stunnel-users

1 participants
3315 discussions

STunnel and the MAC
by Bryan Bearden 15 Apr '06

15 Apr '06

I am working on setting up a mac server and having trouble getting the stunnel to work on the mac. I installed Darwin Ports and am running it under there. It appears to be running and my stunnel.conf file appears to be correct, but I cannot get it to use stunnel. Any ideas? I'm trying to connect to MySQL 4. thanks... Bryan

1 0

Choosing local 'source' IP? (again)
by Don Werve 14 Apr '06

14 Apr '06

This is a repost, but the response I got last time said, 'use the "local" option'...which does not appear to work. Ok, so here's the problem: I've got stunnel handling SSL for a web-based service that is otherwise too stupid to be able to talk https. On the same piece of hardware that runs this service (Virtuozzo if you must know), I've set up stunnel to listen to ETH0_IP:443 and wrapper them to ETH0_IP:80, which is where VZ listens. This works wonderfully. Unfortunately, I need to set up a redirection rule inside this service that bounces people back to the https:// page if they try to come in over http. Since said service isn't managing its own SSL, I have no solid way of determining which connections are wrappered by stunnel and which connections come in over the wire, save for by the IP address of the connection. Now, each piece of iron has two ethernet adapters, so I got the bright idea to try and get stunnel to 'appear' to be connecting from the IP address of the second adapter. So, I set 'local = ETH1_IP' in stunnel.conf, and...nada. Still shows as connecting from ETH0_IP. I've screwed with socket options, read the source code for Stunnel, and so on. Having read the source code and refreshed my knowledge of socket() and connect(), is it really even possible to do what I want if stunnel is running on the same system? Oh, a ptrace of stunnel also yields the following: socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 8 fcntl64(8, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(8, F_SETFL, O_RDWR|O_NONBLOCK) = 0 bind(8, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("[ETH1_IP]")}, 16) = 0 connect(8, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("[ETH0_IP]")}, 16) = -1 EINPROGRESS (Operation now in progress) ...and the connection inside of $CRAP_SYSTEM shows the connection as coming from ETH0_IP. So, I'm kind of at my wits' end here. Any possible way to make this work? Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

stunnel4 stealing my ports (listening on ports it shouldn't be)
by Eric Brown 12 Apr '06

12 Apr '06

I have two stunnel processes. One listing on 443 -> localhost:80. The other listening on 8000 -> localhost:7001. (See configs below.) However, when I stop the process listening on port 7001, both stunnel processes start listening on 7001 (and a few other ports). I'm completely confused as to why this would happen. This is what I see normally: mta4-tiny-support (epgate)[6]$ sudo lsof -p 25253 -p 25255 -a -i4 Password: COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME stunnel4 25253 root 6u IPv4 3439450 TCP *:8000 (LISTEN) stunnel4 25255 root 6u IPv4 3439456 TCP *:https (LISTEN) This is what I see when stunnel appears to go bizerk: (after stopping the process that was listening on ports *:7000, localhost:7001 & localhost:7005) COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME stunnel4 22788 root 5u IPv4 1269640 TCP 127.0.0.1:4341- >127.0.0.1:19996 (CLOSE_WAIT) stunnel4 22788 root 6u IPv4 1273504 TCP 127.0.0.1:7001 (LISTEN) stunnel4 22788 root 7u IPv4 1273476 TCP 127.0.0.1:4606- >127.0.0.1:19995 (ESTABLISHED) stunnel4 22788 root 9u IPv4 1273477 TCP 127.0.0.1:19995- >127.0.0.1:4606 (ESTABLISHED) stunnel4 22788 root 11u IPv4 1273507 TCP *:7000 (LISTEN) stunnel4 22788 root 17u IPv4 1273515 TCP 127.0.0.1:7005 (LISTEN) stunnel4 22788 root 19u IPv4 1274895 TCP 127.0.0.1:7001- >127.0.0.1:1793 (CLOSE_WAIT) stunnel4 22788 root 24u IPv4 1275089 TCP *:8000 (LISTEN) stunnel4 22790 root 5u IPv4 1269640 TCP 127.0.0.1:4341- >127.0.0.1:19996 (CLOSE_WAIT) stunnel4 22790 root 6u IPv4 1273504 TCP 127.0.0.1:7001 (LISTEN) stunnel4 22790 root 7u IPv4 1273476 TCP 127.0.0.1:4606- >127.0.0.1:19995 (ESTABLISHED) stunnel4 22790 root 9u IPv4 1273477 TCP 127.0.0.1:19995- >127.0.0.1:4606 (ESTABLISHED) stunnel4 22790 root 11u IPv4 1273507 TCP *:7000 (LISTEN) stunnel4 22790 root 17u IPv4 1273515 TCP 127.0.0.1:7005 (LISTEN) stunnel4 22790 root 19u IPv4 1274895 TCP 127.0.0.1:7001- >127.0.0.1:1793 (CLOSE_WAIT) stunnel4 22790 root 24u IPv4 1275094 TCP *:443 (LISTEN) Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 127.0.0.1:7008 0.0.0.0:* LISTEN 0 1281907 24848/python tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 0 1275089 22788/stunnel4 tcp 0 0 0.0.0.0:1025 0.0.0.0:* LISTEN 0 1681 - tcp 0 0 0.0.0.0:963 0.0.0.0:* LISTEN 0 1556 1205/rpc.statd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 0 1238 986/portmap tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 0 1281911 24848/python tcp 0 0 127.0.0.1:7025 0.0.0.0:* LISTEN 0 1281130 24605/master tcp 0 0 127.0.0.1:7026 0.0.0.0:* LISTEN 0 1281542 24677/python tcp 0 0 0.0.0.0:818 0.0.0.0:* LISTEN 0 1356 1061/ypbind tcp 0 0 127.0.0.1:7027 0.0.0.0:* LISTEN 0 1281731 24777/python tcp 0 0 127.0.0.1:7028 0.0.0.0:* LISTEN 0 1281910 24848/python tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 1486 1195/sshd tcp 0 0 0.0.0.0:7000 0.0.0.0:* LISTEN 0 1273507 22788/stunnel4 tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 400 1269115 20559/postmaster tcp 0 0 172.16.80.213:25 0.0.0.0:* LISTEN 0 1281126 24605/master tcp 0 0 172.16.80.212:25 0.0.0.0:* LISTEN 0 1280994 24584/master tcp 0 0 127.0.0.1:7001 0.0.0.0:* LISTEN 0 1273504 22788/stunnel4 tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 0 1275094 22790/stunnel4 tcp 0 0 127.0.0.1:955 0.0.0.0:* LISTEN 0 1518 1201/famd tcp 0 0 127.0.0.1:7005 0.0.0.0:* LISTEN 0 1273515 22788/stunnel4 tcp 0 0 127.0.0.1:7006 0.0.0.0:* LISTEN 0 1281540 24677/python tcp 0 0 127.0.0.1:7007 0.0.0.0:* LISTEN 0 1281724 24777/python I'm running stunnel 4.09 on Debian 3.1/Linux 2.6 Kernel. My configurations are: pid=/var/run/epgate_admin_stunnel4.pid cert=/epgate/etc/ssl/admin.stunnel [Admin] accept=8000 connect=7001 and: pid=/var/run/epgate_quarantine_stunnel4.pid cert=/epgate/etc/ssl/quar.stunnel [Quarantine] accept=443 connect=80

1 0

Deamon signal on close connection
by Ondra Medek 05 Apr '06

05 Apr '06

Hi, I'm using stunnel4 in daemon mode. It runs a bash script "service" for each connection. I want to stop the script, when the client closes the connection. Does the stunnel4 send any signal to child process when the connection is closed? My script receives no signal. Or is it a problem of bash? The only way how can the script find, that connection is broken is by reading the standart input, but I don't want to read any standart input. Thanks P.S. a snip of stunnel4 config: [aswconsole] accept = 1002 exec = /home/ondrejm/SeptimOS/ServerConsole/aswc-new/opt/asw/console/service

1 0

Having problems with an special configuration
by Michael Spiegle 04 Apr '06

04 Apr '06

Hi all, I've got a strange thing (at least I think so) that i'm trying to do with stunnel and it doesn't work. Here's the layout... Feel free to skip the next 3 paragraphs to get to the root of the problem: I'm using stunnel to provide SSL for a set of webservers behind a pair of LVS loadbalancers using keepalived. lets say I have a public IP of 10.0.0.1. I have an iptables rule which marks all 443 traffic to this IP with a fwmark, then keepalived dumps the traffic to the stunnel after seeing this fwmark. I have configured LVS to use direct-routing so that the stunnel server can see the original public IP which was requested (so it can serve up the right cert). Now, here is where things break. Internally, lets say stun is setup with an IP 192.168.0.10, and the LVS server has an interface on this VLAN with the IP 192.168.0.5. In my keepalived configuration for the correct fwmark, I dump the traffic to stun on 192.168.0.10. When I test this by creating a connection to the public IP address (10.0.0.1), LVS dumps the traffic to stunnel as planned and stunnel sees something like the following in TCPDUMP: Websurfer's_IP:123131 ----> 10.0.0.1:443 Stunnel refuses to do anything with the traffic. I assumed this was becuase the IP 10.0.0.1 wasn't configured anywhere on the stunnel box itself. I assigned this IP to the loopback interface as an alias, and it still doesn't work. I've straced/debug-logged stunnel and it doesn't do anything - almost like it doesn't think it should service the traffic. If I run netstat - plan, stunnel is listening to 0.0.0.0:443. So, why doesn't stunnel want to do anything with this traffic? uname -a: Linux ssl-server.domain.com 2.4.29-1.2smp #1 SMP Fri Mar 18 15:45:07 EST 2005 i686 unknown Running redhat 7.3. Glibc: glibc-2.2.5-44 glibc-common-2.2.5-44 openssl version: 0.9.6b configuration: cert = /nfs/ssl/pem/default chroot = /nfs certdir = /ssl/pem hashdir = yes pid = /run/stunnel.pid setuid = nobody setgid = nogroup output = /var/log/stunnel.log [https] accept = 443 connect = *:80 httpprotocol = yes TIMEOUTclose = 1 IP on loopback: bash-2.05a# ip addr list 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo inet 10.0.0.1/32 brd 10.0.0.255 scope global lo:0 ... ... ... Michael Spiegle mike(a)nauticaltech.com 310.686.4570

1 0

(stunnel-4.14) poor performance with openssl engine
by Zhuang Yuyao 03 Apr '06

03 Apr '06

Hi, I've just added openssl engine support for Cavium Nitrox lite PCI card. Here are the speed test output: [engine] stands for speed test output with engine [soft] stands for speed test output without engine (openssl internal software implementation used) ~ # openssl speed -evp [rc4|aes256|sha1] [-engine /root/libcavium.so] ...... The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes rc4[engine] 6339.20k 25376.00k 100966.40k 3757056.00k 919961.60k rc4[soft] 6056.66k 7017.34k 7228.37k 7339.13k 7356.14k aes-256-cbc[engine] 3178.40k 25465.60k 50636.80k 194201.60k 2088140.80k aes-256-cbc[soft] 2430.36k 2572.93k 2597.45k 2617.27k 2609.82k sha1[engine] 774.20k 3115.20k 16486.40k 27033.60k 285593.60k sha1[soft] 915.74k 2622.71k 5678.93k 7942.23k 9041.75k ~ # openssl speed rsa [-engine /root/libcavium.so] sign verify sign/s verify/s rsa[soft] 512 bits 0.013810s 0.001349s 72.4 741.2 rsa[soft] 1024 bits 0.079200s 0.004342s 12.6 230.3 sign verify sign/s verify/s rsa[engine] 512 bits 0.000037s 0.000022s 26725.8 45181.5 rsa[engine] 1024 bits 0.000046s 0.000043s 21866.7 23489.1 The speed test shows than using engine is much much faster than software implementations. but while testing with stunnel, the result is really poor. I am still using apache benchmark 2 as the test tool. #ab2 -c 50 -n 100 https://192.168.10.5/test_1k.html (a html file whose size is 1Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_4k.html (a html file whose size is 4Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_50k.html (a html file whose size is 50Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_100k.html (a html file whose size is 100Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_200k.html (a html file whose size is 200Kbytes) Here is the result: Algorithm engine 1K 4K 50K 100K 200K AES-256-CBC+SHA1 no 14.12 13.21 7.92 4.48 2.17 (Requests per second) AES-256-CBC+SHA1 yes 51.10 23.34 7.30 3.12 1.91 (Requests per second) the data says everything. while using engine with stunnel, we got some performance increasement for processing small files, but processing bigger files is even slower than software implementation (it's quite strange, because proccessing large data blocks with hardware engine is assumed to be much faster than proccessing small data blocks). I did the same test for several times, but the result is the same. something I can be sure: 1) while doing stunnel engine test, all of the algorithms are processed by the engine. I can see it by debugging information printed on console screen. 2) the client running ab2 is a AMD64 with 1G RAM, and the web server (apache) used in the test above is an XEON with 2G RAM. so the bottleneck should be neither ab2 nor apache. So here are my questions: Has anyone tried stunnel with a hardware acceleartor? How about the performance? BTW, attached to this mail is a little patch for stunnel-4.14 which allows the engine directive in stunnel.conf to be set to either a engine id or a shared object path refer to the engine (ie. engine = /root/libcavium.so) Best regards, Zhuang Yuyao --- stunnel-4.14/src/ssl.c Thu Oct 27 09:42:54 2005 UTC +++ stunnel/src/ssl.c Tue Mar 28 08:48:03 2006 UTC @@ -122,6 +143,21 @@ } #if (SSLEAY_VERSION_NUMBER >= 0x00907000L) && defined(HAVE_OSSL_ENGINE_H) +static ENGINE *load_dynamic_engine(const char *engine) +{ + ENGINE *e = ENGINE_by_id("dynamic"); + if (e) + { + if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0) + || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) + { + ENGINE_free(e); + e = NULL; + } + } + return e; +} + static void init_engine(void) { ENGINE *e; @@ -133,9 +169,12 @@ } e=ENGINE_by_id(options.engine); if(!e) { + e = load_dynamic_engine(options.engine); + if (!e) { s_log(LOG_ERR, "Engine not found"); exit(1); } + } if(!ENGINE_init(e)) { s_log(LOG_ERR, "Engine can't be initialized"); ENGINE_free(e);

2 1

autostart stunnel at boot
by christof mestdag 03 Apr '06

03 Apr '06

hi is there another solution for booting stunnel without writting a custom rc5 script ? DO i have to make changes to make it works as a daemon? -> stunnel.conf client=yes output=/var/log/stunnel.log [ldaps] accept=localhost:389 connect=192.168.1.101:636

1 0

Re: [stunnel-users] Config for client proxy https (privoxy + stunnel)
by Xavier Cheney 02 Apr '06

02 Apr '06

Hi everybody, I found my mistake !! The process is not good. This is the correct process : browser (localhost:8118) <-> (localhost:8118) privoxy <-web-> server [and] (localhost:8888) stunnel (server:443) So with only privoxy like proxy in my Firefox config - when I ask http://server/page.html , data is modified by privoxy - when I ask https://server/page.html, data is transmitted by privoxy - when I ask http://localhost:888/page.html data is modified by privoxy and the real data transmitted is https://server/page.html , stunnel managing SSL between localhost and server. My new config : [https] accept = 8888 connect = server:443 In fact, it was the stunnel main function that I didn't understand. Sorry :) Thanks to exos, and hope it will help someone, Xavier Xavier Cheney <xav26000(a)yahoo.fr> a écrit : Hi, I wan to customize web page before viewing by my browser Firefox. With "privoxy" (www.privoxy.org) I can modify (proxy filter) HTTP web page, but not HTTPS pages. So, I want to use stunnel, to transfer HTTPS in HTTP between my proxy and server, like this : browser (8118) <-> (8118) privoxy (8888) <-> (8888) stunnel (server:443) <-web-> server This is my stunnel.conf : ---------------------------------------------------- ciphers = RC4-MD5:DES-CBC3-SHA verify = 0 debug = 7 client = yes [https] accept = 8888 connect = server.server.com:443 TIMEOUTclose = 0 ---------------------------------------------------- And my log : ---------------------------------------------------- 2006.03.31 11:40:02 LOG7[3396:2944]: RAND_status claims sufficient entropy for the PRNG 2006.03.31 11:40:02 LOG6[3396:2944]: PRNG seeded successfully 2006.03.31 11:40:02 LOG7[3396:2944]: SSL context initialized for service https 2006.03.31 11:40:02 LOG5[3396:2944]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.03.31 11:40:02 LOG5[3396:2944]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.03.31 11:40:02 LOG5[3396:2952]: No limit detected for the number of clients 2006.03.31 11:40:02 LOG7[3396:2952]: FD 192 in non-blocking mode 2006.03.31 11:40:02 LOG7[3396:2952]: SO_REUSEADDR option set on accept socket 2006.03.31 11:40:02 LOG7[3396:2952]: https bound to 0.0.0.0:8888 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=200 from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3320]: https started 2006.03.31 11:40:07 LOG7[3396:3320]: FD 200 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3320]: https connected from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:3320]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3320]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: waiting 10 seconds 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: connected 2006.03.31 11:40:07 LOG7[3396:3320]: Remote FD=232 initialized 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): before/connect initialization 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server certificate A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server done A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client key exchange A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:07 LOG7[3396:3320]: 1 items in the session cache 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects (SSL_connect()) 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 client renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects (SSL_accept()) 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache hits 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache misses 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache timeouts 2006.03.31 11:40:07 LOG6[3396:3320]: SSL connected: new session negotiated 2006.03.31 11:40:07 LOG6[3396:3320]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2006.03.31 11:40:07 LOG7[3396:3320]: Socket closed on read 2006.03.31 11:40:07 LOG7[3396:3320]: SSL write shutdown 2006.03.31 11:40:07 LOG7[3396:3320]: SSL alert (write): warning: close notify 2006.03.31 11:40:07 LOG7[3396:3320]: SSL_shutdown retrying 2006.03.31 11:40:07 LOG7[3396:3320]: SSL doesn't need to read or write 2006.03.31 11:40:07 LOG6[3396:3320]: s_poll_wait timeout: connection close 2006.03.31 11:40:07 LOG5[3396:3320]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:07 LOG7[3396:3320]: https finished (0 left) 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=220 from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3944]: https started 2006.03.31 11:40:07 LOG7[3396:3944]: FD 220 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3944]: https connected from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:3944]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3944]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3944]: connect_wait: waiting 10 seconds 2006.03.31 11:40:08 LOG7[3396:3944]: connect_wait: connected 2006.03.31 11:40:08 LOG7[3396:3944]: Remote FD=232 initialized 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): before/connect initialization 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:08 LOG7[3396:3944]: 1 items in the session cache 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects (SSL_connect()) 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 client renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects (SSL_accept()) 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 1 session cache hits 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache misses 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache timeouts 2006.03.31 11:40:08 LOG6[3396:3944]: SSL connected: previous session reused 2006.03.31 11:40:08 LOG7[3396:3944]: Socket closed on read 2006.03.31 11:40:08 LOG7[3396:3944]: SSL write shutdown 2006.03.31 11:40:08 LOG7[3396:3944]: SSL alert (write): warning: close notify 2006.03.31 11:40:08 LOG7[3396:3944]: SSL_shutdown retrying 2006.03.31 11:40:08 LOG7[3396:3944]: SSL doesn't need to read or write 2006.03.31 11:40:08 LOG6[3396:3944]: s_poll_wait timeout: connection close 2006.03.31 11:40:08 LOG5[3396:3944]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:08 LOG7[3396:3944]: https finished (0 left) ---------------------------------------------------- Note the first "Socket closed on read". I think the problem is there. The web reply is "Bad Request (Invalid URL)" Where did I do a mistake ? Thanks for answer, Xavier

1 0

Config for client proxy https (privoxy + stunnel)
by Xavier Cheney 31 Mar '06

31 Mar '06

Hi, I wan to customize web page before viewing by my browser Firefox. With "privoxy" (www.privoxy.org) I can modify (proxy filter) HTTP web page, but not HTTPS pages. So, I want to use stunnel, to transfer HTTPS in HTTP between my proxy and server, like this : browser (8118) <-> (8118) privoxy (8888) <-> (8888) stunnel (server:443) <-web-> server This is my stunnel.conf : ---------------------------------------------------- ciphers = RC4-MD5:DES-CBC3-SHA verify = 0 debug = 7 client = yes [https] accept = 8888 connect = server.server.com:443 TIMEOUTclose = 0 ---------------------------------------------------- And my log : ---------------------------------------------------- 2006.03.31 11:40:02 LOG7[3396:2944]: RAND_status claims sufficient entropy for the PRNG 2006.03.31 11:40:02 LOG6[3396:2944]: PRNG seeded successfully 2006.03.31 11:40:02 LOG7[3396:2944]: SSL context initialized for service https 2006.03.31 11:40:02 LOG5[3396:2944]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.03.31 11:40:02 LOG5[3396:2944]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.03.31 11:40:02 LOG5[3396:2952]: No limit detected for the number of clients 2006.03.31 11:40:02 LOG7[3396:2952]: FD 192 in non-blocking mode 2006.03.31 11:40:02 LOG7[3396:2952]: SO_REUSEADDR option set on accept socket 2006.03.31 11:40:02 LOG7[3396:2952]: https bound to 0.0.0.0:8888 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=200 from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3320]: https started 2006.03.31 11:40:07 LOG7[3396:3320]: FD 200 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3320]: https connected from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:3320]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3320]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: waiting 10 seconds 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: connected 2006.03.31 11:40:07 LOG7[3396:3320]: Remote FD=232 initialized 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): before/connect initialization 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server certificate A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server done A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client key exchange A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:07 LOG7[3396:3320]: 1 items in the session cache 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects (SSL_connect()) 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 client renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects (SSL_accept()) 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache hits 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache misses 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache timeouts 2006.03.31 11:40:07 LOG6[3396:3320]: SSL connected: new session negotiated 2006.03.31 11:40:07 LOG6[3396:3320]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2006.03.31 11:40:07 LOG7[3396:3320]: Socket closed on read 2006.03.31 11:40:07 LOG7[3396:3320]: SSL write shutdown 2006.03.31 11:40:07 LOG7[3396:3320]: SSL alert (write): warning: close notify 2006.03.31 11:40:07 LOG7[3396:3320]: SSL_shutdown retrying 2006.03.31 11:40:07 LOG7[3396:3320]: SSL doesn't need to read or write 2006.03.31 11:40:07 LOG6[3396:3320]: s_poll_wait timeout: connection close 2006.03.31 11:40:07 LOG5[3396:3320]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:07 LOG7[3396:3320]: https finished (0 left) 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=220 from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3944]: https started 2006.03.31 11:40:07 LOG7[3396:3944]: FD 220 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3944]: https connected from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:3944]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3944]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3944]: connect_wait: waiting 10 seconds 2006.03.31 11:40:08 LOG7[3396:3944]: connect_wait: connected 2006.03.31 11:40:08 LOG7[3396:3944]: Remote FD=232 initialized 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): before/connect initialization 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:08 LOG7[3396:3944]: 1 items in the session cache 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects (SSL_connect()) 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 client renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects (SSL_accept()) 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 1 session cache hits 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache misses 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache timeouts 2006.03.31 11:40:08 LOG6[3396:3944]: SSL connected: previous session reused 2006.03.31 11:40:08 LOG7[3396:3944]: Socket closed on read 2006.03.31 11:40:08 LOG7[3396:3944]: SSL write shutdown 2006.03.31 11:40:08 LOG7[3396:3944]: SSL alert (write): warning: close notify 2006.03.31 11:40:08 LOG7[3396:3944]: SSL_shutdown retrying 2006.03.31 11:40:08 LOG7[3396:3944]: SSL doesn't need to read or write 2006.03.31 11:40:08 LOG6[3396:3944]: s_poll_wait timeout: connection close 2006.03.31 11:40:08 LOG5[3396:3944]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:08 LOG7[3396:3944]: https finished (0 left) ---------------------------------------------------- Note the first "Socket closed on read". I think the problem is there. The web reply is "Bad Request (Invalid URL)" Where did I do a mistake ? Thanks for answer, Xavier --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta. --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta.

1 0

Stunnel client failed to connect to a server?
by Xia David You -X (xiyou - Varite Inc.＠Cisco) 31 Mar '06

31 Mar '06

Hi, I have a client which is build on stunnel which is failed to talk to a secured server while we can connect to the server with IE as client. We have both Server certificate and Client Certificate. From looking the log, it appears that the IE also got the same failure in the first step, but it did not give up and tried again with "2 1 0.0470 (0.0470) C>S SSLv2 compatible client hello" and successed. so what did we do wrong here? some extra openssl library need to be built in? thanks David Both Sever side SSL dump attached (IE client and Stunnel client).

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users