Jun '06

12 Jun '06

All: We download crls everyday from a CRL server using LDAP and a cronjob. These CRLs are stored in the CRLpath directory along with its hash. It appears that the stunnel is not refreshing its cache, and it still shows "Found CRL is expired - revoking all certificates until you get updated CRL" when we try to connect to it even though there is a New and valid CRL in the CRLPath folder. Is there a special option In Stunnel configuration for it to recognize/cache/add the new hash file All help is appreciated. Thanks Sekhar

2 1

Re: [stunnel-users] Comparing with BarracudaDrive and Proxytunnel
by Michal Trojnara 12 Jun '06

12 Jun '06

On 2006-06-11, at 21:39, http s wrote: > I am curious if anyone has made a comparison of Stunnel with the > BarracudaDrive HTTPS tunnel and/or Proxytunnel? > > http://barracudaserver.com/examples/BarracudaDrive/HttpsTunnel/ > index.html 1. BarracudaDrive is *not* a free software (even though its home page claims so). See http://www.gnu.org/philosophy/free-sw.html for details. 2. It only works on Windows, Linux, QNX and Mac OS X. Compare it to the list on http://stunnel.mirt.net/. 3. BarracudaDrive is designed to be used for file transfer, while stunnel is a universal tool for encrypting TCP streams. As the result stunnel is much more flexible, but it won't perform any file transfer by itself. > http://proxytunnel.sourceforge.net 1. It's not really an encryption tool, but rather an extension for OpenSSH client. It has some optional basic SSL code (as for version 1.6.0), but it's currently broken. The code incorrectly assumes that SSL_read() only needs to read from a file descriptor and SSL_write() only needs to wrote to a file descriptor. 2. Proxytunnel supports NTLM authentication that is not currently supported by stunnel. 3. It looks like an interesting addition to stunnel on a Unix platform. The client configuration should be something like: [Proxytunnel] client = yes accept = 12345 exec = /path/to/proxytunnel execargs = proxytunnel -p proxy:8080 -u user -s pass -d mybox.athome.nl:443 4. Optional use of stunnel is recommended in README file of Proxytunnel 1.6.0. 8-) Best regards, Mike

1 0

socket closed after SSL_write
by Srilalitha Muralidhara(HCL Capital Market Services) 12 Jun '06

12 Jun '06

Hi, I work on a client-server application that needs to be supported on both UNIX and windows platforms. Currently, we keep one socket open for all communication from client to server (during which many read-write operations take place) For user authentication and security purposes, we are planning to implement SSL-Stunnel. I have developed a small ssl client (based on sclient.c example) which connects to the Stunnel Server. Upon the first SSL_write, SSL is closing the underlying socket. Hence the contents written by subsequent SSL_write operations are not visible in the server log. I saw lot of posts on the same problem. But couldn't find the solution. Any help is greatly appreciated. Please note that: 1. Due platform independency issues, I use RWSocket (a Roguewave library class) instead of the BSD socket in conjunction with SSL. A potion of stunnel server log 2006.06.12 10:47:43 LOG7[19699:28]: FD 1 in non-blocking mode 2006.06.12 10:47:43 LOG7[19699:28]: rssvr connecting 127.0.0.1:28091 2006.06.12 10:47:43 LOG7[19699:28]: Remote FD=1 initialized 2006.06.12 10:47:43 LOG7[19699:28]: TCP_NODELAY option set on remote socket 2006.06.12 10:47:45 LOG7[19699:28]: Socket closed on read 2006.06.12 10:47:45 LOG7[19699:28]: SSL write shutdown 2006.06.12 10:47:45 LOG7[19699:28]: SSL alert (write): warning: close notify 2006.06.12 10:47:45 LOG7[19699:28]: SSL_shutdown retrying 2006.06.12 10:47:45 LOG7[19699:28]: SSL doesn't need to read or write 2006.06.12 10:47:50 LOG3[19699:28]: SSL_read: Connection reset by peer (131) 2006.06.12 10:47:50 LOG5[19699:28]: Connection reset: 0 bytes sent to SSL, 26 bytes sent to socket 2006.06.12 10:47:50 LOG7[19699:28]: linger (remote): Invalid argument (22) 2006.06.12 10:47:50 LOG7[19699:28]: linger (local): Invalid argument (22) 2006.06.12 10:47:50 LOG7[19699:28]: rssvr finished (0 left) Thanks Sri Srilalitha Muralidhara This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

2 1

Reposting...RE: stunnel-users Digest, Vol 23, Issue 2
by Nagasundaram, Sekhar 09 Jun '06

09 Jun '06

Any one... Is there a way to have Stunnel not stop accepting new connections after CRL expiry? See my questions below.. Any help is appreciated... Much thanks Sekhar ---------------------------------------------------------------------- Message: 1 Date: Tue, 6 Jun 2006 15:41:08 -0700 From: "Nagasundaram, Sekhar" <snagasun(a)visa.com> Subject: [stunnel-users] Processing during CRL expiry and refresh To: <stunnel-users(a)mirt.net> Message-ID: <F64762DF94A15C4EA22D250B28D98BE610093C(a)sw720ex064.visa.com> Content-Type: text/plain; charset="US-ASCII" All: I have 2 questions: 1. Is there a way to have Stunnel continue processing and accepting connections after the CRL expiry? Currently it gives a "revoking all certificates" error and stops accepting new connections. 2. Is there a configurable parameter through which we can have the CRL list refresh itself such that 1 above does not happen? Much Thanks in advance.. Sekhar ------------------------------ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users End of stunnel-users Digest, Vol 23, Issue 2 ********************************************

1 0

syslog-ng over stunnel does not work for me
by Christoph Pleger 08 Jun '06

08 Jun '06

Hello, I set up a server and a client machine to test the combination of stunnel and syslog-ng. I followed the instructions in the example at http://www.stunnel.org/examples/syslog-ng.html, but the log messages are not sent correcly. The log on the server says: ****: syslog started ****: syslog connected from ###.###.###.###:51646 ****: SSL state (accept): before/accept initialization ****: SSL_accept: 140B544E: error: 140B544E: SSL routines:SSL_GET_NEW_SESSION:ssl session id callback failed ****: syslog finished (-1 left) The log on the client says: ****: syslog started ****: syslog connected from 127.0.0.1:3524 ****: FD 8 in non-blocking mode ****: syslog connecting ###.###.###.###:514 ****: connect_wait: waiting 10 seconds ****: connect_wait: connected ****: Remote FD=8 initialized ****: SSL state (connect): before/accept initialization ****: SSL state (connect): SSLv3 write client hello A ****: SSL_connect: Peer suddenly disconnected ****: syslog finished (0 left) Please help. Regards Christoph

1 1

Connection Reset by Peer
by Srilalitha Muralidhara(HCL Capital Market Services) 08 Jun '06

08 Jun '06

Hi, My stunnel server is unable to send data correctly to my application running the same machine. This happens when the client is run from windows platform. When client is run from UNIX everything works fine. The Stunnel Server log file says: 2006.06.05 11:54:54 LOG7[23141:8]: rssvr connecting 127.0.0.1:28091 2006.06.05 11:54:54 LOG7[23141:8]: Remote FD=1 initialized 2006.06.05 11:54:54 LOG7[23141:8]: TCP_NODELAY option set on remote socket 2006.06.05 11:54:54 LOG3[23141:8]: SSL_read: Connection reset by peer (131) 2006.06.05 11:54:54 LOG5[23141:8]: Connection reset: 0 bytes sent to SSL, 13 bytes sent to socket 2006.06.05 11:54:54 LOG5[23141:8]: linger (local): Invalid argument (22) 2006.06.05 11:54:54 LOG7[23141:8]: rssvr finished (0 left) ------------------------------------------------------------------------ -------------------------------------------------------------------- Does anybody know the cause of the problem? And hopefully the solution? Thanks Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0

decryption failed or bad record mac
by Trent Townsend 07 Jun '06

07 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've emailed about this once already, but am just giving a *little* more info. It seems similar problems with SSL proliferate the web. The problem is below (message from the client and server posted). I thought it may be a bug reported with SSL and zlib (which a fix isn't due out until the next version of OpenSSL). However, I can successfully start up a openssl s_server and talk to it with a s_client, so I think that eliminates OpenSSL. Has anyone seen this before (I'm sure this is the case) and figured it out? Client: SSL_connect: 140943FC: error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac Server: SSL_accept: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac I'm using stunnel 4.11 (tried 4.15 also) and Openssl 0.9.8a. Thanks. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQA/AwUBRIcbw40HAxBKv2yIEQI5XQCg2ylvhIBlZ57euv9/wu8fM5vI40cAoKKk L2bMgFZDc23T6ED6CGJJn8oy =+PA6 -----END PGP SIGNATURE-----

1 0

RE: [stunnel-users] stunnel error
by Nadav, Erez 07 Jun '06

07 Jun '06

Hi, It seems that the problem occur when the client write large buffers (30-40Kbytes) on each write. Any idea how to solve it Thanks Erez ________________________________ From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Nadav, Erez Sent: Wednesday, June 07, 2006 6:00 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] stunnel error Hi, I use stunnel 4.14 and face this error when performing buffer writes from client to remote side SSL_write: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call Does anybody know how can I overcome this ??? Thanks Erez ________________________________________________________________________ __________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1). __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

stunnel error
by Nadav, Erez 07 Jun '06

07 Jun '06

Hi, I use stunnel 4.14 and face this error when performing buffer writes from client to remote side SSL_write: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call Does anybody know how can I overcome this ??? Thanks Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Processing during CRL expiry and refresh
by Nagasundaram, Sekhar 06 Jun '06

06 Jun '06

All: I have 2 questions: 1. Is there a way to have Stunnel continue processing and accepting connections after the CRL expiry? Currently it gives a "revoking all certificates" error and stops accepting connections. 2. Is there a configurable parameter through which we can have the CRL list refresh itself such that 1 above does not happen? Much Thanks in advance.. Sekhar

1 0

unsecure configuration
by Robert Bator 01 Jun '06

01 Jun '06

Hi , I am trying to set up stunnel to accept unsecure calls on port 1001 from inside and secure calls on port 1000 from internet. All calls are forwarded to machin B The configuration like this: secure --> 1000 machine A unsecure --> 1002 machine B unsecure --> 1001 machine A unsecure --> 1002 machine B Is this setup possible i stunnel? PS. I use "stone repeater" and this rules are easy to setup. Best Regards, Robert Bator

1 0

stunnel and bad rsa signature
by Trent Townsend 30 May '06

30 May '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On a test environment, I successfully had stunnel securing MySQL traffic between 2 systems using a verify level of 3. However, with the production system and what I would call an identical setup (albeit with new certificates), I get the following errors (see log below.) The version I'm running of stunnel is 4.11. I saw the "bad rsa signature" message in the server's output, so I regenerated the private key file to be sure I'd used the right one. Everything seems to be in order, but it will not work. Any ideas? Client: 2006.05.30 09:20:21 LOG5[21951:1]: stunnel 4.11 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.05.30 09:20:21 LOG5[21951:1]: 499 clients allowed 2006.05.30 09:20:25 LOG5[21951:2]: stunnel_mysql connected from 127.0.0.1:32853 2006.05.30 09:20:25 LOG3[21951:2]: SSL_connect: 14094410: error: 14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2006.05.30 09:20:25 LOG5[21951:2]: stack_info: size=65536, current=15296 (23%), maximum=15296 (23%) Server: 2006.05.30 09:19:42 LOG7[19964:3086334176]: RAND_status claims sufficient entropy for the PRNG 2006.05.30 09:19:42 LOG6[19964:3086334176]: PRNG seeded successfully 2006.05.30 09:19:42 LOG7[19964:3086334176]: Certificate: /usr/KRB5/ openssl/ssl/private/server.key 2006.05.30 09:19:42 LOG7[19964:3086334176]: Key file: /usr/KRB5/ openssl/ssl/private/server.key 2006.05.30 09:19:42 LOG7[19964:3086334176]: Verify directory set to / usr/KRB5/openssl/ssl/certs 2006.05.30 09:19:42 LOG5[19964:3086334176]: Peer certificate location /usr/KRB5/openssl/ssl/certs 2006.05.30 09:19:42 LOG7[19964:3086334176]: SSL context initialized for service stunnel_mysqld 2006.05.30 09:19:42 LOG5[19964:3086334176]: stunnel 4.15 on i686-pc- linux-gnu with OpenSSL 0.9.7a Feb 19 2003 2006.05.30 09:19:42 LOG5[19964:3086334176]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2006.05.30 09:19:42 LOG6[19964:3086334176]: file ulimit = 1022 (can be changed with 'ulimit -n') 2006.05.30 09:19:42 LOG6[19964:3086334176]: poll() used - no FD_SETSIZE limit for file descriptors 2006.05.30 09:19:42 LOG5[19964:3086334176]: 499 clients allowed 2006.05.30 09:19:42 LOG7[19964:3086334176]: FD 4 in non-blocking mode 2006.05.30 09:19:42 LOG7[19964:3086334176]: FD 5 in non-blocking mode 2006.05.30 09:19:42 LOG7[19964:3086334176]: FD 6 in non-blocking mode 2006.05.30 09:19:42 LOG7[19964:3086334176]: SO_REUSEADDR option set on accept socket 2006.05.30 09:19:42 LOG7[19964:3086334176]: stunnel_mysqld bound to 0.0.0.0:606 2006.05.30 09:19:42 LOG7[19964:3086334176]: Created pid file /usr/ local/var/stunnel/stunnel.pid 2006.05.30 09:20:40 LOG7[19964:3086334176]: stunnel_mysqld accepted FD=7 from xxx.xxx.xxx.xxx:32854 2006.05.30 09:20:40 LOG7[19964:3086330800]: stunnel_mysqld started 2006.05.30 09:20:40 LOG7[19964:3086330800]: FD 7 in non-blocking mode 2006.05.30 09:20:40 LOG7[19964:3086330800]: FD 8 in non-blocking mode 2006.05.30 09:20:40 LOG7[19964:3086330800]: FD 9 in non-blocking mode 2006.05.30 09:20:40 LOG7[19964:3086330800]: Connection from xxx.xxx.xxx.xxx:32854 permitted by libwrap 2006.05.30 09:20:40 LOG5[19964:3086330800]: stunnel_mysqld connected from xxx.xxx.xxx.xxx:32854 2006.05.30 09:20:40 LOG7[19964:3086334176]: Cleaning up the signal pipe 2006.05.30 09:20:40 LOG6[19964:3086334176]: Child process 19967 finished with code 0 2006.05.30 09:20:40 LOG5[19964:3086330800]: VERIFY OK: depth=2, ... (Root CA) 2006.05.30 09:20:40 LOG5[19964:3086330800]: VERIFY OK: depth=1, ... (CA) 2006.05.30 09:20:40 LOG5[19964:3086330800]: VERIFY OK: depth=0, ... (client) 2006.05.30 09:20:40 LOG3[19964:3086330800]: error stack: 1408807A : error:1408807A:SSL routines:SSL3_GET_CERT_VERIFY:bad rsa signature 2006.05.30 09:20:40 LOG3[19964:3086330800]: SSL_accept: 4077068: error:04077068:rsa routines:RSA_verify:bad signature 2006.05.30 09:20:40 LOG5[19964:3086330800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.30 09:20:40 LOG7[19964:3086330800]: stunnel_mysqld finished (0 left) Thanks. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQA/AwUBRHx+bI0HAxBKv2yIEQIJ1wCcCVJ+9ZqXdxWGTBAS8y7ldUv+J4UAn1al ZYIA5gmw38iwsYuE7tG9esAk =ljGb -----END PGP SIGNATURE-----

1 0

Problem getting stunnel to chroot on Suse 10
by Paul Stepowski 29 May '06

29 May '06

Hi list, I'm using stunnel package that comes standard with Suse 10.0 stunnel 4.10 on i686-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 I can tunnel ports over ssl using stunnel but the chroot directive doesn't seem to be working. E.g. my pid file is being created under / rather than /var/lib/stunnel-syslogng. The other paths in the config file are taken by stunnel as relative to / rather than the chroot directory. What am I missing? Here's my stunnel config. I'm not passing any other flags when running stunnel. ---snip--- client = no #debug = 7 #foreground = yes chroot = /var/lib/stunnel-syslogng setuid = stunnel setgid = nogroup pid = /stunnel.pid #output = stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 #compression = rle #options = DONT_INSERT_EMPTY_FRAGMENTS #verify = 2 #CApath = /certs #CAfile = /certs/stunnel.pem #CRLpath = /crls #CRLfile = /etc/stunnel/crls.pem cert = /var/lib/stunnel-syslogng/certs/stunnel.pem ---snip--- Thanks, Paul

1 0

Re: [stunnel-users] stunnel-4.15 segfaulting and looping under FreeBSD-CURRENT
by Michael Weiser 26 May '06

26 May '06

On Wed, May 17, 2006 at 06:01:37PM +0200, Michael Weiser wrote: > > I'm now retrying with a freshly compiled openssl-0.9.8b to see if that has > > anything to do with anything. > The problem persists with openssl-0.9.8b: > # gdb src/stunnel --core stunnel.core --batch -ex "thread apply all bt > full" -ex "quit" > Core was generated by `stunnel'. > Program terminated with signal 11, Segmentation fault. > #0 0x280d07b5 in SSL_get_peer_certificate () from > ../bin/openssl-0.9.8b/lib/libssl.so.0.9.8 > [New LWP 100077] The problem is triggered by a change to src/client.c in stunnel-4.15. client() now loops over calls to run_client() instead of doing it just once. The first, successful (!) call to run_client() seems to leave the ssl context in an undefined state which makes the following calls to run_client() segfault in the forked child which in turn produces the core file. My guess is, that it's not actually supposed to loop if the call to run_client() is successful. Reverting client.c to roughly 4.14 fixes the problem for me. A patch is attached. Any insights and a more permanent fix would be highly appreciated. BTW: I configured stunnel with --with-threads=pthread. By default, ucontext is detected, which is broken in stunnel-4.14 as well. After finishing, 4.14 hangs in s_poll_wait waiting for -1 seconds on 0 fds (!?). I can provide debugging log and gdb output if needed. -- bye, Michael

1 0

DNS Spoofing
by Happy Manocha 25 May '06

25 May '06

Hello All, >From Website I came to know Stunnel can help in DNS spoofing. Can someone redirect to know how this can be achieved. Stunnel can help: Protect interception of data Prevent manipulation of data And, if compiled with libwrap support: Defend against IP source routing, (one host sending packets as if they came from somewhere else) DNS spoofing (an attacker forging name server records) Regds Happy Manocha

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users