- stunnel-users - stunnel.org

Mailing list web interface
by Michal Trojnara 24 Apr '05

24 Apr '05

Dear Users, I'm glad to announce that mirt.net server is now fully moved to the new location. I hope you'll enjoy the speed. 8-) The mailing list management web interface is operational, again. Best regards, Mike

1 0

Stunnel 4.10 released
by Michal Trojnara 23 Apr '05

23 Apr '05

Here is the ChangeLog entry: Version 4.10, 2005.04.23, urgency: LOW/EXPERIMENTAL: * DLLs for OpenSSL 0.9.7g. * Bugfixes - Missing locking on Win32 platform was added (thx to Yi Lin <yi.lin(a)convergys.com>) - Some problems with closing SSL fixed. * New features - New UCONTEXT user-level non-preemptive threads model is used on systems that support SYSV-compatible ucontext.h. - Improved stunnel3 script with getopt-compatible syntax. * Release notes - This version should be thoroughly tested before using it in the mission-critical environment. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

Patch: Windows version of stunnel 4.09 is not thread-safe
by yi.lin＠convergys.com 23 Apr '05

23 Apr '05

We have been using stunnel on Windows as a SSL proxy to connect to HTTPS server but stunnel kept crashing randomly under load. After some investigation, we found the following: according to OpenSSL document (http://www.openssl.org/docs/crypto/threads.html), "OpenSSL can safely be used in multi-threaded applications provided that at least two callback functions are set. locking_function(int mode, int n, const char *file, int line) is needed to perform locking on shared data structures. (Note that OpenSSL uses a number of global data structures that will be implicitly shared whenever multiple threads use OpenSSL.) Multi-threaded applications will crash at random if it is not set. " The original stunnel package only implements a POSIX Pthread version of locking callback functions, but doesn't provide any implementation for Windows. This has caused random crashes during our testing because the way we use stunnel requires frequent creation/destruction of threads and stunnel is not thread-safe without the locking callbacks. The attached fix attempts to address the problem by implementing the Windows version of locking callbacks using Windows native CRITICAL_SECTION object. =============================================================================================================================== *** sthreads.c Fri Dec 31 02:55:40 2004 --- sthreads_w32.c Thu Apr 14 08:29:07 2005 *************** *** 121,126 **** --- 121,127 ---- #ifdef USE_WIN32 CRITICAL_SECTION stunnel_cs[CRIT_SECTIONS]; + static CRITICAL_SECTION lock_cs[CRYPTO_NUM_LOCKS]; void enter_critical_section(SECTION_CODE i) { EnterCriticalSection(stunnel_cs+i); *************** *** 130,141 **** --- 131,161 ---- LeaveCriticalSection(stunnel_cs+i); } + static void locking_callback(int mode, int type, + #ifdef HAVE_OPENSSL + const /* Callback definition has been changed in openssl 0.9.3 */ + #endif + char *file, int line) { + if(mode&CRYPTO_LOCK) + EnterCriticalSection(lock_cs+type); + else + LeaveCriticalSection(lock_cs+type); + } + + void sthreads_init(void) { int i; /* Initialize stunnel critical sections */ for(i=0; i<CRIT_SECTIONS; i++) InitializeCriticalSection(stunnel_cs+i); + + /* Initialize OpenSSL locking callback */ + for(i=0; i<CRYPTO_NUM_LOCKS; i++) + InitializeCriticalSection(lock_cs+i); + CRYPTO_set_locking_callback(locking_callback); + + } unsigned long stunnel_process_id(void) { (See attached file: sthread_diff) Yi Lin Convergys Corporation yi.lin(a)convergys.com (703)885-5767 -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

2 1

connection refsed (111)
by RAJADURAI D 20 Apr '05

20 Apr '05

hi I am trying to connect using mysql, there are no fw between the 2 boxes. I tested with stunnel latest version 4.08 in red hat 9,it shows the last message as connection refused (111) after the cipher negotiation Any ideas on how to solve this error plz help me, to short out this problem ? i am using ==> Stunnel 4.08 redhat 9 Kernel 2.4.20-8 mysql Ver 11.18 Distrib 3.23.54,for redhat-linux-gnu(i386) I am using stunnel.pem generated while installing stunnel 4.08 SERVER SIDE [root@scorpion src]# ./stunnel 2005.03.30 12:23:19 : stunnel with OpenSSL 0.9.7a Feb 19 2003 2005.03.30 12:23:19 : Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.03.30 12:23:19 : Key file: /usr/local/etc/stunnel/stunnel.pem 2005.03.30 12:23:19 : 500 clients allowed 2005.03.30 12:23:19 : SO_REUSEADDR option set on accept socket 2005.03.30 12:23:19 : mysqls bound to 0.0.0.0:3307 2005.03.30 12:23:19 : Created pid file /stunnel.pid 2005.03.30 12:27:01 : mysqls accepted FD=7 from 192.168.2.175:33091 2005.03.30 12:27:01 : mysqls started 2005.03.30 12:27:01 : mysqls connected from 192.168.2.175:33091 2005.03.30 12:27:01 : SSL state (accept): before/accept initialization 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read client hello A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write server hello A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write certificate A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write server done A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 flush data 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read client key exchange A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read finished A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write change cipher spec A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write finished A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 flush data 2005.03.30 12:27:01 : 1 items in the session cache 2005.03.30 12:27:01 : 0 client connects (SSL_connect()) 2005.03.30 12:27:01 : 0 client connects that finished 2005.03.30 12:27:01 : 0 client renegotiatations requested 2005.03.30 12:27:01 : 1 server connects (SSL_accept()) 2005.03.30 12:27:01 : 1 server connects that finished 2005.03.30 12:27:01 : 0 server renegotiatiations requested 2005.03.30 12:27:01 : 0 session cache hits 2005.03.30 12:27:01 : 0 session cache misses 2005.03.30 12:27:01 : 0 session cache timeouts 2005.03.30 12:27:01 : SSL accepted: new session negotiated 2005.03.30 12:27:01 : Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.30 12:27:01 : mysqls connecting 127.0.0.1:3306 2005.03.30 12:27:01 : connect_wait: waiting 10 seconds 2005.03.30 12:27:01 : connect_wait: getsockopt: Connection refused (111) 2005.03.30 12:27:01 : Failed to initialize remote connection 2005.03.30 12:27:01 : mysqls finished (0 left) ====================================================== CLIENT SIDE [root@redhat src]# ./stunnel 2005.03.30 23:24:42 LOG5[7383:1075999904]: stunnel 4.08 on i686-pc-linux-gnu PTH READ+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2005.03.30 23:24:42 LOG7[7383:1075999904]: RAND_status claims sufficient entropy for the PRNG 2005.03.30 23:24:42 LOG6[7383:1075999904]: PRNG seeded successfully 2005.03.30 23:24:42 LOG7[7383:1075999904]: Certificate: /usr/local/etc/stunnel/s tunnel.pem 2005.03.30 23:24:42 LOG7[7383:1075999904]: Key file: /usr/local/etc/stunnel/stun nel.pem 2005.03.30 23:24:42 LOG6[7383:1075999904]: file ulimit = 1024 (can be changed wi th 'ulimit -n') 2005.03.30 23:24:42 LOG6[7383:1075999904]: poll() used - no FD_SETSIZE limit for file descriptors 2005.03.30 23:24:42 LOG5[7383:1075999904]: 500 clients allowed 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 4 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 5 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 6 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: SO_REUSEADDR option set on accept soc ket 2005.03.30 23:24:42 LOG7[7383:1075999904]: mysqls bound to 0.0.0.0:3306 2005.03.30 23:24:42 LOG7[7383:1075999904]: Created pid file /stunnel.pid 2005.03.30 23:32:19 LOG7[7383:1075999904]: mysqls accepted FD=7 from 127.0.0.1:3 3090 2005.03.30 23:32:19 LOG7[7383:1075999904]: FD 7 in non-blocking mode 2005.03.30 23:32:19 LOG7[7383:1076067520]: mysqls started 2005.03.30 23:32:20 LOG5[7383:1076067520]: mysqls connected from 127.0.0.1:33090 2005.03.30 23:32:20 LOG7[7383:1076067520]: FD 8 in non-blocking mode 2005.03.30 23:32:20 LOG7[7383:1076067520]: mysqls connecting 192.168.2.210:3307 2005.03.30 23:32:20 LOG7[7383:1076067520]: connect_wait: waiting 10 seconds 2005.03.30 23:32:20 LOG7[7383:1076067520]: connect_wait: connected 2005.03.30 23:32:20 LOG7[7383:1076067520]: Remote FD=8 initialized 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): before/connect initialization 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write client hello A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server hello A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server certificate A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server done A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write client key exchange A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write finished A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 flush data 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read finished A 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 items in the session cache 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 client connects (SSL_connect()) 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 client connects that finished 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 client renegotiatations requeste d 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server connects (SSL_accept()) 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server connects that finished 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server renegotiatiations request ed 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache hits 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache misses 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache timeouts 2005.03.30 23:32:20 LOG6[7383:1076067520]: SSL connected: new session negotiated 2005.03.30 23:32:20 LOG6[7383:1076067520]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.30 23:32:20 LOG3[7383:1076067520]: SSL_read: Connection reset by peer (1 04) 2005.03.30 23:32:20 LOG5[7383:1076067520]: Connection reset: 0 bytes sent to SSL , 0 bytes sent to socket 2005.03.30 23:32:20 LOG7[7383:1076067520]: mysqls finished (0 left) RUNNING mysqL IN AN SEPARATE TERMINAL [root@redhat bharathi]# mysql -h 127.0.0.1 -u anirudh -p Enter password: ERROR 2013: Lost connection to MySQL server during query

2 2

Disabling IPv6
by Punitha 20 Apr '05

20 Apr '05

Hello Everyone !! I need to build Stunnel-4.09 in HP-UX11.11 without the support of IPv6. I did not use --enable-ipv6 option. In the configure log I could see the reference of getaddrinfo and getnameinfo functions. Is that refers any of the system file or the function defined in the souce code? I used `nm stunnel | grep getaddrinfo` and it shows the following. $ nm stunnel | grep getaddrinfo getaddrinfo | |undef |code | getaddrinfo | 118768|uext |stub | $ I need to confirm the source(from where they are taken) of getaddrinfo and getnameinfo functions. Is that related with the support of ipv6 in any way? Any of you please make me clear. Thanx in ADVANCE. Regards, Punitha.

2 1

Disabling IPv6
by Punitha 20 Apr '05

20 Apr '05

Hello Everyone !! I need to build Stunnel-4.09 in HP-UX11.11 without the support of IPv6. I did not use --enable-ipv6 option. In the configure log I could see the reference of getaddrinfo and getnameinfo functions. Is that refers any of the system file or the function defined in the souce code? I used `nm stunnel | grep getaddrinfo` and it shows the following. $ nm stunnel | grep getaddrinfo getaddrinfo | |undef |code | getaddrinfo | 118768|uext |stub | $ I need to confirm the source(from where they are taken) of getaddrinfo and getnameinfo functions. Is that related with the support of ipv6 in any way? Any of you please make me clear. Thanx in ADVANCE. Regards, Punitha.

1 0

Reporting problems
by Michal Trojnara 19 Apr '05

19 Apr '05

Dear Users, Please stop reporting problems with obsolete versions of stunnel. You should always upgrade to the latest stunnel and OpenSSL first, than repeat your tests and report a problem. Best regards, Mike

2 1

Stunnel - Transfer loop executes not transferring any data.
by Michel Esber 19 Apr '05

19 Apr '05

Hello All, I am running a proprietary daemon on port 443 that accepts incoming connections. We are experiencing problems when activating stunnel on our production box. Everytime that we run our daemon with stunnel, our CPU and memory/swap area consumption is extremely intensive. Each stunnel process consumes approximately 37Mb of RSS memory. I have browsed through my logs and here is what I found: 2005.04.18 14:35:00 LOG3[15242:1245336]: transfer() loop executes not transferring any data 2005.04.18 14:35:06 LOG3[15242:1245336]: please report the problem to Michal.Trojnara(a)mirt.net 2005.04.18 14:35:06 LOG3[15242:1245336]: socket open rd=yes wr=yes, ssl open rd=yes wr=yes 2005.04.18 14:35:06 LOG3[15242:1245336]: socket ready rd=no wr=no, ssl ready rd=no wr=no 2005.04.18 14:35:06 LOG3[15242:1245336]: check_SSL_pending=0, ssl_closing=0 2005.04.18 14:35:06 LOG5[15242:1245336]: Connection reset: 258 bytes sent to SSL, 153319 bytes sent to socket Some details: a) My configuration file: [https] accept = 443 exec = /path/to/daemon execargs = daemon -ssl stunnel 4.07 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.6b [engine] 9 Jul 2001 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds b) glibc-2.2.4-31.7 glibc-devel-2.2.4-32.8 libcap-1.10-6 glibc-common-2.2.4-31.7 c) uname -a Linux myserver 2.4.9-e.57enterprise #1 SMP Thu Dec 2 20:45:51 EST 2004 i686 unknown d) gcc -v gcc version 2.96 20000731 (Red Hat Linux 7.2 2.96-118.7.2) e) openssl version OpenSSL 0.9.6b [engine] 9 Jul 2001 Can anyone shred some light? I believe I should upgrade some of my core components (gcc / openssl). I just need to make sure this is the right direction. Thanks in advance, X------------------- Michel Esber MCSE, MCSA, MCDBA Automatos - www.automatos.com US: 1 (866) 2293584

2 1

stunnel generating defuncts
by Serxio Barral 19 Apr '05

19 Apr '05

Hi there! I'm using stunnel as client with SuSE SLES 8. Usually after several days working OK (up to two weeks) it begins to generate defunct processes for every transfer. At first, stunnel version was 3.14 (the one that comes out of the box with SLES 8), but now I have downloaded an compiled 3.26 and it just happens the same. killing stunnel won't help, since relaunching it again turns on generating defuncts. Situation does not come back to normal until rebooting the server. Any hint on this issue? Thanks in advance, Serxio Barral.

1 0

stunnel generating defuncts
by SERXIO BARRAL PAN/ Generali-España 19 Apr '05

19 Apr '05

Hi there! I'm using stunnel as client with SuSE SLES 8. Usually after several days working OK (up to two weeks) it begins to generate defunct processes for every transfer. At first, stunnel version was 3.14 (the one that comes out of the box with SLES 8), but now I have downloaded an compiled 3.26 and it just happens the same. killing stunnel won't help, since relaunching it again turns on generating defuncts. Situation does not come back to normal until rebooting the server. Any hint on this issue? Thanks in advance, Serxio Barral.

1 0

Please Help! I keep getting the same error.
by Theodore W. Hildebrandt 11 Apr '05

11 Apr '05

Refer to my submission of 03/24/05: "error:1408F10B:SSL . . . " I had hoped that someone would tell me how to get around this error, but no message has appeared in the stunnel Archive. I have now ftp'd version 4.09 and tried it, with the same results. I wait and wait for a connection, and finally interrupt the process, since it's not going anywhere. And then I get the "error:1408F10B. . ." message in the stunnel log. Since I seem to be able to send e-mail from my old Pentium II computer (Windows 98SE) I'm, using it so send this message. [Note that I can still receive e-mail on the new Dell Pentium IV machine (Windows XP Home). I just can't send anything.] Doesn't anyone have answers? Ted Hildebrandt

1 0

Unexpected closed connections
by Rory Campbell-Lange 11 Apr '05

11 Apr '05

Hi Everyone We have been very happily using stunnel for about 5 months connecting a site office back to a main office, tunnelling imap connections. We are suddenly seeing lots of disconnection messages and people at a. can no longer see their mail on d. The server suffers a "socket write shutdown" condition and shuts down the associated process. We have restarted the routers and firewalls and all seems to be working fine, other than stunnel. I'd be grateful for any insight or further help. Many thanks Rory Present arrangement: a. site client | b. site server port forwarded to c. | | internet | | c. main office server port forwarded to d. | d. imap server Server b forwards imap connections securely to the main office server, which then passes on on the imap connections to the imap server. Server b connects through the following inetd line: imaph stream tcp nowait nobody /usr/sbin/stunnel /usr/sbin/stunnel -c -r server_c_address:imap We are running version 3.26 on debian: stunnel 3.26 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Server shows following disconnect messages: 2005.04.11 13:21:46 LOG7[13320:163848]: SSL alert (read): warning: close notify 2005.04.11 13:21:46 LOG7[13320:163848]: SSL closed on SSL_read 2005.04.11 13:21:46 LOG7[13320:163848]: SSL alert (write): warning: close notify 2005.04.11 13:21:46 LOG7[13320:163848]: SSL write shutdown (output buffer empty) 2005.04.11 13:21:46 LOG7[13320:163848]: Socket write shutdown (output buffer empty) 2005.04.11 13:21:46 LOG5[13320:163848]: Connection closed: 92 bytes sent to SSL, 0 bytes sent to socket 2005.04.11 13:21:46 LOG7[13320:163848]: 10.0.0.24.imap finished (6 left) Client logs: Apr 11 15:50:26 hald stunnel[4672]: server_b.imaps connected from 10.0.1.54:49301 Apr 11 15:55:05 hald stunnel[4672]: SSL_connect: Peer suddenly disconnected ... Apr 11 15:49:55 hald stunnel[4655]: 195.172.252.146.imaps connected from 10.0.1.52:49819 Apr 11 15:54:08 hald stunnel[4655]: SSL_connect: Peer suddenly disconnected -- Rory Campbell-Lange <rory(a)campbell-lange.net> <www.campbell-lange.net>

1 0

Re: [stunnel-users] Pass IP Attn: Alexander Lazic
by Tim Brown 10 Apr '05

10 Apr '05

Nope...I see Cygwin is a Linux-like environment for Windows. Can you send me the stunnel.exe that already has this patch compiled? This works for windows? thanks. ----- Original Message ----- From: "Alexander Lazic" <al-stunnel(a)none.at> To: "Tim Brown" <tbrown2376(a)adelphia.net> Sent: Sunday, April 10, 2005 12:06 PM Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic > On Son 10.04.2005 10:24, Tim Brown wrote: >>Al....not following how to do this from Windows..cmd prompt? > > Don't you use cygwin? > > al ;-) > >>From: "Alexander Lazic" <al-stunnel(a)none.at> >>To: "Tim Brown" <tbrown2376(a)adelphia.net> >>Cc: <stunnel-users(a)mirt.net> >>Sent: Sunday, April 10, 2005 4:28 AM >>Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic >> >> >>>On Son 10.04.2005 00:33, Tim Brown wrote: >>>>Al...how do I install this patch? ...I running stunnel 4.07 >>> >>>Have you ever used the program 'patch'? >>> >>>>Thanks for your help. >>> >>>get stunnel-4.07.tar.gz >>>extract stunnel-4.07.tar.gz >>>get the patch >>>call patch -p0 < the_patch_file >>> >>>al ;-) >>> >>>>From: "Alexander Lazic" <al-stunnel(a)none.at> >>>>To: <tbrown2376(a)adelphia.net> >>>>Cc: <stunnel-users(a)mirt.net> >>>>Sent: Saturday, April 09, 2005 3:54 AM >>>>Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic >>>> >>>> >>>>>Hi, >>>>> >>>>>On Fre 08.04.2005 12:48, tbrown2376(a)adelphia.net wrote: >>>>>>Attn: Alexander Lazic >>>>>> >>>>>>Can you please send me the patch for: >>>>>>patch for HTTP => X-Forwarded-For Header >>>>>> >>>>>>to: tbrown2376(a)adelphia.net >>>>> >>>>>You can get it from: >>>>> >>>>>http://stunnel.mirt.net/pipermail/stunnel-users/2005-February/000331.html >>>>> >>>>>or you can wait for monday, then i can send you the patch. >>>>> >>>>>al ;-) >>>>> >>>>_______________________________________________ >>>>stunnel-users mailing list >>>>stunnel-users(a)mirt.net >>>>http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >>_______________________________________________ >>stunnel-users mailing list >>stunnel-users(a)mirt.net >>http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

stunnel 4.09 error message-- s_poll_wait:invalid argurment <WSAEINVAL> <10022>
by Ed Huckins 10 Apr '05

10 Apr '05

Occurs when I upgraded from stunnel 4.08 to 4.09. Using OpenSSL 0.9.7f . Stunnel.conf looks like # We're running as a client to SSLify the POP & IMAP connections client=yes # POP3 service, listens on localhost:11110 [dslx-pop3s] accept=localhost:11110 connect=mail.dslextreme.com:995 What do I need to add when going from 4.08 to 4.09? Everything seems to work; just a reset of the connection occurs instead of a close. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0514-3, 04/10/2005 Tested on: 4/10/2005 10:40:50 AM

1 0

Pass IP Attn: Alexander Lazic
by tbrown2376＠adelphia.net 10 Apr '05

10 Apr '05

Attn: Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-)

3 4

Pass IP Attn: Alexander Lazic
by Tim Brown 09 Apr '05

09 Apr '05

Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-) Tim Brown VP Network Services Florida Telco Credit Union Ph: 904.723.6315 Toll Free: 800.342.2352 ext. 6315 Fax: 904.722.6615 <mailto:[email protected]> tbrown(a)floridatelco.org Confidentiality Notice: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately delete this message and attachments (including all copies) and notify the sender by return e-mail or by phone at 904.723.6300.

3 3

stunnel and NNTP on windows - best practices
by Sir Thanksalot 08 Apr '05

08 Apr '05

Hi all, I am trying to use stunnel for SSL access to a NNTP newserver and found quite a few pages that list ways of doing that. I personally am using xnews as my newsreader, and I have seen variations of the same instructions with different software (Agent, Free Agent for newsreaders, Pegasus Mail as your mail application etc.). For completeness sake, here are some of the ones that I've found - http://www.cotse.net/users/putty/ssl (for Xnews and stunnel 4.x) http://www.geocities.com/d4vidb/x_setup13.html (for Xnews and stunnel 3.x - doesn't use the stunnel.conf file necessary in stunnel 4.x) http://www.noderunner.net/~llin/old/nntp-ssl.html (for a newsreader and stunnel 3.x. It also has links to a stunnel.conf file for stunnel 4.x users) In all these instructions (whether using the stunnel 3.x commandline options or using the stunnel.conf file for stunnel 4.x), I haven't seen any instructions about creating any certificates or public/private keys or a passphrase. Also there doesn't seem to be any writeup on what algorithm actually ends up getting used or even a way to pick which algorithm to use. What's the best practise for users? Should they do anything extra? Set up key pairs? Choose a default algorithm? Thanks. -- _______________________________________________ NEW! Lycos Dating Search. The only place to search multiple dating sites at once. http://datingsearch.lycos.com

1 0

TIMEOUTclose
by Joe Abbey 08 Apr '05

08 Apr '05

Background: I have been having issues getting Entourage to connect with my mail server over POP3S. Entourage will connect, communicate, and then hangs for 60 seconds. According to tcpdumps, Entourage appears to hang until a timeout. Connecting directly to the pop3 daemon, bypassing stunnel, there is no lag. Therefore something appears to be wrond with the stunnel/Entourage interaction. To get Entourage to work with POP3S and have virtually no lag, I've set in my stunnel.conf TIMEOUTclose = 2 for [pop3s]. Question: Is there any reason not to set TIMEOUTclose = 0? Thanks! Joe

1 0

Pass IP Attn: Alexander Lazic
by tbrown2376＠adelphia.net 08 Apr '05

08 Apr '05

ATTN: Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-)

1 0

Compilation error on windows, cannot find "-lssl"
by Billinger Olle 07 Apr '05

07 Apr '05

Hi I'm trying to compile stunnel 4.08 on windows using mingw, with openssl-0.9.7f. I have edited the Makefile.w32 and it compiles ok until it cannot find the "-lssl". Any suggestions are welcome. //Olle ************************************** $ make -f Makefile.w32 stunnel.exe gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o stunnel.o stunnel.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o ssl.o ssl.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o client.o client.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o protocol.o protocol.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o sthreads.o sthreads.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o log.o log.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o options.o options.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o network.o network.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o resolver.o resolver.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o gui.o gui.c gcc -s -o stunnel.exe stunnel.o ssl.o client.o protocol.o sthreads.o log.o options.o network.o resolver.o gui.o resources.o -L/c/openssl/bin -lwsock32 -lgdi32 -lssl -mwindows c:\mingw\bin\..\lib\gcc-lib\mingw32\3.2.3\..\..\..\..\mingw32\bin\ld.exe: cannot find -lssl make: *** [stunnel.exe] Error 1 My Makefile.w32 ******************* SSLDIR=/c/openssl DEFINES=-DUSE_WIN32 -DHAVE_OPENSSL CFLAGS=-g -O2 -Wall $(DEFINES) -I$(SSLDIR)/include LDFLAGS=-s # LIBS=-L$(SSLDIR)/out -lssl -lcrypto -lwsock32 -lgdi32 LIBS=-L$(SSLDIR)/bin -lwsock32 -lgdi32 -lssl OBJS=stunnel.o ssl.o client.o protocol.o sthreads.o log.o options.o network.o resolver.o gui.o resources.o stunnel.exe: $(OBJS) $(CC) $(LDFLAGS) -o stunnel.exe $(OBJS) $(LIBS) -mwindows clean: rm *.o rm stunnel.exe #resources.o: resources.rc resources.h # windres resource.rc resources.o $(OBJS): *.h Makefile.w32 *********************

1 0

Stunnel.conf reload
by CIM Massy 05 Apr '05

05 Apr '05

Hi, is there a way, under win32, to have stunnel reload its .conf file and certificates without restarting the service ? (A kind of SIGHUP) Thanks, Phil

1 0

Stunnel and CRLs
by CIM Massy 05 Apr '05

05 Apr '05

Hi, is there a way to automagically mutually verify certificates (verify=3) and to check the certificates against a .crl file hosted on a web server ? I want my "VNC over Stunnel" host check if the incoming connexions are authorized or if the certificates have expired / been revoked. Thanks, Phil

1 0

stunnel 4.09 problem: Connection rejected: too many clients
by Steven Van Acker 04 Apr '05

04 Apr '05

Hi, after upgrading to stunnel 4.09, we are having 2 problems with it that did not exist in a previous version (our case: stunnel 4.05 without pthreads) ---[ My testsetup is as follows: * stunnel listening on port 4321, connects to localhost port 13 (daytime) * daytime is enabled in inetd * stunnel was compiled without pthreads * ulimit -u = 8192 ---[ problem 1 At first, it works fine. For every incoming connection, the process forks and data is transferred. However, when the connection is closed, the forked process remains hanging for a while (about 1 minute) and then exits. This in itself is not a real problem, except that it generates a lot of processes. (and maybe causes problem 2 ?) ---[ data and logs concerning problem 1 (process hangs for 1 minute): I run the following command: openssl s_client -connect 192.168.2.119:4321 the output follows immediately The logfile (debug = debug) looks like this: 2005.03.31 14:05:05 LOG7[4552:0]: daytime accepted FD=8 from 192.168.2.103:47200 2005.03.31 14:05:05 LOG7[4552:0]: FD 8 in non-blocking mode 2005.03.31 14:05:05 LOG7[4553:0]: daytime started 2005.03.31 14:05:05 LOG5[4553:0]: daytime connected from 192.168.2.103:47200 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): before/accept initialization 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read client hello A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write server hello A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write certificate A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write server done A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 flush data 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read client key exchange A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read finished A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write change cipher spec A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write finished A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 flush data 2005.03.31 14:05:05 LOG7[4553:0]: 1 items in the session cache 2005.03.31 14:05:05 LOG7[4553:0]: 0 client connects (SSL_connect()) 2005.03.31 14:05:05 LOG7[4553:0]: 0 client connects that finished 2005.03.31 14:05:05 LOG7[4553:0]: 0 client renegotiatations requested 2005.03.31 14:05:05 LOG7[4553:0]: 1 server connects (SSL_accept()) 2005.03.31 14:05:05 LOG7[4553:0]: 1 server connects that finished 2005.03.31 14:05:05 LOG7[4553:0]: 0 server renegotiatiations requested 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache hits 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache misses 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache timeouts 2005.03.31 14:05:05 LOG6[4553:0]: SSL accepted: new session negotiated 2005.03.31 14:05:05 LOG6[4553:0]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2005.03.31 14:05:05 LOG7[4553:0]: FD 7 in non-blocking mode 2005.03.31 14:05:05 LOG7[4553:0]: daytime connecting 127.0.0.1:13 2005.03.31 14:05:05 LOG7[4553:0]: connect_wait: waiting 10 seconds 2005.03.31 14:05:05 LOG7[4553:0]: connect_wait: connected 2005.03.31 14:05:05 LOG7[4553:0]: Remote FD=7 initialized 2005.03.31 14:05:05 LOG7[4553:0]: Socket closed on read 2005.03.31 14:05:05 LOG7[4553:0]: SSL write shutdown 2005.03.31 14:05:05 LOG7[4553:0]: SSL alert (write): warning: close notify 2005.03.31 14:05:05 LOG7[4553:0]: SSL_shutdown retrying 2005.03.31 14:05:06 LOG7[4553:0]: SSL alert (read): warning: close notify 2005.03.31 14:05:06 LOG7[4553:0]: SSL closed on SSL_read 2005.03.31 14:05:06 LOG7[4553:0]: Socket write shutdown When I check netstat, the connection from the client to stunnel is in the CLOSE_WAIT state and the connection from stunnel to the daytime server is in TIME_WAIT state then 1 minute later, this follows: 2005.03.31 14:06:06 LOG6[4553:0]: s_poll_wait timeout: connection close 2005.03.31 14:06:06 LOG5[4553:0]: Connection closed: 26 bytes sent to SSL, 0 bytes sent to socket 2005.03.31 14:06:06 LOG7[4553:0]: removing pid file /stunnel.pid 2005.03.31 14:06:06 LOG7[4552:0]: Steven: going into client_status with num_clients = 1 2005.03.31 14:06:06 LOG7[4552:0]: Process 4553 finished with code 0 (0 left) Now, netstat no longer shows the connections in any state. ---[ problem 2 Another problem that was found is that after bombarding stunnel with lots of connections, it stops accepting new connections. This would be normal if all connections remained open, but they are all closed. This is the error: Mar 31 13:53:40 hostname stunnel[13044]: Connection rejected: too many clients (>=4000) netstat only shows +- 500 connections, of which none are aimed at the stunnel process in question (port 4321 in my test setup) there is only 1 stunnel process active aswell. I dug into the problem a bit and it probably has to do with num_clients not being decreased after a process is closed (although I can not find any specifics :/) greets, -- Steven

3 4

Terminal services and stunnel 4.09
by Mattias Olsson 01 Apr '05

01 Apr '05

Hi! Im tying to access an internal Win2003 terminal server from my Linux box (internet). As i understand it stunnel should do the work. I have read some documents but im not sure... This is my setup. Linuxbox ----> Linuxbox ssh server | Firewall | Terminal server i wish to access. Can this be done or do i have to open a port in the fw to access the TS directly? Should stunnel.conf look like this on my linuxbox (client) cert = /usr/local/etc/stunnel/mail.pem client = yes On the TS? [TS] accept = 3000 connect = 3389 Should it have cert = ? Or could i on my linux ssh server have a config looking like this: [TS-remote] accept = 3000 connect = <internal-ip>:3389 Should it have cert = ? A novice man sends his best regards and thanks! /Kaz -- Mvh / Regards Mattias Olsson - aka - KaZaMaNIaC

1 0

Does stunnel work on Windows 2000 & SIMP(Secure Instant Messaging) ??
by DK 01 Apr '05

01 Apr '05

Hi Group, I have a windows 2000 box & want to communicate securely with someone else via SIMP(Secure Instant Messaging Protocol - http://www.winfosec.com/simp.php) I know that SIMP Instant Messaging is a "Direct Connection" & does NOT go through an intermediary server & that its encrypted, but being the security nut I am, I want to know if "stunnel" handles the SIMP protocols ? ... as I can't find anywhere what the SIMP protocols are ... because as I have read in the stunnel FAQ, stunnel does not handle UDP. Regards, David __________________________________ Do you Yahoo!? Yahoo! Personals - Better first dates. More second dates. http://personals.yahoo.com

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users