- stunnel-users - stunnel.org

Re: [stunnel-users] Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Leandro Avila 04 May '11

04 May '11

Hi Laurent, Good to see you figured out the issue. I also learned more things myself. Thanks Jose ! To my knowledge cipher suites that use SHA2 are part of the TLS 1.2 specification but I don't think OpenSSL has that implemented. Cheers ---------------- Leandro Avila ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wednesday, May 4, 2011 11:02 AM Subject: [stunnel-users] Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Hi everyone, It's ok now i have found the solution i add the root and intermediate certificate of verisign in my Capath and i use in s_client the option -CApath and now it's ok : New, TLSv1/SSLv3, Cipher is DES-CBC-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : DES-CBC-SHA Session-ID: XXXXXXXXXXX Session-ID-ctx: Master-Key: XXXXXXXXXXXXXXXXXXXX Key-Arg : None Start Time: 1304524805 Timeout : 7200 (sec) Verify return code: 0 (ok) but i have another question: How can i test the SHA-2? i search the cipher corresponding in SHA-2 but i didn't found it. Thanks for your help. Regards, Laurent UK Laurent UK Analyste PROTOCOLES RBIS - DBF PBMF2 DOMAINE PMF202 ELECTRONIC FILES 41, rue de Valmy - 93100 Montreuil - ACI CME04B1 Bureau 4226 Tel: 01.58.16.86.45 (68645) 04/05/2011 15:36 Pour josealf(a)rocketmail.com cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHALien Jose, thanks you, i use my client certificate but have another error now : 1028202:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1028202:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: Enter pass phrase for /opt/freeware/etc/stunnel/keystore/crl-3skey.pem: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write certificate verify A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3 1 s:/C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts i:/O=SWIFT --- Server certificate -----BEGIN CERTIFICATE----- XXXXXXXXXXXXXXXXXX -----END CERTIFICATE----- subject=/C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3 --- No client certificate CA names sent --- SSL handshake has read 2633 bytes and written 1732 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : AES256-SHA Session-ID: XXXXXXXXXXXXXXXXXX Session-ID-ctx: Master-Key: XXXXXXXXXXXXXXXXXX Key-Arg : None Start Time: 1304515751 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) --- Do you know the reason of this error? Maybe i have to add the first certificate file to a specific folder ? Regards, Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 15:09 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, We need to present a client certificate to the server. That's the important part missing. Do that by adding -cert your_cert_filename to the command, like: openssl s_client -ssl3 -state -cert your_client_cert_filename -connect your-stunnel-ip:10443 See http://www.openssl.org/docs/apps/s_client.html Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 6:55:19 AM Subject: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, thanks you for your response, i use the openssl s_client command but i have the following error : 1499296:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1499296:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL3 alert write:warning:no certificate SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL3 alert read:fatal:handshake failure SSL_connect:failed in SSLv3 read finished A 1499296:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1060:SSL alert number 40 1499296:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: is it normal? Thanks. Regards. Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 13:38 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Ideally, you should terminate the SSL connection on your final server. But that's not the problem here. It should work as is. Mosty likely the problem is on the client SSL software you are using to connect to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and TLSv1. Can you force your client to use those protocols? Maybe it is trying to negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text? You can test your connection to stunnel server with openssl s_client command. Example openssl s_client -ssl3 -state -connect your-stunnel-ip:10443 openssl s_client -tls1 -state -connect your-stunnel-ip:10443 if this works, we found the culprit. Regards Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 2:05:07 AM Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, I use 2 servers in my configuration: the first one who listenning on the port 10443 (where we receive encrypted traffic from software using ssl) and the second one who listenning the port 10016 (where we receive decrypted traffic). The first one receive the encrypted traffic, it decrypted it and send it to the second server that's why i only use the server mode on my fist server. Do you think that i also need to change this configuration? Cordialement, Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 19:18 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 04 May '11

04 May '11

Laurent, Everything looks fine to me. Your were connected to the server using SSLv3 and AES256-SHA ciphers. The zlib error can be ignored. Message "Verify return code: 21 (unable to verify the first certificate)" indicates that openssl s_client was unable to verify the server certificate. You can get rid of this by giving the CAPath in the paremters and making sure the verisign root Ca cert is there. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 8:36:16 AM Subject: Réf. : Re: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, thanks you, i use my client certificate but have another error now : 1028202:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1028202:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: Enter pass phrase for /opt/freeware/etc/stunnel/keystore/crl-3skey.pem: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write certificate verify A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A --- Certificate chain 0 s:/C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3 1 s:/C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts i:/O=SWIFT --- Server certificate -----BEGIN CERTIFICATE----- XXXXXXXXXXXXXXXXXX -----END CERTIFICATE----- subject=/C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3 --- No client certificate CA names sent --- SSL handshake has read 2633 bytes and written 1732 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : AES256-SHA Session-ID: XXXXXXXXXXXXXXXXXX Session-ID-ctx: Master-Key: XXXXXXXXXXXXXXXXXX Key-Arg : None Start Time: 1304515751 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) --- Do you know the reason of this error? Maybe i have to add the first certificate file to a specific folder ? Regards, Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 15:09 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, We need to present a client certificate to the server. That's the important part missing. Do that by adding -cert your_cert_filename to the command, like: openssl s_client -ssl3 -state -cert your_client_cert_filename -connect your-stunnel-ip:10443 See http://www.openssl.org/docs/apps/s_client.html Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 6:55:19 AM Subject: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, thanks you for your response, i use the openssl s_client command but i have the following error : 1499296:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1499296:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL3 alert write:warning:no certificate SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL3 alert read:fatal:handshake failure SSL_connect:failed in SSLv3 read finished A 1499296:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1060:SSL alert number 40 1499296:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: is it normal? Thanks. Regards. Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 13:38 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Ideally, you should terminate the SSL connection on your final server. But that's not the problem here. It should work as is. Mosty likely the problem is on the client SSL software you are using to connect to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and TLSv1. Can you force your client to use those protocols? Maybe it is trying to negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text? You can test your connection to stunnel server with openssl s_client command. Example openssl s_client -ssl3 -state -connect your-stunnel-ip:10443 openssl s_client -tls1 -state -connect your-stunnel-ip:10443 if this works, we found the culprit. Regards Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 2:05:07 AM Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, I use 2 servers in my configuration: the first one who listenning on the port 10443 (where we receive encrypted traffic from software using ssl) and the second one who listenning the port 10016 (where we receive decrypted traffic). The first one receive the encrypted traffic, it decrypted it and send it to the second server that's why i only use the server mode on my fist server. Do you think that i also need to change this configuration? Cordialement, Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 19:18 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Re: [stunnel-users] Réf. : Re: Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 04 May '11

04 May '11

Laurent, We need to present a client certificate to the server. That's the important part missing. Do that by adding -cert your_cert_filename to the command, like: openssl s_client -ssl3 -state -cert your_client_cert_filename -connect your-stunnel-ip:10443 See http://www.openssl.org/docs/apps/s_client.html Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 6:55:19 AM Subject: Réf. : Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, thanks you for your response, i use the openssl s_client command but i have the following error : 1499296:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:162:filename(libz.so): Could not load module . System error: No such file or directory 1499296:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=27:certificate not trusted verify return:1 depth=0 /C=FR/ST=PARIS/L=PARIS/O=BNP PARIBAS/OU=RBIS_PMF202/CN=psp-exp.bnpparibas.com verify error:num=21:unable to verify the first certificate verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL3 alert write:warning:no certificate SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL3 alert read:fatal:handshake failure SSL_connect:failed in SSLv3 read finished A 1499296:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1060:SSL alert number 40 1499296:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: is it normal? Thanks. Regards. Laurent UK Internet josealf(a)rocketmail.com 04/05/2011 13:38 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Ideally, you should terminate the SSL connection on your final server. But that's not the problem here. It should work as is. Mosty likely the problem is on the client SSL software you are using to connect to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and TLSv1. Can you force your client to use those protocols? Maybe it is trying to negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text? You can test your connection to stunnel server with openssl s_client command. Example openssl s_client -ssl3 -state -connect your-stunnel-ip:10443 openssl s_client -tls1 -state -connect your-stunnel-ip:10443 if this works, we found the culprit. Regards Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 2:05:07 AM Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, I use 2 servers in my configuration: the first one who listenning on the port 10443 (where we receive encrypted traffic from software using ssl) and the second one who listenning the port 10016 (where we receive decrypted traffic). The first one receive the encrypted traffic, it decrypted it and send it to the second server that's why i only use the server mode on my fist server. Do you think that i also need to change this configuration? Cordialement, Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 19:18 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Re: [stunnel-users] Réf. : Re: Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 04 May '11

04 May '11

Laurent, Ideally, you should terminate the SSL connection on your final server. But that's not the problem here. It should work as is. Mosty likely the problem is on the client SSL software you are using to connect to stunnel. The cipher you are trying to use DESC-CBC-SHA works with SSLv3 and TLSv1. Can you force your client to use those protocols? Maybe it is trying to negotiate SSLv2. Also are you sure it is speaking SSL instead of plain text? You can test your connection to stunnel server with openssl s_client command. Example openssl s_client -ssl3 -state -connect your-stunnel-ip:10443 openssl s_client -tls1 -state -connect your-stunnel-ip:10443 if this works, we found the culprit. Regards Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Wed, May 4, 2011 2:05:07 AM Subject: Réf. : Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Jose, I use 2 servers in my configuration: the first one who listenning on the port 10443 (where we receive encrypted traffic from software using ssl) and the second one who listenning the port 10016 (where we receive decrypted traffic). The first one receive the encrypted traffic, it decrypted it and send it to the second server that's why i only use the server mode on my fist server. Do you think that i also need to change this configuration? Cordialement, Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 19:18 Pour Laurent UK cc stunnel-users(a)stunnel.org, stunnel-users-bounces(a)stunnel.org Objet Re: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Re: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 03 May '11

03 May '11

Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Re: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Leandro Avila 03 May '11

03 May '11

Hi, If you have control of both ends of the connection make sure your SSL version is consistent on both sides. I would not recomend using sslVersion = all Either set it to SSLv3 or TLSv1 DES-CBC-SHA is supported under those However, judging for the cipher you are choosing I assume you might be dealing with a legacy application and you might not have access to both ends of the connection. I would try setting only one version at the time and moving down from TLSv1, SSLv3 and SSLv2 sslVersion = ciphers = DES-CBC-SHA Cheers ----------------- Leandro Avila ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tuesday, May 3, 2011 10:48 AM Subject: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

stunnel 4.36 released
by Michal Trojnara 03 May '11

03 May '11

Dear Users, Version 4.36 of stunnel was released. The ChangeLog entry: Version 4.36, 2011.05.03, urgency: LOW: * New features - Updated Win32 DLLs for OpenSSL 1.0.0d. - Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint. - Strict public key comparison added for "verify = 3" certificate checking mode (thx to Philipp Hartwig). - Backlog parameter of listen(2) changed from 5 to SOMAXCONN: improved behavior on heavy load. - Example tools/stunnel.service file added for systemd service manager. * Bugfixes - Missing pthread_attr_destroy() added to fix memory leak (thx to Paul Allex and Peter Pentchev). - Fixed the incorrect way of setting FD_CLOEXEC flag. - Fixed --enable-libwrap option of ./configure script. - /opt/local added to OpenSSL search path for MacPorts compatibility. - Workaround implemented for signal handling on MacOS X. - A trivial bug fixed in the stunnel.init script. - Retry implemented on EAI_AGAIN error returned by resolver calls. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.36.tar.gz: 3483fc2011e8a9d2614a93a9dbf7eabf405044df3566f29144fe2d1dd37a35f5 Best regards, Mike

3 2

Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by josealf＠rocketmail.com 03 May '11

03 May '11

Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Temporary failure in name resolution (Michal Trojnara)
by Phil Wieland 29 Apr '11

29 Apr '11

I attach two strace reports, strace-good shows a successful use, strace-bad shows it failing after a reboot. In both cases I just telnet to localhost 55899, which gives the smtp server's banner in the good case. ltrace craps out with a [pid 1107] +++ killed by SIGTRAP +++ in both cases, and doesn't show anything useful. These are WITHOUT the suggested patch, I am not really equipped for building on this server. Phil

2 1

Re: [stunnel-users] Réf. : Re: Tr : Réf. : Re: Need some informations about stunnel(AC,?crl ?files)
by Ludolf Holzheid 29 Apr '11

29 Apr '11

On Fri, 2011-04-29 15:39:45 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear Ludolf thank you for your response. > > I have another question. > > Is it possible to have 2 stunnel running on the same server? > > 1 stunnel with no client's certificate verification (verify = 0) with a > specific port > > and 1 stunnel with client's certificate verification (verify = 3) with > other specific port You may run as many instances of stunnel as you like, as long as they don't share listening ports (accept=...) or pid files (pid=...). Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Tr : Réf. : Re: Need some informations about stunnel (AC,?crl?files)
by Ludolf Holzheid 28 Apr '11

28 Apr '11

On Thu, 2011-04-28 17:06:28 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear Ludolf i need some help with the verify option. > > I want to check the certificate client in my machine and also check if the > certificate's client is in the crl list. > > You said that " > If you are using verify=3, stunnel checks client certificates against > the set of certificates in CApath or CAfile, not against CAs and CRLs." > > Is it possible to check client certificates with certificates in CaPath > and also with CRls? Laurent, By installing a certificate (to CApath or CAfile), you express your trust in the certificate. For the client certificates, you could either o implicitly trust all certificates signed by an installed CA certificate and not yet revoked (verify=2), or o explicitly trust installed client certificates (verify=3). In both cases, all installed certificates are fully trusted. Cross-checking a trusted (client-) certificate against an other trusted (CA-) certificate does not raise security or trustworthiness. In order to revoke a client certificate in verify=3 mode, just uninstall it. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Delay before sending server hello
by Dan Price 28 Apr '11

28 Apr '11

I am using stunnel to accept TLS connections. I'm opening eight connections at virtually the same time, and occasionally see that for one of the connections, the handshake does not complete - stunnel does not send the server hello, and the client usually resets the connection. I did manage to capture one instance where stunnel sends the server hello, but it is delayed by over a minute. I upgraded to version 4.35, and I see the same behavior. I set debug=debug, and captured what I think are the relevant logs (through write server hello). I kept the logs for the successful connection (59924) that came in after the failed one (59923). Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=15 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=15 from ::ffff:10.50.2.11:59923 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=16 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=16 from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Acquired libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Releasing libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Released libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG5[10357:1433471888]: Service msrp accepted connection from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): before/accept initialization Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 read client hello A Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 write server hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Acquired libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Releasing libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Released libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG5[10357:1431989136]: Service msrp accepted connection from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): before/accept initialization Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 read client hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 write server hello A Thanks, Dan

1 0

Does stunnel support startTLS?
by Markus Borst 28 Apr '11

28 Apr '11

Stunnel supports encryption in the "old" ssl style extra port configuration (i.e. imaps on port 993) where the encryption is negotiated immediately upon start of the connection. Does stunnel also support the startTLS method? i.e. a clear text connection is established (imap on port 143) and one of the first imap commands is startTLS, which negotiates the encryption and protects the connection from that time onwards. I know that supporting startTLS is a lot harder, since it means sniffing commands in the higher level protocol, but we need it nevertheless. (In fact, our imap server does support startTLS, but it does _not_ support importing an external certificate, which is why I'm looking for an external solution.) From reading the documentation I'm not sure whether stunnel supports startTLS, there are a few option descriptions which might point to startTLS, but I'm not sure. Anybody knows the definite answer? Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersenstrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 3

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 28 Apr '11

28 Apr '11

Thx for continuing reply my msg, Yes, there is var/log/messages Inside there only has some iptables log, FTP, SMTP application log and nothing else. I am positive that this problem is not cause by iptables, becuase I tried with iptables off. Nothing else related to stunnel is found in that folder. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 20:00:30 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > I guess in centos that's /var/log/messages > but in general, you should probably check everything in /var/log to make sure. > > On Mon, Apr 25, 2011 at 5:38 PM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > Thank you for helping, but both logs r not presented in my var/log/ dir. Any > > other suggestions? > > > > > > Mr. Jack > > > > > > > > > > > >> From: sunyucong(a)gmail.com > >> Date: Mon, 25 Apr 2011 16:25:20 -0700 > >> Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): > >> before/accept initialization > >> To: jackliu92(a)hotmail.com > >> CC: stunnel-users(a)stunnel.org > >> > >> Are you sure that's entire log? check /var/log/daemons.log and > >> syslog.log as well. > >> > >> On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > >> > It anyone knows how to fix Stunnel stuck at SSL state (accept): > >> > before/accept initialization??? > >> > > >> > Here is the log: > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes > >> > to > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims > >> > sufficient > >> > entropy for the PRNG > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > >> > /etc/stunnel/CA > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > >> > /etc/stunnel/CRL > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > >> > service 3proxy > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > >> > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > >> > Sockets:POLL,IPv6 Auth:LIBWRAP > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > >> > changed with 'ulimit -n') > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > >> > limit for file descriptors > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > >> > accept socket > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to > >> > 0.0.0.0:30001 > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > >> > /var/run/stunnel.pid > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > >> > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > >> > with code 0 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > >> > xx.xxx.xxx.xx:41165 permitted by libwrap > >> > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > >> > before/accept initialization <-----------------------Stuck here > >> > forever!!! > >> > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > >> > disconnected > >> > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes > >> > sent > >> > to SSL, 0 bytes sent to socket > >> > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > >> > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; > >> > terminating > >> > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > >> > /var/run/stunnel.pid > >> > [root@vps1 ~]# > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > stunnel.conf: > >> > cert = /etc/stunnel/stunnel.pem > >> > key = /etc/stunnel/stunnel.pem > >> > CApath = /etc/stunnel/CA > >> > CRLpath = /etc/stunnel/CRL > >> > debug = 7 > >> > foreground = yes > >> > verify = 1 > >> > # > >> > [3proxy] > >> > accept = 30001 > >> > connect = 127.0.0.1:33135 > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > > >> > I am hosting with CentOS 5.5, and installed Stunnel via yum. > >> > Planning to use it with 3Proxy. However I experience the problem above, > >> > can > >> > someone please help with that? > >> > Thank you very much! > >> > > >> > > >> > > >> > Mr. Jack > >> > > >> > _______________________________________________ > >> > stunnel-users mailing list > >> > stunnel-users(a)stunnel.org > >> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >> > > >> > > >

3 6

Patch to enhance verify=3 with SHA-1 check
by Philipp Hartwig 27 Apr '11

27 Apr '11

As indicated in a previous mail to this list I was surprised by the following behavior: With "verify=3" stunnel doesn't compare the peer's certificate with the locally installed certificate for actual equality but it only checks whether they have the same subject. The recent Comodo incident[1] has shown that it is not impossible to get a certificate which matches the subject of the certificate of some interesting server and is signed by a trusted CA. That's why I was interested in a stricter form of verification (at least in client mode). I have attached a small patch, derived from code in the file "mutt_ssl.c" of the Mutt[2] mail client, which adds a check for equality of SHA-1 hashes to the "verify=3" certificate check. I mainly wrote it for personal use but maybe someone else will find it useful or has some comments. Regards, Philipp [1] http://blog.mozilla.com/security/2011/03/25/comodo-certificate-issue-follow… [2] http://www.mutt.org/

1 0

Re: [stunnel-users] Réf. : Re: Need some informations about stunnel (AC,?crl?files)
by Ludolf Holzheid 27 Apr '11

27 Apr '11

On Wed, 2011-04-27 13:06:43 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear ludolf thanks you for your response. > > So if i use verify = 3, the crl files is useless. > > I went to the url http://crl.verisign.com , and there were a lot of files. > > what are the files corresponding of the crl list please? Those with the ".crl" extension, I suppose ;-) You'll need to look for the CRLs matching the certificates you want to use. Note, there may be CRLs for intermediate certificates too. At least (the randomly selected) Class3SoftwarePublishers.crl seems to be in DES format, you might have to convert it to PEM for use with stunnel. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Need some informations about stunnel (AC, crl files)
by Ludolf Holzheid 27 Apr '11

27 Apr '11

On Wed, 2011-04-27 10:47:42 +0200, laurent.uk(a)bnpparibas.com wrote: > Hi all, > > I need some informations about stunnel. > > First, when the client's software use a certificate signed by a CA like > veriSign. Did we need to add the certificates of this CA? or it is not > neccessary because it is a knowned CA. If you are using verify=3, stunnel checks client certificates against the set of certificates in CApath or CAfile, not against CAs and CRLs. In order to have stunnel check the certificate chain of client certificates, you'll have to use verify=2. For that, stunnel needs access to the CA's root certificate and the intermediate certificates (i.e. they have to be locally installed to CApath/CAfile). > Secondally, i need to download and update the crl files, and also (if it's > possible) the certificates of knowed CA. How can i do that in my AIX's > machine please? This depends on the way the CA publishes its certificates and CRLs. For VeriSign, my first idea is to use wget to download them from http://crl.verisign.com. There may be better ways, though. And I don't know AIX. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] need help for the error VERIFY ERROR ONLY MY: no cert fo (verify = 3)
by Ludolf Holzheid 26 Apr '11

26 Apr '11

On Tue, 2011-04-26 17:00:06 +0200, laurent.uk(a)bnpparibas.com wrote: > Hi, > > I tried to configure my STUNNEL server, with my client's software test but > i always have the the following error : > > 2011.04.26 14:23:09 LOG4[1683500:258]: VERIFY ERROR ONLY MY: no cert for > /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts > > [..] > > I tried to extract the public certificate from the crl-3skey-ebics-ts and > add it in the keystore and in the folder /usr/local/ssl/certs/trusted/ > > [..] > > verify = 3 > ; Don't forget to c_rehash CApath > ; CApath is located inside chroot jail > ;CApath = /opt/freeware/etc/stunnel/ > ; It's often easier to use CAfile > CAfile = /opt/freeware/etc/stunnel/ca.pem > ; Don't forget to c_rehash CRLpath Laurent, If you specify a CAfile in 'verify=3' mode, you need to add the client's certificates to this file. You could also store the client's certificates in PEM format files (one file per certificate) in a directory stunnel can reach at connection time. You have to specify the name of this directory as CApath then (in contrast to CAfile), and you'll have to run c_rehash on this directory. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Temporary failure in name resolution
by Phil Wieland 26 Apr '11

26 Apr '11

I think I've done something stupid but I can't work out what. I'm running stunnel4 version 4.29 on an Ubuntu server box, using it to tunnel smtp connections to my ISP's mail server. Everything works perfectly until I reboot the server, when it stops working. In syslog, I get: Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: ssmtp accepted connection from 127.0.0.1:50681 Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: Error resolving 'smtp.blueyonder.co.uk': Temporary failure in name resolution (EAI_AGAIN) Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: No host resolved Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket every time I attempt to send mail. I can ping smtp.blueyonder.co.uk no problem. The problem persists until I restart stunnel4, after which it works perfectly for weeks on end. Looking at syslog for boot time, it looks like stunnel tries to resolve smtp.blueyonder.co.uk as soon as it starts, but dhcp hasn't finished at this time so it fails. It seems to cache something from the failure and not try again? Even though the error is "Temporary". All advice gratefully received. Phil Wieland Liverpool, UK. ###@friedbread:~$ stunnel4 -version stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ###@friedbread:~$ cat /etc/stunnel/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 55899 connect = smtp.blueyonder.co.uk:465 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini ###@friedbread:~$

3 2

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 26 Apr '11

26 Apr '11

Thank you for helping, but both logs r not presented in my var/log/ dir. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 16:25:20 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > Are you sure that's entire log? check /var/log/daemons.log and > syslog.log as well. > > On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > It anyone knows how to fix Stunnel stuck at SSL state (accept): > > before/accept initialization??? > > > > Here is the log: > > ----------------------------------------------------------------------------------------------------------- > > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient > > entropy for the PRNG > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > > /etc/stunnel/CA > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > > /etc/stunnel/CRL > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > > service 3proxy > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > > Sockets:POLL,IPv6 Auth:LIBWRAP > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > > changed with 'ulimit -n') > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > > limit for file descriptors > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > > accept socket > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > > /var/run/stunnel.pid > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > > with code 0 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > > xx.xxx.xxx.xx:41165 permitted by libwrap > > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > > before/accept initialization <-----------------------Stuck here > > forever!!! > > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > > disconnected > > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent > > to SSL, 0 bytes sent to socket > > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating > > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > > /var/run/stunnel.pid > > [root@vps1 ~]# > > ----------------------------------------------------------------------------------------------------------- > > stunnel.conf: > > cert = /etc/stunnel/stunnel.pem > > key = /etc/stunnel/stunnel.pem > > CApath = /etc/stunnel/CA > > CRLpath = /etc/stunnel/CRL > > debug = 7 > > foreground = yes > > verify = 1 > > # > > [3proxy] > > accept = 30001 > > connect = 127.0.0.1:33135 > > ----------------------------------------------------------------------------------------------------------- > > > > I am hosting with CentOS 5.5, and installed Stunnel via yum. > > Planning to use it with 3Proxy. However I experience the problem above, can > > someone please help with that? > > Thank you very much! > > > > > > > > Mr. Jack > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

I installed the 4.35 one into my CentOS, it seems like the same problem still exist. Is there anything I can do to fix it? Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

Thank you! Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 25 Apr '11

25 Apr '11

It anyone knows how to fix Stunnel stuck at SSL state (accept): before/accept initialization??? Here is the log: ----------------------------------------------------------------------------------------------------------- [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient entropy for the PRNG 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to /etc/stunnel/CA 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to /etc/stunnel/CRL 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for service 3proxy 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be changed with 'ulimit -n') 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE limit for file descriptors 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on accept socket 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file /var/run/stunnel.pid 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished with code 0 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from xx.xxx.xxx.xx:41165 permitted by libwrap 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): before/accept initialization <-----------------------Stuck here forever!!! 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly disconnected 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file /var/run/stunnel.pid [root@vps1 ~]# ----------------------------------------------------------------------------------------------------------- stunnel.conf: cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem CApath = /etc/stunnel/CA CRLpath = /etc/stunnel/CRL debug = 7 foreground = yes verify = 1 # [3proxy] accept = 30001 connect = 127.0.0.1:33135 ----------------------------------------------------------------------------------------------------------- I am hosting with CentOS 5.5, and installed Stunnel via yum. Planning to use it with 3Proxy. However I experience the problem above, can someone please help with that? Thank you very much! Mr. Jack

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

Possible leak in client.c:init_ssl()
by Sven Ulland 16 Apr '11

16 Apr '11

Quick summary: Stunnel 4.35 configured with four services. As clients connect, the main stunnel process grows a lot in vsz/rss memory. With a lot of clients connecting, it quickly grows to several gigabytes rss. The use case is quite special: The multithreaded download accelerator 'axel' is used to download large files using 800 simultaneous threads. The downloads are from China, so the network performance is horrible, and connections are reset/broken all the time, so there is lots of new connections created constantly. Up to four axel instances run at the same time, so we're talking 3200 simultaneous connections. Over a short 2h timespan, nearly 30000 connections have been set up (ref attached stunnel.log). The memory use increases over time, often in very large steps. As connections finish and the transfers stop (i.e. no active connections at all), the memory is not released. A similar issue was reported in 2008 [1]. Attached are the following files: stunnel.conf: Four services, no special config. Debug level 5. massif.out.excerpt.txt: Valgrind Massif output. The Massif log indicates that most of the memory is allocated through client.c:init_ssl(), by libssl and zlib. I haven't looked too much at the code yet, but could this be related to the high rate of connection resets/timeouts, combined with connection/session reuse? sven [1]: possible stunnel memory leak Message-ID: <47E8E0AD.8010709(a)eu.citrix.com> http://www.stunnel.org/pipermail/stunnel-users/2008-March/001903.html

4 5