- stunnel-users - stunnel.org

Newbie Question
by Mark 23 Nov '05

23 Nov '05

I am completely new to SSL and stunnel. I need to test the differences between 4th Dimension's SSL and doing the same thing without the 4D implementation of SSL using stunnel. Can anyone please tell me where to get started? Mark Zinke

2 1

Call for Beta Testers: Tool similar to Stunnel.
by Wilfred Nilsen 22 Nov '05

22 Nov '05

We have designed a tool that is similar to Stunnel and we would like to know if anyone would be interested in testing the tool. A short introduction: The Barracuda HTTPS tunnel allows you to encrypt arbitrary TCP connections inside SSL. The HTTPS tunnel allows you to secure non-SSL aware services such as TELNET, FTP, VNC, etc., by having the HTTPS tunnel provide the encryption. The HTTPS tunnel can also be used, for example, to tunnel traffic out from behind a restrictive firewall/proxy that only allows outgoing HTTPS web connections. The client is a Java program that can either be downloaded and started from the command prompt or started using Java Web Start. The server is BarracudaDrive. http://barracudaserver.com/examples/BarracudaDrive/ We will make the beta program (the server and client) available if anyone is interested in testing the tool and give us feedback. We are specifically interested in beta testers that are behind a restrictive company proxy. Thanks, Wilfred

7 10

Re: [stunnel-users] Problem with Stunnel Working fine on the firstconnection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05

19 Nov '05

> I'd try to disable chroot and run stunnel under strace with "foreground = yes" option. Mike, When running in foreground, with or without chroot, things work as expected. Without foreground, it did not work. Two key differences on the logs for each: Output of "Cleaning up the signal pipe" prior to checking the libwrap permissions a finish line of "ssmtp finished (0 left)" instead of "ssmtp finished (-1 left)" (Yes, this is a dual processor box.) It looks like the key problem lies in the regerenation of the standalone mode. Is there a way with v4 to just use inetd to answer on port 465, negotiate and connect on port 25 on another host because perhaps that will avoid the issue. Regards, KAM 2005.11.19 13:07:51 LOG7[3893:1024]: Key file: /usr/local/ssl/certs/stunnel.pem 2005.11.19 13:07:51 LOG6[3893:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.11.19 13:07:51 LOG6[3893:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2005.11.19 13:07:51 LOG5[3893:1024]: 500 clients allowed 2005.11.19 13:07:51 LOG7[3893:1024]: FD 4 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: FD 5 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: FD 6 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: SO_REUSEADDR option set on accept socket 2005.11.19 13:07:51 LOG7[3893:1024]: ssmtp bound to 0.0.0.0:465 2005.11.19 13:07:51 LOG7[3893:1024]: Created pid file /stunnel.pid [ed: 1st email] 2005.11.19 13:08:32 LOG7[3893:1024]: ssmtp accepted FD=7 from 66.149.103.32:3130 2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp started 2005.11.19 13:08:32 LOG7[3898:1026]: FD 7 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on local socket 2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: FD 11 in non-blocking mode 2005.11.19 13:08:32 LOG7[3893:1024]: Cleaning up the signal pipe 2005.11.19 13:08:32 LOG7[3898:1026]: Connection from 66.149.103.32:3130 permitted by libwrap 2005.11.19 13:08:32 LOG5[3898:1026]: ssmtp connected from 66.149.103.32:3130 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): before/accept initialization 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:32 LOG7[3898:1026]: 1 items in the session cache 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects (SSL_connect()) 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects that finished 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client renegotiatations requested 2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects (SSL_accept()) 2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects that finished 2005.11.19 13:08:32 LOG7[3898:1026]: 0 server renegotiatiations requested 2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache hits 2005.11.19 13:08:32 LOG7[3898:1026]: 1 session cache misses 2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache timeouts 2005.11.19 13:08:32 LOG6[3898:1026]: SSL accepted: new session negotiated 2005.11.19 13:08:32 LOG6[3898:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: waiting 10 seconds 2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: connected 2005.11.19 13:08:32 LOG7[3898:1026]: Remote FD=10 initialized 2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on remote socket 2005.11.19 13:08:33 LOG7[3898:1026]: Socket closed on read 2005.11.19 13:08:33 LOG7[3898:1026]: SSL write shutdown 2005.11.19 13:08:33 LOG7[3898:1026]: SSL alert (write): warning: close notify 2005.11.19 13:08:33 LOG7[3898:1026]: SSL_shutdown retrying 2005.11.19 13:08:33 LOG7[3898:1026]: SSL doesn't need to read or write 2005.11.19 13:08:33 LOG7[3898:1026]: SSL socket closed on SSL_read 2005.11.19 13:08:33 LOG7[3898:1026]: Socket write shutdown 2005.11.19 13:08:33 LOG5[3898:1026]: Connection closed: 834 bytes sent to SSL, 1358 bytes sent to socket 2005.11.19 13:08:33 LOG7[3898:1026]: ssmtp finished (0 left) [ed: 2nd email] 2005.11.19 13:08:40 LOG7[3893:1024]: ssmtp accepted FD=7 from 66.149.103.32:3137 2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp started 2005.11.19 13:08:40 LOG7[3900:2050]: FD 7 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on local socket 2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: FD 11 in non-blocking mode 2005.11.19 13:08:40 LOG7[3893:1024]: Cleaning up the signal pipe 2005.11.19 13:08:40 LOG7[3900:2050]: Connection from 66.149.103.32:3137 permitted by libwrap 2005.11.19 13:08:40 LOG5[3900:2050]: ssmtp connected from 66.149.103.32:3137 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): before/accept initialization 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:40 LOG7[3900:2050]: 2 items in the session cache 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects (SSL_connect()) 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects that finished 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client renegotiatations requested 2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects (SSL_accept()) 2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects that finished 2005.11.19 13:08:40 LOG7[3900:2050]: 0 server renegotiatiations requested 2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache hits 2005.11.19 13:08:40 LOG7[3900:2050]: 2 session cache misses 2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache timeouts 2005.11.19 13:08:40 LOG6[3900:2050]: SSL accepted: new session negotiated 2005.11.19 13:08:40 LOG6[3900:2050]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: waiting 10 seconds 2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: connected 2005.11.19 13:08:40 LOG7[3900:2050]: Remote FD=10 initialized 2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on remote socket 2005.11.19 13:08:42 LOG7[3900:2050]: Socket closed on read 2005.11.19 13:08:42 LOG7[3900:2050]: SSL write shutdown 2005.11.19 13:08:42 LOG7[3900:2050]: SSL alert (write): warning: close notify 2005.11.19 13:08:42 LOG7[3900:2050]: SSL_shutdown retrying 2005.11.19 13:08:42 LOG7[3900:2050]: SSL doesn't need to read or write 2005.11.19 13:08:42 LOG7[3900:2050]: SSL socket closed on SSL_read 2005.11.19 13:08:42 LOG7[3900:2050]: Socket write shutdown 2005.11.19 13:08:42 LOG5[3900:2050]: Connection closed: 834 bytes sent to SSL, 1358 bytes sent to socket 2005.11.19 13:08:42 LOG7[3900:2050]: ssmtp finished (0 left) Without foreground, things do not continue past the first connection: 2005.11.19 13:10:32 LOG7[3910:1024]: ssmtp accepted FD=7 from 66.149.103.32:3268 2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp started 2005.11.19 13:10:32 LOG7[3916:1026]: FD 7 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on local socket 2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: FD 11 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: Connection from 66.149.103.32:3268 permitted by libwrap 2005.11.19 13:10:32 LOG5[3916:1026]: ssmtp connected from 66.149.103.32:3268 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): before/accept initialization 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:10:32 LOG7[3916:1026]: 1 items in the session cache 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects (SSL_connect()) 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects that finished 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client renegotiatations requested 2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects (SSL_accept()) 2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects that finished 2005.11.19 13:10:32 LOG7[3916:1026]: 0 server renegotiatiations requested 2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache hits 2005.11.19 13:10:32 LOG7[3916:1026]: 1 session cache misses 2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache timeouts 2005.11.19 13:10:32 LOG6[3916:1026]: SSL accepted: new session negotiated 2005.11.19 13:10:32 LOG6[3916:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: waiting 10 seconds 2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: connected 2005.11.19 13:10:32 LOG7[3916:1026]: Remote FD=10 initialized 2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on remote socket 2005.11.19 13:10:33 LOG7[3916:1026]: Socket closed on read 2005.11.19 13:10:33 LOG7[3916:1026]: SSL write shutdown 2005.11.19 13:10:33 LOG7[3916:1026]: SSL alert (write): warning: close notify 2005.11.19 13:10:33 LOG7[3916:1026]: SSL_shutdown retrying 2005.11.19 13:10:33 LOG7[3916:1026]: SSL doesn't need to read or write 2005.11.19 13:10:34 LOG7[3916:1026]: SSL socket closed on SSL_read 2005.11.19 13:10:34 LOG7[3916:1026]: Socket write shutdown 2005.11.19 13:10:34 LOG5[3916:1026]: Connection closed: 834 bytes sent to SSL, 1353 bytes sent to socket 2005.11.19 13:10:34 LOG7[3916:1026]: ssmtp finished (-1 left)

1 0

Problem with Stunnel Working fine on the first connection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05

19 Nov '05

Have worked on this all day without any glimmer of hope and would appreciate help and feedback! Regards, KAM # Description of your problem. What programs are on which machines, and how are they attempting to communicate. What connections are you attempting to secure in SSL. I am having problems with the regeneration of stunnel on an old but fairly reliable machine. I am switching from v3 to v4 and it works absolutely perfectly ONCE. The second time it just hangs. # What version of Stunnel you're using - remember, Stunnel 4.x doesn't take Stunnel 3.x command line options! 4.x # The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd. I am running it in standalone. My conf file is: cert = /usr/local/ssl/certs/stunnel.pem key = /usr/local/ssl/certs/stunnel.pem chroot = /usr/local/var/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log [ssmtp] accept = 465 connect = 10.10.10.30:25 # Output of "stunnel -f -D 7 <your-parameters>". Not sure this works on v4.X but here are the logs from the connection: 2005.11.18 19:17:56 LOG7[13166:1024]: ssmtp accepted FD=7 from 66.149.103.32:3542 2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp started 2005.11.18 19:17:56 LOG7[13171:1026]: FD 7 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on local socket 2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: FD 11 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: Connection from 66.149.103.32:3542 permitted by libwrap 2005.11.18 19:17:56 LOG5[13171:1026]: ssmtp connected from 66.149.103.32:3542 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): before/accept initialization 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server done A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read finished A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write finished A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data 2005.11.18 19:17:56 LOG7[13171:1026]: 1 items in the session cache 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects (SSL_connect()) 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects that finished 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client renegotiatations requested 2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects (SSL_accept()) 2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects that finished 2005.11.18 19:17:56 LOG7[13171:1026]: 0 server renegotiatiations requested 2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache hits 2005.11.18 19:17:56 LOG7[13171:1026]: 1 session cache misses 2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache timeouts 2005.11.18 19:17:56 LOG6[13171:1026]: SSL accepted: new session negotiated 2005.11.18 19:17:56 LOG6[13171:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp connecting 10.10.10.30:25 2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: waiting 10 seconds 2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: connected 2005.11.18 19:17:56 LOG7[13171:1026]: Remote FD=10 initialized 2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on remote socket 2005.11.18 19:17:58 LOG7[13171:1026]: Socket closed on read 2005.11.18 19:17:58 LOG7[13171:1026]: SSL write shutdown 2005.11.18 19:17:58 LOG7[13171:1026]: SSL alert (write): warning: close notify 2005.11.18 19:17:58 LOG7[13171:1026]: SSL_shutdown retrying 2005.11.18 19:17:58 LOG7[13171:1026]: SSL doesn't need to read or write 2005.11.18 19:17:58 LOG7[13171:1026]: SSL socket closed on SSL_read 2005.11.18 19:17:58 LOG7[13171:1026]: Socket write shutdown 2005.11.18 19:17:58 LOG5[13171:1026]: Connection closed: 827 bytes sent to SSL, 1362 bytes sent to socket 2005.11.18 19:17:58 LOG7[13171:1026]: ssmtp finished (-1 left) There is nothing more after this point # Output of "stunnel -V". I think you want -version: /usr/local/sbin/stunnel -version stunnel 4.14 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds # Output of "uname -a". Linux <removed> 2.2.26 #8 Fri Jul 16 00:42:34 EDT 2004 i686 unknown # Your libc version if you use Linux. 2.2.5 # Output of "gcc -v". Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/specs gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release) # Output of "openssl version" or "ssleay version" depending on your library. Subscribe to stunnel-users. OpenSSL 0.9.7e 25 Oct 2004

2 1

Stunnel Session Hangs
by Zachariah K Zachariah 17 Nov '05

17 Nov '05

Hi folks, I use stunnel-4.12 with openssl-0.9.7g to tunnel my CVS-pserver protocols. I have set up the local stunnel client to listen to port 22400 and to forward any connections on it to the cvs server that has the server side stunnel listening on port 22401 forwarding connections to the cvs-pserver on port 2401. Having set up thus, I can do a cvs login just fine. I can watch the negotiation happening using tcpdump. However when I try to check out a module from the repository, I see some files coming through but only to eventually hang. If I <Ctrl C> and try again, more files come in but hangs before the transaction is complete. I have to do this several time in order to download all the files to my local workspace. Upon checking the logs, I find that the hang occurs immediately after the message: 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying I have included a snippet of the log file for reference. I have also included my stunnel.conf file. Sorry for the voluminous output. Can some one help me here? Thanks in advance. -ZZ ===============================STUNNEL.LOG================================== The full log file reads: 2005.10.28 14:20:44 LOG6[15095:64]: SSL accepted: previous session reused 2005.10.28 14:20:44 LOG7[15095:64]: FD 1 in non-blocking mode 2005.10.28 14:20:44 LOG7[15095:64]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:44 LOG7[15095:64]: Remote FD=1 initialized 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (read): warning: close notify 2005.10.28 14:20:50 LOG7[15095:64]: SSL closed on SSL_read 2005.10.28 14:20:50 LOG7[15095:64]: Socket write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (write): warning: close notify 2005.10.28 14:20:50 LOG6[15095:64]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:50 LOG5[15095:64]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:50 LOG7[15095:64]: smd-pserver finished (0 left) 2005.10.28 14:20:50 LOG5[15095:64]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:50 LOG7[15095:64]: Context 64 closed 2005.10.28 14:20:51 LOG7[15095:1]: Context set: 64 (dropped) -> 1 2005.10.28 14:20:51 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:51 LOG7[15095:1]: Releasing context 64 2005.10.28 14:20:51 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:51 LOG7[15095:1]: Context 65 created 2005.10.28 14:20:51 LOG7[15095:65]: Context swap: 1 -> 65 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver started 2005.10.28 14:20:51 LOG7[15095:65]: FD 0 in non-blocking mode 2005.10.28 14:20:51 LOG5[15095:65]: smd-pserver connected from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): before/accept initialization 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:51 LOG7[15095:65]: 6 items in the session cache 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects (SSL_connect()) 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 client renegotiatations requested 2005.10.28 14:20:51 LOG7[15095:65]: 64 server connects (SSL_accept()) 2005.10.28 14:20:51 LOG7[15095:65]: 55 server connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 server renegotiatiations requested 2005.10.28 14:20:51 LOG7[15095:65]: 38 session cache hits 2005.10.28 14:20:51 LOG7[15095:65]: 0 session cache misses 2005.10.28 14:20:51 LOG7[15095:65]: 11 session cache timeouts 2005.10.28 14:20:51 LOG6[15095:65]: SSL accepted: previous session reused 2005.10.28 14:20:51 LOG7[15095:65]: FD 1 in non-blocking mode 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:51 LOG7[15095:65]: Remote FD=1 initialized 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (read): warning: close notify 2005.10.28 14:20:57 LOG7[15095:65]: SSL closed on SSL_read 2005.10.28 14:20:57 LOG7[15095:65]: Socket write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (write): warning: close notify 2005.10.28 14:20:57 LOG6[15095:65]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:57 LOG5[15095:65]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:57 LOG7[15095:65]: smd-pserver finished (0 left) 2005.10.28 14:20:57 LOG5[15095:65]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:57 LOG7[15095:65]: Context 65 closed 2005.10.28 14:20:58 LOG7[15095:1]: Context set: 65 (dropped) -> 1 2005.10.28 14:20:58 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:58 LOG7[15095:1]: Releasing context 65 2005.10.28 14:20:58 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:58 LOG7[15095:1]: Context 66 created 2005.10.28 14:20:58 LOG7[15095:66]: Context swap: 1 -> 66 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver started 2005.10.28 14:20:58 LOG7[15095:66]: FD 0 in non-blocking mode 2005.10.28 14:20:58 LOG5[15095:66]: smd-pserver connected from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): before/accept initialization 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:58 LOG7[15095:66]: 6 items in the session cache 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects (SSL_connect()) 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 client renegotiatations requested 2005.10.28 14:20:58 LOG7[15095:66]: 65 server connects (SSL_accept()) 2005.10.28 14:20:58 LOG7[15095:66]: 56 server connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 server renegotiatiations requested 2005.10.28 14:20:58 LOG7[15095:66]: 39 session cache hits 2005.10.28 14:20:58 LOG7[15095:66]: 0 session cache misses 2005.10.28 14:20:58 LOG7[15095:66]: 11 session cache timeouts 2005.10.28 14:20:58 LOG6[15095:66]: SSL accepted: previous session reused 2005.10.28 14:20:58 LOG7[15095:66]: FD 1 in non-blocking mode 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:58 LOG7[15095:66]: Remote FD=1 initialized 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (read): warning: close notify 2005.10.28 14:21:50 LOG7[15095:66]: SSL closed on SSL_read 2005.10.28 14:21:50 LOG7[15095:66]: Socket write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (write): warning: close notify 2005.10.28 14:21:50 LOG6[15095:66]: SSL_shutdown successfully sent close_notify 2005.10.28 14:21:50 LOG5[15095:66]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:21:50 LOG7[15095:66]: smd-pserver finished (0 left) 2005.10.28 14:21:50 LOG5[15095:66]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:21:50 LOG7[15095:66]: Context 66 closed 2005.10.28 14:21:52 LOG7[15095:1]: Context set: 66 (dropped) -> 1 2005.10.28 14:21:52 LOG7[15095:1]: Current context: 1 2005.10.28 14:21:52 LOG7[15095:1]: Releasing context 66 2005.10.28 14:21:52 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:1]: Creating a new context 2005.10.28 14:21:52 LOG7[15095:1]: Context 67 created 2005.10.28 14:21:52 LOG7[15095:67]: Context swap: 1 -> 67 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver started 2005.10.28 14:21:52 LOG7[15095:67]: FD 0 in non-blocking mode 2005.10.28 14:21:52 LOG5[15095:67]: smd-pserver connected from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): before/accept initialization 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 flush data 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:21:52 LOG7[15095:67]: 6 items in the session cache 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects (SSL_connect()) 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 client renegotiatations requested 2005.10.28 14:21:52 LOG7[15095:67]: 66 server connects (SSL_accept()) 2005.10.28 14:21:52 LOG7[15095:67]: 57 server connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 server renegotiatiations requested 2005.10.28 14:21:52 LOG7[15095:67]: 40 session cache hits 2005.10.28 14:21:52 LOG7[15095:67]: 0 session cache misses 2005.10.28 14:21:52 LOG7[15095:67]: 11 session cache timeouts 2005.10.28 14:21:52 LOG6[15095:67]: SSL accepted: previous session reused 2005.10.28 14:21:52 LOG7[15095:67]: FD 1 in non-blocking mode 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:21:52 LOG7[15095:67]: Remote FD=1 initialized 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying ========================================================================== =========================STUNNEL.CONF====================================== ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ;Delay DNS Lookups delay = yes ; Certificate/key is needed in server mode and optional in client mode cert = /tools/stunnel/4.12/etc/stunnel/stunnel.pem ;key = /tools/stunnel/4.12/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /tools/stunnel/4.12/var/stunnel/ setuid = cvsadmin setgid = cvs ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath; CApath is located inside chroot jail: ;CApath = /certs ; It's often easier to use CAfile: ;CAfile = /tools/stunnel/4.12/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: ;CRLpath = /crls ; Alternatively you can use CRLfile: ;CRLfile = /tools/stunnel/4.12/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /tools/stunnel/current/var/stunnel/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [pserver] accept = 22401 connect = 2401 TIMEOUTclose = 30 ; vim:ft=dosini

3 3

Strict.pm
by Jorge Abrines 17 Nov '05

17 Nov '05

Hi all, Once installed stunnel4 debian package, when I execute stunnel stunnel-mysql-client.conf (given sample) get following errors: Can't locate strict.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.8.7 /usr/local/share/perl/5.8.7 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at /usr/share/perl/5.8/AutoLoader.pm line 3. BEGIN failed--compilation aborted at /usr/share/perl/5.8/AutoLoader.pm line 3. Compilation failed in require at /usr/lib/perl/5.8/POSIX.pm line 7. BEGIN failed--compilation aborted at /usr/lib/perl/5.8/POSIX.pm line 7. Compilation failed in require at /usr/sbin/stunnel line 26. BEGIN failed--compilation aborted at /usr/sbin/stunnel line 26. Any ideas? Thanks in advance. Regards, Jorge.

2 2

Filesystem Hierarchy Standard 2.3
by Michal Trojnara 17 Nov '05

17 Nov '05

Dear Users, I tried to make stunnel more compatible with Filesystem Hierarchy Standard 2.3. Here is the current status: - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup Your critical comments are welcome. Best regards, Mike

1 0

Visual studio compilation errors
by Jorge Abrines 17 Nov '05

17 Nov '05

Hi, After browsing all previous list messages I havent found information about an error I get compiling stunnel with visual studio. The errors appear in linking step with undefined symbol message: "undefined symbol: LNK2019 undefined symbol _exit_stunnel referenced in function _main_initialize". I also attach the Makefile.w32 changed to work with visual studio. Thanks in advance. Regards, Jorge. Makefile.w32 follows: # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2000 # # Modified by Brian Hatch (bri(a)stunnel.org) # This makefile is only tested on the mingw compiler. Mingw # can successfully compile both openssl and stunnel. If you want # to use another compiler, give it a shot, and tell us how it went. # Modify this to point to your actual openssl compile directory # (You did already compile openssl, didn't you???) SSLDIR=..\..\openssl-0.9.7g DEFINES=-DUSE_WIN32 -DHAVE_OPENSSL # You may want to add some of the following flags # to the DEFINES definition above. # Location of default certificate file for -v option # -DCERT_FILE=\"/stunnel/certs/certs.pem\" # Location of default certificate directory for -v option # -DCERT_DIR=\"/stunnel/certs\" # Default directory for stunnel.pem file # -DPEM_DIR=\"/stunnel/private\" # Use the default certificate sources from your ssl library? (0==no, 1==yes) # -DSSLLIB_CS=0 CC=cl CFLAGS= $(DEFINES) /I"$(SSLDIR)inc32" LDFLAGS=/LIBPATH:"$(SSLDIR)\out" /LIBPATH:"$(SSLDIR)\out32dll" # LIBS=-L$(SSLDIR)/out -lssl -lcrypto -lwsock32 -lgdi32 # LIBS=-L$(SSLDIR)/out -leay32 -lssl32 -lwsock32 -lgdi32 LIBS="$(SSLDIR)\out32dll\libeay32.lib" "$(SSLDIR)\out32dll\ssleay32.lib" " wsock32.lib" "gdi32.lib" OBJS=stunnel.obj ssl.obj protocol.obj sthreads.obj log.obj stunnel.exe: $(OBJS) $(CC) $(LDFLAGS) -o stunnel.exe $(OBJS) $(LIBS) .c.obj: # {.}.c{_obj\}.obj:: $(CC) /c $(CFLAGS) $(INCPATH) @<< $< << clean: del *.o del stunnel.exe

2 2

CONNECT protocol negotiations
by Michal Trojnara 16 Nov '05

16 Nov '05

Dear Users, I think some of you could be interested in testing this new feature: ftp://stunnel.mirt.net/stunnel/stunnel-4.15b2.tar.gz ftp://stunnel.mirt.net/stunnel/stunnel-4.15b2-installer.exe Sample configuration: debug=7 client = yes [my_proxy] accept=1111 connect=proxy.example.com:8080 protocol=connect protocolHost=stunnel.mirt.net:443 protocolCredentials=username:password Best regards, Mike

1 0

Vasudha Upadhyaya is out of the office.
by vasudha.upadhyaya＠convergys.com 16 Nov '05

16 Nov '05

I will be out of the office starting 11/16/2005 and will not return until 12/05/2005. I will respond to your message when I return. -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0

more stunnel problems
by Louis Young 10 Nov '05

10 Nov '05

Hi guys Ok, as I've said in a previous mail, I'm now merely trying to get the linux client to work. In the config file: [ssmtp] accept = 465 connect = 25 But now: louislaptop:/usr/local/etc/stunnel # telnet localhost 25 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 louislaptop.kpho.local ESMTP Postfix Works fine. I get the SMTP prompt. And now: louislaptop:/usr/local/etc/stunnel # telnet localhost 465 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. No SMTP prompt. In the log files: 2005.11.09 16:32:47 LOG5[32348:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.11.09 16:32:47 LOG7[32348:1]: Snagged 64 random bytes from /root/.rnd 2005.11.09 16:32:47 LOG7[32348:1]: Wrote 1024 new random bytes to /root/.rnd 2005.11.09 16:32:47 LOG7[32348:1]: RAND_status claims sufficient entropy for the PRNG 2005.11.09 16:32:47 LOG6[32348:1]: PRNG seeded successfully 2005.11.09 16:32:47 LOG7[32348:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.11.09 16:32:47 LOG7[32348:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.11.09 16:32:47 LOG6[32348:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.11.09 16:32:47 LOG6[32348:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.11.09 16:32:47 LOG5[32348:1]: 500 clients allowed 2005.11.09 16:32:47 LOG7[32348:1]: FD 4 in non-blocking mode 2005.11.09 16:32:47 LOG7[32348:1]: FD 5 in non-blocking mode 2005.11.09 16:32:47 LOG7[32348:1]: FD 6 in non-blocking mode 2005.11.09 16:32:47 LOG7[32348:1]: SO_REUSEADDR option set on accept socket 2005.11.09 16:32:47 LOG7[32348:1]: ssmtp bound to 0.0.0.0:7777 2005.11.09 16:32:47 LOG7[32349:1]: Created pid file /stunnel.pid 2005.11.09 16:32:47 LOG7[32349:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.11.09 16:32:53 LOG7[32349:0]: CONTEXT 1, FD=4, (IN)->() 2005.11.09 16:32:53 LOG7[32349:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.11.09 16:32:53 LOG7[32349:1]: ssmtp accepted FD=7 from 127.0.0.1:15767 2005.11.09 16:32:53 LOG7[32349:1]: Creating a new context 2005.11.09 16:32:53 LOG7[32349:1]: Context 2 created 2005.11.09 16:32:53 LOG7[32349:2]: Context swap: 1 -> 2 2005.11.09 16:32:53 LOG7[32349:2]: ssmtp started 2005.11.09 16:32:53 LOG7[32349:2]: FD 7 in non-blocking mode 2005.11.09 16:32:53 LOG7[32349:2]: TCP_NODELAY option set on local socket 2005.11.09 16:32:53 LOG5[32349:2]: ssmtp connected from 127.0.0.1:15767 2005.11.09 16:32:53 LOG7[32349:2]: SSL state (accept): before/accept initialization 2005.11.09 16:32:53 LOG7[32349:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.11.09 16:37:53 LOG7[32349:0]: CONTEXT 1, FD=4, (IN)->() 2005.11.09 16:37:53 LOG7[32349:0]: CONTEXT 1, FD=6, (IN)->() 2005.11.09 16:37:53 LOG7[32349:0]: CONTEXT 2, FD=7, (IN)->() 2005.11.09 16:37:53 LOG6[32349:2]: init_ssl: s_poll_wait timeout 2005.11.09 16:37:53 LOG7[32349:2]: ssmtp finished (0 left) 2005.11.09 16:37:53 LOG3[32349:2]: STACK_RESERVE is too high 2005.11.09 16:37:53 LOG7[32349:2]: Context 2 closed 2005.11.09 16:37:53 LOG7[32349:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.11.09 16:58:51 LOG5[32349:0]: Received signal 15; terminating 2005.11.09 16:58:51 LOG7[32349:0]: removing pid file /stunnel.pid Any ideas? -- Regards Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

2 3

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 09 Nov '05

09 Nov '05

Hans Werner Strube wrote: > 1. Line 92 of sthreads.c, > (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; > causes a compiler warning: "a cast does not yield an lvalue." > > 2. The Solaris <9 SPARC peculiarity concerning the third argument of > makecontext might be taken into account. > > Both would be fixed by the following changes. > ***Caveat: I do not know how the third argument of makecontext behaves > in Solaris x86 for versions <9 vs. >=9. Have no machine to test this. Sorry, my patch contained a bad error: ctx->stack+=STACK_SIZE-8 is, of course, nonsense, since ctx->stack must not be changed. My patch to version 4.15b1 should read instead: *** sthreads.c.15b1 Wed Nov 9 12:18:18 2005 --- sthreads.c Wed Nov 9 17:07:57 2005 *************** *** 78,85 **** return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! ctx->ctx.uc_stack.ss_sp=ctx->stack; ! #if defined(__sgi) || (defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ --- 78,84 ---- return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! #if defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ *************** *** 88,96 **** defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8))) ! (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; #endif ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; --- 87,102 ---- defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8)) ! #define MCTXA 2 ! #else ! #define MCTXA 1 #endif + #if defined(__sgi) || (MCTXA == 2) + ctx->ctx.uc_stack.ss_sp=ctx->stack+STACK_SIZE-8; + #else + ctx->ctx.uc_stack.ss_sp=ctx->stack; + #endif ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; *************** *** 121,127 **** if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); return 0; } --- 127,133 ---- if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, MCTXA, arg); return 0; }

1 0

Trouble between linux client and windows server
by Louis Young 09 Nov '05

09 Nov '05

Hi guys I'm trying to use stunnel between a windows server and a linux client. On the windows server: [VNC] accept = 5901 connect = 5900 and on the linux client: ; VNC server on 192.168.100.57 accept = 5901 connect = 192.168.100.65:5901 But, alas: Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused Trying ::1... telnet: connect to address ::1: Connection refused It's almost as if stunnel isn't listening on that port on the linux client. Any ideas? -- Regards Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

1 1

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 09 Nov '05

09 Nov '05

Michal Trojnara wrote: > Please try: ftp://stunnel.mirt.net/stunnel/stunnel-4.15b1.tar.gz The changes to common.h and sthreads.c with respect to new_context and makecontext are reasonable. However, there are two problems: 1. Line 92 of sthreads.c, (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; causes a compiler warning: "a cast does not yield an lvalue." 2. The Solaris <9 SPARC peculiarity concerning the third argument of makecontext might be taken into account. Both would be fixed by the following changes. ***Caveat: I do not know how the third argument of makecontext behaves in Solaris x86 for versions <9 vs. >=9. Have no machine to test this. *** sthreads.c.15b1 Wed Nov 9 12:18:18 2005 --- sthreads.c Wed Nov 9 14:56:18 2005 *************** *** 78,85 **** return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! ctx->ctx.uc_stack.ss_sp=ctx->stack; ! #if defined(__sgi) || (defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ --- 78,84 ---- return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! #if defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ *************** *** 88,96 **** defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8))) ! (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; #endif ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; --- 87,101 ---- defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8)) ! #define MCtxA 2 ! #else ! #define MCtxA 1 #endif + #if defined(__sgi) || (MCtxA == 2) + ctx->stack+=STACK_SIZE-8; + #endif + ctx->ctx.uc_stack.ss_sp=ctx->stack; ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; *************** *** 121,127 **** if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); return 0; } --- 126,132 ---- if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, MCtxA, arg); return 0; }

1 0

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 09 Nov '05

09 Nov '05

Alexander Lazic wrote: > The semantics of the uc_stack member of the ucontext_t structure have > changed as they apply to inputs to makecontext(). Prior to Solaris 10, > the ss_sp member of the uc_stack structure represented the high memory > address of the area reserved for the stack. The ss_sp member now > represents the base (low memory address), in keeping with other uses of > ss_sp. > > This change in the meaning of ss_sp is now the default behavior. The > -D__MAKECONTEXT_V2_SOURCE compilation flag used in Solaris 9 update > releases to access this behavior is obsolete. Solaris 9_x86 does not use __MAKECONTEXT_V2_SOURCE, see /usr/include/ucontext.h: *** Solaris 9: #if defined(__MAKECONTEXT_V2_SOURCE) && defined(__sparc) #ifdef __PRAGMA_REDEFINE_EXTNAME #pragma redefine_extname makecontext __makecontext_v2 #else #define makecontext __makecontext_v2 #endif #endif *** Solaris 10: #ifdef __sparc #ifdef __PRAGMA_REDEFINE_EXTNAME #pragma redefine_extname makecontext __makecontext_v2 #else #define makecontext __makecontext_v2 #endif In libc.so.1, __makecontext_v2 is the "new" function and makecontext the "old" one (binary compatible to Solaris 8 and earlier). For Solaris x86, there is only one function makecontext in all versions. Thus the behavior might not have been changed. A small test program in Solaris 9_x86 (have no earlier versions) indicated the "new" behavior.

2 1

IPTables/Stunnel Help needed
by Alaric Dailey 08 Nov '05

08 Nov '05

Ok, I have a fairly complex firewall setup on my Linux box with 7 host IPs, 2 Internet connections, and a DMZ. I need to direct 1 IP to stunnel on the firewall to be forwarded to the mail server in the DMZ on ports 8383, 993, 995 etc.. but leave ports 25, and 3389 forwarded via iptables, can anyone lend a hand?

1 0

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 08 Nov '05

08 Nov '05

Michal Trojnara wrote: > I had no Solaris 10 to test it... So what's the correct way to detect > Solaris 10? This must probably be done by a modified configure and a new #if or #ifdef. uname -r gives 5.10 for Solaris 10. > Solaris 9 behaves correctly if __MAKECONTEXT_V2_SOURCE is defined (it > is defined in common.h). I've tested this case. Yes, of course. I have not stated anything different. > The manual claims: > The value of > argc must match the number of integer arguments passed to > func, otherwise the behavior is undefined. > (SunOS mion 5.9 Generic_112233-12 sun4u sparc SUNW,Ultra-250) > > I only pass single argument... Yes, but up to Solaris 8 it claimed: The integer value of argc must be one-greater-than the number of arguments that follow argc; otherwise, the behavior is undefined. For 5 arguments, the value of argc must be 6. AfaIk this would also hold for Solaris 9 without __MAKECONTEXT_V2_SOURCE, but this is deprecated. Btw, Solaris 9 and 10 can still handle binaries compiled under earlier versions.

1 0

Re: stunnel 4.14 and openssl 0.9.8a
by MeeAGhost 08 Nov '05

08 Nov '05

I am using stunnel to tunnel my VNC connection. As recent as version 4.12 I have been able to use the libeay32.dll and libssl32.dll files I created with openssl 0.9.X.X using Msys and Mingw with the steps below: 1. I comment out line 910 in the openssl Configure script 2. Create .def for dll's: perl util/mkdef.pl 32 libeay > ms/libeay32.def perl util/mkdef.pl 32 ssleay > ms/ssleay32.def 3. Execute the openssl configure script ./Configure mingw 4. Execute the make for openssl make 5. After the make completes I create the dlls dllwrap --dllname libeay32.dll --output-lib libeay32.a --def ms/libeay32.def libcrypto.a -lwsock32 -lgdi32 dllwrap --dllname libssl32.dll --output-lib libssl32.a --def ms/ssleay32.def libssl.a libeay32.a When I place the resulting dlls on the remote machine with version 4.14installed and establish a VNC connection to machine stunnel crashes and generates a Dr. Watson error. If I revert back to version 4.12 the dlls I created using the steps above --- everything works. If I install the 0.9.7idlls (which come as a part of the 4.14 Win Install package) everything works. I am trying to keep server and clients on the same version of openssl which is why I have been compling new dlls whenever I have upgraded the servers. Is there something unique being done in version 4.14 that prevents dlls created with 0.9.8a from being used? -- Chris

2 3

Solaris: new_context, makecontext
by Hans Werner Strube 08 Nov '05

08 Nov '05

Concerns all versions of sthreads.c using ucontext: As far as I know from the Solaris documentation and some experiments, the context treatment in new_context() is not universally correct. #if defined(__sgi) || (defined(__sparc) && !defined(HAVE___MAKECONTEXT_V2)) ctx->ctx.uc_stack.ss_sp=ctx->stack+STACK_SIZE-8; #else /* not an IRIX or old and buggy Solaris on Sparc */ ctx->ctx.uc_stack.ss_sp=ctx->stack; #endif The first case is wrong for Solaris 10, since HAVE___MAKECONTEXT_V2 is not defined there but the behavior is _always_ as with HAVE___MAKECONTEXT_V2 in Solaris 9 SPARC. (Solaris 9 SPARC behaves like Solaris 7 and 8 SPARC ["old and buggy"] if HAVE___MAKECONTEXT_V2 is not set, and like Solaris 10 if it is set.) In the "old and buggy" case, the third argument of makecontext() should be 2 instead of 1 (although the latter _may_ work). I do not know how this is in Solaris x86. At least, HAVE___MAKECONTEXT_V2 has no meaning there.

3 3

stunnel 4.14 released
by Michal Trojnara 03 Nov '05

03 Nov '05

The ChangeLog entry for stunnel 4.14: Version 4.14, 2005.11.02, urgency: HIGH: * Bugfixes - transfer() fixed to avoid random stalls introduced in version 4.12. - poll() error handing bug fixed. - Checking for dynamic loader libraries added again. - Default pidfile changed from $localstatedir/run/stunnel.pid to $localstatedir/stunnel/stunnel.pid. - Basic SSL library initalization moved to the beginning of execution. * Release notes - This is an important bugfix release. Upgrade is recommended. sha1sum for stunnel-4.14.tar.gz: b2edb3a2473367f2a9f04a877adcb332483a5267 Home page and download: http://stunnel.mirt.net/ Best regards, Mike

2 2

I: error=certificate signature failure
by Pulcini Maddalena 03 Nov '05

03 Nov '05

________________________________ Da: Pulcini Maddalena Inviato: gio 03/11/2005 8.58 A: stunnel Oggetto: I: error=certificate signature failure ________________________________ Da: Pulcini Maddalena Inviato: mer 02/11/2005 17.14 A: stunnel Oggetto: error=certificate signature failure Hi All, someone could help me to understand what happens and what my client needs to verify the peer? Thanks&Regards I configure stunnel in this way: stunnel.conf ================================ client = yes debug=7 cert = client69f.pem key = chiave69.pem cafile=cacert.pem verify = 1 capath= . [telnet] accept = 23 connect = 10.36.3.191:4433 ============================ I put all the files configured above in the same directory where stunnel-4.07.exe runs; I have a machine in which ssl server runs with a certificate signed by the same CA (cacert.pem). The log file is : ====================================== 2005.11.02 16:33:47 LOG5[1456:1084]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 2005.11.02 16:33:47 LOG7[1456:1504]: Snagged 64 random bytes from C:/.rnd 2005.11.02 16:33:47 LOG7[1456:1504]: Wrote 1024 new random bytes to C:/.rnd 2005.11.02 16:33:47 LOG7[1456:1504]: RAND_status claims sufficient entropy for the PRNG 2005.11.02 16:33:47 LOG6[1456:1504]: PRNG seeded successfully 2005.11.02 16:33:47 LOG7[1456:1504]: Certificate: client69f.pem 2005.11.02 16:33:47 LOG7[1456:1504]: Key file: chiave69.pem 2005.11.02 16:33:47 LOG7[1456:1504]: Loaded verify certificates from cacert.pem 2005.11.02 16:33:47 LOG7[1456:1504]: Verify directory set to . 2005.11.02 16:33:47 LOG5[1456:1504]: No limit detected for the number of clients 2005.11.02 16:33:47 LOG7[1456:1504]: FD 156 in non-blocking mode 2005.11.02 16:33:47 LOG7[1456:1504]: SO_REUSEADDR option set on accept socket 2005.11.02 16:33:47 LOG7[1456:1504]: telnet bound to 0.0.0.0:23 2005.11.02 16:34:14 LOG7[1456:1504]: telnet accepted FD=168 from 127.0.0.1:2501 2005.11.02 16:34:14 LOG7[1456:1504]: FD 168 in non-blocking mode 2005.11.02 16:34:14 LOG7[1456:1504]: Creating a new thread 2005.11.02 16:34:14 LOG7[1456:1504]: New thread created 2005.11.02 16:34:14 LOG7[1456:1320]: telnet started 2005.11.02 16:34:14 LOG5[1456:1320]: telnet connected from 127.0.0.1:2501 2005.11.02 16:34:14 LOG7[1456:1320]: FD 192 in non-blocking mode 2005.11.02 16:34:14 LOG7[1456:1320]: telnet connecting 10.36.3.191:4433 2005.11.02 16:34:14 LOG7[1456:1320]: connect_wait: waiting 10 seconds 2005.11.02 16:34:14 LOG7[1456:1320]: connect_wait: connected 2005.11.02 16:34:14 LOG7[1456:1320]: Remote FD=192 initialized 2005.11.02 16:34:14 LOG7[1456:1320]: SSL state (connect): before/connect initialization 2005.11.02 16:34:14 LOG7[1456:1320]: SSL state (connect): SSLv3 write client hello A 2005.11.02 16:34:14 LOG7[1456:1320]: SSL state (connect): SSLv3 read server hello A 2005.11.02 16:34:14 LOG4[1456:1320]: VERIFY ERROR: depth=1, error=certificate signature failure: /C=Siena/O=amtec/OU=elsag/CN=CERTIFICATION AUTHORITY 2.0/description=CA CERTIFICATE/L=Abbadia San Salvatore 2005.11.02 16:34:14 LOG7[1456:1320]: SSL alert (write): fatal: handshake failure 2005.11.02 16:34:14 LOG3[1456:1320]: error stack: 14090086 : error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2005.11.02 16:34:14 LOG3[1456:1320]: error stack: D089006 : error:0D089006:asn1 encoding routines:ASN1_verify:EVP lib 2005.11.02 16:34:14 LOG3[1456:1320]: SSL_connect: 4077068: error:04077068:rsa routines:RSA_verify:bad signature 2005.11.02 16:34:14 LOG7[1456:1320]: telnet finished (0 left)

1 0

4.14b1+0.9.7i client loop in s_poll_wait/scan_waiting_queue
by Richard.Hall 30 Oct '05

30 Oct '05

Obviously stunnel problems are like London buses - you wait years for one, then two come along inside a week ;-) Having fixed my server-side problems by installing 4.14b1, I now have a problem on the client side. Apologies for the voluminous diagnostics below, but hopefully they will help make the problem clear. I am running Apache + mod_jk, stunneling to a remote JBoss server. The client is stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 When things are running normally, everything is sweetness and light. However, if I 'kill -HUP' the Apache server (eg to do a log rotation), the mod_jk connection to stunnel gets closed, and stunnel goes into a loop. If I enable DEBUG_UCONTEXT in network.c, and add a few lines of diagnostics:- $ diff -c network.c.orig network.c.loop *** network.c.orig Thu Oct 20 08:37:47 2005 --- network.c.loop Thu Oct 27 13:07:10 2005 *************** *** 31,37 **** #include "common.h" #include "prototypes.h" ! /* #define DEBUG_UCONTEXT */ #ifndef USE_WIN32 static int signal_pipe[2]={-1, -1}; --- 31,37 ---- #include "common.h" #include "prototypes.h" ! #define DEBUG_UCONTEXT #ifndef USE_WIN32 static int signal_pipe[2]={-1, -1}; *************** *** 156,167 **** for(i=0; i<ctx->fds->nfds; i++) { ctx->fds->ufds[i].revents=ufds[nfds].revents; #ifdef DEBUG_UCONTEXT ! s_log(LOG_DEBUG, "CONTEXT %ld, FD=%d, (%s%s)->(%s%s)", ctx->id, ufds[nfds].fd, ufds[nfds].events & POLLIN ? "IN" : "", ufds[nfds].events & POLLOUT ? "OUT" : "", ufds[nfds].revents & POLLIN ? "IN" : "", ! ufds[nfds].revents & POLLOUT ? "OUT" : ""); #endif if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; --- 156,170 ---- for(i=0; i<ctx->fds->nfds; i++) { ctx->fds->ufds[i].revents=ufds[nfds].revents; #ifdef DEBUG_UCONTEXT ! s_log(LOG_DEBUG, "CONTEXT %ld, FD=%d, (%s%s)->(%s%s%s%s%s)", ctx->id, ufds[nfds].fd, ufds[nfds].events & POLLIN ? "IN" : "", ufds[nfds].events & POLLOUT ? "OUT" : "", ufds[nfds].revents & POLLIN ? "IN" : "", ! ufds[nfds].revents & POLLOUT ? "OUT" : "", ! ufds[nfds].revents & POLLERR ? "ERR" : "", ! ufds[nfds].revents & POLLHUP ? "HUP" : "", ! ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; I get (with fd=9 being the mod_jk socket, fd=10 the SSL one, and TIMEOUTidle set to 35 seconds for demo purposes) ... 2005.10.27 13:13:42 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 2, FD=9, (INOUT)->(OUT) 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:42 LOG7[1286:2]: SSL_read returned WANT_READ: retrying 2005.10.27 13:13:42 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:43 LOG7[1286:2]: Socket closed on read ... ie mod_jk has disconnected. Everything carries on for a while ... 2005.10.27 13:13:43 LOG7[1286:2]: SSL write shutdown 2005.10.27 13:13:43 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.10.27 13:13:43 LOG7[1286:2]: SSL alert (write): warning: close notify 2005.10.27 13:13:43 LOG7[1286:2]: SSL_shutdown retrying 2005.10.27 13:13:43 LOG7[1286:2]: SSL doesn't need to read or write 2005.10.27 13:13:43 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:45 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(OUT) [...] 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:46 LOG7[1286:2]: SSL_read returned WANT_READ: retrying 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) ... but eventually we start getting ERRHUP (ie POLLERR | POLLHUP), not OUT, on fd 9, and then we end up in a tight loop of 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) ... until eventually we get [...] 2005.10.27 13:14:23 LOG7[1286:0]: Waiting 2 second(s) for 6 file descriptor(s) 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:14:25 LOG7[1286:0]: Waiting 0 second(s) for 6 file descriptor(s) 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:14:25 LOG6[1286:2]: s_poll_wait timeout: connection reset 2005.10.27 13:14:25 LOG5[1286:2]: Connection reset: 260 bytes sent to SSL, 24734 bytes sent to socket The problem seems to be in network.c:s_poll_wait(), in the code while(!ready_head) /* no context ready */ scan_waiting_queue(); because poll() returns > 0, but scan_waiting_queue() never sets ready_head because no fd has yielded POLLIN or POLLOUT:- if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; The end result is that we chew up CPU until TIMEOUTidle expires (which is rather a long time if left at the default of 12 hours!!) I have fudged a circumvention as follows (because I couldn't follow the logic well enough to do it cleanly, and time is running out on me, I'm afraid.) $ diff -c network.c.loop network.c *** network.c.loop Thu Oct 27 13:07:10 2005 --- network.c Thu Oct 27 13:05:21 2005 *************** *** 166,172 **** ufds[nfds].revents & POLLHUP ? "HUP" : "", ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif ! if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; nfds++; } --- 166,172 ---- ufds[nfds].revents & POLLHUP ? "HUP" : "", ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif ! if(ufds[nfds].revents & (POLLIN|POLLOUT|POLLERR|POLLHUP|POLLNVAL)) ctx->ready++; nfds++; } ... which seems to solve the problem but produces a rather untidy result:- 2005.10.27 13:17:46 LOG7[1759:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2005.10.27 13:17:46 LOG7[1759:0]: Waiting 35 second(s) for 6 file descriptor(s) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:17:46 LOG3[1759:2]: INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready 2005.10.27 13:17:46 LOG5[1759:2]: Connection reset: 260 bytes sent to SSL, 41132 bytes sent to socket ... i.e it sorts itself out quickly, but at the cost of logging an INTERNAL ERROR, which doesn't look very good ;-) As far as I could tell (but haven't shown), everything actually got close'd correctly. As I say, I appear to have a circumvention, so I'm not hanging on a proper fix (unless anyone can see any fatal flaw in what I've done?) Regards, Richard

2 1

Question on config for Global Option 'output'
by Tara.L.Weaver＠wellsfargo.com 30 Oct '05

30 Oct '05

Can a file size be determined for 'output' in the config? If so, how can that be done? Or can overwrite be configured for output? STunnel version 4.09 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7e (SQL)Server config: client = no taskbar = yes CAFile = root_ca.cer ciphers = AES128-SHA cert = stunnel.pem output = d:\STunnel\STunnelLog debug=5 [FraudProd] accept = 1364 connect = 1433 Tara L. Weaver Network Analyst 2 Wells Fargo Services Contact Center System Support Office: 612\667-5795 Tara.L.Weaver(a)WellsFargo.com > This message may contain confidential and/or privileged information. > If you are not the addressee or authorized to receive this for the > addressee, you must not use, copy, disclose, or take any action based > on this message or any information herein. If you have received this > message in error, please advise the sender immediately by reply e-mail > and delete this message. Thank you for your cooperation. >

2 1

Boot Password
by Bob 30 Oct '05

30 Oct '05

I need to use signed certificates with stunnel. New to the whole certificate thing. I have the certificate and key and built the .PEM file but when I try to start stunnel in the background it asks me to enter the PEM password. How can I enter the password and have stunnel start during boot? _______________________________________________________________________ Thanks, Bob (bobif(a)yahoo.com) YahooIM: bobif AOLIM: bobifmd ICQ: 111083556

2 1

4.13+0.9.7i server stops writing SSL output
by Richard.Hall 25 Oct '05

25 Oct '05

First-time post (though long-time satisfied occasional user). Searched the archives but if there is anything relevant, I've obviously missed it. I really cannot decide if this is an stunnel problem or an OpenSSL problem. Client is remote and running stunnel 4.12 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.6i Server is local, I've been through 4.12 + 0.9.6m 4.13 + 0.9.6m and now trying stunnel 4.13 on sparc-sun-solaris2.8 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7i (I've resisted the urge to try OpenSSL 0.9.8* as people seem to be experiencing 'issues') Small amounts of data are fine. But for larger amounts the connection goes to sleep. The way I read it, the server end stops trying to write to the SSL side. The relevant parts of # truss -w2 -v poll -dl /usr/local/stunnel-4.13/sbin/stunnel look like this: (apologies for doing it like this, but it seemed the easiest way to combine the debug output and truss output) (fd=7 is the SSL side, fd=8 the local side, TIMEOUTidle is set to 35 seconds for demo purposes) /1: 15.5722 read(8, " A B\0\n03\007\t\t\r\n\t".., 8178) = 8178 /1: poll(0x00049DD8, 3, 35000) (sleeping...) /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLIN /1: 17.3166 poll(0x00049DD8, 3, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLOUT /1: 17.3229 write(7, "1703\0\0188CBEC9 : O\t u".., 16442) = 16442 /1: 17.3234 poll(0x00049DD8, 4, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=8 ev=POLLIN rev=POLLIN /1: fd=7 ev=POLLIN rev=0 So far, so good. /1: 17.3238 read(8, "\t\t\t\r\n\t\t\t\r\n\t\t".., 16384) = 16384 /1: 17.3240 poll(0x00049DD8, 3, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLOUT /1: 17.3299 write(7, "1703\0\018ED 1AD91A888 i".., 16442) = 14480 For whatever reason, the write() was only partial. I'm guessing n/w issues, as the client is a loooong way away ;-) /1: 17.3303 write(7, " fE3DDA8FE ! i8DD8\fEBEC".., 1962) Err#11 EAGAIN /1: 17.3308 write(2, 0x00071D60, 74) = 74 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 0 : 3 0 L O G 7 [ 2 0 6 4 7 : 2 /1: ] : S S L _ w r i t e r e t u r n e d W A N T _ W R I T E /1: : r e t r y i n g /1: 17.3312 write(2, "\n", 1) = 1 /1: 17.3315 read(7, 0x000778D8, 5) Err#11 EAGAIN /1: 17.3318 write(2, 0x00071D60, 72) = 72 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 0 : 3 0 L O G 7 [ 2 0 6 4 7 : 2 /1: ] : S S L _ r e a d r e t u r n e d W A N T _ R E A D : /1: r e t r y i n g /1: 17.3321 write(2, "\n", 1) = 1 So we've now done an SSL_write, which yielded SSL_ERROR_WANT_WRITE, _and_ an SSL_read, which yielded SSL_ERROR_WANT_READ, (and which I think removes the SSL_ERROR_WANT_WRITE condition, as we can only have one or the other.) This means that, the next time round the loop (in client.c:transfer()), want_rd is TRUE, want_wr is FALSE, so we don't poll the SSL connection for output, only input: /1: poll(0x00049DD8, 3, 35000) (sleeping...) /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN rev=POLLOUT But there won't be any input (trust me on that!), so we time out ... /1: 52.3387 poll(0x00049DD8, 3, 35000) = 0 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN rev=0 /1: 52.3394 write(2, 0x00071D60, 72) = 72 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 1 : 0 5 L O G 6 [ 2 0 6 4 7 : 2 /1: ] : s _ p o l l _ w a i t t i m e o u t : c o n n e c t i /1: o n r e s e t /1: 52.3399 write(2, "\n", 1) = 1 /1: 52.3403 write(2, 0x00071DD0, 102) = 102 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 1 : 0 5 L O G 5 [ 2 0 6 4 7 : 2 /1: ] : C o n n e c t i o n r e s e t : 5 7 6 1 7 b y t e s /1: s e n t t o S S L , 1 3 1 b y t e s s e n t t o /1: s o c k e t Now I have never before needed (nor wanted!) to delve into the inner workings of either stunnel or OpenSSL, so I may be in completely the wrong ballpark here. But I cannot understand the logic of the following bit of code in transfer() :- if((c->sock_ptr && !want_rd) || /* socket input buffer not empty */ ssl_closing==CL_INIT /* need to send close_notify */ || ((c->ssl_ptr<BUFFSIZE || ssl_closing==CL_RETRY) && want_wr)) /* want to SSL_read or SSL_shutdown but write to the * underlying socket needed for the SSL protocol */ s_poll_add(&c->fds, c->ssl_wfd->fd, 0, 1); In particular, if I change the first line to if(c->sock_ptr || /* socket input buffer not empty */ then everything starts working (correctly as far as I can see). The OpenSSL man pages seem (to me) to say that it is perfectly permissible to call SSL_write when we have SSL_ERROR_WANT_READ. Help? TIA, Richard Hall

4 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users