- stunnel-users - stunnel.org

fips=no
by dominic.schweizer＠zkb.ch 18 Feb '11

18 Feb '11

Hi All, I have the problem that when I start Stunnel, the following error pops up: FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match I now added in my config file: fips=no and it works. My question is now, what is the difference between with fips and without fips? stunnel version 4.34 openssl 0.9.8 redhat 5 Thanks in advance for the answer Regards Dominic Freundliche Grüsse Dominic Schweizer Zürcher Kantonalbank Unix System Engineer, LIOEU Neue Hard 9, 8005 Zürich Telefon 044 292 83 52, Fax 044 292 80 34 Briefadresse: Postfach 8010 Zürich, http://www.zkb.ch Sie drucken dieses E-Mail nicht aus? Die Umwelt dankt! ___________________________________________________________________ Disclaimer : Diese Mitteilung ist nur fuer die Empfaengerin / den Empfaenger bestimmt. Fuer den Fall, dass sie von nichtberechtigten Personen empfangen wird, bitten wir diese hoeflich, die Mitteilung an die ZKB zurueckzusenden und anschliessend die Mitteilung mit allen Anhaengen sowie allfaellige Kopien zu vernichten bzw. zu loeschen. Der Gebrauch der Information ist verboten. This message is intended only for the named recipient and may contain confidential or privileged information. If you have received it in error, please advise the sender by return e-mail and delete this message and any attachments. Any unauthorised use or dissemination of this information is strictly prohibited.

2 1

openvpn with stunnel
by Guy Sapir 17 Feb '11

17 Feb '11

Hi all, Is it possible to use openvpn on port 80 or 443 using stunnel so the packets on openvpn will be wrapped as http or https pure packets. What should I do in the config file. Guy Sapir

2 1

Wireshark didn't show TLSv1 traffic?
by Bao, Robert 17 Feb '11

17 Feb '11

Hi, I have "ciphers = AES256-SHA" option in stunnel.conf file. And when the server/client established the connection, I see this line in the log file: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 However when I use Wireshark to sniff the traffic, I only see "TCP" in the <Protocol> column for the traffics between the server and the client. Is this normal? What did I do wrong? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

2 2

key+cert+dh risks
by Jean-Yves F. Barbier 15 Feb '11

15 Feb '11

Hi list, I'm using stunnel between two machines only, so is there a risk to reuse the server stunnel.pem on the client? (and if it's risky, why?) JY -- Have a coke and a smile! -- John DeLorean

3 6

Confusion regarding part of stunnel.conf
by Dave 12 Feb '11

12 Feb '11

I've set up a test of stunnel with the latest stunnel and latest openssl, and if I set "verify=0" or "verify=1" I can get it to work (I'm tunneling a pop3 session), but if I set it any higher (to 2 or 3) it won't work for me. Now, I'm not sure which level is "necessary" because in stunnel.conf I read: ------------------------- ; authentication stuff needs to be configured to prevent MITM attacks ; it is not enabled by default! ;verify = 2 ------------------------- ... which sounds like verify defaults to 0. But is a verify level of 1 enough to solve the man-in-the-middle problem? It seems like it would not be (since level 1 will allow absence of a certificate), but I am not sure. I guess my questions boil down to: 1) What are the necessary settings for "authentication stuff" to prevent the MITM attack vector mentioned in stunnel.conf? 2) What is the proper way to set up (self-signed) certs to prevent such an attack? Can a self-signed cert be used at a verify level of 2 or 3? Dave

2 11

[patch] Unix socket support for Stunnel
by Stefan Behte 11 Feb '11

11 Feb '11

Hi, yet another request for a patch inclusion... Quoting from http://haproxy.1wt.eu/#down : "This patch contributed by Exceliance adds to stunnel the ability to connect to haproxy over a UNIX stream socket instead of using TCP. Sometimes this can be more convenient and/or more secure. " I think it would be nice to have it upstream. And I hope I am not bothering Michals yet. ;) Best regards, Stefan Behte

1 0

Security Problems with 4.35
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, in the announcement of 4.35, I saw: "CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments." I searched a bit, but did not find an exploit or more information on the severity of this issue. Could someone elaborate the problem a bit? I could diff to the previous version and have a look, but that will take quite some time, and my C is weak... Best regards, Stefan Behte

2 1

use somaxconn in stunnel
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, attached you will find a patch from Thomas Franco to honor SOMAXCONN. It defaults to 128, which is not enough for some setups. It defines the maximum number of requests that can be queued to a listening socket and can be changed with sysctl via net.core.somaxconn. I think it would be nice to have it in stunnel-4.36 to make it usable in bigger installations. It's available online here: https://github.com/op4g/stunnel/commit/e200bebaf92c068aa319c43fdd50cddd6816… Best regards, Stefan Behte

2 4

publish/subscribe with stunnel
by Dam Dam 10 Feb '11

10 Feb '11

Hello, I am having a problem to configure stunnel in a publish/subscribe architecture. Basically, I have a publisher service configured with stunnel as a server. Its configuration is close to: [publisher] accept = p1 connect = 127.0.0.1:p2 This service publishes data to a subscriber. As far I as understood, the subscriber should be configured as a client with stunnel with a configuration close to this: [subscriber] accept = p3 connect = remote:p1 client = yes Now, my problem is that the subscriber does not listen on any port. So p3 does not actually exist. When the subscriber starts, it automatically connects and subscribes to the publisher and waits for data from the publisher service. I would like to secure the connection between the publisher and the subscriber but I am stuck with the configuration. Any ideas? Regards, Damien

2 1

stunnel, haproxy and ssl cert
by Amol 10 Feb '11

10 Feb '11

i got the SSL setup done with the stunnel, but when i connect from the url i always see this entry in my stunnel.log 2011.02.09 14:52:34 LOG3[2433:139832543721216]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing my stunnel config is cert=/etc/stunnel/ssl/group-cert.pem key = /etc/stunnel/ssl/l.key ;setuid = nobody ;setgid = nogroup pid = /etc/stunnel/stunnel.pid debug = 3 output = /etc/stunnel/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=443 connect=80 TIMEOUTclose=0 xforwardedfor=yes i have just got familiar to stunnel to not sure i that error is ok?

2 3

Help with stunnel configuration
by Rohler, Brian L 09 Feb '11

09 Feb '11

I'm looking to see if the windows version of stunnel (4.34) can be executed from a command line and have it configured to connect and accept on different ports?

1 0

X-Forwarded-For / X-Forwarded-Proto
by Stefan Behte 09 Feb '11

09 Feb '11

Hello Michal, I've read that you prefer not to support X-Forwarded-For because an old code had a buffer overflow and did not support keep-alive functions of HTTP/1.1. I believe the overflow was fixed in the newer version of the patch I've attached. IMHO the patch will still be very useful, even if it does not support keep-alive: often in high-performence setups keep-alive is not even desired because it fills up ressources needlessly. Even if this does not provide all features, a lot of people would be satisfied with it. There is a great desire for this patch, if one searches for "stunnel x-forwarded-for" on google, you will find more than 60 pages and not only a few dozens of blogs/mailing lists that discuss applying the patch and getting it to work as an SSL terminator for loadbalancing software. And last, I know that the patch (the one Willy Tarreau is hosting on haproxy.1wt.eu and is attached) is in use at several high-traffic websites and runs stable. ;) If it's too much of a hassle for you to review and/or integrate the patch, I can understand that very well, I'd just like to open a discussion and would like to know if you have concerns regarding the patch quality, even if you do not want to include the patch at this time. :) Best regards, Stefan Behte

2 1

stunnel HUP bug
by Stefan Behte 09 Feb '11

09 Feb '11

Hi, kill -HUP does not seem to work for me with 4.35, I always get: 2011.02.07 17:51:25 LOG5[14988:139705784043264]: Received signal 15; terminating Best regards, Stefan Behte Babiel GmbH Moskauer Str. 27 D-40227 Düsseldorf Tel: 0211-179349 0 Fax: 0211-179349 29 E-Mail: S.Behte(a)babiel.com Internet: http://www.babiel.com

2 6

stunnel libwrap/tcpwrapper bug (patch included)
by Stefan Behte 09 Feb '11

09 Feb '11

Hi, I stumbled upon a really old bug in stunnel: ./configure --enable-libwrap && make [...] mv -f .deps/pty.Tpo .deps/pty.Po gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.35\" -DPACKAGE_STRING=\"stunnel\ 4.35\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.35\" -D_GNU_SOURCE=1 -DHOST=\"i686-pc-linux-gnu\" -DCPU_I686=1 -DVENDOR_PC=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_TCPD_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LINUX_NETFILTER_IPV4_H=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_PIPE2=1 -DHAVE_ACCEPT4=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -DHAVE_LIBWRAP=1 -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -MT libwrap.o -MD -MP -MF .deps/libwrap.Tpo -c -o libwrap.o libwrap.c libwrap.c: In function 'libwrap_init': libwrap.c:91: warning: ignoring return value of 'write', declared with attribute warn_unused_result mv -f .deps/libwrap.Tpo .deps/libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/lib64 -L/usr/lib -lssl -lcrypto /bin/sh: warning: setlocale: LC_ALL: cannot change locale (c) libtool: link: gcc -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/lib64 -L/usr/lib -lssl -lcrypto libwrap.o: In function `check': /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:194: undefined reference to `request_init' /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:195: undefined reference to `sock_host' /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:196: undefined reference to `hosts_access' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/usr/portage/distfiles/stunnel-4.35/src' make: *** [all-recursive] Error 1 The attached patch solves the problem; it would be cool, if you could include it in the next release. Best regards Stefan Behte Babiel GmbH Moskauer Strasse 27 D-40227 Düsseldorf Tel: 0211-179349 0 Fax: 0211-179349 29 E-Mail: S.Behte(a)babiel.com Internet: http://www.babiel.com Geschäftsführer: Georg Babiel, Dr. Rainer Babiel, Harald Babiel Amtsgericht Düsseldorf HRB 38633 ~~~~~~~~~~~~~~ DISCLAIMER ~~~~~~~~~~~~~~~ The information transmitted in this electronic mail message may contain confidential and or privileged materials. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive such e-mails in error, please contact the sender and delete the material from any computer.

2 2

Using CA intyermediate on stunnel problem
by Abdelkarim Mateos Sanchez 08 Feb '11

08 Feb '11

Hi. We are using RapidSSL certificate for my hosts. We are using stunnel for ASSP (AntiSpam Proxy System) We are trying use this certificate but get some errors. We are looking for solution but problem persist, cert = /etc/stunnel/cpanel.pem chroot = /usr/local/cpanel/var/run/stunnel-assp/ pid = /stunnel.pid setuid = stunnel setgid = stunnel output = /var/log/stunnel.log [ssmtp] accept = 465 connect = 127.0.0.2:26 #CAfile = /etc/stunnel/cpanel.cabundle #CApath = /etc/stunnel/rapidssl/ When try connect get this error depth=0 /serialNumber=cso/HwRW/nTj87jIivvttDvfpI7rUt2c/C=ES/O=genesis.islaserver.com/OU=GT15685418/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=genesis.islaserver.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /serialNumber=cso/HwRW/nTj87jIivvttDvfpI7rUt2c/C=ES/O=genesis.islaserver.com/OU=GT15685418/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=genesis.islaserver.com verify error:num=27:certificate not trusted verify return:1 depth=0 /serialNumber=cso/HwRW/nTj87jIivvttDvfpI7rUt2c/C=ES/O=genesis.islaserver.com/OU=GT15685418/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=genesis.islaserver.com verify error:num=21:unable to verify the first certificate verify return:1 Of /etc/stunnel/cpanel.pem there're KEY and CERT for host CA intermediate certificate for RapidSSL I'm lost. Apreciate help.

2 1

stunnel 4.35 released
by Michal Trojnara 05 Feb '11

05 Feb '11

Dear Users, I'm pleased to announce long-awaited version 4.35 of stunnel. The ChangeLog entry: * New features - Updated Win32 DLLs for OpenSSL 1.0.0c. - Transparent source (non-local bind) added for FreeBSD 8.x. - Transparent destination ("transparent = destination") added for Linux. * Bugfixes - Fixed reload of FIPS-enabled stunnel. - Compiler options are now auto-detected by ./configure script in order to support obsolete versions of gcc. - Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler. - CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments. - Directory lib64 included in the OpenSSL library search path. - Windows CE compilation fixes (thx to Pierre Delaage). - Deprecated RSA_generate_key() replaced with RSA_generate_key_ex(). * Domain name changes (courtesy of Bri Hatch) - http://stunnel.mirt.net/ --> http://www.stunnel.org/ - ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/ - stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel - stunnel-users(a)mirt.net --> stunnel-users(a)stunnel.org - stunnel-announce(a)mirt.net --> stunnel-announce(a)stunnel.org Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.35.tar.gz: a810e220498239483e14fae24eeb2a188a6167e9118958b903f8793768c4460f Best regards, Mike

1 0

Compiling with ./configure --enable-fips option
by Lewis, Joseph E Sr Mr CTR USA USA 01 Feb '11

01 Feb '11

I am having a problem with compiling with fips enable mode on. The default is suppose to fips enabled but when the configure runs with no options it states that fips is not enabled and the make runs successfully. When I use the –enable-fips option, the configure runs just fine but the make fails with : In file included from common.h:374, from file.c:38: /usr/include/openssl/fips.h:69:2: error: #error FIPS is disabled. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. IBM support assures me that FIPS is enabled. At this point I am stuck and do not know what to do next. Can anyone offer any suggestions? My system, oslevel, ssl level, etc… are as follows: $ uname -a AIX velssi02 3 5 00C866124C00 $oslevel –s AIX 5300-12-02-1036 $ lslpp -l | grep libc bos.rte.libc 5.3.12.2 COMMITTED libc Library bos.rte.libcfg 5.3.12.1 COMMITTED libcfg Library bos.rte.libcur 5.3.11.0 COMMITTED libcurses Library $ gcc -v Using built-in specs. Target: powerpc-ibm-aix5.3.0.0 Configured with: ../configure --with-as=/usr/bin/as --with-ld=/usr/bin/ld --enable-languages=c,c++,java --prefix=/opt/freeware --enable-threads --enable-version-specific-runtime-libs --host=powerpc-ibm-aix5.3.0.0 --target=powerpc-ibm-aix5.3.0.0 --build=powerpc-ibm-aix5.3.0.0 --disable-libjava-multilib Thread model: aix gcc version 4.2.0 $ ssh –V OpenSSH_5.2p1, OpenSSL 0.9.8k-fips 25 Mar 2009 stunnel-4.34 $ /usr/local/bin/stunnel/stunnel -version stunnel 4.32 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8k-fips 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 2

malformed packets - follow-up
by Jean-Yves F. Barbier 01 Feb '11

01 Feb '11

Hi list, After asking a friend about these errors, it appear they come from large packets reassembly; so my questions are: does it come from stunnel or http-tunnel? & if it is stunnel, is there an easy way to fine tune the max packet size? JY -- We totally deny the allegations, and we're trying to identify the allegators.

1 0

Stunnel to IRC (quakenet)
by s 31 Jan '11

31 Jan '11

Greetings all, I'm trying to set up stunnel for use with IRC for the first time, and everything appears to work dandy until I try to connect to connect to the various servers, I which I receive errors of the following type: 2011.01.31 16:06:39 LOG5[2212:2640]: Service 6001 accepted connection from 127.0.0.1:37345 2011.01.31 16:06:39 LOG5[2212:2640]: connect_blocking: connected 213.131.156.50:6667 2011.01.31 16:06:39 LOG5[2212:2640]: Service 6001 connected remote server from 10.1.4.13:37346 2011.01.31 16:06:40 LOG3[2212:2640]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.01.31 16:06:40 LOG5[2212:2640]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Below is my stunnel.conf: cert = C:\temp\downloads\stunnel\stunnel.pem key = C:\temp\downloads\stunnel\stunnel.pem client = yes [6001] accept = 6001 connect = irc.quakenet.org:6667 [6002] accept = 6002 connect = irc.fu-berlin.de:6667 [6003] accept = 6003 connect = eu.undernet.org:6667 [6004] accept = 6004 connect = irc.servercentral.net:6667 Can anyone explain to me the significance of my error? Thank you very much, S

1 0

malformed packets
by Jean-Yves F. Barbier 31 Jan '11

31 Jan '11

server: xp sp3, 4.34, http-tunnel (192.168.1.251) client: vm virtualbox xp sp3 under Debian Linux sid, 4.34, http-tunnel purpose: secured tunneling of an RDP access =================== Hi list, As I made a wireshark packet analysis, I noticed that *every* packet coming from the server id tagged [Malformed Packet], ie: No Time Source SrcP Destination DstP Protocol 620 37.247880 192.168.1.251 443 192.168.1.26 1062 SSLv3 Info Continuation Data [Malformed Packet] The protocols analyse window says 25% packets are malformed. Could you tell me where it comes from, if it generates extra traffic and if so, how I can fix that? (this setup will be used on a laptop that connect to the internet with a cell phone, so each byte has a cost.) JY -- You will be dead within a year.

1 0

How to define stunnel.conf so openvpn packet will go thru stunnel to as HTTP?
by Guy Sapir 23 Jan '11

23 Jan '11

Hi, >From what I read the examples in stunnel site it possible to wrap VPN's using Stunnel tool. Is it possible to do it for openvpn packets? I can configure thru the openvpn configurations that it packets will go thru port 80 and use TCP but the packets are not http pure. I need to wrap this packets using the stunnel tool. The purpose is to use openvpn over http. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn if possible. Thanks

2 1

s_poll_wait timeout: connection reset
by manoj kumar 19 Jan '11

19 Jan '11

Hi, We have a problem in our production system. Need help to isolate the cause. Want to know whether issue is with stunnel. We are not in situation to upgrade, since we are in production. Your help is appreciated. Environment: 1) Client program(java in win desktops) connect to server (solaris) Stunnel port which is forwarded locally to an inetd program which connects to oracle database. ( 2 Tier Architecture ) 2) Setup worked for almost 2 years without any issue, suddenly since last September, we have connection reset issue on app clients intermittently. 3) almost lots of clients ( in 100's ) get reset and we find 100's of below messages in /var/adm/messages file of solaris. stunnel: [ID 821868 daemon.info] LOG6[21204:5272]: s_poll_wait timeout: connection reset stunnel: [ID 821868 daemon.notice] LOG5[21204:4804]: Connecti on reset: 1867341 bytes sent to SSL, 55211 bytes sent to socket 4) After reset, Client attempt to relogin works without any issue. there is no pattern of load, time, no of users. 5) all the database, inetd program, stunnel runs with oracle userid 6) No other OS related, resource related errors in /var/adm/messages. 7) At this point, i dont have stunnel debug log during the problem occurrence , since we have cron job that recycles logs. if required will send later. 8) Interms of change happend before the first occurance of issue, we did CPU/RAM upgrade, Oracle Database CPU Patch. But database team says no errors reported on oracle side during reset. 9) Max users on database is around 1024, which our max users is 300. ******************************************************************** Config: #/usr/local/bin/stunnel -version stunnel 4.25 on sparc-sun-solaris2.10 with OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!DHE-RSA-AES256-SHA:!DHE-DSS-AES256-SHA:!AES256-SHA:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------- #uname -a SunOS xxxxxxxxxx 5.10 Generic_144488-02 sun4u sparc SUNW,SPARC-Enterprise --------------------------------------------------------------------- # gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) ------------------------------------------------------------------------ # openssl version OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) ----------------------------------------------------------------------------- # more avaloq.conf ( Ssl config file we use /usr/local/bin/stunnel /opt/app/ssl/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/app/ssl/cert.pem key = /opt/app/ssl/cert.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /opt/app/ssl/avaloq_ssl/avaloq.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /db/avaloq/export/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [application] accept =7766 connect =localhost:7767 TIMEOUTconnect = 60 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini -------------------------------------------------------------------------------- #netstat -an |grep 7766 |wc -l 249 Regards, kumar

2 5

What legal issues come up if I use GPL-incompatible libraries with GPL software?
by Michal Trojnara 17 Jan '11

17 Jan '11

Dear Users, I just noticed some people declare GPL license on stunnel patches. Since stunnel uses GPL license *with OpenSSL exception* (OpenSSL license is not GPL-compatible), it cannot be distributed if it is linked against any GPL code (patches, libraries) without this exception. It is still legal to distribute stunnel with patches that use GPL license with OpenSSL exception. Such patches constitute forks of stunnel and will *never* be accepted to my source tree. Third party patches rarely meet my quality criteria, but I occasionally accept patches released as public domain or having their copyright ownership transferred to me. Also see: http://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs https://secure.wikimedia.org/wikipedia/en/wiki/Fork_%28software_development… Mike

1 0

Re: [stunnel-users] Multi Tunnel Support in STunnel
by Narendra Prasad Madanapalli 16 Jan '11

16 Jan '11

I'm sorry, if my previous mail explained the problem differently. Stunnel does load balancing when multiple connect statements are specified in a section as in the below mail. The scenario is something like http://mirt.net/pipermail/stunnel-users/2006-May/001139.html and explained below N servers each running a service of the same service-program (e.g: ip1:2345, ip2:2345, ... ipN:2345) A management server running on a different server (ipM:6789) is required to connect to all or a subset of the above servers through stunnel based on the user request. I couldn't find this feature supported by stunnel in the man page. I would appreciate if you provide any information on this. Thanks, Narendra. > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Narendra Prasad Madanapalli wrote: > > connect = ip1:5678,ip2:5678,ip3:5678,...ipn:5678 > > > > Anyone can please let me know the steps to configure the stunnel if > > the support is already in place or provide your thoughts on the new > > support? > > > Use multiple "connect" options within a single section: > connect = ip1:5678 > connect = ip2:5678 > connect = ip3:5678 > ... > connect = ipn:5678 > > Reading The Fine Manual would answer your question. It's not that > hard to read the manual for "connect" before proposing any extensions > for this option. > Thanks, Narendra.

2 1

Stunnel forwarding IP
by oscaruser＠programmer.net 15 Jan '11

15 Jan '11

Folks, For my server daemon process, I am accepting incoming requests only from pre-seeded IP addrs. Using Stunnel, I am finding connecting IPs are '127.0.0.1' or localhost. Is there any configuration or solution to represent incoming IPs for the given file descriptor belonging to their originating IP addrs? Thank you.

4 5

stunnel with FIPS and SIGHUP
by Eric Lambert 15 Jan '11

15 Jan '11

Hello, I am having difficulting when running stunnel in FIPS mode and using a SIGHUP to get stunnel to re-read it's configuration file (for instance if I've changed a port # or IP address for one of the connections). This causes stunnel to call the SSL routine FIPS_mode_set() a second time after receiving the SIGHUP, which in turn attempts to reinitialize SSL. Unfortunately, OpenSSL does not support calling FIPS_mode_set(1) more than once. The initialization of SSL becomes incomplete as a result of the 2nd call and subsequent attempts to use stunnel to establish encrypted connections fail. Does anyone have any suggestions on how I can make this work (besides killing and restarting stunnel)? If not, I have a proposed fix (and there are multiple ways that this could be addressed). Anyway, my suggestion is to add the following two lines to the ssl_configure() function (found in the file "ssl.c"), right before the current FIPS_mode_set() routine is called: FIPS_mode_set(0); RAND_set_rand_method(NULL); The function currently looks like: int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : } With the suggested fix, it would look as follows: int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS FIPS_mode_set(0); RAND_set_rand_method(NULL); if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : } Does the above seem reasonable. Could this change, or some other modification which would support using SIGHUP with FIPS, be considered for a future stunnel update? Thanks for your help.

2 1

Multi Tunnel Support in STunnel
by Narendra Prasad Madanapalli 15 Jan '11

15 Jan '11

Hi, Current stunnel implementation is based on peer-to-peer communication and it cannot be used in the environment where a management server wants to talk to multi-site server (i.e. an instance of server running in different sites). Multi Tunnel support for Stunnel enables a Management Server to communicate with Multisite Server. But it requires extending Stunnel with a new protocol whereby Management Server & Client Stunnel Process communicates. 1. The new stunnel conf for multi tunnel (keeping backward compatibility) look like [singleTunnelServiceName] accept = aport connect = ip:cport [serviceName] multitunnel = yes accept = 1234 connect = ip1:5678,ip2:5678,ip3:5678,...ipn:5678 Anyone can please let me know the steps to configure the stunnel if the support is already in place or provide your thoughts on the new support? Thanks, Narendra.

2 1

Re: [stunnel-users] Problem with a signed certificate by CA andcurl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

perfect! that made the trick!!! thank you for your time Saludos On Thu, Jan 13, 2011 at 3:00 PM, <josealf(a)rocketmail.com> wrote: > Maybe your curl client is trying to negotiate SSLv2... Did you try addding --sslv3 to the command line? Openssl fips disables sslv2.. > > > -----Original Message----- > From: Gabriel Sosa <sosagabriel(a)gmail.com> > Sender: stunnel-users-bounces(a)mirt.net > Date: Thu, 13 Jan 2011 01:39:15 > To: <stunnel-users(a)mirt.net> > Subject: [stunnel-users] Problem with a signed certificate by CA and > curl/wget > > hello, > > I bought an ssl certificate on thawte and installed to stunnel. > > When I go to the site with any browser the ssl is established without > any issue, however when I try to call an url using curl or wget I'm > not able to download the content > > here are the output of curl/wget > > [root@www ~]$ curl https://secure.example.com/test.php > curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 > [root@www1 ~]$ wget https://secure.example.com/test.php > --23:27:15-- https://secure.example.com/test.php > Resolving secure.example.com... xxx.xxx.xxx.xxx > Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. > Unable to establish SSL connection. > [root@www ~]$ > > > my stunnel config file looks like > > ;setuid=nobody > ;setgid=nobody > fips=no > > pid=/var/run/stunnel.pid > debug=3 > output=/var/log/stunnel.log > cert=/etc/ssl/certs/stunnel.pem > CAfile=/etc/ssl/certs/ssl123.crt > > socket=l:TCP_NODELAY=1 > socket=r:TCP_NODELAY=1 > > > [secure.example.com] > accept=xxx.xxx.xxx.xxx:443 > connect=zzz.zzz.zzz.zzz:8443 > TIMEOUTclose=0 > xforwardedfor=yes > > I'm using the version 4.34 + xforwardedfor patch > > the file ssl123.crt contains the root CA of thawte > > uname -a output > > Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 > EST 2009 x86_64 x86_64 x86_64 GNU/Linux > > gcc -v output > > Using built-in specs. > Target: x86_64-redhat-linux > Configured with: ../configure --prefix=/usr --mandir=/usr/share/man > --infodir=/usr/share/info --enable-shared --enable-threads=posix > --enable-checking=release --with-system-zlib --enable-__cxa_atexit > --disable-libunwind-exceptions --enable-libgcj-multifile > --enable-languages=c,c++,objc,obj-c++,java,fortran,ada > --enable-java-awt=gtk --disable-dssi --enable-plugin > --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre > --with-cpu=generic --host=x86_64-redhat-linux > Thread model: posix > gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) > > openssl version > > OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > > Does anyone have some clue about what could be causing the problem. > Any help will be really appreciated. > > Thank you > > -- > Gabriel Sosa > Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Re: [stunnel-users] Problem with a signed certificate by CA andcurl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

Jose, thanks for your reply here is the output of curl --verbose [root@www ~]$ curl --verbose https://secure.example.com/test.php * About to connect() to secure.example.com port 443 * Trying xxx.xxx.xxx.xxx... connected * Connected to secure.example.com (xxx.xxx.xxx.xxx) port 443 * successfully set certificate verify locations: * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * SSLv2, Client hello (1): Unknown SSL protocol error in connection to secure.example.com:443 * Closing connection #0 curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 if is there any other info you need please just let me know. Thank you On Thu, Jan 13, 2011 at 8:42 AM, <josealf(a)rocketmail.com> wrote: > Gabriel, > > Can you add the --verbose flag to your curl command and post the result? > > > Jose > -----Original Message----- > From: Gabriel Sosa <sosagabriel(a)gmail.com> > Sender: stunnel-users-bounces(a)mirt.net > Date: Thu, 13 Jan 2011 01:39:15 > To: <stunnel-users(a)mirt.net> > Subject: [stunnel-users] Problem with a signed certificate by CA and > curl/wget > > hello, > > I bought an ssl certificate on thawte and installed to stunnel. > > When I go to the site with any browser the ssl is established without > any issue, however when I try to call an url using curl or wget I'm > not able to download the content > > here are the output of curl/wget > > [root@www ~]$ curl https://secure.example.com/test.php > curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 > [root@www1 ~]$ wget https://secure.example.com/test.php > --23:27:15-- https://secure.example.com/test.php > Resolving secure.example.com... xxx.xxx.xxx.xxx > Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. > Unable to establish SSL connection. > [root@www ~]$ > > > my stunnel config file looks like > > ;setuid=nobody > ;setgid=nobody > fips=no > > pid=/var/run/stunnel.pid > debug=3 > output=/var/log/stunnel.log > cert=/etc/ssl/certs/stunnel.pem > CAfile=/etc/ssl/certs/ssl123.crt > > socket=l:TCP_NODELAY=1 > socket=r:TCP_NODELAY=1 > > > [secure.example.com] > accept=xxx.xxx.xxx.xxx:443 > connect=zzz.zzz.zzz.zzz:8443 > TIMEOUTclose=0 > xforwardedfor=yes > > I'm using the version 4.34 + xforwardedfor patch > > the file ssl123.crt contains the root CA of thawte > > uname -a output > > Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 > EST 2009 x86_64 x86_64 x86_64 GNU/Linux > > gcc -v output > > Using built-in specs. > Target: x86_64-redhat-linux > Configured with: ../configure --prefix=/usr --mandir=/usr/share/man > --infodir=/usr/share/info --enable-shared --enable-threads=posix > --enable-checking=release --with-system-zlib --enable-__cxa_atexit > --disable-libunwind-exceptions --enable-libgcj-multifile > --enable-languages=c,c++,objc,obj-c++,java,fortran,ada > --enable-java-awt=gtk --disable-dssi --enable-plugin > --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre > --with-cpu=generic --host=x86_64-redhat-linux > Thread model: posix > gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) > > openssl version > > OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > > Does anyone have some clue about what could be causing the problem. > Any help will be really appreciated. > > Thank you > > -- > Gabriel Sosa > Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Problem with a signed certificate by CA and curl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

hello, I bought an ssl certificate on thawte and installed to stunnel. When I go to the site with any browser the ssl is established without any issue, however when I try to call an url using curl or wget I'm not able to download the content here are the output of curl/wget [root@www ~]$ curl https://secure.example.com/test.php curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 [root@www1 ~]$ wget https://secure.example.com/test.php --23:27:15-- https://secure.example.com/test.php Resolving secure.example.com... xxx.xxx.xxx.xxx Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. Unable to establish SSL connection. [root@www ~]$ my stunnel config file looks like ;setuid=nobody ;setgid=nobody fips=no pid=/var/run/stunnel.pid debug=3 output=/var/log/stunnel.log cert=/etc/ssl/certs/stunnel.pem CAfile=/etc/ssl/certs/ssl123.crt socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [secure.example.com] accept=xxx.xxx.xxx.xxx:443 connect=zzz.zzz.zzz.zzz:8443 TIMEOUTclose=0 xforwardedfor=yes I'm using the version 4.34 + xforwardedfor patch the file ssl123.crt contains the root CA of thawte uname -a output Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 EST 2009 x86_64 x86_64 x86_64 GNU/Linux gcc -v output Using built-in specs. Target: x86_64-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,obj-c++,java,fortran,ada --enable-java-awt=gtk --disable-dssi --enable-plugin --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --with-cpu=generic --host=x86_64-redhat-linux Thread model: posix gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) openssl version OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Does anyone have some clue about what could be causing the problem. Any help will be really appreciated. Thank you -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Win32 FIPS Question
by pk＠cliffhanger.com 12 Jan '11

12 Jan '11

Hello, Greetings. I am new to STUNNEL and working on a proof of concept to compile the latest FIPS Compliant 1.2.2 OpenSSL with STUNNEL 4.34. in Windows 32 Bit environment. In the install.FIPS file it is mentioned that Win32 is not supported with FIPS. Is it still the case or it is fixed now? Have anybody done this? I greatly appreciate your time and help. Thank you. PK

1 0

Re: [stunnel-users] Question of stunnel/openssl for X86 processor -- Pierre's patch
by Pierre DELAAGE 11 Jan '11

11 Jan '11

Hi Jiehua, Please review the instructions on my webpage : in particular use my compilation scripts, and look inside them to know the syntax. It is quite simple : makece X86 for stunnel. For openssl, run the command "mywcebuild X86". It works. Pierre Le 10/01/2011 17:40, Li, Jiehua a écrit : > Dear Pierre and Dear Stunnel Users, > > We are trying to build stunnel for WinCE on X86 processor. After reviewing messages on the board, I found your article published in late November. I've downloaded packages from your personal website athttp://delaage.pierre.free.fr/ > > These packages include: > 1. Precompiled wcecompat library > 2. Source code foropenssl v100a for WCE <http://delaage.pierre.free.fr/contrib/openssl/wce/openssl100a_WCEpatched3.z…>. > 3. Source code forstunnel v434 for WCE <http://delaage.pierre.free.fr/contrib/stunnel/wce/stunnel434_WCEpatched2X86…>. > > I was hoping to the get the precompiled openssl library files, but it seems there are only library files for ARM processor under the folder of "out32dll_ARMV4" and there's no precompiled version for X86. So I tried to compile the openssl downloaded from your website for the X86 processor after customizing a few parameters (OSVERSION, PLATFORM, WCEROOT, SDKROOT, WCECOMPAT) as you suggested. But the compilation failed, I got error messages as below. I'm also including all options for cl.exe in the email as well. I wonder if you have seen similar issues before. Any suggestion is appreciated. Thanks for the help. > > Regards, > > Jiehua > > cl.exe /Fotmp32dll_x86\cryptlib.obj -Iinc32 -Itmp32dll_x86 /MC /O1 /Oi > /W3 /WX /GF /Gy /nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LE > AN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT -D_WIN32 > _WCE=420 -DUNDER_CE=420 -DWCE_PLATFORM_STANDARDSDK_420 -Dx86 -D_ -IC:\STunnel\wc > ecompat12_patched2X86\patchedX86/include -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPE > NSSL_NO_KRB5 -DOPENSSL_NO_JPAKE -DOPENSSL_NO_STATIC_ENGINE /Zi /Fdtmp32dll_x86/l > ib -D_WINDLL -D_DLL -DOPENSSL_BUILD_SHLIBCRYPTO -c .\crypto\cryptlib.c > Command line warning D4002 : ignoring unknown option '/MC' > cryptlib.c > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(301 > 9) : error C2061: syntax error : identifier 'PCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(302 > 0) : error C2059: syntax error : '}' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2061: syntax error : identifier 'LPCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2146: syntax error : missing ')' before identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2081: 'LPCONTEXT' : name in formal parameter list illegal > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2061: syntax error : identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 223) : error C2059: syntax error : ')' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing ')' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing '{' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 231) : error C2059: syntax error : ')' > NMAKE : fatal error U1077: 'cl.exe' : return code '0x2' > Stop. > > ---------------------------------------------------------------------------------------- > Dear Michal, Dear all, > I have continued to work on my WCE version of stunnel 4.34, after having > received some request for help to compile for other TARGET CPU than ARM, > typically WCE/X86. > > That led me to a few more compilation bug fixes and some improvments in > makefiles, proper usage of winsock2 library, automatisation and > management of "make/build" process > for multiple targets WCE (ARM|X86...) and Win32 (with MS VC and > Gnu-mingw32 !). > I added also, as a practical feature, the inclusion of > "version/copyright" properties in the exe files, properties that are > displayable in the Windows Explorer or by right-clicking on the exefile. > This is not only a "beautifying" feature: this allows automatic version > checking by external tools without having to run the stunnel program, > particularly useful when the targetcpu does not match the host cpu... > > I also worked to have "as close as possible" evc.mak, vc.mak, and > mingw.mak files. > A lot of work and test-fail-adapt cycles have been performed to have a > common code working with the various flavors of C-PREPROCESSORS ! > because there are subtle differences between MS EVC, MS VC, Borland BCC > and GNU-GCC preprocessors. > > THE ATTACHMENT has been sent in zip format, because it contains a few > scripts and other files that exceed the 100KB limit of the mailing list. > it contains the files : > version.h : contains the #define version numbers, major and minor > version.rc : version displayable by Windows Explorer property sheet > makew32.bat : an helper for build wih MS VC > > Michal: > patched2X86.txt : a FULL diff -cr between your last 4.34 official > version and my last patched > patched2X86_incr.txt : an INCREMENTAL diff -cr between my previous > patched version sent on 27/09/2010 and the present one. > > > For the impatient, my patched version of stunnel 4.34 is available here : > http://delaage.pierre.free.fr/contrib/stunnel/wce/stunnel434_WCEpatched2X86… > > IT COVERS both WCE and Win32 versions of stunnel. > > NEW FILES have been added to the sources: see attachments: > - version.h is NOW the CENTRAL point to define major and minor versions > of stunnel (NO MORE definition is makefile, which is logical : you > modify the version of the product, without necessarily modifying the > production process). > - version.rc is the resource file required by windows as the repository > of the stunnel.exe properties displayed in Windows Explorer. > Compiled with evc for wce or with VC for win32, this works perfectly. > But compiled and linked with gcc, those properties are unfortunately not > displayed by Windows Explorer, although embedded in the exe file. I have > established that it is a bug in "gnu-link" stage. > - makew32 : the equivalent of makece for Win32, which avoid repetitive > and error prone pollution of env vars when repetitively compiling for > w32. It is very useful in frequent recompilation at dev/test time. > > *** SOME PRACTICAL INFO : > - now to compile, or clean up things, for a particular WCE TARGET CPU : > just type things like : > makece ARMV4, eg for ARMV4 CPU > makece ARMV4 clean > makece X86, eg for ARMV4 CPU > makece X86clean > ===> this create ../bin/ARMV4/stunnel.exe and ../obj/ARMV4/all objs > files, or the like with X86 cpu and so on. > See list of all supported target cpu in evc.mak. ARMV4 and X86 go well; > more cpu may be checked by experts vs compilation flags... > This is very practical to compile for various targets without modifying, > deleting, renaming, anything and with no side effects between targets. > > - For Win32, yes for Windows PC, just type : > makew32 > makew32 clean > ===> this create ../bin/W32/stunnel.exe and ../obj/W32/all objs files. > This tool uses MS-VC 2008 express as compiler/linker. > > - For Win32, but with MINGW32 tools (and GNU-WIN32 coreutils !!!), just > type : > mingw32-make -f mingw.mak > mingw32-make -f mingw.mak clean > ===> this create ../bin/MGW32/stunnel.exe and ../obj/MGW32/objs files. > GOODIE: I have tricked the mingw.mak to work EITHER on a Windows > compilation HOST MACHINE, OR a LINUX/UN*X compilation HOST. > On windows mingw.mak properly checks and warns about potential missing > of gnu-win32 tools. > Note: the make.bat file is just a shortcut for mingw32-make -f mingw.mak. > > *** MODIFICATIONS of FILES : > > So, since my previous version of the patch, here are my adds : > > 1/ evc.mak : > 1.1/linking with a recompiled version of Essemer/wcecompat: > this library has been customized to compile in SEPARATE folders for > MULTIPLE targets. > So path to proper libs have been changed. > My customized version of wcecompat is available here : > http://delaage.pierre.free.fr/contrib/wcecompat/wcecompat12_patched2X86.zip > > IT HAS ALSO been adapted to have separate folders for distinct targets > pre-compiled versions. > Please note that this philosophy is shared with openssl. > > 1.2/ linking with winsock2 library instead of winsock1: at first to be > consistent with the C code, and second because winsock2 is more close to > socket standard than ws1. > > 1.3/ linking with COREDLL.lib and CORELIBC.lib ONLY: whatever /MC or /MT > or other flag you put for CLxxx command, the set of default libs > expected to be linked is WRONG. > This is a bug of CLxxx tools, inconsitent with MS doc. > SO we have to overwrite the default lib list by always the same ones. > You can verify that this is the right way to do it by searching for a > libc.lib in various evc/libs : you will NOT find any although clxxx /? > talks about it. > > 1.3/ change in VERSION management : now there is a version.h and > version.rc souce file for this. > One that wants to change version has just to edit version.h and then > version info will be propagated as usual in resource.h, AND also > in the exe itself to be displayable in Windows Explorer. > Now people will have a simple mean to check the version of stunnel. > > Michal: have you noticed that there was a vestige "version.h" file > mentioned in vc.mak ! > now it makes sense in evc.mak, vc.mak and mingw.mak, for wce or win32 > targets. > > 1.4/ link /machine : IX86 is improper with WCE, it is X86. > > 1.5/ Multiple WCE CPU targets supported by giving targetcpu on the make > command line like this : > makece ARMV4 all > targetcpu is now mandatory. > makece without options, as usual, will show the new syntax (very simple). > > 1.6/ improved clean target with some rmdirs and proper redirection of > error messages. > proper use of make flags -@. > > 1.7/ added explicit "inference rules" that are compatible MS nmake/ > Borland make, > to be sure of the proper options, and to manage multiple subdirs > management matching TARGETCPU. > Now stunnel.exe is build in stunnel/bin/TARGETCPU subdir > objs are build in stunnel/obj/TARGETCPU > > I really think it is practical and good policy : on my host machine I > have been able to test efficiently at the same time > three flavors of stunnel : win32, wce/arm, wce/x86 without > erasing/renaming/recompiling each time and wondering for what platform > was my stunnel.Exe built for. > > 1.8/ HOST flag put in $(DEFINES) for CC and RC to add more info to exe > info property shhet in Windows Explorer "this stunnel is for THIS type > of target" > > > 2/ makece.bat: > protection against pollution of environment when makece is repeatedly > run with the same targetcpu. > + Env is updated only when one is switching targetcpu. > This is not perfect, but a step in the good direction. > To understand what I mean, perform "set" to see all the env vars after > each makece call... > > PRACTICALLY : you can type makece ARMV4 and then makece X86 in the same > command line window, without polluting "too much" the environment, > only when changing target. No need, reasonably, to have multiple command > line windows opened. > > 3/ vc.mak: for win32 > "multiple target" support by putting w32 obj and exe files in obj/w32 > and bin/w32 subdirs, version.rc support, winsock2 lib integration. > > crypt32 was missing .lib SUFFIX ! > > improper use of winsock1 : it is better to take winsock2 lib, and it is > what the code requires (#includes...) ! > > version management through version.h /.rc instead of /DVERSION > > general logic now close to that of WCE evc.mak, as can be (evc and vc > are very close in their syntax, flags...). > HOST flag to add more info to exe info property sheet in Windows > Explorer "this stunnel is for THIS type of target" > > 4/ created a makew32.bat script > as a wrapper to setenv vars for MSVC 2008 Express, and nmake call. > This has to be improved in the future: presently it cannot be called > after a previous compilation for WCE : > pollution of PATH and INCLUDE env vars requires to reopen a shell via > cmd.exe. > One day I will check if there a simple way to clean env vars from some > path (not so simple). > > 5/ adapted mingw.mak to link with WINSOCK 2 (!!) and use of > version.rc/.h + general processing made similar to that of vc.mak. > I tested with mingw for windows and it works. Someone should test with > gcc under linux, this should work... > HOST flag to add more info to exe info property sheet in Windows > Explorer "this stunnel is for THIS type of target" > Some rewriting to have a mingw.mak close to vc.mak, to ease maintenance... > I checked gnu make syntax, and it is close to ms nmake and borland make, > except for ifdef directives and inference rules syntax, unfortunately. > I am somehow skilled in this boring exercise of comparing various make > tools and syntax. > > MINGW.MAK bugs: incorrect reference to "Makefile.w32", incorrect INC > path for openssl/win32 (this is NOT "outinc" but "inc32"! since a long > time). > > NOTE : to compile on windows I commented "-l zdll" lib in the mingw.mak. > Michal, may you restore it if it is useful (I do not see why anyway). > > Added a testenv pseudo-target to check for gnu-win32 proper installation. > Added some tricks to enable proper execution with the same makefile > either on a Windows HOST or a Linux HOST. > When I say host, I mean "production machine" , and NOT TARGET machine > which is always win32 with mingw.mak. > > 6/ make.bat: this script is ONLY meaningful with mingw.mak and MINGW32 > gnu environment. > Due to various improvments I MADE in mingw.mak, mingw.mak is now only > compatible with mingw32-make, > and not just "make.exe", which is Borland make on Windows... > > > TODO : I did not deal with stunnel making for linux, and/or rpm packaging. > But I guess that makefile.in etc...should be updated... > Anyway, on linux, NOT including version.rc is not a problem, as this > file is useless in that target environment. > But I think that having ../obj/UNX and ../bin/UNX folders should be a > good practice... > > 7/ common.h : > Eureka ! I finally understood and cleaned up the mess around the > redefinition of various Socket Error codes. > This comes from the fact that, previously, those codes were defined in > MS winsock1 header files, but disappeared in winsock2 header files (they > are commented) > Apparently, stunnel code was including winsock1 for w32 but winsock2 for > WCE, although winsock2 is in fact available on both platforms. > So I decided to move to winsock2 for WCE, and re-declaring (again) SOME > of those constants. > Some clean up of the makefile has been done also to REALLY link to ws2 > lib instead of ws1 (because there was also a confusion there!). > > 8/ ctx.c : htons is requesting "short". so a cast was required to avoid > warnings from the compiler. > > 9/ resolver.c : here we are: > many routines have been reimplemented when they are in fact available in > winsock2 both for w32 AND WCE. > Michal: I expect that you review this with particular attention. > In fact I have modified the logic of "masking" local_routines when > already defined in winsock2. > the previous code was HIDING winsock2 instead of the local_routines. > It seemed not logical. > It is important to note that the three routines "getaddrinfo, > freeaddrinfo, getnameinfo" are FOR INSTANT used only in resolver.c, > BUT the previous code was preventing them from being used by other modules. > Now, with my code, it is possible. > My code also avoid compilation warnings (because, as getaddrinfo REALLY > exist in win32, such a "#define getaddrinfo localgetaddrinfo" > inevitably raises a warning of the compiler for redef of an existing > symbol; and hence it reveals a problem of conflict..., while my solution > avoids all this pitfalls). > > Removed also the restriction "AND IPV6" on win32 conditional #IF: > winsock2 supports ipv6. > Michal: a review on these conditional #IF should be useful... > > I wanted to add that those routines are also parts of the POSIX standard > API, so they are available almost everywhere... > so I hardly understand their purpose today. > > 10/ version.h : > I have used some preprocessor tricks to have a VERSION string correctly > defined BOTH with MS evc preprocessor, MS vc preprocessor: > AND GNU preprocessor. > those preprocessors have some differences...particularly when called > from a rc compiler through a "pipe" like gnu windres. > In ms VC and EVC the rc preprocessing is NOT the same as that of the > compiler... > Now it works with every build system, and either in .c compilation or > .rc compilation. > > > USEFUL : openssl team is desperately ignoring any WCE patch, so if you > want an openssl 100a source tree compatible with WCE, > just download mine there : > http://delaage.pierre.free.fr/contrib/openssl/wce/openssl100a_WCEpatched3.z… > FYI, my patch to openssl is registered here : > http://rt.openssl.org/index.html?q=2350 (login guest/password guest). > > TODO : gui.c contains code to dynamically load ws2 getaddrinfo > why not rely only on static linking for that, as ws2 is available > everywhere since w95 and wce4.1 ? > we have to harmonize the code there with resolver.c and various makefiles > In resolver.c: code remains to load dynamically ws2 getaddrinfo etc..at > run-time only on win32, and not in CE while it is ALSO available! > I suggest to have "static" linking to ws2.lib both in w32 and wce . but > more code has to be modified to be definitely clean and clear. > When I say "static linking" I mean "Load-Time Dynamic Linking", ie link > with ws2.lib stub at build time, not "link with static lib"... > > I thank you for your good work and attention, > Yours sincerely, > > Pierre Delaage > > > Le 27/09/2010 00:40, Pierre DELAAGE a écrit : > > Dear All, > > Please find enclosed a patch in "diff -cr orig patched" format, > > applying to stunnel4.34 as found hereftp://stunnel.mirt.net/stunnel/. > > This patch mainly addresses compilation and unicode issues for Windows > > CE targets + ONE critical issue preventing stunnel to service anything > > (!). > > > > I use MS EVC 4sp2 compiler with WCE 420 SDK, on a vista host platform. > > Once debugged the code works fine on WM6 HTC smartphones. > > Should work on WM5. > > It needs a windows CE openssl lib (I recompiled MY patched version of > > openssl 1.0.0a successfully: I will have to log a patch to those > > gentlemen, hoping that they are open to integrate it, something not so > > obvious in the past). > > > > I will later post here a link to my patch for openssl 100a pointing to > > the openssl mailing list. THIS OPENSSL PATCH IS ESSENTIAL : with my > > older version of openssl 098pre_j for wce, stunnel does not work > > anymore (it crashes after first cnx). > > > > > > The present stunnel patch addresses the following issues : > > > > ************* > > I] COMPILATION FAILURES > > > > 1/ on common.h "EINVAL redefinition" : > > in fact the compile options WX (see evc.mak) does not tolerate any > > warning : > > The MS evc420 compiler ALWAYS issues a warning on this symbol > > redefinition. > > Michal and I are dealing with it since month... > > But, considering that NEITHER Exxx error codes are used in stunnel, > > I suggest that in fact ALL these redef should be suppressed. > > > > TODO: In the future a proper rewrite of code in log.c, where hardcoded > > values of WSA error codes are used instead of symbolic constant, will > > have to be done. > > > > > > 2/ client.c > > CreateProcess is a UNICODE function: code was ascii only. > > Code has been adapted to work in unicode. > > > > 3/ evc.mak > > path to new openssl lib has been redefined. > > proper location for the libs in openssl tree has been set in the > > make-install block (although this block is presently USELESS and needs > > a complete rewrite). > > > > 4/ gui.c > > All code using hmainmenu is OFF under winCE. > > So some new lines involving it were not compiling. > > > > 5/ options.c > > > > linger_val.l_linger and linger_val.l_onoff require ushort values. > > Strict type checking of the compiler required a proper cast to ushort > > of the r-values. > > > > > > stralloc uses "strdup": > > on Win32 and winCE strdup is _strdup (!). > > > > 6/ prototypes.h : > > _beginthread was defined as returning an int, an a long in sthread.c. > > After some checking in various documentations, long is the correct type, > > in particular because _beginthread can return the special error value > > "-1L". So that unsigned types are illogical. > > This simplifies the code in some locations, by saving some -now > > useless- casts. > > > > 7/ sthread.c > > > > create_client: suppressed some useless cast to (long) for beginthread. > > > > ************* > > II] OPERATIONAL ERRORS (at run-time) > > This is a reminder of previous notification to the mailing list : > > due to beginthread improper code and/or use, > > It is presently IMPOSSIBLE for stunnel 434 to be used in production on > > WCE: > > it is just unable to service any...service. > > Nothing happens if, for example, you use it to connect to an https > > server. No log either ! > > > > I corrected the code with both Michal patch to gui.c and mine to > > sthread.c: > > > > gui.c (Michal patch) : > > _beginthread was called with 0 as stacksize which, cumulated to an > > improper coding of sthread/beginthread, led to FAILURE of service > > thread creation. > > > > sthread.c: > > _beginthread : now supports "0" stacksize value, leading to default > > linker stack size (1MB by default unless specified differently on the > > linker command line, something we do not yet perform but could). > > > > ************* > > III] MINOR IMPROVMENT > > _beginthread: added a log on critical event of "failure" to create a > > service thread. because I think it is a critical event, isn't it? > > > > > > I hope you will find this patch useful. > > Thank you for your excellent work, > > Yours sincerely, > > > > Pierre Delaage > > > > Note : I use stunnel to establish a simple "vpn" between smartphones and > > a corporate linux server mainly for HTTPS/POPS/SMTPS support. > > Stunnel is very relevant in that matter, over solutions based on SSH > > (although we use also ssh), from a communication cost point of view : > > ssh establishes permanent socket between client and server, so that the > > communication is charged by the mobile network provider : and these > > charges are very expensive. > > On the contrary stunnel only establishes ssl sockets on demand so that > > financial charges are limited to strict necessary. > > Please note that stunnel brings "client based certificate > > authentication" to POP/SMTP mobile mail user agents which only > > BASICALLY supports SSL with server authentication, but NO client > > authentication, such as M$ Outlook forMobile (unless you pay for an > > exchange server and exchange client licence). > > Here again stunnel is very relevant. > > > > Note 2 : the strdup and unicode bug fixes should benefit also to the > > win32 (for PC) stunnel version for PC. > > > > > > > > > > > *["stunnel434patch20101117.zip" (application/x-zip-compressed)]* <http://marc.info/?l=stunnel-users&m=129002593426045&q=p3> > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > *[prev in list <http://marc.info/?l=stunnel-users&m=129001288405228&w=2>] [next in list <http://marc.info/?l=stunnel-users&m=129010241218147&w=2>] [prev in thread <http://marc.info/?l=stunnel-users&m=128554087819713&w=2>] [**next in thread]* > > Configure <http://marc.info/?q=configure> | About > <http://marc.info/?q=about> | News <http://marc.info/?q=news> | >

2 1

Re: [stunnel-users] Question of stunnel/openssl for X86 processor -- Pierre's patch
by Pierre DELAAGE 11 Jan '11

11 Jan '11

Hi Jiehua, Please review the instructions on my webpage : in particular use my compilation scripts, and look inside them to know the syntax. It is quite simple : makece X86 for stunnel. For openssl, "mywcebuild X86". It works. Let me know if you have problems. Pierre Le 10/01/2011 17:40, Li, Jiehua a écrit : > Dear Pierre and Dear Stunnel Users, > > We are trying to build stunnel for WinCE on X86 processor. After reviewing messages on the board, I found your article published in late November. I've downloaded packages from your personal website athttp://delaage.pierre.free.fr/ > > These packages include: > 1. Precompiled wcecompat library > 2. Source code foropenssl v100a for WCE <http://delaage.pierre.free.fr/contrib/openssl/wce/openssl100a_WCEpatched3.z…>. > 3. Source code forstunnel v434 for WCE <http://delaage.pierre.free.fr/contrib/stunnel/wce/stunnel434_WCEpatched2X86…>. > > I was hoping to the get the precompiled openssl library files, but it seems there are only library files for ARM processor under the folder of "out32dll_ARMV4" and there's no precompiled version for X86. So I tried to compile the openssl downloaded from your website for the X86 processor after customizing a few parameters (OSVERSION, PLATFORM, WCEROOT, SDKROOT, WCECOMPAT) as you suggested. But the compilation failed, I got error messages as below. I'm also including all options for cl.exe in the email as well. I wonder if you have seen similar issues before. Any suggestion is appreciated. Thanks for the help. > > Regards, > > Jiehua > > cl.exe /Fotmp32dll_x86\cryptlib.obj -Iinc32 -Itmp32dll_x86 /MC /O1 /Oi > /W3 /WX /GF /Gy /nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LE > AN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT -D_WIN32 > _WCE=420 -DUNDER_CE=420 -DWCE_PLATFORM_STANDARDSDK_420 -Dx86 -D_ -IC:\STunnel\wc > ecompat12_patched2X86\patchedX86/include -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPE > NSSL_NO_KRB5 -DOPENSSL_NO_JPAKE -DOPENSSL_NO_STATIC_ENGINE /Zi /Fdtmp32dll_x86/l > ib -D_WINDLL -D_DLL -DOPENSSL_BUILD_SHLIBCRYPTO -c .\crypto\cryptlib.c > Command line warning D4002 : ignoring unknown option '/MC' > cryptlib.c > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(301 > 9) : error C2061: syntax error : identifier 'PCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(302 > 0) : error C2059: syntax error : '}' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2061: syntax error : identifier 'LPCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2146: syntax error : missing ')' before identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2081: 'LPCONTEXT' : name in formal parameter list illegal > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2061: syntax error : identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 223) : error C2059: syntax error : ')' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing ')' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing '{' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 231) : error C2059: syntax error : ')' > NMAKE : fatal error U1077: 'cl.exe' : return code '0x2' > Stop. > >

1 0

RFC: purge use of keyword 'transparent'
by oscaruser＠programmer.net 08 Jan '11

08 Jan '11

Folks, After searching, installing various Linuces (in the 2.6 family), e.g. CentOS, Ubuntu, and so on, I have not been able to get transparent proxy working at all. As such since it the function does not work, and there is great debate as to whether it ever worked, I would like to propose that this keyword and reference to its function be discarded entirely. This will save many folks a great deal of time and effort attempting to try and get it to work, myself having spent over 80 hours (including my precious holiday time) trying to dig, scratch, research up old posts that say it works or someone has it working under such and such a configuration! The documentation itself has folks claiming that it works and does not, which is really a bad practice. Why did you perpetuate this option in the first place?! I hope you see the importance and reason with my request and act immediately. ... Unless someone really really does have it working. Thank you

3 7

How can I configure Intermediate Certificate
by Carlos García Villate 04 Jan '11

04 Jan '11

Hi. Two months ago, we installed our SSL certificate with stunnel succesfully. That certificate was issued by Verisign. We did not experience any issues. A few weeks ago, we had to renew that certficate and after doing that, we started to get 'Invalid certificate' errors form our web site users. It seems that the new certificate issued by Verisign, has changed its hierarchy, and browsers like FF that do not have one of the necessary intermediate certificate registered fail. This is the new hierarchy: - VeriSign Class 3 Public Primary Certification Authority - G5 - VeriSign Class 3 Secure Server CA - G3 - www.b-kin.com It is the 'VeriSign Class 3 Secure Server CA - G3' certificate the one that most FF browsers do not have registered, and so the browsers reject the request with an 'Invalid certificate' message. To solve this issue, we are trying to incorporate the 'VeriSign Class 3 Secure Server CA - G3' certificate in the .pem file, where our www.b-kin.comcertificate is installed. We have tried to include the Verisign certificate first and then the other one; and the other way round, first our certificate and then the Verisign one, but without success. The Verisign certificate has been directly taken from the Verisign web site. The .pem file has following structure: Bag Attributes heading section ..... -----BEGIN RSA PRIVATE KEY----- ..... -----END RSA PRIVATE KEY----- Bag Attributes heading section -----BEGIN CERTIFICATE----- /*We have alternated to put here the www.b-kin.com or the Verisign certificate*/ ..... -----END CERTIFICATE----- Bag Attributes heading section -----BEGIN CERTIFICATE----- /*We have alternated to put here the www.b-kin.com or the Verisign certificate*/ ..... -----END CERTIFICATE----- We are running stunnel on CentOS with the following configuration: stunnel 4.32 on i686-pc-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = FIPS session = 300 seconds stack = 65536 bytes sslVersion = TLSv1 TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none As we have seen in the documentation, it is possible to include a certificate hierarchy in a .pem file. What we do not know is the order nor the values to set int Bag Attributes heading section, for the Verisign certificate. Best regards, Carlos.

1 0

Is it possible to encrypt the Web server IP , URL , Data???
by cpu.lin 20 Dec '10

20 Dec '10

Dear Michal Trojnara, Some protocols (e.g. ssh,vpn...) must install software in SERVER side. I want to understand the fact below: If only the CLIENT side can install the special software. What is the special software? Is it possible to encrypt the Web server IP ,URL ,Data??? If stunnel can solve this issue. How to configure? Merry X'mas, Best regards, cpu.lin(a)gmail.com > 2010/12/17 Michal Trojnara <Michal.Trojnara(a)mirt.net>: > Dear cpu.lin, > >> No response to the problem: >> > http://stunnel.mirt.net/pipermail/stunnel-users/2010-December/002860.html >> Could you please help me? > > This is how the protocol works: > http://tools.ietf.org/id/draft-luotonen-ssl-tunneling-02.txt > You need a different protocol (e.g. ssh) if you don't like it. > > Mike

1 0

Stunnel 4.05 "SSL write shutdown (output buffer empty)"
by Issam ourrai 17 Dec '10

17 Dec '10

Hi guys, For My apps I'm using a SSL connection using STunnel 4.05 on a windows box. I have the following errors while running a connection : 2010.12.17 14:28:55 LOG7[2764:6312]: Socket closed on read 2010.12.17 14:28:55 LOG7[2764:6312]: SSL write shutdown (output buffer empty) 2010.12.17 14:28:55 LOG7[2764:6312]: SSL alert (write): warning: close notify 2010.12.17 14:28:55 LOG7[2764:6312]: SSL_shutdown retrying 2010.12.17 14:28:55 LOG7[2764:5588]: tradingscreen_connection accepted FD=1728 from 127.0.0.1:2231 2010.12.17 14:28:55 LOG7[2764:5588]: FD 1728 in non-blocking mode 2010.12.17 14:28:55 LOG7[2764:5588]: Creating a new thread 2010.12.17 14:28:55 LOG7[2764:5588]: New thread created 2010.12.17 14:28:55 LOG7[2764:3860]: tradingscreen_connection started 2010.12.17 14:28:55 LOG7[2764:3860]: TCP_NODELAY option set on local socket 2010.12.17 14:28:55 LOG5[2764:3860]: tradingscreen_connection connected from 127.0.0.1:2231 2010.12.17 14:28:55 LOG7[2764:3860]: FD 1708 in non-blocking mode 2010.12.17 14:28:55 LOG7[2764:3860]: tradingscreen_connection connecting XX.XX.XX.XX:9500 2010.12.17 14:28:55 LOG7[2764:3860]: remote connect #1: EWOULDBLOCK: retrying 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=write 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:55 LOG7[2764:3860]: Remote FD=1708 initialized 2010.12.17 14:28:55 LOG7[2764:3860]: TCP_NODELAY option set on remote socket 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): before/connect initialization 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): SSLv3 write client hello A 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=read 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): SSLv3 read server hello A 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=read 2010.12.17 14:28:56 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 read finished A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 write change cipher spec A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 write finished A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 flush data 2010.12.17 14:28:56 LOG7[2764:3860]: 1 items in the session cache 2010.12.17 14:28:56 LOG7[2764:3860]: 2 client connects (SSL_connect()) 2010.12.17 14:28:56 LOG7[2764:3860]: 2 client connects that finished 2010.12.17 14:28:56 LOG7[2764:3860]: 0 client renegotiatations requested 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server connects (SSL_accept()) 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server connects that finished 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server renegotiatiations requested 2010.12.17 14:28:56 LOG7[2764:3860]: 1 session cache hits 2010.12.17 14:28:56 LOG7[2764:3860]: 0 session cache misses 2010.12.17 14:28:56 LOG7[2764:3860]: 0 session cache timeouts 2010.12.17 14:28:56 LOG6[2764:3860]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2010.12.17 14:28:56 LOG7[2764:6312]: SSL alert (read): warning: close notify 2010.12.17 14:28:56 LOG7[2764:6312]: SSL closed on SSL_read 2010.12.17 14:28:56 LOG7[2764:6312]: Socket write shutdown (*output buffer empty*) 2010.12.17 14:28:56 LOG5[2764:6312]: Connection closed: 31795 bytes sent to SSL, 35089 bytes sent to socket 2010.12.17 14:28:56 LOG7[2764:6312]: tradingscreen_connection finished (1 left) 2010.12.17 14:39:01 LOG7[2764:3860]: Socket closed on read 2010.12.17 14:39:01 LOG7[2764:3860]: SSL write shutdown (*output buffer empty*) 2010.12.17 14:39:01 LOG7[2764:3860]: SSL alert (write): warning: close notify 2010.12.17 14:39:01 LOG7[2764:3860]: SSL_shutdown retrying 2010.12.17 14:39:01 LOG7[2764:5588]: tradingscreen_connection accepted FD=1732 from 127.0.0.1:2362 2010.12.17 14:39:01 LOG7[2764:5588]: FD 1732 in non-blocking mode 2010.12.17 14:39:01 LOG7[2764:5588]: Creating a new thread Did some one ever face this kind of issue, I'm a neube using this connector, thanks for your kind help, -- Cheers Sam

1 0

Re: [stunnel-users] Experimental stunnel-4.35b1
by Michal Trojnara 17 Dec '10

17 Dec '10

Dear cpu.lin, > No response to the problem: > http://stunnel.mirt.net/pipermail/stunnel-users/2010-December/002860.html > Could you please help me? This is how the protocol works: http://tools.ietf.org/id/draft-luotonen-ssl-tunneling-02.txt You need a different protocol (e.g. ssh) if you don't like it. Mike

1 0

Experimental stunnel-4.35b1
by Michal Trojnara 15 Dec '10

15 Dec '10

Dear Users, I have uploaded stunnel-4.35b1 to ftp://stunnel.mirt.net/stunnel/ for your testing. Please give it a shot and submit any problems to stunnel-users mailing list. This is the way you can not only help me improve production 4.35, but also make sure it's going to work on your platform! Please consider version 4.35b1 highly experimental and not ready for production. Specifically it is no supposed to be packaged for any OS distribution (e.g. *BSD ports). Best regards, Michal Trojnara

1 0

endpoints using different versions of stunnel
by nishith n 15 Dec '10

15 Dec '10

Hello all, We have a client who would like to send us data using stunnel 4.33 at their end of the connection. Can we establish connection from our end using stunnel 4.11 version. We are working on a sun machine. I know I can simply download the latest stunnel version but it has to go through an authorization process which probably will take more time than I have and hence this question. What could be the impacts to connectivity or otherwise with such a setup? Thanks for your replies, Nishith

1 0

Examples of stunnel and lighttpd
by fanboy 15 Dec '10

15 Dec '10

Apparently lighttpd ssl support isn't so flash, I'm been attempting (I'm a newb) to use stunnel instead, are there any examples? I have a free startssl cert also (ssl.key / ssl.cert) What information do I need to setup a reliable connection?

1 0

How to encrypt the URL?
by cpu.lin 08 Dec '10

08 Dec '10

Dear friends, After reading mailing lists & Web & FAQ I couldn't find answers to these: stunnel.conf as follows: debug=7 client = yes [proxy] accept=1111 connect=62.215.5.69:8080 (Public SSL Proxy) protocol=connect protocolHost=stunnel.mirt.net:443 CLIENT(Browser+Special software)<->firewall<->(Internet)<->Public SSL Proxy<->WEB SERVER Public SSL Proxy as follows: http://tools.rosinstrument.com/raw_free_db.htm?t=2 Only the CLIENT side have stunnel. After running stunnel 4.34 (Windows binaries). Then. Browser http://localhost:1111/ But Sniffer can monitor the command-(CONNECT stunnel.mirt.net:443). The problem as follows: Only the CLIENT side can install special software. Special software including but not limited to stunnel. If the firewall can block many websites depend on Web IP & URL. How to pass through the firewall base on Public SSL Proxy? How to encrypt the URL-(stunnel.mirt.net:443)? What is the special software? If stunnel can solve this issue. How to configure? Best regards, cpu

1 0

stunnel and IE6 issue
by Bill Tindal 06 Dec '10

06 Dec '10

Hi, I have stunnel running in front of HaProxy and everything is working fine however IE6 users cannot access our HTTPS pages and are instead shown a 'Page cannot be found'. They can access normal pages. Obviously there's something that stunnel doesn't like about IE6 (who doesn't) but I'm at a loss as to what changes to make to the stunnel conf. My conf for stunnel is below: ------------------------------------------------ sslVersion = all options = NO_SSLv2 fips = no setuid = root setgid = stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log [secure.domain.com] cert = /usr/local/openssl/certs/secure.domain.com.crt key = /usr/local/openssl/certs/secure.domain.com.key accept = X.X.X.X:443 connect = X.X.X.X:81 xforwardedfor = yes TIMEOUTclose = 0

1 0

How to define stunnel.conf so openvpn packet will go thru stunnel to as HTTP?
by UARE1234 29 Nov '10

29 Nov '10

Hi, >From what I read the examples in stunnel site it possible to wrap VPN's using Stunnel tool. Is it possible to do it for openvpn packets? I can configure thru the openvpn configurations that it packets will go thru port 80 and use TCP but the packets are not http pure. I need to wrap this packets using the stunnel tool. The purpose is to use openvpn over http. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn if possible. Thanks -- View this message in context: http://old.nabble.com/How-to-define-stunnel.conf-so-openvpn-packet-will-go-… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Is it possible to wrap openvpn thru stunnel to HTTP-Like
by UARE1234 28 Nov '10

28 Nov '10

Hi, I understand that it is possible to wrap VPN's using Stunnel tool. How Can I do that for openvpn. The purpose is to use openvpn over http like. OpenVPN can establish an HTTP connection to a proxy server, where it will issue a CONNECT to establish a binary connection to the VPN server on port 443/TCP. This works in 99,9% but not in this case since I am talking about a very restrictive network but yet Skype for example works on it since it works in a way of http like. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn or other tool if possible. Thanks -- View this message in context: http://old.nabble.com/Is-it-possible-to-wrap-openvpn-thru-stunnel-to-HTTP-L… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Stunnel resource usage
by Avinash Gaonkar 26 Nov '10

26 Nov '10

Hi All, I need to understand how can we calculate the throughput for stunnel based on allocated CPU and memory. For e.g if we allocate 512Mb of RAM and 1 core for the stunnel in Vmware, what would be the throughput in Mbps. Regards, Avinash gaonkar

1 0

Enhance description of transparent mode in FAQ
by Ivan Trancik 25 Nov '10

25 Nov '10

Hello, I would suggest to improve 'transparent = yes | no (Unix only)' section of http://www.stunnel.org/faq/stunnel.html#service_level_options and how this option work on OS X. I think that this part remote mode (I<connect> option) on Linux >=2.6.28 remote mode (I<connect> option) 2.2.x local mode (I<exec> option) is not clear. Remote mode is a "I<connect> option"? What the heck? And local mode is a "I<exec> option"? Does this "I" thingie stand for unnamed pipe or capital "i" or small cap "L"?? I ran to this problem when I tried to set up stunnel on Mac OS X and carelessly used some example config on web. Setting "transparent = yes" in Mac OS X will result in very funny behavior. Consider this conf debug=7 output=stunnel.log verify=0 foreground=yes client=yes pid= [https] accept=localhost:8080 connect=google.com:443 transparent=yes will result in unbelievable error - "local_bind (original port): Address family not supported by protocol family (47)" Using 127.0.0.1 instead of localhost will do better - "Service https bound to 127.0.0.1:8080" - BUT when you try to access 127.0.0.1:8080 nothing reasonable happens and log will show another strange error "connect_blocking: connect <ip_address>: Network is unreachable (51)" The next spectacular thing is that when you use only localhost connect and accept parameter, than transparent=yes works OK. I would suggest rewriting that part to reflect these kind of situations in more clear way - they are very hard to debug, and honestly I couldn't figure it out even though I read FAQ several times. Final question - is it possible on OS X (which doesn't have iptables interface, but has ipfw) to set up transparent proxy tunnel with stunnel? Thanks.

2 1

Problems with cert
by Ross 25 Nov '10

25 Nov '10

Hello, we were using Stunnel 4.25 for a long time without any problems. We used "verify=3". Our client config file: service = stunnel-client cert = client.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = certificates CAfile = CAcert.pem client = yes [rdp] accept = 3398 connect = XX.XX.XX.XX:3398 But after switching to Stunnel 4.34 (preserving configuration) we started to get errors: 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database accepted connection from 127.0.0.1:30082 2010.11.25 13:13:30 LOG5[8332:5336]: connect_blocking: connected 95.130.236.42:3398 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database connected remote server from XX.XX.XX.XX:30083 2010.11.25 13:13:30 LOG5[8332:5336]: Certificate accepted: depth=1, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/emailAddress=bla(a)bla.com 2010.11.25 13:13:30 LOG4[8332:5336]: CERT: Certificate not found in local repository 2010.11.25 13:13:30 LOG4[8332:5336]: Certificate check failed: depth=0, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/CN=OURSERVER/emailAddress=bala(a)bla.com 2010.11.25 13:13:30 LOG3[8332:5336]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2010.11.25 13:13:30 LOG5[8332:5336]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Main error is: CERT: Certificate not found in local repository Looks like stunnel cannot find the hashed server's certificate in C:\Program Files\stunnel\certificates (CApath = certificates) We tried specifying full paths, but it does not help. Switching to "verify=2" (do not check server's cert) works ok. Also stunnel 4.25 (with verify=3) works ok on this configuration. Could you help? Ross

2 1

Re: [stunnel-users] ssl renegotiation
by Jason Haar 25 Nov '10

25 Nov '10

On 11/25/2010 05:42 AM, Joe Williams wrote: > > Got it, so there's no way to configure stunnel to disable it without building a new openssl from source. I was thinking there might be an SSL option I could pass in. > That kind of feature was only introduced into the newer versions of OpenSSL, so by definition, older versions can't have an option to disable it ;-) FYI I still have to run fully patched Apache with "SSLInsecureRenegotiation on" due to MSIE still not supporting proper optional client cert renegotiation. It's only *2 years* since the vulnerability was discovered... (Chrome, Firefox are fine of course) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

1 0

ssl renegotiation
by Joe Williams 24 Nov '10

24 Nov '10

List, How does one secure stunnel from man in the middle attacks regarding ssl renegotiation. I have seen http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html#SECURE_RENEGOTIATI… but I couldn't tell if stunnel is affected by it, nor what I could do outside of installing a newer version of openssl to prevent it. Additionally I did a scan on www.ssllabs.com and it stated that insecure renegotiation was supported, which isn't good. I am running 0.9.8k-7ubuntu8.4, the standard version that ships with ubuntu 10.04, and stunnel 4.32. What can I do to configure stunnel to protect myself? My current config is below. Thanks. -Joe ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/file.crt key = /etc/stunnel/file.key foreground = yes debug = 5 ciphers = DES-CBC3-SHA:AES256-SHA:AES128-SHA:RC4-SHA:RC4-MD5 ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all options = NO_SSLv2 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [https] accept = 443 connect = localhost:80 TIMEOUTclose = 0 Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

2 2