- stunnel-users - stunnel.org

Graceful config reload when -fd option was used
by z a 09 May '17

09 May '17

Hi, Since version 4.30, sending a HUP signal to a running stunnel process will cause it to gracefully reload with the given config file. Is there a way to accomplish this when the running stunnel process was started with the "-fd" flag as in the example below? cat foo.conf | stunnel-fd 0 I tried writing to /proc/$pid/fd/0 but that didn't work. I'm hoping someone here has overcome this issue and might be able to whisper a hint in my direction. I am on Centos 7.2. Thanks

1 0

Trouble with stunnel.conf (version 5.41)
by Mark Garciano 02 May '17

02 May '17

Hi Stunnel users, Any ideas why I get a "server down" message"? Below is the conf file: ;--------------------------------------------------------------------------- ; ************************************************************************** ; * Global options * ; ************************************************************************** ; ; Debugging stuff (may useful for troubleshooting) debug = 7 output = stunnel.log ;Disable FIPS mode to allow non-approved protocols and algorithms fips = no ;************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 key = stunnel.pem cert = stunnel.pem client = yes accept = 5001 connect = XXXXXXXXXXX.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 ;--------------------------------------------------------------------------- HERE IS THE LOG WINDOW MESSAGE: [!] Server is down [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing inetd mode configuration [!] Service [(null)]: 'accept' option is only allowed in a [section] Mark Garciano Systems Programmer II USC Libraries Integrated Library Systems 213-740-3568

2 1

Re: [stunnel-users] Help in setting stunnel in client mode to connect webservice in mutual authentication
by Chokkalingam, Jothish 28 Apr '17

28 Apr '17

Hi Can you help in sorting it out below scenario We have a URL whose TLS is 1.0 and now it is being upgraded to 1.2. Since the current application doesn't support V1.0 I am planning to use stunnel in between to fix the gap. Can you help if my below config is correct or not. The communication between client and server is MASSL(mutual authentication SSL) [Billpay46200] client = yes CApath = /apps/bss/CCBTrustStore-->trust store where the remote webservice certificates are stored in cert format accept = 46200-->port configured from client machine to connect using http connect = xxx.in.xxx.com.au:46200-->port where the incoming http request need to be changed from http to https cert = /stunnel/bin/client.pem-->identity certificate used for client key = /stunnel/bin/key.pem-->corresponding key for the above identity certificate. While hitting using the URL http://localhost:46200 it is shown in stunnel log as below 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 accepted connection from 127.0.0.1:58382 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 connected remote server from 10.116.194.24:58383 2017.04.28 17:17:51 LOG3[2627:3]: SSL_connect: Peer suddenly disconnected 2017.04.28 17:17:51 LOG5[2627:3]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

1 0

Remove session callback
by Florian Gossin 19 Apr '17

19 Apr '17

Hi, I have updated to the latest 5.41 version. I was troubleshooting another problem and I discovered dozens of lines in the log file with "Remove session callback, Deallocating application specific data for session connect address": 2017.04.19 14:49:49 LOG7[17483]: Service [pgbouncer-client] started 2017.04.19 14:49:49 LOG7[17483]: Option TCP_NODELAY set on local socket 2017.04.19 14:49:49 LOG5[17483]: Service [pgbouncer-client] accepted connection from x.x.x.x:36018 2017.04.19 14:49:49 LOG6[17483]: Peer certificate required 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): before/accept initialization 2017.04.19 14:49:49 LOG7[17483]: SNI: no virtual services defined 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read client hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write server hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write change cipher spec A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write finished A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 flush data 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read finished A 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address ... Can anyone explain me what it is about ? Thank you, Florian

1 0

Windows Server 2012 stunnel service
by Adam Shackleton 18 Apr '17

18 Apr '17

Hi All I'm running stunnel on Windows Server 2012 R2 with the following config: [test-qa] client = yes accept = 127.0.0.1:8080 connect = webaddress.com:443 cert = API-q-response.pfx CAfile = ca-certs.pem OCSPaia = yes When I start the GUI I'm prompted for the certificate password then and then stunnel works fine, but I need it to run as a service. I've tried using the start menu stunnel Service Install button, I've also tried opening a command prompt in C:\Program Files (x86)\stunnel\config and running C:\Program Files (x86)\stunnel\bin\stunnel.exe -install, and I've also tried moving the config file and certs to the \bin directory and running stunnel -install there as well. In all case the service installs ok, and when you run it, it starts (I can see it in the services tool), you can click the stunnel Configuration File Reload button in the start menu and it says the configuration was successfully reloaded, but it doesn't work when I try to use it. I've noticed two things that might be relevant: 1. At no point does it prompt me for the certificate password like it does when I load the GUI 2. The dialog boxes that open when the service is installed or started say "stunnel 5.40 on Win32 (not configured) [cid:[email protected]] If anyone has any advice that would be greatly appreciated. Thanks Adam

2 1

SOCKS connection to the IPv4 loopback rejected.
by Robert de Bath 15 Apr '17

15 Apr '17

Hi everyone, How do I get rid of this message? I have a stunnel server setup on a remote machine using the socks protocol. I use two keys plus the certificates and a private CA to protect the SSL link. On a local machine I have an stunnel client running without a protocol option set. If I try to make a socks connection to an interface IP of the remote server it works perfectly, bypassing the intervening firewalls through the protected tunnel. But the interface IP changes and I only want to allow connections to the remote server through the tunnel. I could setup traditional tunnels, but while one of the services (remote desktop to the Windows server) is constant the others are dynamically configurable. I have even considered using SNI to distinguish the incoming connections to the various services but while this allows there to be just one tunnel port it will still need a remote reconfiguration of stunnel every time a service port is added or removed. The best way to express this limit is that the socks server should ONLY connect to localhost; but it's "rejected". In actual operation I will probably need to allow the local network too which will probably be an rfc1597 address. Looking at the source it appears that this condition is hard coded into the "validate" function so my question becomes: can you please remove this or add a flag to turn it off? -- Robert de Bath robert(a)tvisiontech.co.uk

1 0

Configure Error
by Kenway Ng 12 Apr '17

12 Apr '17

Hi I am running into an issue when I go into the src directory and I run the configure command, I get configure: error: Could not find your TLS library installation dir Use --with-ssl option to fix this problem I am trying to upgrade our version of stunnel. Our SME left and now I am trying to upgrade stunnel to fix a vulnerability . I am being told to use TLS1.1 or higher Here is our current version of stunnel $ ./stunnel -version stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Any help would be appreciated. Kenway

1 0

PSK, verifying the client
by Mike 05 Apr '17

05 Apr '17

Is it possible to verify the client using PSK? On the stunnel server I specify a PSKsecrets file with two lines in it, one for client01 and one for client02. The secret is about 36 characters long. On a client, I have a similar PSKsecrets file, but only containing the client01 line. Now, if I try to connect with, say, a client03, i.e., any client that does not have a matching line in the server's PSKsecrets file, how can I assure that the client connection will be rejected? What I'd like to see would be the following: any client that tries to connect, and does not present a PSK that is present in the server's PSKsecrets file, then that client's connection request is rejected, with an appropriate message logged. Can I do that with the current stunnel? thx.

1 0

Scan to email failure: RapbianPi3 to Office365
by Graeme Ellisson 03 Apr '17

03 Apr '17

Hi. I recently bought a Pi3 and have loaded Raspbian with Doobs (Previously I had this running faultlessly under a Windows Server for my Canon multi function printer that does not support SSL/TLS but only authentication). After about 8 attempts to get Stunnel4 working (there doesn't seem to be a later version to install via the command line) I eventually found that Stunnel4 works fine as long as one doesn't update Dabian from the initial Doobs install. So, I now have the service running and listening on port 25 with the following config file: debug=7 output=/etc/stunnel/stunnel.log client=yes options=NO_SSLv2 (I added this last night after reading a blog) [SMTP OUT] sslVersion=TLSv1 (I added this last night after reading a blog) protocol=smtp accept=25 connect=smtp.office365.com:587 On restarting the service I see the following which looks okay to my untrained eye: 2017.04.03 09:42:09 LOG7[3570]: Dispatching signals from the signal pipe 2017.04.03 09:42:09 LOG7[3570]: Processing SIGNAL_TERMINATE 2017.04.03 09:42:09 LOG5[3570]: Terminated 2017.04.03 09:42:09 LOG7[3570]: Closing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed (FD=7) 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed 2017.04.03 09:42:09 LOG7[3570]: removing pid file /var/run/stunnel4.pid 2017.04.03 09:42:09 LOG7[3926]: Clients allowed=500 2017.04.03 09:42:09 LOG5[3926]: stunnel 5.06 on arm-unknown-linux-gnueabihf platform 2017.04.03 09:42:09 LOG5[3926]: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2017.04.03 09:42:09 LOG5[3926]: Running with OpenSSL 1.0.1t 3 May 2016 2017.04.03 09:42:09 LOG5[3926]: Update OpenSSL shared libraries or rebuild stunnel 2017.04.03 09:42:09 LOG5[3926]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD SSL:ENGINE,OCSP,FIPS Auth:LIB$ 2017.04.03 09:42:09 LOG7[3926]: errno: (*__errno_location ()) 2017.04.03 09:42:09 LOG5[3926]: Reading configuration from file /etc/stunnel/stunnel4.conf 2017.04.03 09:42:09 LOG5[3926]: FIPS mode disabled 2017.04.03 09:42:09 LOG7[3926]: Compression disabled 2017.04.03 09:42:09 LOG7[3926]: Snagged 64 random bytes from /dev/urandom 2017.04.03 09:42:09 LOG7[3926]: PRNG seeded successfully 2017.04.03 09:42:09 LOG6[3926]: Initializing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3926]: No private key specified 2017.04.03 09:42:09 LOG7[3926]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2017.04.03 09:42:09 LOG5[3926]: Configuration successful 2017.04.03 09:42:09 LOG7[3926]: Listening file descriptor created (FD=7) 2017.04.03 09:42:09 LOG7[3926]: Service [SMTP OUT] (FD=7) bound to 0.0.0.0:25 2017.04.03 09:42:09 LOG7[3927]: Created pid file /var/run/stunnel4.pid When sending a scan from the printer to an email address I see the following in the log file: 2017.04.03 10:00:05 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1085 2017.04.03 10:00:05 LOG7[3960]: Service [SMTP OUT] started 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] accepted connection from 192.168.8.99:1085 2017.04.03 10:00:05 LOG6[3960]: s_connect: connecting 40.101.73.162:587 2017.04.03 10:00:05 LOG7[3960]: s_connect: s_poll_wait 40.101.73.162:587: waiting 10 seconds 2017.04.03 10:00:05 LOG5[3960]: s_connect: connected 40.101.73.162:587 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] connected remote server from 192.168.8.33:59792 2017.04.03 10:00:05 LOG7[3960]: Remote socket (FD=9) initialized 2017.04.03 10:00:05 LOG7[3960]: <- 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> EHLO localhost 2017.04.03 10:00:05 LOG7[3960]: <- 250-DB6PR07CA0179.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:05 LOG7[3960]: <- 250-SIZE 157286400 2017.04.03 10:00:05 LOG7[3960]: <- 250-PIPELINING 2017.04.03 10:00:05 LOG7[3960]: <- 250-DSN 2017.04.03 10:00:05 LOG7[3960]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:05 LOG7[3960]: <- 250-STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 250-8BITMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-BINARYMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-CHUNKING 2017.04.03 10:00:05 LOG7[3960]: <- 250 SMTPUTF8 2017.04.03 10:00:05 LOG7[3960]: -> STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:05 LOG6[3960]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): before/connect initialization 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: 0 items in the session cache 2017.04.03 10:00:05 LOG7[3960]: 2 client connects (SSL_connect()) 2017.04.03 10:00:05 LOG7[3960]: 2 client connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 client renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 server connects (SSL_accept()) 2017.04.03 10:00:05 LOG7[3960]: 0 server connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 server renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 external session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 session cache misses 2017.04.03 10:00:05 LOG7[3960]: 0 session cache timeouts 2017.04.03 10:00:05 LOG6[3960]: SSL connected: new session negotiated 2017.04.03 10:00:05 LOG6[3960]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:05 LOG6[3960]: Compression: null, expansion: null 2017.04.03 10:00:10 LOG6[3960]: SSL socket closed (SSL_read) 2017.04.03 10:00:10 LOG7[3960]: Sent socket write shutdown 2017.04.03 10:00:10 LOG5[3960]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:10 LOG7[3960]: Remote socket (FD=9) closed 2017.04.03 10:00:10 LOG7[3960]: Local socket (FD=3) closed 2017.04.03 10:00:10 LOG7[3960]: Service [SMTP OUT] finished (0 left) 2017.04.03 10:00:20 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1086 2017.04.03 10:00:20 LOG7[3961]: Service [SMTP OUT] started 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] accepted connection from 192.168.8.99:1086 2017.04.03 10:00:20 LOG6[3961]: s_connect: connecting 40.101.72.194:587 2017.04.03 10:00:20 LOG7[3961]: s_connect: s_poll_wait 40.101.72.194:587: waiting 10 seconds 2017.04.03 10:00:20 LOG5[3961]: s_connect: connected 40.101.72.194:587 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] connected remote serve from 192.168.8.33:57422 2017.04.03 10:00:20 LOG7[3961]: Remote socket (FD=9) initialized 2017.04.03 10:00:21 LOG7[3961]: <- 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> EHLO localhost 2017.04.03 10:00:21 LOG7[3961]: <- 250-DB6PR07CA0014.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:21 LOG7[3961]: <- 250-SIZE 157286400 2017.04.03 10:00:21 LOG7[3961]: <- 250-PIPELINING 2017.04.03 10:00:21 LOG7[3961]: <- 250-DSN 2017.04.03 10:00:21 LOG7[3961]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:21 LOG7[3961]: <- 250-STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 250-8BITMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-BINARYMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-CHUNKING 2017.04.03 10:00:21 LOG7[3961]: <- 250 SMTPUTF8 2017.04.03 10:00:21 LOG7[3961]: -> STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:21 LOG6[3961]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): before/connect initialization 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: 0 items in the session cache 2017.04.03 10:00:21 LOG7[3961]: 3 client connects (SSL_connect()) 2017.04.03 10:00:21 LOG7[3961]: 3 client connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 client renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 server connects (SSL_accept()) 2017.04.03 10:00:21 LOG7[3961]: 0 server connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 server renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 external session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 session cache misses 2017.04.03 10:00:21 LOG7[3961]: 0 session cache timeouts 2017.04.03 10:00:21 LOG6[3961]: SSL connected: new session negotiated 2017.04.03 10:00:21 LOG6[3961]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:21 LOG6[3961]: Compression: null, expansion: null 2017.04.03 10:00:26 LOG6[3961]: SSL socket closed (SSL_read) 2017.04.03 10:00:26 LOG7[3961]: Sent socket write shutdown 2017.04.03 10:00:26 LOG5[3961]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:26 LOG7[3961]: Remote socket (FD=9) closed 2017.04.03 10:00:26 LOG7[3961]: Local socket (FD=3) closed 2017.04.03 10:00:26 LOG7[3961]: Service [SMTP OUT] finished (0 left) At the end of this, no email is received. I can't tell from the above if the document is not being received by Stunnel from the printer or if Stunnel can not pass the document to Office365. It looks like TLSv1 is being negotiated and some data is being sent but then it closes the connection. Any help would be much appreciated. Regards, Graeme

2 1

Stunnel Version Vulnerability-Currently using 5.04
by Tracy Drake - IQGC-C 28 Mar '17

28 Mar '17

Hello Stunnel Users Forum! I wonder if anyone may have suggestions of what, if anything can be done to surmount a reported vulnerability for Stunnel versions prior to 5.34. I have limited savvy in this arena so please excuse this "Stunnel for Dummies" question. The following statements surfaced in a "security vulnerabilities" report... The version of stunnel installed on the remote host is 4.46 or later but prior to 5.34. It is, therefore, affected by a security bypass vulnerability related to the validation of level 4 peer certificates. An unauthenticated, remote attacker can exploit this to have an impact on confidentiality, integrity, and/or availability. No other details are available. I am of the mind that perhaps an entry in Stunnel.conf until we can deploy an upgrade? Thanks in advance for any feedback! Upgrade to stunnel version 5.34 or later. -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

Multi source VPN connectivity
by Aykut SAY 24 Mar '17

24 Mar '17

Hi, We are working on a integration project and we need to connect our application to three different sources. These three sources have their own VPN. Can stunnel connect to three different vpn from one server? If yes, which version of stunnel we need to install to our server? Thanks, Aykut

1 0

stunnel public private key authentication like ssh
by Michael Power 23 Mar '17

23 Mar '17

Is there a way to configure stunnel just to check the public key of the provided certificate? I want authentication between the server and the client to take place by public key only, no PKI just like ssh. Is this possible? Is this verify level 4, or does that still check the CN against the host that I am connecting to? Michael Power

1 0

update stunnel with engine pkcs11
by Heinsbroek, Peter 20 Mar '17

20 Mar '17

Hallo, I’m a newbee in C programming. I have to upgrade stunnel 5.31 with engine_pkcs11 (0.1.8) for windows to the latest versions. (5.40 & 0.2.2) My engine_pkcs.c contains an subroutine my_get_pin (see attachment line 707) that reads a pin from a file in the windows folder. After reading it ,it transforms the pin to hexadecimal, if not already done, and writes it back in the file. After adjusting the new source it compiles without errors, but when executing it doesn’t work anymore. I also attached the old engine_pkcs11.c as we used it. Can someone help me with this problem. After compairing the old and new source I noticed that there have been major improvements to the source With regards, Peter Heinsbroek Application manager NT / SQL20xx Tel. +31 (0)88 265 9869 Mob. +31 6 5375 3244 Werner von Siemensstraat 3 2712 PN Zoetermeer, Nederland Org. unit PS Central Fin Services Unit 02 SI NL Email peter.heinsbroek(a)atos.net<mailto:[email protected]> Web www.nl.atos.net<UrlBlockedError.aspx> Atos IT Solutions and Services B.V. Comm. Register The Hague no. 27380688 This e-mail is intended exclusively for the addressee(s), and may not be forwarded or made available for use to any person other than the addressee(s). If you are not the intended recipient, please notify the sender thereof and destroy/delete the message. The sender disclaims any liability as regards (the content of) this e-mail. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Fwd: Stunnel Performance strangeness
by Scott McKeown 10 Mar '17

10 Mar '17

Hi All, We have been doing some throughput testing and are wondering of you can help explain some of the results we have been getting. We are trying to establish the maximum number of handshakes per second our appliances can do when using Stunnel. Our tests have been done on a 4 core Intel(R) Xeon(R) CPU E3-1230 v5 @ 3.40GHz machine with 8Gb ram. Using stunnel 5.33 openssl 1.0.2j (We use stunnel 5.33 here, but this was also tested with stunnel 5.40 and we got the same issue) Stunnel was compiled with - ./configure --enable-fips --enable-ipv6 --with-threads=pthread --sysconfdir=/etc --with-ssl=/usr/src/built/OpenSSL_1_0_2j-no_march/usr/local/ --disable-libwrap --disable-systemd I was using a python script of my own design for load testing when I noticed the problem we then switched to an open source package called vegeta https://github.com/tsenart/vegeta the command I was using to run it was - echo "GET https://10.10.10.10:443" | ./vegeta attack -workers=30 -rate=3000 -duration=300s -insecure > test.out We are essentially seeing a degradation in throughput at a fixed point in time. I am seeing the problem when using 3000 transactions per second. We are doing https gets through stunnel to a http backend, 1 transaction is an ssl handshake the http get and waiting for the response. Interestingly if I try 5.06 it works fine I get a smooth constant loading. Please take a look at 30worker3000rate5.33-300s.png where you can see after about 55 seconds there is a jump in latency. I get the same issue if I run the test with 2000 transactions. Please see 30worker20005.33-700s.png but with the lower transaction rate the issue takes longer to rear its head. The issue doesnt happen if I run the test with 3000 transaction using 5.06. Please see 30worker3000rate5.06-300s.png >From looking at the graphs our thoughts were that we were hitting some sort of cache limit and used that as a starting point. We have taken a look at the code changes between versions we know were working and the problematic version and the main thing that stands out is the changes to the leak detection. Previously this was partially based on the number of clients but has been changed to use the sections. This led to the decision to try a different limit value and found the number of connections we saw before seeing an issue corresponds to the change of the limit value. We think we have identified the code that is causing the problem/doing something funny it was added in 5.33 NOEXPORT long leak_threshold() { long limit; limit=10000*((int)number_of_sections+1); #ifndef USE_FORK limit+=100*num_clients; #endif return limit; } its src/str.c when increasing the limit number so limit=10000*((int)number_of_sections+1) to limit=20000*((int)number_of_sections+1) This still results in an increase in response time but at a later time in the test, please see 30worker3000rate5.33-ben-highlimit.png Interestingly once I end up in this state I am stuck with high latencies until I restart stunnel. (The box I am testing on was left over night to make sure its not any hanging tcp connections or anything like that) I must admit we are at the limit of our C understanding and your imput would be welcomed. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 <0330%20380%201064> (24x7) Tel (US) - +1 888.867.9504 <+1%20888-867-9504> (Toll Free)(24x7)

1 0

Segfault after connecting
by Andrew Culver 23 Feb '17

23 Feb '17

I had my stunnel instance working as expected last week. Since then I've moved the server behind a load balancer, which is doing regular health checks (opens a tcp connection, then disconnects) to see that stunnel is up. I don't believe the health checks are a problem, but they're the only change I've made since I had stunnel working. I can see the health checks connecting and disconnecting. However when I open a new connection, either by telnet or by: openssl s_client -connect mtar.uwo.ca:587 -starttls smtp ... stunnel says it fails to verify the server certificate, then seg faults. I'm running stunnel 5.40 and I'm having the same problem on 2 different servers running openssl 1.1.0d and 1.1.0e. Here's my config: [root@mtar1 stunnel]# egrep -v '^;|^ *$' stunnel.conf ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2017 setuid = stunnel setgid = stunnel pid = /usr/local/var/run/stunnel/stunnel.pid foreground = yes debug = debug [uwo2local] accept = 587 cert = /usr/local/etc/stunnel/mtar-withprivatekey.pem connect = 20587 protocol = smtp [local2o365] client = yes accept = 127.0.0.1:20587 connect = smtp.office365.com:587 checkHost = smtp.office365.com verifyChain = yes CApath = /etc/ssl/certs OCSPaia = yes protocol = smtp Here's my debug log: The health checks are from 172.18.58.5 and my test connection which leads to the seg fault is from 129.100.6.17. [root@mtar1 stunnel]# /usr/local/bin/stunnel /usr/local/etc/stunnel/stunnel.conf 2017.02.23 11:28:48 LOG7[ui]: Clients allowed=500 2017.02.23 11:28:48 LOG5[ui]: stunnel 5.40 on x86_64-unknown-linux-gnu platform 2017.02.23 11:28:48 LOG5[ui]: Compiled/running with OpenSSL 1.1.0d 26 Jan 2017 2017.02.23 11:28:48 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.23 11:28:48 LOG7[ui]: errno: (*__errno_location ()) 2017.02.23 11:28:48 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2017.02.23 11:28:48 LOG5[ui]: UTF-8 byte order mark detected 2017.02.23 11:28:48 LOG5[ui]: FIPS mode disabled 2017.02.23 11:28:48 LOG7[ui]: Compression disabled 2017.02.23 11:28:48 LOG7[ui]: PRNG seeded successfully 2017.02.23 11:28:48 LOG7[cron]: Cron thread initialized 2017.02.23 11:28:48 LOG6[ui]: Initializing service [uwo2local] 2017.02.23 11:28:48 LOG7[ui]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.02.23 11:28:48 LOG7[ui]: TLS options: 0x02020004 (+0x02000000, -0x00000000) 2017.02.23 11:28:48 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG7[ui]: Private key check succeeded 2017.02.23 11:28:48 LOG7[ui]: DH initialization 2017.02.23 11:28:48 LOG7[ui]: Could not load DH parameters from /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Using dynamic DH parameters 2017.02.23 11:28:48 LOG7[ui]: ECDH initialization 2017.02.23 11:28:48 LOG7[ui]: ECDH initialized with curve prime256v1 2017.02.23 11:28:48 LOG6[ui]: Initializing service [local2o365] 2017.02.23 11:28:48 LOG7[ui]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.02.23 11:28:48 LOG7[ui]: TLS options: 0x02020004 (+0x02000000, -0x00000000) 2017.02.23 11:28:48 LOG7[ui]: No certificate or private key specified 2017.02.23 11:28:48 LOG5[ui]: Configuration successful 2017.02.23 11:28:48 LOG7[ui]: Listening file descriptor created (FD=7) 2017.02.23 11:28:48 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2017.02.23 11:28:48 LOG7[ui]: Service [uwo2local] (FD=7) bound to 0.0.0.0:587 2017.02.23 11:28:48 LOG7[ui]: Listening file descriptor created (FD=8) 2017.02.23 11:28:48 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2017.02.23 11:28:48 LOG7[ui]: Service [local2o365] (FD=8) bound to 127.0.0.1:20587 2017.02.23 11:28:48 LOG6[cron]: Executing cron jobs 2017.02.23 11:28:48 LOG5[cron]: Updating DH parameters 2017.02.23 11:28:48 LOG7[ui]: Created pid file /usr/local/var/run/stunnel/stunnel.pid 2017.02.23 11:28:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:28:51 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:40161 2017.02.23 11:28:51 LOG7[0]: Service [uwo2local] started 2017.02.23 11:28:51 LOG7[0]: Option TCP_NODELAY set on local socket 2017.02.23 11:28:51 LOG5[0]: Service [uwo2local] accepted connection from 172.18.58.5:40161 2017.02.23 11:28:51 LOG6[0]: failover: round-robin, starting at entry #0 2017.02.23 11:28:51 LOG6[0]: s_connect: connecting ::1:20587 2017.02.23 11:28:51 LOG7[0]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:28:51 LOG3[0]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:28:51 LOG6[0]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:28:51 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:28:51 LOG5[0]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:28:51 LOG5[0]: Service [uwo2local] connected remote server from 127.0.0.1:33132 2017.02.23 11:28:51 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.02.23 11:28:51 LOG7[0]: Remote descriptor (FD=9) initialized 2017.02.23 11:28:51 LOG7[0]: RFC 2487 not detected 2017.02.23 11:28:51 LOG6[0]: Peer certificate not required 2017.02.23 11:28:51 LOG7[0]: TLS state (accept): before SSL initialization 2017.02.23 11:28:51 LOG3[0]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:28:51 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:51 LOG7[0]: Remote descriptor (FD=9) closed 2017.02.23 11:28:51 LOG7[0]: Local descriptor (FD=3) closed 2017.02.23 11:28:51 LOG7[0]: Service [uwo2local] finished (0 left) 2017.02.23 11:28:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:28:51 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33132 2017.02.23 11:28:51 LOG7[1]: Service [local2o365] started 2017.02.23 11:28:51 LOG3[1]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:28:51 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:51 LOG7[1]: Local descriptor (FD=3) closed 2017.02.23 11:28:51 LOG7[1]: Service [local2o365] finished (0 left) 2017.02.23 11:28:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:28:56 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:19333 2017.02.23 11:28:56 LOG7[2]: Service [uwo2local] started 2017.02.23 11:28:56 LOG7[2]: Option TCP_NODELAY set on local socket 2017.02.23 11:28:56 LOG5[2]: Service [uwo2local] accepted connection from 172.18.58.5:19333 2017.02.23 11:28:56 LOG6[2]: failover: round-robin, starting at entry #1 2017.02.23 11:28:56 LOG6[2]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:28:56 LOG7[2]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:28:56 LOG5[2]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:28:56 LOG5[2]: Service [uwo2local] connected remote server from 127.0.0.1:33134 2017.02.23 11:28:56 LOG7[2]: Option TCP_NODELAY set on remote socket 2017.02.23 11:28:56 LOG7[2]: Remote descriptor (FD=9) initialized 2017.02.23 11:28:56 LOG7[2]: RFC 2487 not detected 2017.02.23 11:28:56 LOG6[2]: Peer certificate not required 2017.02.23 11:28:56 LOG7[2]: TLS state (accept): before SSL initialization 2017.02.23 11:28:56 LOG3[2]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:28:56 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:56 LOG7[2]: Remote descriptor (FD=9) closed 2017.02.23 11:28:56 LOG7[2]: Local descriptor (FD=3) closed 2017.02.23 11:28:56 LOG7[2]: Service [uwo2local] finished (0 left) 2017.02.23 11:28:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:28:56 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33134 2017.02.23 11:28:56 LOG7[3]: Service [local2o365] started 2017.02.23 11:28:56 LOG3[3]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:28:56 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:56 LOG7[3]: Local descriptor (FD=3) closed 2017.02.23 11:28:56 LOG7[3]: Service [local2o365] finished (0 left) 2017.02.23 11:29:01 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:01 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:01 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:46315 2017.02.23 11:29:01 LOG7[4]: Service [uwo2local] started 2017.02.23 11:29:01 LOG7[4]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:01 LOG5[4]: Service [uwo2local] accepted connection from 172.18.58.5:46315 2017.02.23 11:29:01 LOG6[4]: failover: round-robin, starting at entry #0 2017.02.23 11:29:01 LOG6[4]: s_connect: connecting ::1:20587 2017.02.23 11:29:01 LOG7[4]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:01 LOG3[4]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:01 LOG6[4]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:01 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:01 LOG5[4]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:01 LOG5[4]: Service [uwo2local] connected remote server from 127.0.0.1:33138 2017.02.23 11:29:01 LOG7[4]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:01 LOG7[4]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:01 LOG7[4]: RFC 2487 not detected 2017.02.23 11:29:01 LOG6[4]: Peer certificate not required 2017.02.23 11:29:01 LOG7[4]: TLS state (accept): before SSL initialization 2017.02.23 11:29:01 LOG3[4]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:01 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:01 LOG7[4]: Remote descriptor (FD=9) closed 2017.02.23 11:29:01 LOG7[4]: Local descriptor (FD=3) closed 2017.02.23 11:29:01 LOG7[4]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:01 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:01 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:01 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33138 2017.02.23 11:29:01 LOG7[5]: Service [local2o365] started 2017.02.23 11:29:01 LOG3[5]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:01 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:01 LOG7[5]: Local descriptor (FD=3) closed 2017.02.23 11:29:01 LOG7[5]: Service [local2o365] finished (0 left) 2017.02.23 11:29:06 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:06 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:06 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:55003 2017.02.23 11:29:06 LOG7[6]: Service [uwo2local] started 2017.02.23 11:29:06 LOG7[6]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:06 LOG5[6]: Service [uwo2local] accepted connection from 172.18.58.5:55003 2017.02.23 11:29:06 LOG6[6]: failover: round-robin, starting at entry #1 2017.02.23 11:29:06 LOG6[6]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:06 LOG7[6]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:06 LOG5[6]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:06 LOG5[6]: Service [uwo2local] connected remote server from 127.0.0.1:33140 2017.02.23 11:29:06 LOG7[6]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:06 LOG7[6]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:06 LOG7[6]: RFC 2487 not detected 2017.02.23 11:29:06 LOG6[6]: Peer certificate not required 2017.02.23 11:29:06 LOG7[6]: TLS state (accept): before SSL initialization 2017.02.23 11:29:06 LOG3[6]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:06 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:06 LOG7[6]: Remote descriptor (FD=9) closed 2017.02.23 11:29:06 LOG7[6]: Local descriptor (FD=3) closed 2017.02.23 11:29:06 LOG7[6]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:06 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:06 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:06 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33140 2017.02.23 11:29:06 LOG7[7]: Service [local2o365] started 2017.02.23 11:29:06 LOG3[7]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:06 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:06 LOG7[7]: Local descriptor (FD=3) closed 2017.02.23 11:29:06 LOG7[7]: Service [local2o365] finished (0 left) 2017.02.23 11:29:11 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:11 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:11 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:52586 2017.02.23 11:29:11 LOG7[8]: Service [uwo2local] started 2017.02.23 11:29:11 LOG7[8]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:11 LOG5[8]: Service [uwo2local] accepted connection from 172.18.58.5:52586 2017.02.23 11:29:11 LOG6[8]: failover: round-robin, starting at entry #0 2017.02.23 11:29:11 LOG6[8]: s_connect: connecting ::1:20587 2017.02.23 11:29:11 LOG7[8]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:11 LOG3[8]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:11 LOG6[8]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:11 LOG7[8]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:11 LOG5[8]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:11 LOG5[8]: Service [uwo2local] connected remote server from 127.0.0.1:33144 2017.02.23 11:29:11 LOG7[8]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:11 LOG7[8]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:11 LOG7[8]: RFC 2487 not detected 2017.02.23 11:29:11 LOG6[8]: Peer certificate not required 2017.02.23 11:29:11 LOG7[8]: TLS state (accept): before SSL initialization 2017.02.23 11:29:11 LOG3[8]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:11 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:11 LOG7[8]: Remote descriptor (FD=9) closed 2017.02.23 11:29:11 LOG7[8]: Local descriptor (FD=3) closed 2017.02.23 11:29:11 LOG7[8]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:11 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:11 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:11 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33144 2017.02.23 11:29:11 LOG7[9]: Service [local2o365] started 2017.02.23 11:29:11 LOG3[9]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:11 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:11 LOG7[9]: Local descriptor (FD=3) closed 2017.02.23 11:29:11 LOG7[9]: Service [local2o365] finished (0 left) 2017.02.23 11:29:16 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:16 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:16 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:60425 2017.02.23 11:29:16 LOG7[10]: Service [uwo2local] started 2017.02.23 11:29:16 LOG7[10]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:16 LOG5[10]: Service [uwo2local] accepted connection from 172.18.58.5:60425 2017.02.23 11:29:16 LOG6[10]: failover: round-robin, starting at entry #1 2017.02.23 11:29:16 LOG6[10]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:16 LOG7[10]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:16 LOG5[10]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:16 LOG5[10]: Service [uwo2local] connected remote server from 127.0.0.1:33146 2017.02.23 11:29:16 LOG7[10]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:16 LOG7[10]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:16 LOG7[10]: RFC 2487 not detected 2017.02.23 11:29:16 LOG6[10]: Peer certificate not required 2017.02.23 11:29:16 LOG7[10]: TLS state (accept): before SSL initialization 2017.02.23 11:29:16 LOG3[10]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:16 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:16 LOG7[10]: Remote descriptor (FD=9) closed 2017.02.23 11:29:16 LOG7[10]: Local descriptor (FD=3) closed 2017.02.23 11:29:16 LOG7[10]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:16 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:16 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:16 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33146 2017.02.23 11:29:16 LOG7[11]: Service [local2o365] started 2017.02.23 11:29:16 LOG3[11]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:16 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:16 LOG7[11]: Local descriptor (FD=3) closed 2017.02.23 11:29:16 LOG7[11]: Service [local2o365] finished (0 left) 2017.02.23 11:29:21 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:21 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:21 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:50381 2017.02.23 11:29:21 LOG7[12]: Service [uwo2local] started 2017.02.23 11:29:21 LOG7[12]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:21 LOG5[12]: Service [uwo2local] accepted connection from 172.18.58.5:50381 2017.02.23 11:29:21 LOG6[12]: failover: round-robin, starting at entry #0 2017.02.23 11:29:21 LOG6[12]: s_connect: connecting ::1:20587 2017.02.23 11:29:21 LOG7[12]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:21 LOG3[12]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:21 LOG6[12]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:21 LOG7[12]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:21 LOG5[12]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:21 LOG5[12]: Service [uwo2local] connected remote server from 127.0.0.1:33150 2017.02.23 11:29:21 LOG7[12]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:21 LOG7[12]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:21 LOG7[12]: RFC 2487 not detected 2017.02.23 11:29:21 LOG6[12]: Peer certificate not required 2017.02.23 11:29:21 LOG7[12]: TLS state (accept): before SSL initialization 2017.02.23 11:29:21 LOG3[12]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:21 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:21 LOG7[12]: Remote descriptor (FD=9) closed 2017.02.23 11:29:21 LOG7[12]: Local descriptor (FD=3) closed 2017.02.23 11:29:21 LOG7[12]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:21 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:21 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:21 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33150 2017.02.23 11:29:21 LOG7[13]: Service [local2o365] started 2017.02.23 11:29:21 LOG3[13]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:21 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:21 LOG7[13]: Local descriptor (FD=3) closed 2017.02.23 11:29:21 LOG7[13]: Service [local2o365] finished (0 left) 2017.02.23 11:29:26 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:26 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:26 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:7384 2017.02.23 11:29:26 LOG7[14]: Service [uwo2local] started 2017.02.23 11:29:26 LOG7[14]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:26 LOG5[14]: Service [uwo2local] accepted connection from 172.18.58.5:7384 2017.02.23 11:29:26 LOG6[14]: failover: round-robin, starting at entry #1 2017.02.23 11:29:26 LOG6[14]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:26 LOG7[14]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:26 LOG5[14]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:26 LOG5[14]: Service [uwo2local] connected remote server from 127.0.0.1:33152 2017.02.23 11:29:26 LOG7[14]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:26 LOG7[14]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:26 LOG7[14]: RFC 2487 not detected 2017.02.23 11:29:26 LOG6[14]: Peer certificate not required 2017.02.23 11:29:26 LOG7[14]: TLS state (accept): before SSL initialization 2017.02.23 11:29:26 LOG3[14]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:26 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:26 LOG7[14]: Remote descriptor (FD=9) closed 2017.02.23 11:29:26 LOG7[14]: Local descriptor (FD=3) closed 2017.02.23 11:29:26 LOG7[14]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:26 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:26 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:26 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33152 2017.02.23 11:29:26 LOG7[15]: Service [local2o365] started 2017.02.23 11:29:26 LOG3[15]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:26 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:26 LOG7[15]: Local descriptor (FD=3) closed 2017.02.23 11:29:26 LOG7[15]: Service [local2o365] finished (0 left) 2017.02.23 11:29:31 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:31 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:31 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:40920 2017.02.23 11:29:31 LOG7[16]: Service [uwo2local] started 2017.02.23 11:29:31 LOG7[16]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:31 LOG5[16]: Service [uwo2local] accepted connection from 172.18.58.5:40920 2017.02.23 11:29:31 LOG6[16]: failover: round-robin, starting at entry #0 2017.02.23 11:29:31 LOG6[16]: s_connect: connecting ::1:20587 2017.02.23 11:29:31 LOG7[16]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:31 LOG3[16]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:31 LOG6[16]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:31 LOG7[16]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:31 LOG5[16]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:31 LOG5[16]: Service [uwo2local] connected remote server from 127.0.0.1:33156 2017.02.23 11:29:31 LOG7[16]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:31 LOG7[16]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:31 LOG7[16]: RFC 2487 not detected 2017.02.23 11:29:31 LOG6[16]: Peer certificate not required 2017.02.23 11:29:31 LOG7[16]: TLS state (accept): before SSL initialization 2017.02.23 11:29:31 LOG3[16]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:31 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:31 LOG7[16]: Remote descriptor (FD=9) closed 2017.02.23 11:29:31 LOG7[16]: Local descriptor (FD=3) closed 2017.02.23 11:29:31 LOG7[16]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:31 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:31 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:31 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33156 2017.02.23 11:29:31 LOG7[17]: Service [local2o365] started 2017.02.23 11:29:31 LOG3[17]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:31 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:31 LOG7[17]: Local descriptor (FD=3) closed 2017.02.23 11:29:31 LOG7[17]: Service [local2o365] finished (0 left) 2017.02.23 11:29:36 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:36 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:36 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:23632 2017.02.23 11:29:36 LOG7[18]: Service [uwo2local] started 2017.02.23 11:29:36 LOG7[18]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:36 LOG5[18]: Service [uwo2local] accepted connection from 172.18.58.5:23632 2017.02.23 11:29:36 LOG6[18]: failover: round-robin, starting at entry #1 2017.02.23 11:29:36 LOG6[18]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:36 LOG7[18]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:36 LOG5[18]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:36 LOG5[18]: Service [uwo2local] connected remote server from 127.0.0.1:33158 2017.02.23 11:29:36 LOG7[18]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:36 LOG7[18]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:36 LOG7[18]: RFC 2487 not detected 2017.02.23 11:29:36 LOG6[18]: Peer certificate not required 2017.02.23 11:29:36 LOG7[18]: TLS state (accept): before SSL initialization 2017.02.23 11:29:36 LOG3[18]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:36 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:36 LOG7[18]: Remote descriptor (FD=9) closed 2017.02.23 11:29:36 LOG7[18]: Local descriptor (FD=3) closed 2017.02.23 11:29:36 LOG7[18]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:36 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:36 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:36 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33158 2017.02.23 11:29:36 LOG7[19]: Service [local2o365] started 2017.02.23 11:29:36 LOG3[19]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:36 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:36 LOG7[19]: Local descriptor (FD=3) closed 2017.02.23 11:29:36 LOG7[19]: Service [local2o365] finished (0 left) 2017.02.23 11:29:41 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:41 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:41 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:2134 2017.02.23 11:29:41 LOG7[20]: Service [uwo2local] started 2017.02.23 11:29:41 LOG7[20]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:41 LOG5[20]: Service [uwo2local] accepted connection from 172.18.58.5:2134 2017.02.23 11:29:41 LOG6[20]: failover: round-robin, starting at entry #0 2017.02.23 11:29:41 LOG6[20]: s_connect: connecting ::1:20587 2017.02.23 11:29:41 LOG7[20]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:41 LOG3[20]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:41 LOG6[20]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:41 LOG7[20]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:41 LOG5[20]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:41 LOG5[20]: Service [uwo2local] connected remote server from 127.0.0.1:33162 2017.02.23 11:29:41 LOG7[20]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:41 LOG7[20]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:41 LOG7[20]: RFC 2487 not detected 2017.02.23 11:29:41 LOG6[20]: Peer certificate not required 2017.02.23 11:29:41 LOG7[20]: TLS state (accept): before SSL initialization 2017.02.23 11:29:41 LOG3[20]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:41 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:41 LOG7[20]: Remote descriptor (FD=9) closed 2017.02.23 11:29:41 LOG7[20]: Local descriptor (FD=3) closed 2017.02.23 11:29:41 LOG7[20]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:41 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:41 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:41 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33162 2017.02.23 11:29:41 LOG7[21]: Service [local2o365] started 2017.02.23 11:29:41 LOG3[21]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:41 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:41 LOG7[21]: Local descriptor (FD=3) closed 2017.02.23 11:29:41 LOG7[21]: Service [local2o365] finished (0 left) 2017.02.23 11:29:46 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:46 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:46 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:4464 2017.02.23 11:29:46 LOG7[22]: Service [uwo2local] started 2017.02.23 11:29:46 LOG7[22]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:46 LOG5[22]: Service [uwo2local] accepted connection from 172.18.58.5:4464 2017.02.23 11:29:46 LOG6[22]: failover: round-robin, starting at entry #1 2017.02.23 11:29:46 LOG6[22]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:46 LOG7[22]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:46 LOG5[22]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:46 LOG5[22]: Service [uwo2local] connected remote server from 127.0.0.1:33164 2017.02.23 11:29:46 LOG7[22]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:46 LOG7[22]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:46 LOG7[22]: RFC 2487 not detected 2017.02.23 11:29:46 LOG6[22]: Peer certificate not required 2017.02.23 11:29:46 LOG7[22]: TLS state (accept): before SSL initialization 2017.02.23 11:29:46 LOG3[22]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:46 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:46 LOG7[22]: Remote descriptor (FD=9) closed 2017.02.23 11:29:46 LOG7[22]: Local descriptor (FD=3) closed 2017.02.23 11:29:46 LOG7[22]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:46 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:46 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:46 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33164 2017.02.23 11:29:46 LOG7[23]: Service [local2o365] started 2017.02.23 11:29:46 LOG3[23]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:46 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:46 LOG7[23]: Local descriptor (FD=3) closed 2017.02.23 11:29:46 LOG7[23]: Service [local2o365] finished (0 left) 2017.02.23 11:29:51 LOG5[cron]: DH parameters updated 2017.02.23 11:29:51 LOG6[cron]: Cron jobs completed in 63 seconds 2017.02.23 11:29:51 LOG7[cron]: Waiting 86337 seconds 2017.02.23 11:29:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:51 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:28318 2017.02.23 11:29:51 LOG7[24]: Service [uwo2local] started 2017.02.23 11:29:51 LOG7[24]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:51 LOG5[24]: Service [uwo2local] accepted connection from 172.18.58.5:28318 2017.02.23 11:29:51 LOG6[24]: failover: round-robin, starting at entry #0 2017.02.23 11:29:51 LOG6[24]: s_connect: connecting ::1:20587 2017.02.23 11:29:51 LOG7[24]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:51 LOG3[24]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:51 LOG6[24]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:51 LOG7[24]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:51 LOG5[24]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:51 LOG5[24]: Service [uwo2local] connected remote server from 127.0.0.1:33168 2017.02.23 11:29:51 LOG7[24]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:51 LOG7[24]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:51 LOG7[24]: RFC 2487 not detected 2017.02.23 11:29:51 LOG6[24]: Peer certificate not required 2017.02.23 11:29:51 LOG7[24]: TLS state (accept): before SSL initialization 2017.02.23 11:29:51 LOG3[24]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:51 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:51 LOG7[24]: Remote descriptor (FD=9) closed 2017.02.23 11:29:51 LOG7[24]: Local descriptor (FD=3) closed 2017.02.23 11:29:51 LOG7[24]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:51 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33168 2017.02.23 11:29:51 LOG7[25]: Service [local2o365] started 2017.02.23 11:29:51 LOG3[25]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:51 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:51 LOG7[25]: Local descriptor (FD=3) closed 2017.02.23 11:29:51 LOG7[25]: Service [local2o365] finished (0 left) 2017.02.23 11:29:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:56 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:32441 2017.02.23 11:29:56 LOG7[26]: Service [uwo2local] started 2017.02.23 11:29:56 LOG7[26]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:56 LOG5[26]: Service [uwo2local] accepted connection from 172.18.58.5:32441 2017.02.23 11:29:56 LOG6[26]: failover: round-robin, starting at entry #1 2017.02.23 11:29:56 LOG6[26]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:56 LOG7[26]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:56 LOG5[26]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:56 LOG5[26]: Service [uwo2local] connected remote server from 127.0.0.1:33170 2017.02.23 11:29:56 LOG7[26]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:56 LOG7[26]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:56 LOG7[26]: RFC 2487 not detected 2017.02.23 11:29:56 LOG6[26]: Peer certificate not required 2017.02.23 11:29:56 LOG7[26]: TLS state (accept): before SSL initialization 2017.02.23 11:29:56 LOG3[26]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:56 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:56 LOG7[26]: Remote descriptor (FD=9) closed 2017.02.23 11:29:56 LOG7[26]: Local descriptor (FD=3) closed 2017.02.23 11:29:56 LOG7[26]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:56 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33170 2017.02.23 11:29:56 LOG7[27]: Service [local2o365] started 2017.02.23 11:29:56 LOG3[27]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:56 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:56 LOG7[27]: Local descriptor (FD=3) closed 2017.02.23 11:29:56 LOG7[27]: Service [local2o365] finished (0 left) 2017.02.23 11:30:00 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:30:00 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:30:00 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 129.100.6.17:16594 2017.02.23 11:30:00 LOG7[28]: Service [uwo2local] started 2017.02.23 11:30:00 LOG7[28]: Option TCP_NODELAY set on local socket 2017.02.23 11:30:00 LOG5[28]: Service [uwo2local] accepted connection from 129.100.6.17:16594 2017.02.23 11:30:00 LOG6[28]: failover: round-robin, starting at entry #0 2017.02.23 11:30:00 LOG6[28]: s_connect: connecting ::1:20587 2017.02.23 11:30:00 LOG7[28]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:30:00 LOG3[28]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:30:00 LOG6[28]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:30:00 LOG7[28]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:30:00 LOG5[28]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:30:00 LOG5[28]: Service [uwo2local] connected remote server from 127.0.0.1:33176 2017.02.23 11:30:00 LOG7[28]: Option TCP_NODELAY set on remote socket 2017.02.23 11:30:00 LOG7[28]: Remote descriptor (FD=9) initialized 2017.02.23 11:30:00 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:30:00 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:30:00 LOG7[ui]: Service [local2o365] accepted (FD=10) from 127.0.0.1:33176 2017.02.23 11:30:00 LOG7[29]: Service [local2o365] started 2017.02.23 11:30:00 LOG7[29]: Option TCP_NODELAY set on local socket 2017.02.23 11:30:00 LOG5[29]: Service [local2o365] accepted connection from 127.0.0.1:33176 2017.02.23 11:30:00 LOG6[29]: failover: round-robin, starting at entry #13 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:405:4a::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:405:4a::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:3:11e::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:3:11e::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:404:56::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:404:56::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 40.97.132.210:587 2017.02.23 11:30:00 LOG7[29]: s_connect: s_poll_wait 40.97.132.210:587: waiting 10 seconds 2017.02.23 11:30:00 LOG5[29]: s_connect: connected 40.97.132.210:587 2017.02.23 11:30:00 LOG5[29]: Service [local2o365] connected remote server from 172.18.58.248:52538 2017.02.23 11:30:00 LOG7[29]: Option TCP_NODELAY set on remote socket 2017.02.23 11:30:00 LOG7[29]: Remote descriptor (FD=11) initialized 2017.02.23 11:30:00 LOG7[29]: <- 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: -> 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: -> EHLO localhost 2017.02.23 11:30:00 LOG7[28]: RFC 2487 detected 2017.02.23 11:30:00 LOG7[28]: <- 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[28]: -> 220 MWHPR2001CA0006.outlook.office365.com stunnel for Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: <- 250-MWHPR2001CA0006.outlook.office365.com Hello [129.100.1.192] 2017.02.23 11:30:00 LOG7[29]: <- 250-SIZE 157286400 2017.02.23 11:30:00 LOG7[29]: <- 250-PIPELINING 2017.02.23 11:30:00 LOG7[29]: <- 250-DSN 2017.02.23 11:30:00 LOG7[29]: <- 250-ENHANCEDSTATUSCODES 2017.02.23 11:30:00 LOG7[29]: <- 250-STARTTLS 2017.02.23 11:30:00 LOG7[29]: <- 250-8BITMIME 2017.02.23 11:30:00 LOG7[29]: <- 250-BINARYMIME 2017.02.23 11:30:00 LOG7[29]: <- 250-CHUNKING 2017.02.23 11:30:00 LOG7[29]: <- 250 SMTPUTF8 2017.02.23 11:30:00 LOG7[29]: -> STARTTLS 2017.02.23 11:30:00 LOG7[29]: <- 220 2.0.0 SMTP server ready 2017.02.23 11:30:00 LOG6[29]: SNI: sending servername: smtp.office365.com 2017.02.23 11:30:00 LOG6[29]: Peer certificate required 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): before SSL initialization 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS write client hello 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS write client hello 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS read server hello 2017.02.23 11:30:00 LOG7[29]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2017.02.23 11:30:00 LOG4[29]: CERT: Pre-verification error: unable to get local issuer certificate 2017.02.23 11:30:00 LOG4[29]: Rejected by CERT at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2017.02.23 11:30:00 LOG7[29]: Remove session callback 2017.02.23 11:30:00 LOG7[29]: Deallocating application specific data for addr index 2017.02.23 11:30:00 LOG7[29]: TLS alert (write): fatal: unknown CA 2017.02.23 11:30:00 LOG3[29]: SSL_connect: 1416F086: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed 2017.02.23 11:30:00 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:30:00 LOG7[29]: Deallocating application specific data for addr index Segmentation fault [root@mtar1 stunnel]# *Andrew Culver* System Administrator Information Technology Services <https://www.uwo.ca/its> University of Western Ontario <https://www.uwo.ca> e: aculver(a)uwo.ca p: 519-661-2111 x80265 <15196612111,80265> cal: html <http://goo.gl/wVoDlo> | ics <http://goo.gl/ncUjV0>

1 0

Bad Magic
by Melzer, Jacob 21 Feb '17

21 Feb '17

I'm trying to do a proof of concept using Stunnel on AIX 6.1. Without stunnel I'd have: Telnet session -> listening service With stunnel, I want: telnet session -> stunnel client -[secure connection]--> Stunnel server -->listening service. The stunnel client seems to be working fine, but the stunnel server abends as soon as it receives a secure connection. Client: Accepts non-secure on port 33342. Forwards to secure socket 33343 stunnel stunnel.conf.2 2017.02.21 09:31:35 LOG5[ui]: stunnel 5.40 on powerpc-ibm-aix6.1.0.0 platform 2017.02.21 09:31:35 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 2017.02.21 09:31:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.21 09:31:35 LOG5[ui]: Reading configuration from file /bmo/stunnel/bin/stunnel.conf.2 2017.02.21 09:31:35 LOG5[ui]: UTF-8 byte order mark detected 2017.02.21 09:31:35 LOG5[ui]: FIPS mode disabled 2017.02.21 09:31:35 LOG6[ui]: Initializing service [hif] 2017.02.21 09:31:35 LOG6[ui]: Loading certificate from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Certificate loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Loading private key from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG4[ui]: Insecure file permissions on /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Private key loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG4[ui]: Service [hif] needs authentication to prevent MITM attacks 2017.02.21 09:31:35 LOG5[ui]: Configuration successful 2017.02.21 09:31:38 LOG5[0]: Service [hif] accepted connection from 127.0.0.1:34749 2017.02.21 09:31:38 LOG6[0]: s_connect: connecting 127.0.0.1:33343 2017.02.21 09:31:38 LOG6[0]: s_connect: connected 127.0.0.1:33343 2017.02.21 09:31:38 LOG5[0]: Service [hif] connected remote server from 127.0.0.1:34750 2017.02.21 09:31:38 LOG6[0]: SNI: sending servername: localhost 2017.02.21 09:31:38 LOG6[0]: Peer certificate not required 2017.02.21 09:31:38 LOG3[0]: SSL_connect: Peer suddenly disconnected 2017.02.21 09:31:38 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Server Accepts SSL connections on port 33343, connects to a non-secure service. stunnel stunnel.conf.1 2017.02.21 09:31:25 LOG5[ui]: stunnel 5.40 on powerpc-ibm-aix6.1.0.0 platform 2017.02.21 09:31:25 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 2017.02.21 09:31:25 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.21 09:31:25 LOG5[ui]: Reading configuration from file /bmo/stunnel/bin/stunnel.conf.1 2017.02.21 09:31:25 LOG5[ui]: UTF-8 byte order mark detected 2017.02.21 09:31:25 LOG5[ui]: FIPS mode disabled 2017.02.21 09:31:25 LOG6[ui]: Initializing service [hif] 2017.02.21 09:31:25 LOG6[ui]: Loading certificate from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Certificate loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Loading private key from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG4[ui]: Insecure file permissions on /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Private key loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG5[ui]: Configuration successful 2017.02.21 09:31:38 LOG5[0]: Service [hif] accepted connection from 127.0.0.1:34750 2017.02.21 09:31:38 LOG6[0]: Peer certificate not required INTERNAL ERROR: Bad magic at OpenSSL, line 0 (this is an abend - core file gets created). log file exactly matches the standard output. Any idea what's going wrong here? dbx of the core file: tbs@netcbccadvwvr01 /bmo/hif/stunnel-5.40/src>dbx /bmo/stunnel/bin/stunnel core Type 'help' for help. [using memory image in core] reading symbolic information ... IOT/Abort trap in abort at 0xd01af1f8 ($t3) 0xd01af1f8 (abort+0xf8) 80410014 lwz r2,0x14(r1) (dbx) where abort() at 0xd01af1f8 fatal_debug(txt = "Bad magic", file = "OpenSSL", line = 0), line 359 in "log.c" get_alloc_list_ptr(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 399 in "str.c" str_detach_debug(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 348 in "str.c" str_free_debug(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 383 in "str.c" free_function(ptr = 0x2007e1c8), line 191 in "tls.c" mem.CRYPTO_free() at 0xd97dd8d8 bn_lib.bn_expand2@AF37_5() at 0xd97e8da4 bn_mont.BN_mod_mul_montgomery() at 0xd981e150 ecp_mont.ec_GFp_mont_field_mul() at 0xd9837a18 ecp_smpl.ec_GFp_simple_point_get_affine_coordinates() at 0xd9839890 ec_lib.EC_POINT_get_affine_coordinates_GFp() at 0xd9a81dfc ecp_oct.ec_GFp_simple_point2oct() at 0xd9acc0d4 ec_oct.EC_POINT_point2oct() at 0xd9acb754 ssl3_send_server_key_exchange() at 0xd99e7c28 ssl3_accept() at 0xd99e9950 SSL_accept() at 0xd99c0b98 ssl23_get_client_hello() at 0xd9a003f4 ssl23_accept() at 0xd9a00c5c SSL_accept() at 0xd99c0b98 ssl_start(c = 0x20084cb8), line 431 in "client.c" client_try(c = 0x20084cb8), line 273 in "client.c" client_run(c = 0x20084cb8), line 181 in "client.c" client_main(c = 0x20084cb8), line 140 in "client.c" client_thread(arg = 0x20084cb8), line 99 in "client.c" (dbx) thread thread state-k wchan state-u k-tid mode held scope function $t1 run running 26279997 u no sys __fd_poll $t2 run running 45088879 u no sys _p_nsleep >$t3 run running 19070997 k no sys abort (dbx) list free_function 186 187 #if OPENSSL_VERSION_NUMBER<0x10100000L 188 NOEXPORT void free_function(void *ptr) { 189 /* CRYPTO_set_mem_ex_functions() needs a function rather than a macro */ 190 /* unfortunately, OpenSSL provides no file:line information here */ 191 str_free_debug(ptr, "OpenSSL", 0); 192 } 193 #endif 194 195 /* end of tls.c */ Should I be concerned that it looks like it is executing "free_function" from within an if statement "if OPENSSL_VERSION_NUMBER<0x1010000L but my openssl version is 2017.02.21 09:31:35 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 Troubleshooting so far: - I had the same problem with earlier versions of openssl. - I've tried this with 5.37 as well (based on Brian McGinity's post from a few days ago), but get the same error. Jacob

1 0

stunnel on Windows Client: Changing active network interface (wired, wireless)
by b.koch.kemper 17 Feb '17

17 Feb '17

Dear stunnel community, we are running an application on our windows clients. The application needs a remote connection to our server (linux) for remote function calls. We could successfully secure this connection via stunnel. However, when our windows users change their network connection (e.g. they disconnect their notebook from the docking station to our corporate wifi) the connection and hence the whole application breaks. The users actually have to restart stunnel to make the application work again, which is really inconvenient. As the application on the notebook is always using the same port, is it somehow possible to make stunnel establish a new connection using the new active network interface? Kind regards, Bernhard

1 0

RSA too big problem
by Vikrant Agarwal 16 Feb '17

16 Feb '17

Hi, I upgraded my Stunnel server machine to CentOS 6.8 and post upgrade , the stunnel too got upgraded to stunnel 4.29 on x86_64-redhat-linux-gnu with OpenSSL 1.0.1e-fips 11 Feb 2013 . Now since then many of the stunnel client using newer stunnel client (those uses TLSv1.2 for Negotiation) are not able to connect . I get below error on the server in logs RSA_sign:digest too big for rsa key:rsa_sign’ How to fix this please? Regards, Vikrant

1 0

Re: [stunnel-users] Problem with 5.40 and Peer suddenly disconnected
by Brian McGinity 08 Feb '17

08 Feb '17

I found the archives and downgraded to 5.37 and this fixed the problem. Before going this route I tried 5.40 and 5.41 beta and both had the same issues with 'Peer suddenly disconnected'. Strange that it this was only happening for one particular connection (1 out of 7). It would happen with every test. If you would like for me to beta test another version, I would be happy to try. Bran

1 0

Problem with 5.40 and Peer suddenly disconnected
by Brian McGinity 07 Feb '17

07 Feb '17

After updating to stunnel 5.40 on x86-pc-msvc-1500 platform, I am getting a Peer suddenly disconnected each time I post data to a particular url. [VISION_WEB] client = yes accept = 127.0.0.1:1935 connect = xx.xx.web.com:443 sslVersion = TLSv1 2017.02.07 16:30:08 LOG5[160]: Service [XX_WEB] accepted connection from 192.168.100.21:53507 2017.02.07 16:30:08 LOG5[160]: s_connect: connected 11.11.111.36:443 2017.02.07 16:30:08 LOG5[160]: Service [XX_WEB] connected remote server from 192.168.100.21:53508 2017.02.07 16:30:08 LOG3[160]: SSL_connect: Peer suddenly disconnected 2017.02.07 16:30:08 LOG5[160]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is a production issue and is causing a lot of problems for a lot of people and I need to do something quickly. Is it possible to download stunnel 5.37 installed to see if going back to this version will fix this issue? Where is it? Or does anyone possibly know why this might be happening? Thank you for your help. Brian

1 0

Default passthrough to different destination?
by Mark Boyce 03 Feb '17

03 Feb '17

Hi All Wondering if there’s a way to pass an unencrypted connections traffic to an alternative location if a client does not SSL/TLS with the stunnel server? So considering stunnel running as a server to wrap an unencrypted SMTP server. If the SMTP client/server talks SSL/TLS all is good and as expected. If the client tries to talk without encryption it gets disconnect. Is there any way to send this traffic elsewhere rather than disconnecting the client? So that stunnel is adding an SSL/TLS option to a service rather than enforcing it. Splitting the traffic to destination servers based on if the client was encrypted or not. Thoughts? Thanks Mark

2 3

Mixed cert/PSKsecrets & TLS/SSL before proxy
by Varda Zklir 02 Feb '17

02 Feb '17

Hello Gentlemen. Needs help in configuration or negative clarifications on two issues. 1) First question whether is mixed use of cert/PSKsecrets auth possible? The same method (ether cert or PSKsecrets explicitly) serverside trough the parent [TLS] and inherited services works properly. But mixed cert/PSKsecrets like in config snippet below doesn't work. [TLS] client = no accept = 0.0.0.0:https connect = localhost:http cert = /etc/opt/stunnel/stunnel.pem [ssh] client = no sni = TLS:ssh connect = localhost:ssh [socks] client = no sni = TLS:socks protocol = socks PSKsecrets = /etc/opt/stunnel/auth/passwd The idea is to pass insensibly all incorrect or non-SNI aware requests to main http server and hide other multiplexed services. And at the same time to establish encryption and password access control to [socks] service. 2) And the second question is it possible proxy CONNECT after establishing SSL/TLS encryption? The configuration section: [ssh] accept = 22222 protocol = connect protocolHost = server.tld:443 protocolUsername = usernamehere protocolPassword = passwordhere connect = proxy.tld:8080 Say to establish unencrypted connection with proxy, pass username and password, tell proxy to establish CONNECT to target 443 and then transmit SSL/TLS to it. Goal is if I have SSL/TLS termination server/proxy on port 443 so we at first speak SSL/TLS with proxy and only then proceed to proxy requests phase. Thanks for future explanations.

1 0

installation problems
by HOFFMAN, GEOFFREY 30 Jan '17

30 Jan '17

I am having trouble installing stunnel on CentOS 7.3. I was given a directive to "use the latest OpenSSL" so on one target machine, it has 1.0.2k built from source. On the machine with OpenSSL 1.0.2k, when attempting to install stunnel, when I run ./configure, it passes with this info: configure: FIPS support not found Then make fails with: /usr/bin/ld: /usr/local/ssl/lib/libssl.a(s3_srvr.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC On another target machine, it has 1.0.1e-fips, installed via yum package. On the machine with OpenSSL 1.0.1e-fips, ./configure fails with: checking for TLS directory... not found configure: error: Could not find your TLS library installation dir Advice on installing with the latest OpenSSL (1.0.2k) would be much appreciated. This e-mail, including any attachments, is meant only for the intended recipient of the transmission, and may be a confidential communication or a communication privileged by law. If you received this e-mail in error, any review, use, dissemination, distribution, or copying of this e-mail is strictly prohibited. Please notify us immediately of the error by return e-mail and please delete this message from your system. Thank you in advance for your cooperation.

1 0

Life cycle information
by Ben Harper 30 Jan '17

30 Jan '17

Greetings, I am trying to confirm some life cycle information, mainly supported version(s) and what versions do not insure backwards compatibility. It would appear that only the latest version is supported, per the first item under 'Before you send your question to stunnel-users' on the Mailing Lists page[0]. Does this project use semantic versioning? Will incompatibilities only come when a 6.x.x version is released? It seems at one point this was the case per the 'Upgrading to stunnel 4' link on the Documentation page[1]. Are my assumptions correct? Thanks, Ben [0]: https://www.stunnel.org/lists.html [1]: https://www.stunnel.org/docs.html

1 0

Proxy one site to HTTPS?
by Jeffrey Walton 30 Jan '17

30 Jan '17

Hi Everyone, I'm having trouble setting up a proxy for one site. The client is MacPorts on OS X 10.5. It makes some requests for files over port 80, but they apparently need to be made over port 443. Also see https://trac.macports.org/ticket/53423 and https://trac.macports.org/ticket/53347. My first question is, is it possible to proxy one site to HTTPS? My second question is, how does one do so if it is possible? The concrete example from the 53423 bug report is, I need to proxy requests from http://distfiles.macports.org/... to https://distfiles.macports.org/... I also need the opposite on the responses. Thanks in advance, Jeff

1 0