- stunnel-users - stunnel.org

Looking for help - Stunnel works with Gmail but not with my provider
by Verberne, Pieter 31 Mar '12

31 Mar '12

Hello, I have successfully used stunnel with blat to send e-mails from my gmail accounts. Getting this to work with my new internet provider "Ziggo" in The Netherlands seems impossible, despite days spent on the internet searching for help and trying numerous configurations. Whatever I do, there is always this message: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Any help would be highly appreciated. Pieter Verberne PC: i7 OS: Windows 7 - 64bits Stunnel version: 4.53 When sending an e-mail from my PC with Thunderbird 2.0 I can successfully use TLS but not SSL. My provider says about secure smtp connections on their website: Outgoing mail server smtp.ziggo.nl (port number 587) Use of SSL (Secure Socket Layer) / TLS yes For this server is verification required / identity check yes User name your e-mail address Password your e-mail password Stunnel.conf: # GLOBAL OPTIONS debug = 7 output = D:\Pieter\Temp\stunnel-log.txt fips = no cert = stunnel.pem # SERVICE-LEVEL OPTIONS [SMTP Ziggo] client = yes options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1 accept = 587 connect = smtp.ziggo.nl:587 stunnel-log.txt: 2012.03.31 12:04:33 LOG7[2460:2516]: No limit detected for the number of clients 2012.03.31 12:04:33 LOG5[2460:2516]: stunnel 4.53 on x86-pc-mingw32-gnu platform 2012.03.31 12:04:33 LOG5[2460:2516]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.03.31 12:04:33 LOG5[2460:2516]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.03.31 12:04:33 LOG5[2460:2516]: Reading configuration from file stunnel.conf 2012.03.31 12:04:33 LOG5[2460:2516]: FIPS mode is disabled 2012.03.31 12:04:33 LOG7[2460:2516]: Compression not enabled 2012.03.31 12:04:34 LOG7[2460:2516]: Snagged 64 random bytes from C:/.rnd 2012.03.31 12:04:34 LOG7[2460:2516]: Wrote 1024 new random bytes to C:/.rnd 2012.03.31 12:04:34 LOG7[2460:2516]: PRNG seeded successfully 2012.03.31 12:04:34 LOG6[2460:2516]: Initializing service section [SMTP Ziggo] 2012.03.31 12:04:34 LOG7[2460:2516]: Certificate: stunnel.pem 2012.03.31 12:04:34 LOG7[2460:2516]: Certificate loaded 2012.03.31 12:04:34 LOG7[2460:2516]: Key file: stunnel.pem 2012.03.31 12:04:34 LOG7[2460:2516]: Private key loaded 2012.03.31 12:04:34 LOG7[2460:2516]: SSL options set: 0x03000004 2012.03.31 12:04:34 LOG5[2460:2516]: Configuration successful 2012.03.31 12:04:34 LOG7[2460:2516]: Service [SMTP Ziggo] (FD=308) bound to 0.0.0.0:587 2012.03.31 12:06:01 LOG7[2460:2516]: Service [SMTP Ziggo] accepted (FD=436) from 192.168.3.11:49195 2012.03.31 12:06:01 LOG7[2460:2516]: Creating a new thread 2012.03.31 12:06:01 LOG7[2460:2516]: New thread created 2012.03.31 12:06:01 LOG7[2460:3652]: Service [SMTP Ziggo] started 2012.03.31 12:06:01 LOG5[2460:3652]: Service [SMTP Ziggo] accepted connection from 192.168.3.11:49195 2012.03.31 12:06:01 LOG6[2460:3652]: connect_blocking: connecting 212.xx.xx.x:587 2012.03.31 12:06:01 LOG7[2460:3652]: connect_blocking: s_poll_wait 212.xx.xx.x:587: waiting 10 seconds 2012.03.31 12:06:01 LOG5[2460:3652]: connect_blocking: connected 212.xx.xx.x:587 2012.03.31 12:06:01 LOG5[2460:3652]: Service [SMTP Ziggo] connected remote server from 192.168.3.11:49196 2012.03.31 12:06:01 LOG7[2460:3652]: Remote socket (FD=460) initialized 2012.03.31 12:06:01 LOG3[2460:3652]: *SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number* 2012.03.31 12:06:01 LOG5[2460:3652]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.03.31 12:06:01 LOG7[2460:3652]: Remote socket (FD=460) closed 2012.03.31 12:06:01 LOG7[2460:3652]: Local socket (FD=436) closed 2012.03.31 12:06:01 LOG7[2460:3652]: Service [SMTP Ziggo] finished (0 left) 2012.03.31 12:18:01 LOG7[2460:2516]: Dispatching signals from the signal pipe 2012.03.31 12:18:04 LOG7[2460:2516]: Processing SIGNAL_TERMINATE

1 0

Re: [stunnel-users] stunnel 4.53 make error
by Scott McKeown 30 Mar '12

30 Mar '12

Hi Jose, That did it, thanks. Stupid thing is I check that I had OpenSSL but not the devel package. Mark one up for my stupidity (again). ~Yours, Scott On 30 March 2012 16:11, <josealf(a)rocketmail.com> wrote: > Scott, > > Most likely you don't have openssl-devel package installed. > > Regards > Jose > > -----Original Message----- > From: Scott McKeown <scott(a)loadbalancer.org> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Fri, 30 Mar 2012 16:00:45 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] stunnel 4.53 make error > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

stunnel 4.53 make error
by Scott McKeown 30 Mar '12

30 Mar '12

Hi Guys, Just tried to install stunnel-4.53 onto a virgin Cento6.2 x64 system with HAProxy (box is fully patched too), However, every time I runt the 'make' command I get the following output. I've had a bit of a hunt around but this is a little outside of both my comfort zone and my knowledge levels so any help would be great. [root@localhost ~]# cd /root/stunnel-4.53 [root@localhost stunnel-4.53]# make Making all in src make[1]: Entering directory `/root/stunnel-4.53/src' make all-am make[2]: Entering directory `/root/stunnel-4.53/src' gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c In file included from str.c:38: common.h:392:33: error: openssl/opensslconf.h: No such file or directory common.h:405:27: error: openssl/lhash.h: No such file or directory common.h:406:25: error: openssl/ssl.h: No such file or directory common.h:407:25: error: openssl/err.h: No such file or directory common.h:408:66: error: openssl/crypto.h: No such file or directory common.h:409:26: error: openssl/rand.h: No such file or directory common.h:411:25: error: openssl/md4.h: No such file or directory common.h:413:25: error: openssl/des.h: No such file or directory In file included from str.c:38: common.h:449: warning: return type defaults to ‘int’ common.h: In function ‘STACK_OF’: common.h:449: error: expected declaration specifiers before ‘*’ token In file included from str.c:39: prototypes.h:50: error: storage class specified for parameter ‘LOG_MODE’ prototypes.h:61: error: storage class specified for parameter ‘SOCKADDR_UNION’ prototypes.h:64: error: expected specifier-qualifier-list before ‘SOCKADDR_UNION’ prototypes.h:67: warning: struct has no members prototypes.h:67: error: storage class specified for parameter ‘SOCKADDR_LIST’ prototypes.h:72: error: storage class specified for parameter ‘COMP_TYPE’ prototypes.h:78: error: expected specifier-qualifier-list before ‘COMP_TYPE’ prototypes.h:114: warning: struct has no members prototypes.h:114: error: storage class specified for parameter ‘GLOBAL_OPTIONS’ prototypes.h:116: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘global_options’ prototypes.h:124: error: expected specifier-qualifier-list before ‘SSL_CTX’ prototypes.h:222: error: storage class specified for parameter ‘SERVICE_OPTIONS’ prototypes.h:224: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘service_options’ prototypes.h:236: error: storage class specified for parameter ‘VAL_TYPE’ prototypes.h:244: error: storage class specified for parameter ‘OPT_UNION’ prototypes.h:250: error: expected specifier-qualifier-list before ‘VAL_TYPE’ prototypes.h:252: error: storage class specified for parameter ‘SOCK_OPT’ prototypes.h:256: error: storage class specified for parameter ‘CONF_TYPE’ prototypes.h:269: error: storage class specified for parameter ‘s_poll_set’ prototypes.h:278: error: storage class specified for parameter ‘DISK_FILE’ prototypes.h:285: error: storage class specified for parameter ‘FD’ prototypes.h:290: error: storage class specified for parameter ‘max_clients’ prototypes.h:291: error: storage class specified for parameter ‘num_clients’ prototypes.h:327: warning: parameter names (without types) in function declaration prototypes.h:347: error: storage class specified for parameter ‘cli_index’ prototypes.h:347: error: storage class specified for parameter ‘opt_index’ prototypes.h:350: error: expected ‘)’ before ‘*’ token prototypes.h:355: error: expected declaration specifiers or ‘...’ before ‘CONF_TYPE’ prototypes.h:361: error: expected specifier-qualifier-list before ‘SERVICE_OPTIONS’ prototypes.h:363: warning: struct has no members prototypes.h:363: error: storage class specified for parameter ‘UI_DATA’ prototypes.h:365: error: expected ‘)’ before ‘*’ token prototypes.h:370: error: expected ‘)’ before ‘*’ token prototypes.h:374: error: expected declaration specifiers before ‘s_poll_set’ prototypes.h:375: error: expected ‘)’ before ‘*’ token prototypes.h:376: error: expected ‘)’ before ‘*’ token prototypes.h:377: error: expected ‘)’ before ‘*’ token prototypes.h:378: error: expected ‘)’ before ‘*’ token prototypes.h:379: error: expected ‘)’ before ‘*’ token prototypes.h:380: error: expected ‘)’ before ‘*’ token prototypes.h:381: error: expected ‘)’ before ‘*’ token prototypes.h:401: error: expected specifier-qualifier-list before ‘SSL’ prototypes.h:422: error: storage class specified for parameter ‘CLI’ prototypes.h:424: error: expected declaration specifiers before ‘CLI’ prototypes.h:426: error: expected ‘)’ before ‘*’ token prototypes.h:430: error: expected ‘)’ before ‘*’ token prototypes.h:431: error: expected ‘)’ before ‘*’ token prototypes.h:432: error: expected ‘)’ before ‘*’ token prototypes.h:433: error: expected ‘)’ before ‘*’ token prototypes.h:434: error: expected ‘)’ before ‘*’ token prototypes.h:436: error: expected ‘)’ before ‘*’ token prototypes.h:450: error: storage class specified for parameter ‘PROTOCOL_TYPE’ prototypes.h:453: error: expected ‘)’ before ‘*’ token prototypes.h:457: error: expected ‘)’ before ‘*’ token prototypes.h:458: error: expected ‘)’ before ‘*’ token prototypes.h:459: error: expected ‘)’ before ‘*’ token prototypes.h:460: error: expected ‘)’ before ‘*’ token prototypes.h:461: error: expected ‘)’ before ‘*’ token prototypes.h:462: warning: type defaults to ‘int’ in declaration of ‘SOCKADDR_UNION’ prototypes.h:462: error: expected ‘;’, ‘,’ or ‘)’ before ‘*’ token prototypes.h:493: error: storage class specified for parameter ‘SECTION_CODE’ prototypes.h:495: warning: parameter names (without types) in function declaration prototypes.h:496: warning: parameter names (without types) in function declaration prototypes.h:500: error: expected declaration specifiers or ‘...’ before ‘CLI’ prototypes.h:548: error: expected declaration specifiers before ‘DISK_FILE’ prototypes.h:550: error: expected declaration specifiers before ‘DISK_FILE’ prototypes.h:551: error: expected ‘)’ before ‘*’ token prototypes.h:552: error: expected ‘)’ before ‘*’ token prototypes.h:553: error: expected ‘)’ before ‘*’ token prototypes.h:563: error: expected ‘)’ before ‘*’ token str.c:49: error: storage class specified for parameter ‘canary’ str.c:50: error: storage class specified for parameter ‘canary_initialized’ str.c:50: error: parameter ‘canary_initialized’ is initialized str.c:52: error: storage class specified for parameter ‘ALLOC_LIST’ str.c:55: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:57: warning: struct has no members str.c:57: error: storage class specified for parameter ‘ALLOC_TLS’ str.c:60: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:67: warning: struct has no members str.c:59: warning: empty declaration str.c:73: error: expected ‘)’ before ‘*’ token str.c:74: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:75: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:77: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:85: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:95: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:157: error: storage class specified for parameter ‘pthread_key’ str.c:159: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:163: error: expected ‘)’ before ‘*’ token str.c:167: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:191: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:198: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:210: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:228: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:262: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:291: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:315: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:326: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token common.h:449: warning: type of ‘SSL_COMP’ defaults to ‘int’ str.c:157: error: declaration for parameter ‘pthread_key’ but no such parameter str.c:57: error: declaration for parameter ‘ALLOC_TLS’ but no such parameter str.c:52: error: declaration for parameter ‘ALLOC_LIST’ but no such parameter str.c:50: error: declaration for parameter ‘canary_initialized’ but no such parameter str.c:49: error: declaration for parameter ‘canary’ but no such parameter prototypes.h:581: error: declaration for parameter ‘str_printf’ but no such parameter prototypes.h:580: error: declaration for parameter ‘str_vprintf’ but no such parameter prototypes.h:579: error: declaration for parameter ‘str_dup’ but no such parameter prototypes.h:577: error: declaration for parameter ‘str_free_debug’ but no such parameter prototypes.h:575: error: declaration for parameter ‘str_detach_debug’ but no such parameter prototypes.h:573: error: declaration for parameter ‘str_realloc_debug’ but no such parameter prototypes.h:571: error: declaration for parameter ‘str_alloc_debug’ but no such parameter prototypes.h:570: error: declaration for parameter ‘str_stats’ but no such parameter prototypes.h:569: error: declaration for parameter ‘str_cleanup’ but no such parameter prototypes.h:568: error: declaration for parameter ‘str_canary_init’ but no such parameter prototypes.h:567: error: declaration for parameter ‘str_init’ but no such parameter prototypes.h:562: error: declaration for parameter ‘libwrap_init’ but no such parameter prototypes.h:500: error: declaration for parameter ‘create_client’ but no such parameter prototypes.h:499: error: declaration for parameter ‘stunnel_thread_id’ but no such parameter prototypes.h:498: error: declaration for parameter ‘stunnel_process_id’ but no such parameter prototypes.h:497: error: declaration for parameter ‘sthreads_init’ but no such parameter prototypes.h:496: error: declaration for parameter ‘leave_critical_section’ but no such parameter prototypes.h:495: error: declaration for parameter ‘enter_critical_section’ but no such parameter prototypes.h:493: error: declaration for parameter ‘SECTION_CODE’ but no such parameter prototypes.h:463: error: declaration for parameter ‘s_gai_strerror’ but no such parameter prototypes.h:452: error: declaration for parameter ‘find_protocol_id’ but no such parameter prototypes.h:450: error: declaration for parameter ‘PROTOCOL_TYPE’ but no such parameter prototypes.h:425: error: declaration for parameter ‘client_thread’ but no such parameter prototypes.h:422: error: declaration for parameter ‘CLI’ but no such parameter prototypes.h:395: error: declaration for parameter ‘make_sockets’ but no such parameter prototypes.h:394: error: declaration for parameter ‘get_socket_error’ but no such parameter prototypes.h:393: error: declaration for parameter ‘set_socket_options’ but no such parameter prototypes.h:366: error: declaration for parameter ‘sslerror’ but no such parameter prototypes.h:363: error: declaration for parameter ‘UI_DATA’ but no such parameter prototypes.h:356: error: declaration for parameter ‘apply_conf’ but no such parameter prototypes.h:355: error: declaration for parameter ‘parse_conf’ but no such parameter prototypes.h:354: error: declaration for parameter ‘parse_commandline’ but no such parameter prototypes.h:349: error: declaration for parameter ‘ssl_init’ but no such parameter prototypes.h:347: error: declaration for parameter ‘opt_index’ but no such parameter prototypes.h:347: error: declaration for parameter ‘cli_index’ but no such parameter prototypes.h:343: error: declaration for parameter ‘pty_allocate’ but no such parameter prototypes.h:339: error: declaration for parameter ‘s_strerror’ but no such parameter prototypes.h:338: error: declaration for parameter ‘log_error’ but no such parameter prototypes.h:337: error: declaration for parameter ‘sockerror’ but no such parameter prototypes.h:336: error: declaration for parameter ‘ioerror’ but no such parameter prototypes.h:334: error: declaration for parameter ‘fatal_debug’ but no such parameter prototypes.h:328: error: declaration for parameter ‘s_log’ but no such parameter prototypes.h:327: error: declaration for parameter ‘log_flush’ but no such parameter prototypes.h:326: error: declaration for parameter ‘log_close’ but no such parameter prototypes.h:325: error: declaration for parameter ‘log_open’ but no such parameter prototypes.h:323: error: declaration for parameter ‘syslog_close’ but no such parameter prototypes.h:322: error: declaration for parameter ‘syslog_open’ but no such parameter prototypes.h:317: error: declaration for parameter ‘set_nonblock’ but no such parameter prototypes.h:316: error: declaration for parameter ‘s_accept’ but no such parameter prototypes.h:315: error: declaration for parameter ‘s_socketpair’ but no such parameter prototypes.h:314: error: declaration for parameter ‘s_pipe’ but no such parameter prototypes.h:313: error: declaration for parameter ‘s_socket’ but no such parameter prototypes.h:311: error: declaration for parameter ‘get_limits’ but no such parameter prototypes.h:306: error: declaration for parameter ‘stunnel_info’ but no such parameter prototypes.h:304: error: declaration for parameter ‘child_status’ but no such parameter prototypes.h:302: error: declaration for parameter ‘signal_post’ but no such parameter prototypes.h:300: error: declaration for parameter ‘drop_privileges’ but no such parameter prototypes.h:298: error: declaration for parameter ‘bind_ports’ but no such parameter prototypes.h:297: error: declaration for parameter ‘unbind_ports’ but no such parameter prototypes.h:296: error: declaration for parameter ‘daemon_loop’ but no such parameter prototypes.h:295: error: declaration for parameter ‘main_configure’ but no such parameter prototypes.h:294: error: declaration for parameter ‘main_initialize’ but no such parameter prototypes.h:291: error: declaration for parameter ‘num_clients’ but no such parameter prototypes.h:290: error: declaration for parameter ‘max_clients’ but no such parameter prototypes.h:285: error: declaration for parameter ‘FD’ but no such parameter prototypes.h:278: error: declaration for parameter ‘DISK_FILE’ but no such parameter prototypes.h:269: error: declaration for parameter ‘s_poll_set’ but no such parameter prototypes.h:256: error: declaration for parameter ‘CONF_TYPE’ but no such parameter prototypes.h:252: error: declaration for parameter ‘SOCK_OPT’ but no such parameter prototypes.h:244: error: declaration for parameter ‘OPT_UNION’ but no such parameter prototypes.h:236: error: declaration for parameter ‘VAL_TYPE’ but no such parameter prototypes.h:222: error: declaration for parameter ‘SERVICE_OPTIONS’ but no such parameter prototypes.h:114: error: declaration for parameter ‘GLOBAL_OPTIONS’ but no such parameter prototypes.h:72: error: declaration for parameter ‘COMP_TYPE’ but no such parameter prototypes.h:67: error: declaration for parameter ‘SOCKADDR_LIST’ but no such parameter prototypes.h:61: error: declaration for parameter ‘SOCKADDR_UNION’ but no such parameter prototypes.h:50: error: declaration for parameter ‘LOG_MODE’ but no such parameter str.c:342: error: expected ‘{’ at end of input common.h:449: warning: unused parameter ‘SSL_COMP’ str.c:157: warning: unused parameter ‘pthread_key’ str.c:57: warning: unused parameter ‘ALLOC_TLS’ str.c:52: warning: unused parameter ‘ALLOC_LIST’ str.c:50: warning: unused parameter ‘canary_initialized’ str.c:49: warning: unused parameter ‘canary’ prototypes.h:581: warning: unused parameter ‘str_printf’ prototypes.h:580: warning: unused parameter ‘str_vprintf’ prototypes.h:579: warning: unused parameter ‘str_dup’ prototypes.h:577: warning: unused parameter ‘str_free_debug’ prototypes.h:575: warning: unused parameter ‘str_detach_debug’ prototypes.h:573: warning: unused parameter ‘str_realloc_debug’ prototypes.h:571: warning: unused parameter ‘str_alloc_debug’ prototypes.h:570: warning: unused parameter ‘str_stats’ prototypes.h:569: warning: unused parameter ‘str_cleanup’ prototypes.h:568: warning: unused parameter ‘str_canary_init’ prototypes.h:567: warning: unused parameter ‘str_init’ prototypes.h:562: warning: unused parameter ‘libwrap_init’ prototypes.h:500: warning: unused parameter ‘create_client’ prototypes.h:499: warning: unused parameter ‘stunnel_thread_id’ prototypes.h:498: warning: unused parameter ‘stunnel_process_id’ prototypes.h:497: warning: unused parameter ‘sthreads_init’ prototypes.h:496: warning: unused parameter ‘leave_critical_section’ prototypes.h:495: warning: unused parameter ‘enter_critical_section’ prototypes.h:493: warning: unused parameter ‘SECTION_CODE’ prototypes.h:463: warning: unused parameter ‘s_gai_strerror’ prototypes.h:452: warning: unused parameter ‘find_protocol_id’ prototypes.h:450: warning: unused parameter ‘PROTOCOL_TYPE’ prototypes.h:425: warning: unused parameter ‘client_thread’ prototypes.h:422: warning: unused parameter ‘CLI’ prototypes.h:395: warning: unused parameter ‘make_sockets’ prototypes.h:394: warning: unused parameter ‘get_socket_error’ prototypes.h:393: warning: unused parameter ‘set_socket_options’ prototypes.h:366: warning: unused parameter ‘sslerror’ prototypes.h:363: warning: unused parameter ‘UI_DATA’ prototypes.h:356: warning: unused parameter ‘apply_conf’ prototypes.h:355: warning: unused parameter ‘parse_conf’ prototypes.h:354: warning: unused parameter ‘parse_commandline’ prototypes.h:349: warning: unused parameter ‘ssl_init’ prototypes.h:347: warning: unused parameter ‘opt_index’ prototypes.h:347: warning: unused parameter ‘cli_index’ prototypes.h:343: warning: unused parameter ‘pty_allocate’ prototypes.h:339: warning: unused parameter ‘s_strerror’ prototypes.h:338: warning: unused parameter ‘log_error’ prototypes.h:337: warning: unused parameter ‘sockerror’ prototypes.h:336: warning: unused parameter ‘ioerror’ prototypes.h:334: warning: unused parameter ‘fatal_debug’ prototypes.h:328: warning: unused parameter ‘s_log’ prototypes.h:327: warning: unused parameter ‘log_flush’ prototypes.h:326: warning: unused parameter ‘log_close’ prototypes.h:325: warning: unused parameter ‘log_open’ prototypes.h:323: warning: unused parameter ‘syslog_close’ prototypes.h:322: warning: unused parameter ‘syslog_open’ prototypes.h:317: warning: unused parameter ‘set_nonblock’ prototypes.h:316: warning: unused parameter ‘s_accept’ prototypes.h:315: warning: unused parameter ‘s_socketpair’ prototypes.h:314: warning: unused parameter ‘s_pipe’ prototypes.h:313: warning: unused parameter ‘s_socket’ prototypes.h:311: warning: unused parameter ‘get_limits’ prototypes.h:306: warning: unused parameter ‘stunnel_info’ prototypes.h:304: warning: unused parameter ‘child_status’ prototypes.h:302: warning: unused parameter ‘signal_post’ prototypes.h:300: warning: unused parameter ‘drop_privileges’ prototypes.h:298: warning: unused parameter ‘bind_ports’ prototypes.h:297: warning: unused parameter ‘unbind_ports’ prototypes.h:296: warning: unused parameter ‘daemon_loop’ prototypes.h:295: warning: unused parameter ‘main_configure’ prototypes.h:294: warning: unused parameter ‘main_initialize’ prototypes.h:291: warning: unused parameter ‘num_clients’ prototypes.h:290: warning: unused parameter ‘max_clients’ prototypes.h:285: warning: unused parameter ‘FD’ prototypes.h:278: warning: unused parameter ‘DISK_FILE’ prototypes.h:269: warning: unused parameter ‘s_poll_set’ prototypes.h:256: warning: unused parameter ‘CONF_TYPE’ prototypes.h:252: warning: unused parameter ‘SOCK_OPT’ prototypes.h:244: warning: unused parameter ‘OPT_UNION’ prototypes.h:236: warning: unused parameter ‘VAL_TYPE’ prototypes.h:222: warning: unused parameter ‘SERVICE_OPTIONS’ prototypes.h:114: warning: unused parameter ‘GLOBAL_OPTIONS’ prototypes.h:72: warning: unused parameter ‘COMP_TYPE’ prototypes.h:67: warning: unused parameter ‘SOCKADDR_LIST’ prototypes.h:61: warning: unused parameter ‘SOCKADDR_UNION’ prototypes.h:50: warning: unused parameter ‘LOG_MODE’ make[2]: *** [stunnel-str.o] Error 1 make[2]: Leaving directory `/root/stunnel-4.53/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/stunnel-4.53/src' make: *** [all-recursive] Error 1 [root@localhost stunnel-4.53]# ~Yours, Scott

1 0

SNI with protocol=proxy ?
by Marek Majkowski 29 Mar '12

29 Mar '12

Hi, I'm having trouble using SNI with protocol=proxy. Stunnel seems to ignore protocol option defined in the 'children', for example now protocol will be ignored: [https_default] accept = 443 connect = 10443 cert = a.crt key = a.key [https_one] sni = https_default:one.org protocol = proxy connect = 10444 cert = one.crt key = one.key On the other hand when defined on the 'default' resource, the connect option seems to be ignored: [https_default] accept = 443 protocol = proxy connect = 10443 cert = a.crt key = a.key [https_one] sni = https_default:one.org connect = 10444 ;; nope! still 10443 cert = one.crt key = one.key Any suggestions? Cheers, Marek

3 6

RMI with SSL
by Anoop Joseph 29 Mar '12

29 Mar '12

Hi, We have an existing RMI server which is not SSL aware and is based on Java version 1.4.1. We want to use stunnel to make this existing RMI server SSL aware. Checking the official website of stunnel the support to following protocols were found cifs , connect, imap, nntp, pgsql, pop3, proxy and smtp. As no reference to JRMP was available, wondering if stunnel can be used to make the existing non SSL RMI server SSL aware. If this is possible then we belive that it would be achived by providing the mapping between the port configured with stunel and the existing port used by RMI. Also the eixsitng RMI server would have to undergo minial change using this approach. Your help is highly appreciated. Thanks in advance. Best Regards, Anoop

1 0

Unable to clean compile
by Jeffrey Walton 26 Mar '12

26 Mar '12

Hi All, A clean compile is a security gate for me, and I'm having problems meeting the goal on a Fedora 14 box (x64). Jeff [jeffrey@studio stunnel-4.53]$ ./configure CFLAGS="-Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap" configure: **************************************** initialization checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out ... configure: **************************************** success [jeffrey@studio stunnel-4.53]$ make clean [jeffrey@studio stunnel-4.53]$ make Making all in src make[1]: Entering directory `/home/jeffrey/stunnel-4.53/src' make all-am make[2]: Entering directory `/home/jeffrey/stunnel-4.53/src' /bin/sh ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c -o env.lo env.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fPIC -DPIC -o .libs/env.o env.c: In function ‘getpeername’: env.c:64:9: warning: conversion to ‘uint16_t’ from ‘int’ may alter its value mv -f .deps/env.Tpo .deps/env.Plo /bin/sh ../libtool --tag=CC --mode=link gcc -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -avoid-version -o libstunnel.la -rpath /usr/local/lib/stunnel env.lo -lz -ldl -lutil -lnsl -lpthread libtool: link: gcc -shared .libs/env.o -lz -ldl -lutil -lnsl -lpthread -Wl,-z -Wl,relro -Wl,-z -Wl,now -Wl,-z -Wl,noexecstack -Wl,-z -Wl,noexecheap -Wl,-soname -Wl,libstunnel.so -o .libs/libstunnel.so libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c str.c: In function ‘str_vprintf’: str.c:100:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result str.c:103:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result str.c:110:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-str.Tpo .deps/stunnel-str.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-file.o -MD -MP -MF .deps/stunnel-file.Tpo -c -o stunnel-file.o `test -f 'file.c' || echo './'`file.c file.c: In function ‘file_getline’: file.c:136:9: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value file.c: In function ‘file_putline’: file.c:162:5: warning: conversion to ‘int’ from ‘size_t’ may alter its value file.c:163:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result file.c:173:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result file.c:173:5: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value mv -f .deps/stunnel-file.Tpo .deps/stunnel-file.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-client.o -MD -MP -MF .deps/stunnel-client.Tpo -c -o stunnel-client.o `test -f 'client.c' || echo './'`client.c client.c: In function ‘transfer’: client.c:647:13: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result client.c:647:13: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value client.c:665:13: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result client.c:665:13: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value client.c:675:17: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result client.c:750:17: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result client.c: In function ‘auth_user’: client.c:930:9: warning: conversion to ‘in_port_t’ from ‘int’ may alter its value client.c: In function ‘connect_remote’: client.c:1110:13: warning: conversion to ‘u16’ from ‘int’ may alter its value mv -f .deps/stunnel-client.Tpo .deps/stunnel-client.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-log.o -MD -MP -MF .deps/stunnel-log.Tpo -c -o stunnel-log.o `test -f 'log.c' || echo './'`log.c mv -f .deps/stunnel-log.Tpo .deps/stunnel-log.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-options.o -MD -MP -MF .deps/stunnel-options.Tpo -c -o stunnel-options.o `test -f 'options.c' || echo './'`options.c options.c: In function ‘parse_global_option’: options.c:362:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:448:13: warning: conversion to ‘int’ from ‘__gid_t’ may change the sign of the result options.c:451:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:474:13: warning: conversion to ‘int’ from ‘__uid_t’ may change the sign of the result options.c:477:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c: In function ‘parse_service_option’: options.c:840:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1039:9: warning: conversion to ‘int’ from ‘long unsigned int’ may alter its value options.c:1042:9: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result options.c:1346:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1367:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1387:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1408:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1428:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1485:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c: In function ‘parse_conf’: options.c:1585:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1620:9: warning: conversion to ‘int’ from ‘size_t’ may alter its value options.c:1651:9: warning: conversion to ‘int’ from ‘size_t’ may alter its value options.c: In function ‘parse_ssl_option’: options.c:2004:13: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c: In function ‘parse_socket_option’: options.c:2162:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c: In function ‘argalloc’: options.c:2391:5: warning: conversion to ‘int’ from ‘size_t’ may alter its value options.c:2393:5: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-options.Tpo .deps/stunnel-options.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-protocol.o -MD -MP -MF .deps/stunnel-protocol.Tpo -c -o stunnel-protocol.o `test -f 'protocol.c' || echo './'`protocol.c protocol.c: In function ‘cifs_server’: protocol.c:200:5: warning: conversion to ‘u16’ from ‘int’ may alter its value protocol.c: In function ‘connect_client’: protocol.c:531:13: warning: conversion to ‘int’ from ‘size_t’ may alter its value protocol.c: In function ‘ntlm’: protocol.c:607:9: warning: conversion to ‘int’ from ‘long int’ may alter its value protocol.c: In function ‘ntlm3’: protocol.c:640:5: warning: conversion to ‘unsigned int’ from ‘size_t’ may alter its value protocol.c:641:5: warning: conversion to ‘unsigned int’ from ‘long unsigned int’ may alter its value protocol.c:647:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:651:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:652:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:653:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:655:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:656:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:670:5: warning: conversion to ‘int’ from ‘size_t’ may alter its value protocol.c:683:5: warning: conversion to ‘int’ from ‘unsigned int’ may change the sign of the result protocol.c: In function ‘crypt_DES’: protocol.c:692:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:693:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:694:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:695:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:696:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:697:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:698:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c: In function ‘base64’: protocol.c:736:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-protocol.Tpo .deps/stunnel-protocol.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-network.o -MD -MP -MF .deps/stunnel-network.Tpo -c -o stunnel-network.o `test -f 'network.c' || echo './'`network.c network.c: In function ‘set_socket_options’: network.c:376:13: warning: conversion to ‘int’ from ‘size_t’ may alter its value network.c:382:17: warning: conversion to ‘socklen_t’ from ‘int’ may change the sign of the result network.c: In function ‘write_blocking’: network.c:492:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result network.c:492:9: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value network.c: In function ‘read_blocking’: network.c:524:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result network.c:524:9: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value network.c: In function ‘fd_putline’: network.c:544:5: warning: conversion to ‘int’ from ‘size_t’ may alter its value network.c: In function ‘fd_getline’: network.c:576:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-network.Tpo .deps/stunnel-network.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-resolver.o -MD -MP -MF .deps/stunnel-resolver.Tpo -c -o stunnel-resolver.o `test -f 'resolver.c' || echo './'`resolver.c resolver.c: In function ‘name2addrlist’: resolver.c:124:9: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result resolver.c: In function ‘hostport2addrlist’: resolver.c:190:9: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-resolver.Tpo .deps/stunnel-resolver.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ssl.o -MD -MP -MF .deps/stunnel-ssl.Tpo -c -o stunnel-ssl.o `test -f 'ssl.c' || echo './'`ssl.c mv -f .deps/stunnel-ssl.Tpo .deps/stunnel-ssl.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ctx.o -MD -MP -MF .deps/stunnel-ctx.Tpo -c -o stunnel-ctx.o `test -f 'ctx.c' || echo './'`ctx.c ctx.c: In function ‘context_init’: ctx.c:119:9: warning: conversion to ‘unsigned int’ from ‘size_t’ may alter its value ctx.c: In function ‘password_cb’: ctx.c:431:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result ctx.c:434:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result ctx.c:436:9: warning: conversion to ‘int’ from ‘size_t’ may alter its value ctx.c: In function ‘sess_new_cb’: ctx.c:455:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result ctx.c:459:9: warning: conversion to ‘unsigned int’ from ‘long int’ may alter its value ctx.c:459:9: warning: conversion to ‘unsigned int’ from ‘int’ may change the sign of the result ctx.c: In function ‘sess_get_cb’: ctx.c:472:9: warning: conversion to ‘unsigned int’ from ‘int’ may change the sign of the result ctx.c: In function ‘cache_transfer’: ctx.c:540:5: warning: conversion to ‘u_char’ from ‘unsigned int’ may alter its value ctx.c:579:5: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value ctx.c:604:5: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result ctx.c:604:5: warning: conversion to ‘unsigned int’ from ‘long unsigned int’ may alter its value mv -f .deps/stunnel-ctx.Tpo .deps/stunnel-ctx.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-verify.o -MD -MP -MF .deps/stunnel-verify.Tpo -c -o stunnel-verify.o `test -f 'verify.c' || echo './'`verify.c verify.c: In function ‘cert_check’: verify.c:246:17: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result verify.c: In function ‘log_time’: verify.c:528:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-verify.Tpo .deps/stunnel-verify.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c sthreads.c: In function ‘create_client’: sthreads.c:318:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-sthreads.Tpo .deps/stunnel-sthreads.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-fd.o -MD -MP -MF .deps/stunnel-fd.Tpo -c -o stunnel-fd.o `test -f 'fd.c' || echo './'`fd.c fd.c: In function ‘get_limits’: fd.c:64:5: warning: conversion to ‘int’ from ‘long int’ may alter its value mv -f .deps/stunnel-fd.Tpo .deps/stunnel-fd.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function ‘drop_privileges’: stunnel.c:410:9: warning: conversion to ‘__gid_t’ from ‘int’ may change the sign of the result stunnel.c:415:9: warning: conversion to ‘gid_t’ from ‘int’ may change the sign of the result stunnel.c:423:9: warning: conversion to ‘__uid_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-stunnel.Tpo .deps/stunnel-stunnel.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-pty.o -MD -MP -MF .deps/stunnel-pty.Tpo -c -o stunnel-pty.o `test -f 'pty.c' || echo './'`pty.c mv -f .deps/stunnel-pty.Tpo .deps/stunnel-pty.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-libwrap.o -MD -MP -MF .deps/stunnel-libwrap.Tpo -c -o stunnel-libwrap.o `test -f 'libwrap.c' || echo './'`libwrap.c mv -f .deps/stunnel-libwrap.Tpo .deps/stunnel-libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -L/usr//lib64 -L/usr//lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -lz -ldl -lutil -lnsl -lpthread libtool: link: gcc -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z -Wl,relro -Wl,-z -Wl,now -Wl,-z -Wl,noexecstack -Wl,-z -Wl,noexecheap -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -L/usr//lib64 -L/usr//lib -lssl -lcrypto -lz -ldl -lutil -lnsl -lpthread -pthread make[2]: Leaving directory `/home/jeffrey/stunnel-4.53/src' make[1]: Leaving directory `/home/jeffrey/stunnel-4.53/src' Making all in doc make[1]: Entering directory `/home/jeffrey/stunnel-4.53/doc' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jeffrey/stunnel-4.53/doc' Making all in tools make[1]: Entering directory `/home/jeffrey/stunnel-4.53/tools' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jeffrey/stunnel-4.53/tools' make[1]: Entering directory `/home/jeffrey/stunnel-4.53' make[1]: Nothing to be done for `all-am'. make[1]: Leaving directory `/home/jeffrey/stunnel-4.53' [jeffrey@studio stunnel-4.53]$

2 1

Can this be done by Stunnel
by Alan C. Bonnici 23 Mar '12

23 Mar '12

Thomas, After a few exchanges a few hours ago with the folk at STunnel I can confirm that the "problem" was that the company uses host headers. Here is the procedure I used to sort it out: 1. Modify the windows host file and add the following entry 127.0.0.1 rest.nexmo.com. If your STunnel ir running on a different machines, set the 127.0.0.1 to the IP address of the Stunnel server. 2. Add the following to the stunnel.conf file (you may alter the port) [nexmo] client = yes accept = 9013 connect = 174.120.166.82:443 TIMEOUTclose = 0 3. Start sending secure SMSs as follows (note the port number much match the one set in stunnel.conf) http://rest.nexmo.com:9013/sms/xml?username=xxxxxxx&password=xxxxxxx&from=xx xxxxxx&to=xxxxxxx&text=xxxxxxx This will bypass the issue related to host headers and I can confirm that the solution has worked. The setup is useful if using server technology that does not natively support SSL as is our case. Hope this helps. Alan ---------------------------------------------------------------------------- ---------------------------------------- Alan; While I don't generally use Stunnel for HTTPS, I found your question interesting. Since I'm always trying to experiment with configurations of and applications for Stunnel, I decided to give it a whirl. I'm happy to confirm that it works just fine for me. I'm not connecting to the site in your example, but the principle is the same. Perhaps the answer lies in how your browser parses that URL, and how, as a result, it inserts that data into the stream. For the experiment, I used Firefox 9.0.1 running under Windows XP x86 with Stunnel version 4.53. My test config was: debug = 6 fips = no delay = yes output = stunnel.log [https] client = yes accept = 127.0.1.21:7777 connect = www.host.domain:443 Where www.host.domain is just an example. As you can see, I did not include any TIMEOUTclose statement in my config file. Then I pointed the browser at http://127.0.1.21:7777/do/mypage/longparameterstringhere. As far as I can tell, all of the parameters contained in that string were passed on to the web site without any difficulty. You might want to check your log window to see what's happening when you try to connect via Stunnel. Here's an actual example of the connection activity from my log: 2012.03.22 21:20:51 LOG5[992:2548]: Service [https] accepted connection from ***.**.***.*:2671 2012.03.22 21:20:51 LOG6[992:2548]: connect_blocking: connecting ***.***.***.***:443 2012.03.22 21:20:51 LOG5[992:2548]: connect_blocking: connected ***.***.***.***:443 2012.03.22 21:20:51 LOG5[992:2548]: Service [https] connected remote server from ***.**.***.*:2672 2012.03.22 21:20:51 LOG6[992:2548]: SSL connected: new session negotiated 2012.03.22 21:20:51 LOG6[992:2548]: Negotiated TLSv1/SSLv3 ciphersuite: RC4-SHA (128-bit encryption) 2012.03.22 21:20:51 LOG6[992:2548]: Compression: null, expansion: null 2012.03.22 21:21:00 LOG6[992:2548]: SSL_shutdown successfully sent close_notify alert 2012.03.22 21:21:00 LOG5[992:2548]: Connection closed: 1879 byte(s) sent to SSL, 128546 byte(s) sent to socket If you have to post again, it would be helpful if you included more detail. Good luck with your application! Thomas On 3/21/2012 9:50 AM, Alan C. Bonnici wrote: > > Hi, > > I am new to STunnel. I am trying to connect to a service provided by > nexmo.com. > > If from a browser I type the following: > > https://rest.nexmo.com/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx& to=xxxxxxx&text=xxxxxxxxxx > <https://rest.nexmo.com/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx &to=xxxxxxx&text=xxxxxxxxxx> > > The process works. > > I just installed stunnel and have the following config file > > ; Debugging stuff (may useful for troubleshooting) > > ;debug = 7 > > ;output = stunnel.log > > ; Certificate/key is needed in server mode and optional in client mode > > cert = stunnel.pem > > ;key = stunnel.pem > > ; Disable support for insecure SSLv2 protocol > > options = NO_SSLv2 > > [nexmo] > > client = yes > > accept = 9012 > > connect = rest.nexmo.com:443 > > TIMEOUTclose = 0 > > When I type > > http://127.0.0.1:9012/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx&t o=xxxxxxx&text=xxxxxxxxxx > > > it does not. > > Can anyone please confirm whether what I am trying to do is doable and > maybe highlight what I am doing wrong. > > Regards, > > Alan > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Can this be done by Stunnel
by Alan C. Bonnici 22 Mar '12

22 Mar '12

Hi, I am new to STunnel. I am trying to connect to a service provided by nexmo.com. If from a browser I type the following: https://rest.nexmo.com/sms/xml?username=xxxxxxx <https://rest.nexmo.com/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx &to=xxxxxxx&text=xxxxxxxxxx> &password=xxxxx&from=xxxxxxx&to=xxxxxxx&text=xxxxxxxxxx The process works. I just installed stunnel and have the following config file ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [nexmo] client = yes accept = 9012 connect = rest.nexmo.com:443 TIMEOUTclose = 0 When I type http://127.0.0.1:9012/sms/xml? username=xxxxxxx&password=xxxxx&from=xxxxxxx&to=xxxxxxx&text=xxxxxxxxxx it does not. Can anyone please confirm whether what I am trying to do is doable and maybe highlight what I am doing wrong. Regards, Alan

2 1

Can this be done by Stunnel [Nexmo]
by Alan C. Bonnici 22 Mar '12

22 Mar '12

Hi, Nexmo offer (free trial) SMS messages that can be programmed into systems. I've attached the log file when calling the service: 2012.03.22 10:41:13 LOG7[5024:8232]: No limit detected for the number of clients 2012.03.22 10:41:13 LOG5[5024:8232]: stunnel 4.53 on x86-pc-mingw32-gnu platform 2012.03.22 10:41:13 LOG5[5024:8232]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.03.22 10:41:13 LOG5[5024:8232]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.03.22 10:41:13 LOG5[5024:8232]: Reading configuration from file stunnel.conf 2012.03.22 10:41:14 LOG5[5024:8232]: FIPS mode is enabled 2012.03.22 10:41:14 LOG7[5024:8232]: Compression not enabled 2012.03.22 10:41:14 LOG7[5024:8232]: Snagged 64 random bytes from C:/.rnd 2012.03.22 10:41:14 LOG7[5024:8232]: Wrote 1024 new random bytes to C:/.rnd 2012.03.22 10:41:14 LOG7[5024:8232]: PRNG seeded successfully 2012.03.22 10:41:14 LOG6[5024:8232]: Initializing service section [nexmo] 2012.03.22 10:41:14 LOG7[5024:8232]: Certificate: stunnel.pem 2012.03.22 10:41:14 LOG7[5024:8232]: Certificate loaded 2012.03.22 10:41:14 LOG7[5024:8232]: Key file: stunnel.pem 2012.03.22 10:41:14 LOG7[5024:8232]: Private key loaded 2012.03.22 10:41:14 LOG7[5024:8232]: SSL options set: 0x01000004 2012.03.22 10:41:14 LOG5[5024:8232]: Configuration successful 2012.03.22 10:41:14 LOG7[5024:8232]: Service [nexmo] (FD=280) bound to 0.0.0.0:9012 2012.03.22 10:44:09 LOG7[5024:8232]: Service [nexmo] accepted (FD=444) from 127.0.0.1:3692 2012.03.22 10:44:09 LOG7[5024:8232]: Creating a new thread 2012.03.22 10:44:09 LOG7[5024:8232]: New thread created 2012.03.22 10:44:09 LOG7[5024:3280]: Service [nexmo] started 2012.03.22 10:44:09 LOG5[5024:3280]: Service [nexmo] accepted connection from 127.0.0.1:3692 2012.03.22 10:44:09 LOG6[5024:3280]: connect_blocking: connecting 174.120.166.82:443 2012.03.22 10:44:09 LOG7[5024:3280]: connect_blocking: s_poll_wait 174.120.166.82:443: waiting 10 seconds 2012.03.22 10:44:09 LOG5[5024:3280]: connect_blocking: connected 174.120.166.82:443 2012.03.22 10:44:09 LOG5[5024:3280]: Service [nexmo] connected remote server from 10.252.0.51:3693 2012.03.22 10:44:09 LOG7[5024:3280]: Remote socket (FD=476) initialized 2012.03.22 10:44:10 LOG7[5024:3280]: Peer certificate was cached (6499 bytes) 2012.03.22 10:44:10 LOG6[5024:3280]: SSL connected: new session negotiated 2012.03.22 10:44:10 LOG6[5024:3280]: Negotiated TLSv1/SSLv3 ciphersuite: AES256-SHA (256-bit encryption) 2012.03.22 10:44:10 LOG6[5024:3280]: Compression: null, expansion: null 2012.03.22 10:44:10 LOG7[5024:3280]: SSL closed on SSL_read 2012.03.22 10:44:10 LOG7[5024:3280]: Sent socket write shutdown 2012.03.22 10:44:10 LOG7[5024:3280]: Socket closed on read 2012.03.22 10:44:10 LOG7[5024:3280]: Sending close_notify alert 2012.03.22 10:44:10 LOG6[5024:3280]: SSL_shutdown successfully sent close_notify alert 2012.03.22 10:44:10 LOG5[5024:3280]: Connection closed: 388 byte(s) sent to SSL, 200 byte(s) sent to socket 2012.03.22 10:44:10 LOG7[5024:3280]: Remote socket (FD=476) closed 2012.03.22 10:44:10 LOG7[5024:3280]: Local socket (FD=444) closed 2012.03.22 10:44:10 LOG7[5024:3280]: Service [nexmo] finished (0 left) 2012.03.22 10:44:10 LOG7[5024:8232]: Service [nexmo] accepted (FD=440) from 127.0.0.1:3694 2012.03.22 10:44:10 LOG7[5024:8232]: Creating a new thread 2012.03.22 10:44:10 LOG7[5024:8232]: New thread created 2012.03.22 10:44:10 LOG7[5024:8864]: Service [nexmo] started 2012.03.22 10:44:10 LOG5[5024:8864]: Service [nexmo] accepted connection from 127.0.0.1:3694 2012.03.22 10:44:10 LOG6[5024:8864]: connect_blocking: connecting 174.120.166.82:443 2012.03.22 10:44:10 LOG7[5024:8864]: connect_blocking: s_poll_wait 174.120.166.82:443: waiting 10 seconds 2012.03.22 10:44:10 LOG5[5024:8864]: connect_blocking: connected 174.120.166.82:443 2012.03.22 10:44:10 LOG5[5024:8864]: Service [nexmo] connected remote server from 10.252.0.51:3695 2012.03.22 10:44:10 LOG7[5024:8864]: Remote socket (FD=424) initialized 2012.03.22 10:44:10 LOG6[5024:8864]: SSL connected: previous session reused 2012.03.22 10:44:10 LOG7[5024:8864]: SSL closed on SSL_read 2012.03.22 10:44:10 LOG7[5024:8864]: Sent socket write shutdown 2012.03.22 10:44:10 LOG7[5024:8864]: Socket closed on read 2012.03.22 10:44:10 LOG7[5024:8864]: Sending close_notify alert 2012.03.22 10:44:10 LOG6[5024:8864]: SSL_shutdown successfully sent close_notify alert 2012.03.22 10:44:10 LOG5[5024:8864]: Connection closed: 269 byte(s) sent to SSL, 200 byte(s) sent to socket 2012.03.22 10:44:10 LOG7[5024:8864]: Remote socket (FD=424) closed 2012.03.22 10:44:10 LOG7[5024:8864]: Local socket (FD=440) closed 2012.03.22 10:44:10 LOG7[5024:8864]: Service [nexmo] finished (0 left) 2012.03.22 10:44:10 LOG7[5024:8232]: Service [nexmo] accepted (FD=460) from 127.0.0.1:3696 2012.03.22 10:44:10 LOG7[5024:8232]: Creating a new thread 2012.03.22 10:44:10 LOG7[5024:8232]: New thread created 2012.03.22 10:44:10 LOG7[5024:5820]: Service [nexmo] started 2012.03.22 10:44:10 LOG5[5024:5820]: Service [nexmo] accepted connection from 127.0.0.1:3696 2012.03.22 10:44:10 LOG6[5024:5820]: connect_blocking: connecting 174.120.166.82:443 2012.03.22 10:44:10 LOG7[5024:5820]: connect_blocking: s_poll_wait 174.120.166.82:443: waiting 10 seconds 2012.03.22 10:44:11 LOG5[5024:5820]: connect_blocking: connected 174.120.166.82:443 2012.03.22 10:44:11 LOG5[5024:5820]: Service [nexmo] connected remote server from 10.252.0.51:3697 2012.03.22 10:44:11 LOG7[5024:5820]: Remote socket (FD=476) initialized 2012.03.22 10:44:11 LOG6[5024:5820]: SSL connected: previous session reused 2012.03.22 10:44:11 LOG7[5024:5820]: SSL closed on SSL_read 2012.03.22 10:44:11 LOG7[5024:5820]: Sent socket write shutdown 2012.03.22 10:44:11 LOG7[5024:5820]: Socket closed on read 2012.03.22 10:44:11 LOG7[5024:5820]: Sending close_notify alert 2012.03.22 10:44:11 LOG6[5024:5820]: SSL_shutdown successfully sent close_notify alert 2012.03.22 10:44:11 LOG5[5024:5820]: Connection closed: 299 byte(s) sent to SSL, 200 byte(s) sent to socket 2012.03.22 10:44:11 LOG7[5024:5820]: Remote socket (FD=476) closed 2012.03.22 10:44:11 LOG7[5024:5820]: Local socket (FD=460) closed 2012.03.22 10:44:11 LOG7[5024:5820]: Service [nexmo] finished (0 left) 2012.03.22 10:44:11 LOG7[5024:8232]: Service [nexmo] accepted (FD=448) from 127.0.0.1:3698 2012.03.22 10:44:11 LOG7[5024:8232]: Creating a new thread 2012.03.22 10:44:11 LOG7[5024:8232]: New thread created 2012.03.22 10:44:11 LOG7[5024:8476]: Service [nexmo] started 2012.03.22 10:44:11 LOG5[5024:8476]: Service [nexmo] accepted connection from 127.0.0.1:3698 2012.03.22 10:44:11 LOG6[5024:8476]: connect_blocking: connecting 174.120.166.82:443 2012.03.22 10:44:11 LOG7[5024:8476]: connect_blocking: s_poll_wait 174.120.166.82:443: waiting 10 seconds 2012.03.22 10:44:11 LOG5[5024:8476]: connect_blocking: connected 174.120.166.82:443 2012.03.22 10:44:11 LOG5[5024:8476]: Service [nexmo] connected remote server from 10.252.0.51:3699 2012.03.22 10:44:11 LOG7[5024:8476]: Remote socket (FD=424) initialized 2012.03.22 10:44:11 LOG6[5024:8476]: SSL connected: previous session reused 2012.03.22 10:44:12 LOG7[5024:8476]: SSL closed on SSL_read 2012.03.22 10:44:12 LOG7[5024:8476]: Sent socket write shutdown 2012.03.22 10:44:12 LOG7[5024:8476]: Socket closed on read 2012.03.22 10:44:12 LOG7[5024:8476]: Sending close_notify alert 2012.03.22 10:44:12 LOG6[5024:8476]: SSL_shutdown successfully sent close_notify alert 2012.03.22 10:44:12 LOG5[5024:8476]: Connection closed: 299 byte(s) sent to SSL, 200 byte(s) sent to socket 2012.03.22 10:44:12 LOG7[5024:8476]: Remote socket (FD=424) closed 2012.03.22 10:44:12 LOG7[5024:8476]: Local socket (FD=448) closed 2012.03.22 10:44:12 LOG7[5024:8476]: Service [nexmo] finished (0 left) ----------------------------------- Message: 4 Date: Wed, 21 Mar 2012 15:50:59 +0100 From: "Alan C. Bonnici" <chribonn(a)gmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Can this be done by Stunnel Message-ID: <006b01cd0772$0869f3c0$193ddb40$(a)gmail.com> Content-Type: text/plain; charset="us-ascii" Hi, I am new to STunnel. I am trying to connect to a service provided by nexmo.com. If from a browser I type the following: https://rest.nexmo.com/sms/xml?username=xxxxxxx <https://rest.nexmo.com/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx &to=xxxxxxx&text=xxxxxxxxxx> &password=xxxxx&from=xxxxxxx&to=xxxxxxx&text=xxxxxxxxxx The process works. I just installed stunnel and have the following config file ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [nexmo] client = yes accept = 9012 connect = rest.nexmo.com:443 TIMEOUTclose = 0 When I type http://127.0.0.1:9012/sms/xml? username=xxxxxxx&password=xxxxx&from=xxxxxxx&to=xxxxxxx&text=xxxxxxxxxx it does not. Can anyone please confirm whether what I am trying to do is doable and maybe highlight what I am doing wrong. Regards, Alan

1 0

Feature request: restricting incoming IP-adress to a list of allowed adresses
by Ivanko B 22 Mar '12

22 Mar '12

also possibly with smth like callback

2 1

Intermittent connection resets
by Jordan K 21 Mar '12

21 Mar '12

Hi, I've spent the better part of the day trying to find answers on this, and haven't had much luck. I have two systems that talk to eachother via stunnel. In the last week or so, I have noticed a number of errors in the application using the tunnel (messaging application), requiring multiple re-sends, etc. This is my setup. Both server and client run CentOS 6.2, with the RPM version of stunnel. Though it isn't the latest version, I believe RedHat do release any critical bugs in their updated RPMs. I did also go through the ChangeLog but couldn't find anything implemented since 4.29 that seemed to deal with what I'm seeing. stunnel 4.29 on x86_64-unknown-linux-gnu with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- TCP_KEEPCNT -- -- -- 9 TCP_KEEPIDLE -- -- -- 7200 TCP_KEEPINTVL -- -- -- 75 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 Common config (basically default file released by RedHat, with certs and ports configured) : ---------------- ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/run/stunnel/ setuid = stunnel setgid = stunnel ; PID is created inside the chroot jail pid = /stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel.log ------------------- When the connection breaks, the logs (debug=7) on both sides are: Client: 2012.03.21 19:58:14 LOG7[30685:140185543952128]: SSL state (connect): before/connect initialization 2012.03.21 19:58:14 LOG7[30685:140185543952128]: SSL state (connect): SSLv3 write client hello A 2012.03.21 19:58:14 LOG3[30685:140185543952128]: SSL_connect: Peer suddenly disconnected 2012.03.21 19:58:14 LOG5[30685:140185543952128]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Server: 2012.03.21 19:58:14 LOG3[22230:140462283343616]: SSL_accept: Peer suddenly disconnected 2012.03.21 19:58:14 LOG5[22230:140462283343616]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket As I mentioned, it happens intermittently, with probably 50% of the connections working just fine, and the rest being disconnected. It ALWAYS seems to happen just after the client 'write client hello A', as opposed to later in the SSL handshake. I ran a tcpdump on both sides, it is below. Note that both the client and the server are NATd behind firewalls, on the server the port stunnel listens on (31112) is opened through the firewall. CLIENT (192.168.22.120, NATd externally as 66.66.66.66): 18:21:57.009887 IP 192.168.22.120.55747 > 77.77.77.77.31112: Flags [S], seq 2556598106, win 14600, options [mss 1460,sackOK,TS val 88488311 ecr 0,nop,wscale 7], length 0 18:21:57.076130 IP 77.77.77.77.31112 > 192.168.22.120.55747: Flags [S.], seq 351052925, ack 2556598107, win 14480, options [mss 1460,sackOK,TS val 646044220 ecr 88488311,nop,wscale 7], length 0 18:21:57.076195 IP 192.168.22.120.55747 > 77.77.77.77.31112: Flags [.], ack 1, win 115, options [nop,nop,TS val 88488377 ecr 646044220], length 0 18:21:57.077234 IP 192.168.22.120.55747 > 77.77.77.77.31112: Flags [P.], seq 1:140, ack 1, win 115, options [nop,nop,TS val 88488378 ecr 646044220], length 139 18:21:57.143582 IP 77.77.77.77.31112 > 192.168.22.120.55747: Flags [.], ack 140, win 122, options [nop,nop,TS val 646044288 ecr 88488378], length 0 18:21:57.143982 IP 77.77.77.77.31112 > 192.168.22.120.55747: Flags [RP.], seq 1, ack 140, win 122, length 0 SERVER (10.65.0.130, NATd externally as 77.77.77.77): 18:21:57.042122 IP 66.66.66.66.7760 > 10.65.0.130.http: Flags [S], seq 4074124673, win 14600, options [mss 1460,sackOK,TS val 88488311 ecr 0,nop,wscale 7], length 0 18:21:57.042161 IP 10.65.0.130.http > 66.66.66.66.7760: Flags [S.], seq 458906148, ack 4074124674, win 14480, options [mss 1460,sackOK,TS val 646044220 ecr 88488311,nop,wscale 7], length 0 18:21:57.108325 IP 66.66.66.66.7760 > 10.65.0.130.http: Flags [.], ack 1, win 115, options [nop,nop,TS val 88488377 ecr 646044220], length 0 18:21:57.109507 IP 66.66.66.66.7760 > 10.65.0.130.http: Flags [P.], seq 1:140, ack 1, win 115, options [nop,nop,TS val 88488378 ecr 646044220], length 139 18:21:57.109532 IP 10.65.0.130.http > 66.66.66.66.7760: Flags [.], ack 140, win 122, options [nop,nop,TS val 646044288 ecr 88488378], length 0 18:21:57.110092 IP 10.65.0.130.http > 66.66.66.66.7760: Flags [P.], seq 1:178, ack 140, win 122, options [nop,nop,TS val 646044288 ecr 88488378], length 177 18:21:57.175518 IP 66.66.66.66.7760 > 10.65.0.130.http: Flags [R.], seq 140, ack 1, win 115, length 0 Based on what I am seeing, a mysterious RST packet gets received by both sides, which causes them to terminate the session. Neither side originates any RST packets. When the connection is successful, the tcpdump looks a lot more normal, with an appropriate FIN exchange closing the session once the data has been sent. My questions are - am I missing something obvious? Am I correct in reading the above as some firewall or router between the two servers breaking the TCP connection by sending TCP RSTs to both endpoints? any help is appreciated. jordan

1 0

running stunnel from inetd
by Guylhem 21 Mar '12

21 Mar '12

Hello To follow up on my test, I would like to try and run stunnel from inetd However I wonder if anyone has an experience, suggestions, and some inetd.conf examples. I read it was possible in the FAQ but I didn't see a lot of examples Should I use a configuration file (for the global parameters) then specify connect= params? ex : 443 stream tcp6 nowait nobody /sbin/stunnel /etc/stunnel.conf connect=127.0.0.1:80 TIMEOUTclose=0 Thanks Guylhem

1 0

question about Ephemeral Diffie-Hellman
by Guylhem 21 Mar '12

21 Mar '12

Hello I've read that EDH calculations were ca cause of significant slow up on http://matt.io/technobabble/hivemind_devops_alert:_nginx_does_not_suck_at_s… I'm running stunnel on a embedded Linux/MIPS, where I'm trying to light up the load. Is it possible to disable EDH? If so, how? I couldn't find any info on that. Thanks Guylhem

2 3

stunnel with smb from 2 networks behind firewalls
by Philippe 21 Mar '12

21 Mar '12

Hello, Here is my setup : [PCA]-------------[Firewall-A]---------------{INTERNET}-----------[45.212.56.178:21213|Firewall-B|192.168.0.1:8139]--------[PCB] PCA : Windows 7 stunnel.conf : [smb] client = yes accept = 10.232.232.232:139 connect = 45.212.56.178:21213 PCB : Ubuntu Oneiric 11.10 stunnel.conf : [smb] accept = 8139 connect = 139 When I try to connect a network drive from PCA to a remote drive of PCB here are the stunnel.log of PCA : 2012.03.19 13:47:02 LOG5[3744:2564]: Reading configuration from file stunnel.conf 2012.03.19 13:47:02 LOG5[3744:2564]: FIPS mode is enabled 2012.03.19 13:47:02 LOG7[3744:2564]: Compression not enabled 2012.03.19 13:47:02 LOG7[3744:2564]: Snagged 64 random bytes from C:/.rnd 2012.03.19 13:47:02 LOG7[3744:2564]: Wrote 0 new random bytes to C:/.rnd 2012.03.19 13:47:02 LOG7[3744:2564]: PRNG seeded successfully 2012.03.19 13:47:02 LOG6[3744:2564]: Initializing SSL context for service smb 2012.03.19 13:47:02 LOG7[3744:2564]: Certificate: stunnel.pem 2012.03.19 13:47:02 LOG7[3744:2564]: Certificate loaded 2012.03.19 13:47:02 LOG7[3744:2564]: Key file: stunnel.pem 2012.03.19 13:47:02 LOG7[3744:2564]: Private key loaded 2012.03.19 13:47:02 LOG7[3744:2564]: SSL options set: 0x01000004 2012.03.19 13:47:02 LOG6[3744:2564]: SSL context initialized 2012.03.19 13:47:02 LOG5[3744:2564]: Configuration successful 2012.03.19 13:47:02 LOG7[3744:2564]: Service smb closed FD=200 2012.03.19 13:47:13 LOG5[3744:3940]: Service smb accepted connection from 10.232.232.232:50004 2012.03.19 13:47:13 LOG5[3744:3940]: connect_blocking: connected 45.212.56.178:21213 2012.03.19 13:47:13 LOG5[3744:3940]: Service smb connected remote server from 192.168.3.4:50005 2012.03.19 13:47:43 LOG3[3744:3940]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2012.03.19 13:47:43 LOG5[3744:3940]: Connection reset: 143 bytes sent to SSL, 0 bytes sent to socket No logs on PCB it seems that the SSL connection doesn't cross the firewall B, if not I would saw logs in stunnel.log of PCB isn't it ? What can I do better to make this setup working ? Does the firewall B porforwarding is blocking the process ? Best regards Philippe

4 10

stunnel.conf in %USERAPPDATA%
by Sebastian Rose-Indorf 19 Mar '12

19 Mar '12

Hello, I use Stunnel with Windows. The configuration file "stunnel.conf" and the log file "stunnel.log" are in the %USERAPPDATA%\Stunnel folder. Stunnel starts and works without problems. But the GUI options "Edit stunnel.conf" and "Reload stunnel.conf" do not work. Is remedy possible? Sebastian

2 3

Re: [stunnel-users] stunnel with smb from 2 networks behind firewalls
by Philippe 19 Mar '12

19 Mar '12

I have found the stunnel version on PCB : stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 the version on PCA is 4.52 this is perhaps a too big difference isn't it ? Best Philippe

1 0

Help for connecting to Https
by Ali Kabiri 18 Mar '12

18 Mar '12

Hi I have IP & Port with User & Pass from HttpS server I want connect to this server and using for tunneling, (something like vpn, a little of course!) I use stunnel on iPad Please help me I need this for usual using of Internet Please help me Please... Ali

1 0

Re: [stunnel-users] issue with running stunnel
by Thomas Eifert 17 Mar '12

17 Mar '12

Hi again Dewen; It sounds to me like Stunnel isn't being accessed at all. You should be seeing something in the Stunnel log window. I run Stunnel under Windows, so what I generally do is get Stunnel to listen to the loopback interface at address 127.0.0.1, or some other address within the loopback interface range. As such, if I was attempting to access it with a utility like Netcat, my basic stunnel.conf would look something like this for the client side: debug =7 [service.name] client = yes accept = 127.0.0.1:12035 connect = destination.address:1230 Then, I would point Netcat to the listening address and port. In your case, that might be netcat 127.0.0.1:12035. Then see if Stunnel logs your connection attempt. Again, this is under Windows, so your mileage may vary. Let us know how it works out for you. Regards; Thomas On 3/17/2012 12:32 PM, Dewen Kong wrote: > Hi Thomas, > > Thank you for your help. > > here is the config file in one computer >>> client = yes >>> [ncat] >>> accept = 12035 >>> connect = ***.***.***.***:1230 >> and on this computer, I run the command: cat test.file | >> netcat ***.***.***.***: 12035. to connect the remote server with >> IP( ***.***.***.***) on port 12035. I figure on stunnel will accept >> the port 12035 and connect to the remote server on port 1230 or I >> thought. > > and no another remote server, I run the command netcat -l -p 1230 > which means listen to the port 1230. > > after I run the test, it seems on remote server didn't receive > anything on the port 1230.the log file of stunnel dooesn't have any > record of this communication. the last line of the log file is still > "configuration successfully" > > and the version of stunnel I use is 4.42 > > > any suggests that may be wrong? > > > Dewen Kong > >> >> > > On Fri, Mar 16, 2012 at 10:14 PM, Thomas Eifert <kxkvi(a)wi.rr.com > <mailto:[email protected]>> wrote: > > Dewen; > > I think I misread your post. Please forgive me, as I'm unfamiliar > with the Netcat application. > > If you could provide some additional detail, that might be helpful. > > Regards; > > Thomas > > > > On 3/16/2012 9:38 PM, Thomas Eifert wrote: >> Dewen; >> >> I don't know anything about Netcat, so I'm taking a stab in the >> dark here, but it looks as if >> you're pointing Netcat at port 1230, while your config file >> indicates that Stunnel would be >> listening on port 12035. Try redirecting Netcat to the listening >> port. >> >> If you need to post again, please indicate the version of Stunnel >> you are using, and what >> platform your are running it on. >> >> Regards; >> >> Thomas >> >> >> On 3/16/2012 5:35 PM, Dewen Kong wrote: >>> Hi all, >>> I am a new guy to stunnel. >>> here is the issue I meet, i install my stunnel in the lab. and >>> trying to run the test with netcat. >>> Here is the config file i test: >>> client side: >>> ... >>> ... >>> output = stunnel.log >>> client = yes >>> [ncat] >>> accept = 12035 >>> connect = ***.***.***.***:1230 >>> then I run "stunnel test.conf "and the the log file shows >>> configuration successfully >>> then I run the command "cat test.file | netcat ***.***.***.*** >>> 12035 on the client side >>> and run netcat -l -p 1230 > output >>> nothing happens. >>> And I check the log file. there is no record about the netcat. >>> I don't know what happened. >>> >>> >>> -- >>> */Dewen Kong/* >>> >>> >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org <mailto:[email protected]> >>> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >> -- >> Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org <mailto:[email protected]> >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > -- > Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:[email protected]> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > -- > */Dewen Kong/* -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

win-32 : console version with foreground mode & no icon area activity
by IvankoB for-mse 17 Mar '12

17 Mar '12

Needed to start/terminate/{supply private key password}/{catch errors} via pipe reader/writer (MSEgui pipe components) so that a STunnel session only serves a single application.

1 0

issue with running stunnel
by Dewen Kong 16 Mar '12

16 Mar '12

Hi all, I am a new guy to stunnel. here is the issue I meet, i install my stunnel in the lab. and trying to run the test with netcat. Here is the config file i test: client side: ... ... output = stunnel.log client = yes [ncat] accept = 12035 connect = ***.***.***.***:1230 then I run "stunnel test.conf "and the the log file shows configuration successfully then I run the command "cat test.file | netcat ***.***.***.*** 12035 on the client side and run netcat -l -p 1230 > output nothing happens. And I check the log file. there is no record about the netcat. I don't know what happened. -- *Dewen Kong*

2 2

Stunnel 1.45 on Win7 x64, OCSP blows up
by Michael Olson 16 Mar '12

16 Mar '12

I'm using stunnel in client mode on a Windows 7 x64 workstation, installed using ftp://ftp.stunnel.org/stunnel/stunnel-4.52-installer.exe Everything works until I try to check the server certificate for revocation using an OCSP server, at which point stunnel crashes whenever I make a connection. The following error pops up in a dialog box: OPENSSL_Uplink(0FBE5000,14): no OPENSSL_Applink My config is pretty simple: -------------------------------------------------------------- debug = 7 # I do want FIPS enabled, but I figured one problem at a time. fips = no CAfile = ca-bundle.crt verify = 2 OCSP = http://ocsp.test.net/ options = NO_SSLv2 [test1] client = yes accept = 127.0.0.1:80 connect = web.test.net:443 -------------------------------------------------------------- The log gets as far as: 2012.03.02 11:07:41 LOG7[4296:5008]: OCSP: server connected when it crashes. -- Mike

2 3

need suggestion on this issue?
by Dewen Kong 16 Mar '12

16 Mar '12

Hi guys, Right now I am working on this issue trying to encrypt the communication between terminals and our back of house computer. I am trying to solve this problem with stunnel. If the terminal is 'smart' like computer, it will be no issue. implement the stunnel on both end. But it come to be a problem there is some dumb terminal, No way to set up stunnel in its side. I not sure stunnel can works here any more. if not, is there any other methods that may work? -- *Dewen Kong*

2 1

Stunnel->Stunnel Failure Behavior...
by Matt Wise 13 Mar '12

13 Mar '12

I'm using Stunnel in our environment to tunnel our ZooKeeper connections... it works reasonably well as long as ZooKeeper is running on our ZooKeeper servers properly. Here's an example of our server and client configs: Server: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 0.0.0.0:2182 > failover = rr > connect = 127.0.0.1:2181 Client: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 127.0.0.1:2182 > failover = rr > connect = zookeeper1:2182 > connect = zookeeper2:2182 > connect = zookeeper3:2182 Now the intended behavior is that if 'zookeeper1', 'zookeeper'2, or 'zookeeper3' go down that the client will re-establish a connection with one of the other servers. However, that doesnt seem to be happening. Instead, when the connection dies, Stunnel seems to go into a massive loop trying to re-connect to the original server. > Feb 22 21:41:24 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) Whats missing in my config to make the failover work properly? —Matt

2 2

Stunnel stopped working: Will not sync with Google using Outlook 2007 on Ubuntu 11:10 64-bit
by Jonathan Harrison 12 Mar '12

12 Mar '12

I made some changes to my stunnel config, and had one account working. I added the remaining 3 and it seemed to start to work, but now it has stopped. Outbound (send) seems to be fine. Any ideas????? Telnet and post listening test results: [CODE]$ netstat -an | grep -iw LISTEN tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3001 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3002 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3003 0.0.0.0:* LISTEN tcp6 0 0 :::80 :::* LISTEN tcp6 0 0 ::1:631 :::* LISTEN tcp6 0 0 :::445 :::* LISTEN tcp6 0 0 :::139 :::* LISTEN baronipc@baronipc:~$ telnet localhost 3000 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3001 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3002 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3003 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ [/CODE] Copy of config file: [CODE] ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/mail.pem ;key = /etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 [imaps Work] accept = 127.0.0.1:3000 connect = imap.gmail.com:993 [imaps Personal] accept = 127.0.0.1:3001 connect = imap.gmail.com:993 [imaps Admin] accept = 127.0.0.1:3002 connect = imap.gmail.com:993 [imaps Co] accept = 127.0.0.1:3003 connect = imap.gmail.com:993 ;[ssmtp Work] ;accept = 127.0.0.1:4000 ;connect = smtp.gmail.com:465 ;[ssmt Personal] ;accept = 127.0.0.1:4001 ;connect = smtp.gmail.com:465 ;[ssmtp Admin] ;accept = 127.0.0.1:4002 ;connect = smtp.gmail.com:587 ;[ssmtp Co] ;accept = 127.0.0.1:4003 ;connect = smtp.gmail.com:587 ;[ssmtp other] ;accept = 127.0.0.1:4004 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini[/CODE] And /etc/default/stunnel4 [CODE]# /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 # Change to one to enable stunnel automatic startup ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0[/CODE] -- Regards Jonathan

1 0

How to get stunnel to listen on an IPv6 interface?
by jshardlo 11 Mar '12

11 Mar '12

Hi - my server was recently connected to IPv6 as well as the original IPv4 network. I have been using stunnel for some time on the IPv4 network but now that I have IPv6 access I can't work out how to get stunnel to listen on that interface as well. I checked that my stunnel has IPv6 support:- /usr/sbin/stunnel -version stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I have a configuration like this: [pop3s] accept = 995 connect = 110 But when I do netstat I can see that it is only listening for port 995 on IPv4... netstat -an | grep 995 tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN netstat -an -A inet6 | grep 995 And of course when I connect to port 995 over the IPv6 network I get "connection refused". Any ideas how to get stunnel to listen on the v6 address? Thanks ! -- View this message in context: http://old.nabble.com/How-to-get-stunnel-to-listen-on-an-IPv6-interface--tp… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users