- stunnel-users - stunnel.org

Problems implementing certificate
by Marcelo Iturbe 15 Sep '09

15 Sep '09

Hello, I am using Stunnel 4.27 binary version on Windows 2003 server. In the stunnel.pam file I did the following: In the -----BEGIN RSA PRIVATE KEY----- section, I placed the same text that appeared in the -----BEGIN NEW CERTIFICATE REQUEST----- when I purchased the certificate In the -----BEGIN CERTIFICATE----- section I placed what verisign returned to me. When I try to load Stunnel I get the following error messages: : RAND_status claims sufficient entropy for the PRNG : PRNG seeded successfully : SSL context initialized for service gmail-pop3s : Certificate: stunnel.pem : Error reading certificate file: stunnel.pem : error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib : error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib : error stack: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error : error stack: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error : SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag : Server is down Any thoughts as to where I went wrong? Thanks for your help

1 0

Re: [stunnel-users] Stunnel Certificate generation
by Alaric Dailey 10 Sep '09

10 Sep '09

You can modify your stunnel.conf, there are lots of examples on the web to do that. Please don't use self-signed certs, you will have no end of issues, and there is NO reason to. StartCom offers free certificates, is in most browsers now, and will be included in IE by the end of September. http://blog.startcom.org/?p=205 So why would you create the headaches of using self-signed certs? Original Message ----------------------- Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Stunnel Certificate generation
by Matty Ronald 09 Sep '09

09 Sep '09

Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty

1 0

using stunnel in HP UX 11i v3
by Mostafa Arab 09 Sep '09

09 Sep '09

Hi Sorry for my question because it is too elementary but I need some help. I want to use stunnel for one of our projects on an HP Itanium server that have HP UX 11i v3 This is result for #uname –a command : HP-UX xxxxx B.11.31 U ia64 2210092972 unlimited-user license I want to start stunnel as client . I found an stunnel in ‘/opt/hpws/apache’ folder. 1- May I use this stunnel for my project? 2- If it is possible how I can start it ? I added one line to /etc/services and tried to start : stunnel –d …. (according to a document) .But it seems that this version don’t support this option. Best Regards, Mostafa

2 1

Maximum number of services
by Malenfant, Andre 04 Sep '09

04 Sep '09

Hi, we have ran into a problem and we have identified that we have reached the limit of 64 services in stunnel. I have seen some info on the net for a possibility or increasing that limit to 256 using the poll() method. There is a patch available for that but for an older version of stunnel. Is there a configuration that I can do to enable that on version 4.20? If not, what are my other options? Set-up a second stunnel? Thanks André

1 0

Re: [stunnel-users] Random Client Ports
by Ludolf Holzheid 02 Sep '09

02 Sep '09

On Wed, 2009-09-02 16:22:35 +0200, Reinier van der Gugten wrote: > I included STunnel in a VB application, and want to start it using the shell command (how else?) > If I start STunnel from the commandline (dos box) it works fine (stunnel\stunnel.exe) > However from within code I get an error: > > Dim MyProcID As Integer = 0 > MyProcID = Shell("Stunnel\STunnel") > stunnel.conf: No such file or directory (2) Reinier, This says, stunnel is found and started by the system, but stunnel does not find stunnel.conf. Maybe it doesn't correctly determine it's own location in relation to the working directory. You might try to specify stunnel.conf on the command line, e.g. MyProcID = Shell("stunnel\stunnel stunnel\stunnel.conf") or MyProcID = Shell("stunnel\stunnel .\stunnel.conf") or something along those lines. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Random Client Ports
by Matt Keoppel 02 Sep '09

02 Sep '09

We are currently trying to add Stunnel to our application. Each time one of our clients try to connect to the server it seems to make its call from a random port. We have set up the server config file to be: [OurApp] accept = 15366 connect = 15365 The config file on our client is set up as: client = yes [OurApp] accept = 1308 connect = [serverIp]:15366 The problem that we are having is that the source port on our client changes every time we try to send data from our client to our server. So one time we send data the port will be 1308 and the next time will be 1309. We also tried to set up multiple configurations that were configure to accept on many ports and all connecting to [serverIP]:15366. Is there any way to get Stunnel working with our dynamic client port? Thanks, MK

4 3

Help compiling - rpath issues
by Jay Martel 18 Aug '09

18 Aug '09

Hello, I am trying to avoid LD_LIBRARY_PATH and thus want to compile in the run time library path. I have tried various options to configure, hacking the LDFLAGS and CC lines in the Makefile, changing libtool varialbes, etc. but my resulting binary never has the library path inside. Things I have tried: LDFLAGS=-R/app/versions/local/3/lib LDFLAGS=-L/app/versions/local/3/lib LDFLAGS=-Wl,--rpath -Wl,/app/versions/local/3/lib libtool variables that seem related but I cannot figure out: hardcode_minus_L=yes hardcode_libdir_flag_spec="\${wl}--rpath \${wl}\$libdir" I am using stunnel-4.27 and the configure and libtool it contains. Here is the output of gcc -v: Reading specs from /app/versions/local/3/lib/gcc/i386-pc-solaris2.10/3.4.5/specs Configured with: /opt/autobuild/workdir/gcc-3.4.5/configure --prefix=/app/versions/devtools/3 --with-gnu-ld --with-ld=/app/versions/devtools/3/bin/ld --with-gnu-as --with-as=/app/versions/devtools/3/bin/as --libdir=/app/versions/local/3/lib --with-local-prefix=/app/versions/local/3 --with-gxx-include-dir=/app/versions/local/3/include/c++ --enable-languages=c,c++,objc Thread model: posix gcc version 3.4.5 I am having the same issue with Solaris 10 on i86pc and sparc architectures. Here is the last bit of my make output: /bin/bash ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/app/versions/local/3/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/app/versions/local/3/lib -lssl -lcrypto gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/app/versions/local/3/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/app/versions/local/3/lib -lssl -lcrypto The libtool line should show my rpath setting, I think. How do I get libtool to honor the rpath settings? Should I be asking the libtool maintainers? I check the resulting binary using "strings stunnel | grep app" and my library directory never shows up. Many thanks in advance. -Jay Martel _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://windowslive.com/Campaign/SocialNetworking?ocid=PID23285::T:WLMTAGL:O…

1 0

Re: [stunnel-users] Stunnel configure error
by hdf sdesdh 12 Aug '09

12 Aug '09

Having configured with --enable-static, I thought it would be ok. I tried your suggestion though I got the same error. Here is the complete output. Just a note, I am using the source code tree for TomatoVPN, since it comes with the toolchain to compile everything with. LDFLAGS=-static ./configure2 --host=mipsel-linux --with-ssl=/tmp --enable-static --enable-dh configure2: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used. configure2: **************************************** initialization checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking for mipsel-linux-strip... mipsel-linux-strip checking build system type... i686-pc-linux-gnu checking host system type... mipsel-unknown-linux-gnu checking for mipsel-linux-gcc... mipsel-linux-gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... yes checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether mipsel-linux-gcc accepts -g... yes checking for mipsel-linux-gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of mipsel-linux-gcc... gcc3 checking for a BSD-compatible install... /usr/bin/install -c checking whether make sets $(MAKE)... (cached) yes configure2: **************************************** libtool checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ld used by mipsel-linux-gcc... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking for /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld option to reload object files... -r checking for BSD-compatible nm... /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B checking whether ln -s works... yes checking how to recognize dependent libraries... pass_all checking how to run the C preprocessor... mipsel-linux-gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for mipsel-linux-g++... mipsel-linux-g++ checking whether we are using the GNU C++ compiler... yes checking whether mipsel-linux-g++ accepts -g... yes checking dependency style of mipsel-linux-g++... gcc3 checking how to run the C++ preprocessor... mipsel-linux-g++ -E checking for mipsel-linux-g77... no checking for mipsel-linux-xlf... no checking for mipsel-linux-f77... no checking for mipsel-linux-frt... no checking for mipsel-linux-pgf77... no checking for mipsel-linux-cf77... no checking for mipsel-linux-fort77... no checking for mipsel-linux-fl32... no checking for mipsel-linux-af77... no checking for mipsel-linux-xlf90... no checking for mipsel-linux-f90... no checking for mipsel-linux-pgf90... no checking for mipsel-linux-pghpf... no checking for mipsel-linux-epcf90... no checking for mipsel-linux-gfortran... no checking for mipsel-linux-g95... no checking for mipsel-linux-xlf95... no checking for mipsel-linux-f95... no checking for mipsel-linux-fort... no checking for mipsel-linux-ifort... no checking for mipsel-linux-ifc... no checking for mipsel-linux-efc... no checking for mipsel-linux-pgf95... no checking for mipsel-linux-lf95... no checking for mipsel-linux-ftn... no checking for g77... no checking for xlf... no checking for f77... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for xlf90... no checking for f90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for xlf95... no checking for f95... no checking for fort... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 1572864 checking command to parse /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B output from mipsel-linux-gcc object... ok checking for objdir... .libs checking for mipsel-linux-ar... mipsel-linux-ar checking for mipsel-linux-ranlib... mipsel-linux-ranlib checking for mipsel-linux-strip... (cached) mipsel-linux-strip checking if mipsel-linux-gcc supports -fno-rtti -fno-exceptions... yes checking for mipsel-linux-gcc option to produce PIC... -fPIC checking if mipsel-linux-gcc PIC flag -fPIC works... yes checking if mipsel-linux-gcc static flag -static works... yes checking if mipsel-linux-gcc supports -c -o file.o... yes checking whether the mipsel-linux-gcc linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure2: creating libtool appending configuration tag "CXX" to libtool checking for ld used by mipsel-linux-g++... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking for mipsel-linux-g++ option to produce PIC... -fPIC checking if mipsel-linux-g++ PIC flag -fPIC works... yes checking if mipsel-linux-g++ static flag -static works... yes checking if mipsel-linux-g++ supports -c -o file.o... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... GNU/Linux ld.so (cached) (cached) checking how to hardcode library paths into programs... immediate appending configuration tag "F77" to libtool configure2: **************************************** types checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 checking for socklen_t... yes configure2: **************************************** PTY device files checking for "/dev/ptmx"... (cached) yes checking for "/dev/ptc"... no configure2: **************************************** entropy checking for "/dev/urandom"... yes configure2: **************************************** default group checking for default group... nogroup configure2: **************************************** header files checking ucontext.h usability... yes checking ucontext.h presence... yes checking for ucontext.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking pty.h usability... yes checking pty.h presence... yes checking for pty.h... yes checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking for struct msghdr.msg_control... yes configure2: **************************************** libraries checking for library containing gethostbyname... none required checking for library containing yp_get_default_domain... -lnsl checking for socket in -lsocket... no checking for openpty in -lutil... yes checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for inflateEnd in -lz... no configure2: **************************************** thread model checking for pthread_create in -lc_r... no checking for pthread_create in -lpthread... yes configure2: PTHREAD thread model detected configure2: **************************************** library functions checking for snprintf... yes checking for vsnprintf... yes checking for openpty... yes checking for _getpty... no checking for daemon... yes checking for waitpid... yes checking for wait4... yes checking for setsid... yes checking for setgroups... yes checking for chroot... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for localtime_r... yes checking for getcontext... no checking for __makecontext_v2... no checking for poll... yes checking for endhostent... yes checking for getnameinfo... yes checking for getaddrinfo... yes checking for broken poll() implementation... no configure2: **************************************** SSL checking for SSL directory... /tmp checking for obsolete RSAref library... no checking /tmp/include/openssl/engine.h usability... yes checking /tmp/include/openssl/engine.h presence... no configure2: WARNING: /tmp/include/openssl/engine.h: accepted by the compiler, rejected by the preprocessor! configure2: WARNING: /tmp/include/openssl/engine.h: proceeding with the compiler's result checking for /tmp/include/openssl/engine.h... yes configure2: **************************************** optional features checking whether to disable RSA support... no checking whether to enable DH support... yes checking whether to enable IPv6 support... yes checking whether to disable TCP wrappers library support... autodetecting checking for hosts_access in -lwrap... no checking whether to enable FIPS mode support... autodetecting checking for FIPS_mode_set... no configure2: **************************************** write the results configure2: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/stunnel3 config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init config.status: executing depfiles commands configure2: **************************************** success # make Making all in src make[1]: Entering directory `/root/tomato/release/src/router/stunnel/src' if /bin/bash ../libtool --tag=CC --mode=compile mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT env.lo -MD -MP -MF ".deps/env.Tpo" -c -o env.lo env.c; \ then mv -f ".deps/env.Tpo" ".deps/env.Plo"; else rm -f ".deps/env.Tpo"; exit 1; fi mkdir .libs mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" "-DPACKAGE_STRING=\"stunnel 4.27\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR=\"/usr/local/lib/stunnel\" -DCONFDIR=\"/usr/local/etc/stunnel\" -DPIDFILE=\"/usr/local/var/run/stunnel/stunnel.pid\" -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fPIC -DPIC -o .libs/env.o mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" "-DPACKAGE_STRING=\"stunnel 4.27\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR=\"/usr/local/lib/stunnel\" -DCONFDIR=\"/usr/local/etc/stunnel\" -DPIDFILE=\"/usr/local/var/run/stunnel/stunnel.pid\" -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -o env.o >/dev/null 2>&1 /bin/bash ../libtool --tag=CC --mode=link mipsel-linux-gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -static -o libstunnel.la -rpath /usr/local/lib/stunnel -avoid-version env.lo -ldl -lutil -lnsl -lpthread -L/tmp/lib -lssl -lcrypto mipsel-linux-ar cru .libs/libstunnel.a env.o mipsel-linux-ranlib .libs/libstunnel.a creating libstunnel.la (cd .libs && rm -f libstunnel.la && ln -s ../libstunnel.la libstunnel.la) if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT file.o -MD -MP -MF ".deps/file.Tpo" -c -o file.o file.c; \ then mv -f ".deps/file.Tpo" ".deps/file.Po"; else rm -f ".deps/file.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT client.o -MD -MP -MF ".deps/client.Tpo" -c -o client.o client.c; \ then mv -f ".deps/client.Tpo" ".deps/client.Po"; else rm -f ".deps/client.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT log.o -MD -MP -MF ".deps/log.Tpo" -c -o log.o log.c; \ then mv -f ".deps/log.Tpo" ".deps/log.Po"; else rm -f ".deps/log.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT options.o -MD -MP -MF ".deps/options.Tpo" -c -o options.o options.c; \ then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT protocol.o -MD -MP -MF ".deps/protocol.Tpo" -c -o protocol.o protocol.c; \ then mv -f ".deps/protocol.Tpo" ".deps/protocol.Po"; else rm -f ".deps/protocol.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT network.o -MD -MP -MF ".deps/network.Tpo" -c -o network.o network.c; \ then mv -f ".deps/network.Tpo" ".deps/network.Po"; else rm -f ".deps/network.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT resolver.o -MD -MP -MF ".deps/resolver.Tpo" -c -o resolver.o resolver.c; \ then mv -f ".deps/resolver.Tpo" ".deps/resolver.Po"; else rm -f ".deps/resolver.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT ssl.o -MD -MP -MF ".deps/ssl.Tpo" -c -o ssl.o ssl.c; \ then mv -f ".deps/ssl.Tpo" ".deps/ssl.Po"; else rm -f ".deps/ssl.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT ctx.o -MD -MP -MF ".deps/ctx.Tpo" -c -o ctx.o ctx.c; \ then mv -f ".deps/ctx.Tpo" ".deps/ctx.Po"; else rm -f ".deps/ctx.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT verify.o -MD -MP -MF ".deps/verify.Tpo" -c -o verify.o verify.c; \ then mv -f ".deps/verify.Tpo" ".deps/verify.Po"; else rm -f ".deps/verify.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT sthreads.o -MD -MP -MF ".deps/sthreads.Tpo" -c -o sthreads.o sthreads.c; \ then mv -f ".deps/sthreads.Tpo" ".deps/sthreads.Po"; else rm -f ".deps/sthreads.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT stunnel.o -MD -MP -MF ".deps/stunnel.Tpo" -c -o stunnel.o stunnel.c; \ then mv -f ".deps/stunnel.Tpo" ".deps/stunnel.Po"; else rm -f ".deps/stunnel.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT pty.o -MD -MP -MF ".deps/pty.Tpo" -c -o pty.o pty.c; \ then mv -f ".deps/pty.Tpo" ".deps/pty.Po"; else rm -f ".deps/pty.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT libwrap.o -MD -MP -MF ".deps/libwrap.Tpo" -c -o libwrap.o libwrap.c; \ then mv -f ".deps/libwrap.Tpo" ".deps/libwrap.Po"; else rm -f ".deps/libwrap.Tpo"; exit 1; fi /bin/bash ../libtool --tag=CC --mode=link mipsel-linux-gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -static -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -ldl -lutil -lnsl -lpthread -L/tmp/lib -lssl -lcrypto mipsel-linux-gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -ldl -lutil -lnsl -lpthread -L/tmp/lib -lssl -lcrypto make[1]: Leaving directory `/root/tomato/release/src/router/stunnel/src' Making all in doc make[1]: Entering directory `/root/tomato/release/src/router/stunnel/doc' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/root/tomato/release/src/router/stunnel/doc' Making all in tools make[1]: Entering directory `/root/tomato/release/src/router/stunnel/tools' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/root/tomato/release/src/router/stunnel/tools' make[1]: Entering directory `/root/tomato/release/src/router/stunnel' make[1]: Nothing to be done for `all-am'. make[1]: Leaving directory `/root/tomato/release/src/router/stunnel' # After downloading it, to my router # ./stunnel > -sh: ./stunnel: not found I tried uploading the openssl version I compiled for stunnel (v 1.0.0-stable-SNAP-20090809, which I also compiled for the router, and is functioning mostly) as well, and got the same error. If you have any other suggestions, I'm open to them, otherwise, I think I'm going to have to retire this project for now. Thank you -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com!

1 0

Re: [stunnel-users] Stunnel configure error
by hdf sdesdh 12 Aug '09

12 Aug '09

Thanks for the suggestion, I was able to make the necessary changes and pass the configure and make process. Unfortunately, after uploading and running the app, the app will not run: # ls -al /tmp -rwxrwxrwx 1 root root 2434012 Aug 12 01:44 stunnel -rw-r--r-- 1 root root 1148 Aug 12 01:37 stunnel.conf -rw-r--r-- 1 root root 1977 Aug 12 01:44 stunnel.pem drwxr-xr-x 1 root root 0 Dec 31 1969 var # cd /tmp # ./stunnel -sh: ./stunnel: not found The file is obviously there, with execute permissions. What is failing?? Thank you > checking for "/dev/ptmx"... configure: error: cannot check for file > existence when cross compiling. > > Give me your suggestions. Check that /dev/ptmx exists on your router; it does on my Buffalo router with Tomato. If it does, then hack the configure script to force the test to return true. A search in the script for ptmx should take you right to the test. Good luck, Andrew. -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com!

2 1

Stunnel configure error
by hdf sdesdh 12 Aug '09

12 Aug '09

I have been receiving errors when configuring Stunnel, which I intend to cross compile for use with my Linksys WRT54GL router (Tomato firmware). When passing ./configure --host=mipsel-linux --with-ssl=/root/openssl --enable-static --enable-dh --libexecdir=/tmp the configure process stops with an error. Here is the complete output. ./configure --host=mipsel-linux --with-ssl=/root/openssl --enable-static --enable-dh --libexecdir=/tmp configure: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used. configure: **************************************** initialization checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking for mipsel-linux-strip... mipsel-linux-strip checking build system type... i686-pc-linux-gnu checking host system type... mipsel-unknown-linux-gnu checking for mipsel-linux-gcc... mipsel-linux-gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... yes checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether mipsel-linux-gcc accepts -g... yes checking for mipsel-linux-gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of mipsel-linux-gcc... gcc3 checking for a BSD-compatible install... /usr/bin/install -c checking whether make sets $(MAKE)... (cached) yes configure: **************************************** libtool checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ld used by mipsel-linux-gcc... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking for /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld option to reload object files... -r checking for BSD-compatible nm... /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B checking whether ln -s works... yes checking how to recognize dependent libraries... pass_all checking how to run the C preprocessor... mipsel-linux-gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for mipsel-linux-g++... mipsel-linux-g++ checking whether we are using the GNU C++ compiler... yes checking whether mipsel-linux-g++ accepts -g... yes checking dependency style of mipsel-linux-g++... gcc3 checking how to run the C++ preprocessor... mipsel-linux-g++ -E checking for mipsel-linux-g77... no checking for mipsel-linux-xlf... no checking for mipsel-linux-f77... no checking for mipsel-linux-frt... no checking for mipsel-linux-pgf77... no checking for mipsel-linux-cf77... no checking for mipsel-linux-fort77... no checking for mipsel-linux-fl32... no checking for mipsel-linux-af77... no checking for mipsel-linux-xlf90... no checking for mipsel-linux-f90... no checking for mipsel-linux-pgf90... no checking for mipsel-linux-pghpf... no checking for mipsel-linux-epcf90... no checking for mipsel-linux-gfortran... no checking for mipsel-linux-g95... no checking for mipsel-linux-xlf95... no checking for mipsel-linux-f95... no checking for mipsel-linux-fort... no checking for mipsel-linux-ifort... no checking for mipsel-linux-ifc... no checking for mipsel-linux-efc... no checking for mipsel-linux-pgf95... no checking for mipsel-linux-lf95... no checking for mipsel-linux-ftn... no checking for g77... no checking for xlf... no checking for f77... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for xlf90... no checking for f90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for xlf95... no checking for f95... no checking for fort... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 1572864 checking command to parse /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B output from mipsel-linux-gcc object... ok checking for objdir... .libs checking for mipsel-linux-ar... mipsel-linux-ar checking for mipsel-linux-ranlib... mipsel-linux-ranlib checking for mipsel-linux-strip... (cached) mipsel-linux-strip checking if mipsel-linux-gcc supports -fno-rtti -fno-exceptions... yes checking for mipsel-linux-gcc option to produce PIC... -fPIC checking if mipsel-linux-gcc PIC flag -fPIC works... yes checking if mipsel-linux-gcc static flag -static works... yes checking if mipsel-linux-gcc supports -c -o file.o... yes checking whether the mipsel-linux-gcc linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure: creating libtool appending configuration tag "CXX" to libtool checking for ld used by mipsel-linux-g++... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking for mipsel-linux-g++ option to produce PIC... -fPIC checking if mipsel-linux-g++ PIC flag -fPIC works... yes checking if mipsel-linux-g++ static flag -static works... yes checking if mipsel-linux-g++ supports -c -o file.o... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... GNU/Linux ld.so (cached) (cached) checking how to hardcode library paths into programs... immediate appending configuration tag "F77" to libtool configure: **************************************** types checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 checking for socklen_t... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... configure: error: cannot check for file existence when cross compiling. Give me your suggestions. Thank you -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com!

2 1

running more than 1 stunnel as windows service
by Franjo Stipanovic 04 Aug '09

04 Aug '09

Hi guys, is there a way to install multiple stunnel instances as windows service? Where could I change service name? I get error: CreateService : the specified service already exists -- best wishes, Franjo Stipanovic

1 1

stunnel, haproxy and ssl cert
by Maxim 04 Aug '09

04 Aug '09

Hello dear community. I faced some troubles for iphone: I moved separate server from hardware to AWS Cloud with SSL certificate from Register.com. It moved well, and phone application continue work with new server without any problems. Then I installed LoadBalancer (HAProxy and Stunnel) for it and moved certificate with key from configs of Apache to config of stunnel. In PC browser it continue works well, and shows me blue field near the URL as trusted. But on iPhone browser it shows just "Untrusted server certificate". Is there any difference for ssl certificate for stunnel and Apache? I understand that there is very specific question, but would you have any ideas about it? *Config of stunnel:* cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log [https] accept = 443 connect = 80 xforwardedfor=yes TIMEOUTclose = 0 *Patch for stunnel* http://haproxy.1wt.eu/download/patches/stunnel-4.22-xforwarded-for.diff need to make work "xforwardedfor=yes" *# stunnel -version* stunnel 4.22 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none * # uname -a* Linux domU-12-31-38-00-35-07 2.6.18-xenU-ec2-v1.0 #2 SMP Tue Feb 19 10:51:53 EST 2008 i686 athlon i386 GNU/Linux * # openssl version* OpenSSL 0.9.8b 04 May 2006 *And logs from stunnel when iphone tryed to conenct* 2009.08.04 08:20:16 LOG7[31023:3081598672]: https accepted FD=15 from 24.5.77.143:58019 2009.08.04 08:20:16 LOG7[31023:3081550736]: https started 2009.08.04 08:20:16 LOG7[31023:3081550736]: FD 15 in non-blocking mode 2009.08.04 08:20:16 LOG7[31023:3081550736]: TCP_NODELAY option set on local socket 2009.08.04 08:20:16 LOG7[31023:3081550736]: Waiting for a libwrap process 2009.08.04 08:20:16 LOG7[31023:3081550736]: Acquired libwrap process #0 2009.08.04 08:20:16 LOG7[31023:3081550736]: Releasing libwrap process #0 2009.08.04 08:20:16 LOG7[31023:3081550736]: Released libwrap process #0 2009.08.04 08:20:16 LOG7[31023:3081550736]: https permitted by libwrap from 24.5.77.143:58019 2009.08.04 08:20:16 LOG5[31023:3081550736]: https accepted connection from 24.5.77.143:58019 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): before/accept initialization 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 read client hello A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write server hello A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write certificate A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write server done A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 flush data 2009.08.04 08:20:16 LOG3[31023:3081550736]: SSL_accept: Peer suddenly disconnected 2009.08.04 08:20:16 LOG5[31023:3081550736]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.08.04 08:20:16 LOG7[31023:3081550736]: https finished (0 left) Thank you in advance, Max

1 0

write client hello hang/timeout
by . 01 Aug '09

01 Aug '09

stunnel4 config 2009.08.01 05:09:29 LOG7[4856:0]: Snagged 64 random bytes from /home/c7a71k/.rnd 2009.08.01 05:09:29 LOG7[4856:0]: Wrote 1024 new random bytes to /home/c7a71k/.rnd 2009.08.01 05:09:29 LOG7[4856:0]: RAND_status claims sufficient entropy for the PRNG 2009.08.01 05:09:29 LOG7[4856:0]: PRNG seeded successfully 2009.08.01 05:09:29 LOG7[4856:0]: Certificate: /etc/stunnel/stunnel.pem 2009.08.01 05:09:29 LOG7[4856:0]: Certificate loaded 2009.08.01 05:09:29 LOG7[4856:0]: Key file: /etc/stunnel/stunnel.pem 2009.08.01 05:09:29 LOG7[4856:0]: Private key loaded 2009.08.01 05:09:29 LOG7[4856:0]: SSL context initialized for service stunnel 2009.08.01 05:09:29 LOG5[4856:0]: stunnel 4.22 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2009.08.01 05:09:29 LOG5[4856:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv6 2009.08.01 05:09:29 LOG7[4856:0]: stunnel started 2009.08.01 05:09:29 LOG7[4856:0]: FD 0 in non-blocking mode 2009.08.01 05:09:29 LOG7[4856:0]: FD 1 in non-blocking mode 2009.08.01 05:09:29 LOG7[4856:0]: FD 4 in non-blocking mode 2009.08.01 05:09:29 LOG7[4856:0]: stunnel connecting 212.93.193.72:443 2009.08.01 05:09:29 LOG7[4856:0]: connect_wait: waiting 10 seconds 2009.08.01 05:09:29 LOG7[4856:0]: connect_wait: connected 2009.08.01 05:09:29 LOG5[4856:0]: stunnel connected remote server from 192.168.2.100:47406 2009.08.01 05:09:29 LOG7[4856:0]: Remote FD=4 initialized 2009.08.01 05:09:29 LOG7[4856:0]: SSL state (connect): before/connect initialization 2009.08.01 05:09:29 LOG7[4856:0]: SSL state (connect): SSLv2 write client hello A # (hangs indefinitely) #here's the config: client = yes foreground = yes debug = 7 cert = /etc/stunnel/stunnel.pem sslVersion = SSLv2 connect = 212.93.193.72:443 execargs = iceweasel # I think I'm supposed to get a "read server hello A" back?... But I get nothing, and iceweasel is *not* launched. # Anyone know how to overcome this?

1 0

[patch] Redirect to a fake destination if client's certificate couldn't be verified
by Jeremie Le Hen 29 Jul '09

29 Jul '09

Hi list, I've written a patch to bring in the following directives: - evilconnect - evilexec/evilexecargs The idea is when stunnel works in server mode and is asked to verify the client's certificate, it normally shuts the connection down when the latter is invalid. With these options, when the certificate can't be verified, stunnel redirects the "evil" connection to another destination. What is the purpose of this new feature ? For instance, if your company does not allow SSH connections out, you may use the following configuation: % connect = yourdomain.com:22 % evilconnect = www.yourdomain.com:80 So you will access your SSH server with your valid user certificate. On the other hand, if an over-zealous sneaky admin looks at the proxy logs and tries to connect to your stunnel, it will be redirected to an uninteresting website ;). Here is the documentation: % evilconnect = [host:]port % connect to a remote host:port when the client's certificate cannot % be verified % % This is only meaningful in server mode when connect and verify are % used. Otherwise it has the same properties as the connect option. % % evilexec = executable_path (Unix only) % execute local inetd-type program when the client's certificate can- % not be verified % % This is only meaningful in server mode when exec and verify are % used. Otherwise it has the same properties as the exec option. % % execargs = $0 $1 $2 ... (Unix only) % arguments for evilexec including program name ($0) % % Quoting is currently not supported. Arguments are separated with % arbitrary number of whitespaces. I'd like to thank Mathieu CHOUQUET-STRINGER who actually had this very good idea and implemented a proof of concept code with GnuTLS. Also, thank to Vin0x64 <vincent vin0x64 fr> who tested this patch and verified that it works. Looking forward for your remarks... thanks! Best regards, -- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org >

1 1

Stunnel listen on different ports
by Noel Sanchez 21 Jul '09

21 Jul '09

I have had a working stunnel conf for much time, very happy with it. [stunnel] accept = 0.0.0.0:30000 connect = 192.168.27.102:8000 I have stunnel listening on port 30000 and then sending to 192.168.27.102 on port 8000. Works good. I now want to add more listening ports to stunnel, like so: [stunnel] accept = 0.0.0.0:30000 connect = 192.168.27.102:8000 accept = 0.0.0.0:30006 connect = 192.168.27.102:8006 When I do this, stunnel only binds to 30006, per my log file: stunnel bound to 0.0.0.0:30006 And when I do a netstat -vatn: tcp 0 0 0.0.0.0:30006 0.0.0.0:* LISTEN It is not listening on port 30000 anymore. I'd like to accepts connections on many different ports, then send accordingly. Can I do this? Why does stunnel only listen to one port when I add more accept lines in its config? Noel

2 2

Re: [stunnel-users] using webdav: YES IT WORKS WITH NET USE
by delaage.pierre＠free.fr 18 Jul '09

18 Jul '09

Well after some more tests I achieve net use to work: UseBasicAuth is VITAL on the xp client (reboot) Accordingly configure apache with basic plain text auth stunnel routing localhost:80 to remote:443 (as you did) to pass your credentials use EXACTLY this command line : net use y: \\localhost\davfolder (with no extra \) YOURPASSWORD /USER:YOURUSERNAME (this in the only way to have hhtp credentials sent to the server). tested on client: xpsp2 + kb892211 + kb911927 (IMPORTANT ALSO, needs reboot) + stunnel 427 and server apache 2.2.6/Mandriva 2008. kb907306 replaces 892211, but I have not tested with it (I think it should work). If you cannot achieve it to work please let me know the exact error message you receive from windows. Again your problem is only related to windows issue, not stunnel. Pierre Quoting Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > yes, i am the admin. have pulled it back to basic auth. > okay i have installed Webfldrs-KB907306-ENU.exe and checked for its listing > in systemcontrol -> software (show updates) - it does not appear there! :-( > add network location: > it is running directly to the server and through stunnel, too :-) > > wtf? i have to install office2003 for such a problem? mh okay, i did so - no > change in behaviour - mh the failures of net use are changing - now it is a > systemfailure 67. networkname not found > syntax: net use x: \\127.0.0.1\user /user:user > > thank you - flo > > > 2009/7/18 <delaage.pierre(a)free.fr> > > > A question : > > Are you the administrator of your web server ? > > if yes : set up apache with "basic authentication", not digest (this will > > not be > > a problem later with ssl) and setup the registry key usebasicauth to 1 on > > your > > client. > > SP3 does NOT contain kb907306 : so install it (you will not damage your > > system > > if this patch is already in it). > > Forget net use for the moment : "add network location" should work first. > > > > IMPORTANT : "add network location" supports SSL WITHOUT the need of > > stunnel, so > > try to setup directly a "location" pointing to " > > https://yourserver/yourfolder". > > of course you will need to install first your own certificate with > > "internet > > explorer", so that windows can use it to connect to your ssl server. > > > > Something else : check this http://support.microsoft.com/KB/942392 > > ...ie be sure that your server allow browsing dav space FROM the root url. > > Moreover, always according to kb942392, to have net use working one must > > have > > ...MS office installed! > > > > Pierre > > > > > > Quoting Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > > > > > ok, i thought that i've sp3 in my virtualbox... but it is installed now - > > > and all other updates too! > > > i've tested with digest authentification now - but it isn't running. > > > the remote server is a debian lenny with apache2.2. > > > the ssl certificate is validated by Equifax Secure Inc. > > > ie7: sure :) and i am confused in the moment the mapping in networkarea > > as > > > addition web ressource isn't running. tried it with ssl in the past (was > > > running) and now without ssl, there appears this log in apache: > > > [Sat Jul 18 00:30:33 2009] [error] [client ip] user > > > subdomain.example.de\user > > > not found: / > > > for the digest method the same with "realm" > > > however there is no preview for the files with this method, and that is > > what > > > i need :( > > > > > > i think i haven't installed kb907306 in the moment(mh ok maybe it is in > > > servicepack 3 ?), but i don't know what you mean with dbl click feature > > :-( > > > > > > i'm really pleased for your help :-) > > > > > > 2009/7/17 <delaage.pierre(a)free.fr> > > > > > > > Next step : > > > > be sure to have kb892211 (preferred) or more recent kb907306 (suppress > > dbl > > > > click > > > > feature!) installed on your system and retry. > > > > Yes you have to create the registry key by hand on your client system, > > > > but you really have to know more about your server authentication > > process. > > > > About ie7 : have you been able to browse in your webfolders, via a > > folder > > > > view? > > > > > > > > Try also adding your web folder to windows explorer by using "Add > > Network > > > > location", which is another mechanism than mapping a drive letter, and > > more > > > > often works. > > > > > > > > See you soon, > > > > Pierre Delaage > > > > > > > > > > > > > > > > Quoting Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > > > > > > > > > wow thank you, some really good tips :) > > > > > i tested it with ie 7 and it is running fine. > > > > > then i've set the regkey, is it right that i have to create it by > > myself? > > > > > rebooted - and no, there is the same error :-( > > > > > the gui for the net use command ( explorer/tools/ map networkdrive) > > isn't > > > > > running, too! > > > > > > > > > > i really hope, that any body could help me > > > > > thank you > > > > > > > > > > > > > > > 2009/7/17 <delaage.pierre(a)free.fr> > > > > > > > > > > > Hello, > > > > > > There are many things to check on Windows configuration before > > > > > > checking potential issues in stunnel. > > > > > > > > > > > > At first you should check what is the HTTP authentication mechanism > > > > used by > > > > > > your > > > > > > webdav server : > > > > > > if this server is using "basic plain text authentication", this > > WILL > > > > NOT BE > > > > > > supported by the windows "webdav redirector" (the system component > > that > > > > > > allows > > > > > > you to map a webdav folder to a virtual system drive)...unless you > > set > > > > up > > > > > > this > > > > > > registry key : > > > > > > > > > > > > > > > > [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWebClientParameters] > > > > > > "UseBasicAuth"=dword:00000001 > > > > > > > > > > > > Check this page for some MS explanations: > > > > > > > > http://technet.microsoft.com/en-us/library/cc787023%28WS.10%29.aspx > > > > > > > > > > > > Something else to check : try to open your webdav location by using > > > > > > "internet > > > > > > explorer 6 or 7"/file-open/check "web folder" checkbox. let us know > > > > whether > > > > > > it > > > > > > works. > > > > > > Try also by "Explorer/Tools/Map network drive", but it is very > > painful > > > > by > > > > > > asking > > > > > > many times for credentials. > > > > > > > > > > > > Yours sincerely, > > > > > > Pierre Delaage > > > > > > > > > > > > Selon Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > > > > > > > > > > > > > > > > > > > hi - i want to use webdav through stunnel to provide a > > drive(letter). > > > > > > > system: winxp sp3 > > > > > > > net use http://127.0.0.1/dirname /user:someuser > > > > > > > offers a systemfailure 64... stunnel log said SSL_connect: > > 1408F06B: > > > > > > > error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression > > > > > > > but a connection with firefox is running fine. > > > > > > > i am doing try&error for about a week and i am sick now :( > > > > > > > i hope you can help me - thank you > > > > > > > > > > > > > > client=yes > > > > > > > verify=0 > > > > > > > [psuedo-https] > > > > > > > accept = 80 > > > > > > > connect = ssl.studenten-wg-halle.de:443 > > > > > > > TIMEOUTclose = > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >

1 0

using webdav
by Jan-Florian Hilgenberg 17 Jul '09

17 Jul '09

hi - i want to use webdav through stunnel to provide a drive(letter). system: winxp sp3 net use http://127.0.0.1/dirname /user:someuser offers a systemfailure 64... stunnel log said SSL_connect: 1408F06B: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression but a connection with firefox is running fine. i am doing try&error for about a week and i am sick now :( i hope you can help me - thank you client=yes verify=0 [psuedo-https] accept = 80 connect = ssl.studenten-wg-halle.de:443 TIMEOUTclose =

2 1

Common Name checking
by Mark Bolton 15 Jul '09

15 Jul '09

Hi, I believe this has been discussed before on the list but I wanted to get a better understanding and confirm the current situation. Is it still correct that when using verify=2, the peer's hostname is not checked (via a name service lookup) to match the Common Name in the presented certificate? With the main reason being that you cannot necessarily trust the name service? I am asking because we have a closed network in which we do trust our dns servers, and Common Name checking would be advantageous to us given the following scenario: We have is that a single (central) host that connects to multiple 'client' hosts via stunnel. The central host presents a certificate signed by our own CA. Each client has a copy of our CA's certificate and has verify=2. So when the central server connects, the client checks that the certificate presented has really been signed by our own CA. So using this mechanism, only servers (i.e. the central server) with a signed certificate are allowed to connect. All good so far, however the problem is if the signed certificate is copied (stolen) to another server. This 'other' server can connect to all the clients also. With Common Name checking, the clients could as well as checking the signature, check the presenting host has the same hostname as in the certificate. Is there anyway we can use stunnel to help us guard against this 'stolen cert' situation or if not what else could we do? Thanks, Mark

2 3

[patch] add new option send_client_info
by Henrik Riomar 14 Jul '09

14 Jul '09

Hi, The attached patch adds a new option that allows stunnel to pass on some client information to for instance a web service that uses stunnel for it's encryption. The first line of data contains the client info and if the new option is not enabled the patch does nothing. Regards, Henrik Riomar P.S. public domain.

1 0

stunnel throttling and statistics
by Laurens Van Houtven 10 Jul '09

10 Jul '09

Hi! I'm using stunnel to secure an AMQP message broker (RabbitMQ, specifically) using pre-shared certificates. This means that my backends never get to see the SSL certificate that the client used to connect -- unfortunately, it's that very backend that's the first who can decide if a message is malicious or not. In order to sort-of fix this problem, I'm using UUIDs so that the keyspace is so absurdly huge that the odds that someone will guess a key are second to none. Still, if someone is misbehaving (trying a large number of bogus keys) it would be nice to know who it is so I could stop wasting CPU time and bandwidth on them. So, I was wondering if anyone has used stunnel (vanilla or modified) to keep statistical data about who connects (which certificates). Additionally, does anyone know of a decent way to throttle per-certificate (or limit the amount of tunnels that can be opened per certificate). If all else fails I could just do normal throttling on a per-IP basis, which should get me roughly the same thing. The reason I want this is because I want to prevent users from even *trying* a large number of such keys (even though it's statistically unlikely that they'll get one) since it still takes me CPU time to process that junk. Thanks in advance Laurens

2 1

Re: [stunnel-users] Dynamic hosts
by Ludolf Holzheid 29 Jun '09

29 Jun '09

On Tue, 2009-06-23 20:52:30 -0400, Terry Riegel wrote: > > On Jun 23, 2009, at 11:01 AM, Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de > > wrote: > > > >On Tue, 2009-06-23 10:33:14 -0400, Terry Riegel wrote: > >> > >>If I did it the way you are suggesting then 5 concurrent users would > >>fire up 30 processes. On my system starting the daemon starts 6 > >>processes, and if I start it up again I get another 6 processes. > > > >Is this still true with 'foreground = yes'? > > Yes. You are right. On detaching to the background, there is an additional fork(), but the parent dies early. So the number of persistent processes is the same. > >For reducing the number of processes, you might also try to configure > >stunnel with --disable-libwrap. > > I can try that wasn't aware of it as a configuration option There is also a '--with-threads=pthread' option that may help to lower the number of processes. However, on modern operating systems, fork()ing is not as expensive as it looks like. In most cases, the text segment is shared between the two processes and the pages on data/BSS segments are not copied until changed ('copy-on-write'). I don't know if the usage of OS resources is larger for the multi-threaded or the multi-tasked approach. Ludolf P.S.: Please reply to the list, so the community is able to follow all of the thread. -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

4 6

stunnel - connection issue with larger number of connections
by Franjo Stipanovic 26 Jun '09

26 Jun '09

Hello, have anyone experienced a issue with stunnel when there's a larger number of concurrent connections (>50)? I've got my application service and stress tester for it. I've placed stunnel in front of application service because I allow clients only to connect to application service using SSL. When stress tester communicates directly with application service with 100 concurrent connections (threads) there's no issue, but when I connect over SSL (thru stunnel) more than 50% of connections fails with error : connection refused :( Seems like there's a limit in windows server for number of threads per process since stunnel does one thread per connection, right? Any idea on how can I test this further? stunnel information: stunnel 4.22 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = 5 RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 8192 SO_SNDBUF -- -- -- 8192 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 32 TCP_NODELAY -- -- -- 0 Software configuration: Windows Server 2003 R2 - Enterprise x64 Edition Hardware configuration: Intel Core 2 Duo 1 GB RAM Kind regards, fritz

1 0

Re: [stunnel-users] Dynamic hosts
by Ludolf Holzheid 23 Jun '09

23 Jun '09

On Tue, 2009-06-23 10:33:14 -0400, Terry Riegel wrote: > Well, that would be one way of doing it. I would prefer to have > stunnel running as a daemon and just pass a FQDN and local port number > to it. But it may not be able to do that. You are right. Currently, stunnel's configuration can't be changed at run-time (and I still don't see a need for that). > If I did it the way you are suggesting then 5 concurrent users would > fire up 30 processes. On my system starting the daemon starts 6 > processes, and if I start it up again I get another 6 processes. Is this still true with 'foreground = yes'? For reducing the number of processes, you might also try to configure stunnel with --disable-libwrap. If you run stunnel from within a CGI, you will be accepting connections from localhost only anyway. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Dynamic hosts
by Ludolf Holzheid 23 Jun '09

23 Jun '09

On Tue, 2009-06-23 08:13:08 -0400, Terry Riegel wrote: > Take a look at mail2web.com > > You type in your server, it dynamically connects secure or otherwise. Ah, o.k. you want to use stunnel from inside a CGI. You could have the CGI dynamically write the stunnel configuration file then. Maybe you should specify 'foreground = yes' in order to avoid detaching to the background and to get stunnel's log messages written to the web server log. This depends on the CGI, of course. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Dynamic hosts
by Terry Riegel 23 Jun '09

23 Jun '09

Hello, I have just set up stunnel to allow unsecured client pop3 connections to my secured pop3 server chroot = /stunnel/ pid = /stunnel.pid setuid = www setgid = www client = yes foreground=yes [995] accept = localhost:10110 connect = mail.clearimageonline.com:995 And it works as expected. Is there a way to set it up so it can dynamically connect to any server. Something like... connect = *:995 I was able to start a new instance of stunnel with a separate config file but this seems inefficient as it starts up 6 processes each time. What I would like to do is dynamically add/subtract servers that it can connect to. My goal here is to build a webmail client that can use stunnel to do the secure connections to either POP or IMAP servers. My client software uses unsecured sockets. Any help would be greatly appreciated. Terry Riegel

2 1

Install, Starting & Using Stunnel on OS X (more)
by m i l e s 20 Jun '09

20 Jun '09

Hi, I forgot a few things in my last msg, that were implied but not explicitly stated. 1.) I downloaded and installed stunnel-4.27. 2.) Im not running darwin ports. 3.) When I installed I entered the commands on the command line without ever touching xCode. 4.) I am running MAC OS 10.5.7. I will have to do a later install on MAC OS 10.4.11. 5.) I need to connect my laptop (test machine) to an ldap server. The ldap server is NOT running stunnel, and I have no control over the ldap server. I am wanting to create a secure connection from my machine to the target server. +++++++++++++++++++++ Previous Msg Below. +++++++++++++++++++++ Hi I'm a newbie to stunnel. I have a couple of questions....ok, a zillion. However I'll stick to the basics. I found this in the archives that apply to my situation: http://marc.info/?l=stunnel-users&m=121848237124000&w=2 I followed those instructions that Tom Shaw gave, and I can't tell whether or not this thing is installed at all. http://marc.info/?l=stunnel-users&m=121848703131936&w=2 I think that the files are in the right places. And now when I type in stunnel on the command line, I get this as a response: 2009.06.20 12:27:37 LOG7[582:2691602208]: Snagged 64 random bytes from /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: Wrote 1024 new random bytes to /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: RAND_status claims sufficient entropy for the PRNG 2009.06.20 12:27:37 LOG7[582:2691602208]: PRNG seeded successfully 2009.06.20 12:27:37 LOG3[582:2691602208]: stunnel.pem: No such file or directory (2) I suppose that's an improvement over the command line returning no response for stunnel. So I guess it installed. I have a feeling that the config file (the sample that came with) is what's causing it to respond the way that it is... However, I also see that its throwing an error about the PEM file, that it thinks that its not there. Is there any way to check to see if its pointing at the right file for the pem ? Or to use another crt file ? Now the question becomes how the hell do I start this thing ? (I'm running leopard [10.5.7] for test purposes, but I'll have to do this all over again for a tiger install [10.4.11]...) Then once I get it started, how the hell do I initiate what needs doing ? I tried this ->> stunnel -o /Users/Miles/config.lgo -c -d 80 -r 134.84.119.230:636 Which returns -> 2009.06.20 13:34:32 LOG3[738:2691602208]: -o: No such file or directory (2) Obviously its yapping about a file, in this case I'm assuming the log file where its being referenced. Here's what I'm trying to do: I'm trying to set up a secure tunnel to an ldap server at umn.edu. I got this to work a while back but now I have to set this up from scratch....it was set up for me the last time. I wasn't paying attention and now Im kicking myself. The example I post is running in client mode and not server mode ? I was looking at THIS page: http://radio.weblogs.com/0100683/stories/2002/03/23/settingUpStunnelUnderMa… I'm not entirely certain that what I want to do is run in client mode given what I'm wanting to do... Any help would be a great relief. Thanks ahead of time... Sincerely, Miles.

2 4

Install, Starting & Using Stunnel on OS X.
by m i l e s 20 Jun '09

20 Jun '09

Hi I'm a newbie to stunnel. I have a couple of questions....ok, a zillion. However I'll stick to the basics. I found this in the archives that apply to my situation: http://marc.info/?l=stunnel-users&m=121848237124000&w=2 I followed those instructions that Tom Shaw gave, and I can't tell whether or not this thing is installed at all. http://marc.info/?l=stunnel-users&m=121848703131936&w=2 I think that the files are in the right places. And now when I type in stunnel on the command line, I get this as a response: 2009.06.20 12:27:37 LOG7[582:2691602208]: Snagged 64 random bytes from /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: Wrote 1024 new random bytes to /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: RAND_status claims sufficient entropy for the PRNG 2009.06.20 12:27:37 LOG7[582:2691602208]: PRNG seeded successfully 2009.06.20 12:27:37 LOG3[582:2691602208]: stunnel.pem: No such file or directory (2) I suppose that's an improvement over the command line returning no response for stunnel. So I guess it installed. I have a feeling that the config file (the sample that came with) is what's causing it to respond the way that it is... However, I also see that its throwing an error about the PEM file, that it thinks that its not there. Is there any way to check to see if its pointing at the right file for the pem ? Or to use another crt file ? Now the question becomes how the hell do I start this thing ? (I'm running leopard [10.5.7] for test purposes, but I'll have to do this all over again for a tiger install [10.4.11]...) Then once I get it started, how the hell do I initiate what needs doing ? I tried this ->> stunnel -o /Users/Miles/config.lgo -c -d 80 -r 134.84.119.230:636 Which returns -> 2009.06.20 13:34:32 LOG3[738:2691602208]: -o: No such file or directory (2) Obviously its yapping about a file, in this case I'm assuming the log file where its being referenced. Here's what I'm trying to do: I'm trying to set up a secure tunnel to an ldap server at umn.edu. I got this to work a while back but now I have to set this up from scratch....it was set up for me the last time. I wasn't paying attention and now Im kicking myself. The example I post is running in client mode and not server mode ? I was looking at THIS page: http://radio.weblogs.com/0100683/stories/2002/03/23/settingUpStunnelUnderMa… I'm not entirely certain that what I want to do is run in client mode given what I'm wanting to do... Any help would be a great relief. Thanks ahead of time... Sincerely, Miles.

1 0

Re: [stunnel-users] 4.26 works OK, 4.27 will not POP email
by Jeff Salisbury 17 Jun '09

17 Jun '09

Guy, Your suggestion fixed the problem. Thank you! Regards, Jeff Guy wrote: > Jeff Salisbury wrote: > > >> Greetings, We have been using Stunnel 4.26 to facilitate the >> sending and receiving of email with an email client that is not >> SSL enabled. Version 4.26 has been working great. However, when >> we upgrade to 4.27, we are unable to POP email (we can send >> email). We did not change our Stunnel.conf file. >> >> Can anyone advise us what we need to do to get 4.27 working? >> I've included our Stunnel.conf file contents, and the Stunnel log >> output below. >> >> > > > > Try: sslVersion = TLSv1 > > > See below. > > > > Your Modified Configuration File: > > ##### > # GLOBAL OPTIONS > > client = yes > #output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt > debug = 7 > taskbar = yes > > sslVersion = TLSv1 > > # SERVICE-LEVEL OPTIONS > > [pop3] > accept=995 > connect=mail.OurPOP.com:995 > > [smtp] > accept=465 > connect=mail.OurSMTP.com:465 > # > ##### > > > > Configuration File Used: > > ##### > # > client = yes > debug = debug > output = _test.log > rndbytes = 256 > rndfile = t:\tmp\randseed.bin > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > sslVersion = TLSv1 > > [YOUR-POP3S] > accept=TUNNEL-01:110 > connect=216.97.239.60:995 > > [YOUR-SMTPS] > accept=TUNNEL-01:25 > connect=216.97.239.60:465 > # > ##### > > > > Stunnel Debug Output Log: > > Snagged 256 random bytes from t:\tmp\randseed.bin > Wrote 1024 new random bytes to t:\tmp\randseed.bin > RAND_status claims sufficient entropy for the PRNG > PRNG seeded successfully > SSL context initialized for service YOUR-POP3S > SSL context initialized for service YOUR-SMTPS > stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 > Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 > No limit detected for the number of clients > FD 1884 in non-blocking mode > SO_REUSEADDR option set on accept socket > YOUR-POP3S bound to 127.0.10.1:110 > FD 1876 in non-blocking mode > SO_REUSEADDR option set on accept socket > YOUR-SMTPS bound to 127.0.10.1:25 > YOUR-POP3S accepted FD=1860 from 127.0.10.1:1599 > Creating a new thread > New thread created > YOUR-POP3S started > FD 1860 in non-blocking mode > TCP_NODELAY option set on local socket > YOUR-POP3S accepted connection from 127.0.10.1:1599 > FD 1836 in non-blocking mode > connect_blocking: connecting 216.97.239.60:995 > connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds > connect_blocking: connected 216.97.239.60:995 > YOUR-POP3S connected remote server from 10.10.10.10:1600 > Remote FD=1836 initialized > TCP_NODELAY option set on remote socket > SSL state (connect): before/connect initialization > SSL state (connect): SSLv3 write client hello A > SSL state (connect): SSLv3 read server hello A > SSL state (connect): SSLv3 read server certificate A > SSL state (connect): SSLv3 read server done A > SSL state (connect): SSLv3 write client key exchange A > SSL state (connect): SSLv3 write change cipher spec A > SSL state (connect): SSLv3 write finished A > SSL state (connect): SSLv3 flush data > SSL state (connect): SSLv3 read finished A > 1 items in the session cache > 1 client connects (SSL_connect()) > 1 client connects that finished > 0 client renegotiations requested > 0 server connects (SSL_accept()) > 0 server connects that finished > 0 server renegotiations requested > 0 session cache hits > 0 session cache misses > 0 session cache timeouts > SSL connected: new session negotiated > Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > Socket closed on read > SSL write shutdown > SSL alert (write): warning: close notify > SSL socket closed on SSL_shutdown > Socket write shutdown > Connection closed: 49 bytes sent to SSL, 90 bytes sent to socket > YOUR-POP3S finished (0 left) > YOUR-SMTPS accepted FD=1844 from 127.0.10.1:1601 > Creating a new thread > New thread created > YOUR-SMTPS started > FD 1844 in non-blocking mode > TCP_NODELAY option set on local socket > YOUR-SMTPS accepted connection from 127.0.10.1:1601 > FD 1836 in non-blocking mode > connect_blocking: connecting 216.97.239.60:465 > connect_blocking: s_poll_wait 216.97.239.60:465: waiting 10 seconds > connect_blocking: connected 216.97.239.60:465 > YOUR-SMTPS connected remote server from 10.10.10.10:1602 > Remote FD=1836 initialized > TCP_NODELAY option set on remote socket > SSL state (connect): before/connect initialization > SSL state (connect): SSLv3 write client hello A > SSL state (connect): SSLv3 read server hello A > SSL state (connect): SSLv3 read server certificate A > SSL state (connect): SSLv3 read server done A > SSL state (connect): SSLv3 write client key exchange A > SSL state (connect): SSLv3 write change cipher spec A > SSL state (connect): SSLv3 write finished A > SSL state (connect): SSLv3 flush data > SSL state (connect): SSLv3 read finished A > 1 items in the session cache > 1 client connects (SSL_connect()) > 1 client connects that finished > 0 client renegotiations requested > 0 server connects (SSL_accept()) > 0 server connects that finished > 0 server renegotiations requested > 0 session cache hits > 0 session cache misses > 0 session cache timeouts > SSL connected: new session negotiated > Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > Socket closed on read > SSL write shutdown > SSL alert (write): warning: close notify > SSL socket closed on SSL_shutdown > Socket write shutdown > Connection closed: 78 bytes sent to SSL, 423 bytes sent to socket > YOUR-SMTPS finished (0 left) > > > > POP3 Transaction Log: > > CONNECT : Looking up host name TUNNEL-01... > CONNECT : Host name TUNNEL-01 found > CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:110]... > CONNECT : Connected to host TUNNEL-01 [127.0.10.1:110] > POP REPLY : +OK Hello there. > POP SEND : USER username > POP REPLY : +OK Password required. > POP SEND : PASS ********** > POP REPLY : -ERR Login failed. > POP SEND : QUIT > POP REPLY : +OK Better luck next time. > DISCONNECT: Disconnected from server > > > > SMTP Transaction Log: > > CONNECT : Looking up host name TUNNEL-01... > CONNECT : Host name TUNNEL-01 found > CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:25]... > CONNECT : Connected to host TUNNEL-01 [127.0.10.1:25] > SMTP REPLY: 220-crimson.lunarbreeze.com ESMTP Exim 4.69 #1 Tue, 16 Jun 2009 14:45:25 -0700 > SMTP SEND : EHLO computername > SMTP REPLY: 250-crimson.lunarbreeze.com Hello 123,123.123.123 [123,123.123.123] > SMTP REPLY: 250-SIZE 52428800 > SMTP REPLY: 250-PIPELINING > SMTP REPLY: 250-AUTH PLAIN LOGIN > SMTP REPLY: 250 HELP > SMTP SEND : AUTH PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx== > SMTP REPLY: 535 Incorrect authentication data > SMTP SEND : QUIT > SMTP REPLY: 221 crimson.lunarbreeze.com closing connection > DISCONNECT: Disconnected from server > >

1 0

4.26 works OK, 4.27 will not POP email
by Jeff Salisbury 14 Jun '09

14 Jun '09

Greetings, We have been using Stunnel 4.26 to facilitate the sending and receiving of email with an email client that is not SSL enabled. Version 4.26 has been working great. However, when we upgrade to 4.27, we are unable to POP email (we can send email). We did not change our Stunnel.conf file. Can anyone advise us what we need to do to get 4.27 working? I've included our Stunnel.conf file contents, and the Stunnel log output below. Regards, Jeff ===================================================== # GLOBAL OPTIONS client = yes #output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt debug = 7 taskbar = yes # SERVICE-LEVEL OPTIONS [pop3] accept=995 connect=mail.OurPOP.com:995 [smtp] accept=465 connect=mail.OurSMTP.com:465 ===================================================== 2009.06.14 14:03:03 LOG7[3348:540]: RAND_status claims sufficient entropy for the PRNG 2009.06.14 14:03:03 LOG7[3348:540]: PRNG seeded successfully 2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service pop3 2009.06.14 14:03:03 LOG7[3348:540]: SSL context initialized for service smtp 2009.06.14 14:03:03 LOG5[3348:540]: stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 2009.06.14 14:03:03 LOG5[3348:540]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.06.14 14:03:03 LOG5[3348:3668]: No limit detected for the number of clients 2009.06.14 14:03:03 LOG7[3348:3668]: FD 204 in non-blocking mode 2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept socket 2009.06.14 14:03:03 LOG7[3348:3668]: pop3 bound to 0.0.0.0:995 2009.06.14 14:03:03 LOG7[3348:3668]: FD 212 in non-blocking mode 2009.06.14 14:03:03 LOG7[3348:3668]: SO_REUSEADDR option set on accept socket 2009.06.14 14:03:03 LOG7[3348:3668]: smtp bound to 0.0.0.0:465 2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=228 from 127.0.0.1:2027 2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread 2009.06.14 14:03:11 LOG7[3348:3668]: New thread created 2009.06.14 14:03:11 LOG7[3348:3668]: pop3 accepted FD=244 from 127.0.0.1:2026 2009.06.14 14:03:11 LOG7[3348:3668]: Creating a new thread 2009.06.14 14:03:11 LOG7[3348:3668]: New thread created 2009.06.14 14:03:11 LOG7[3348:1144]: pop3 started 2009.06.14 14:03:11 LOG7[3348:1144]: FD 228 in non-blocking mode 2009.06.14 14:03:11 LOG5[3348:1144]: pop3 accepted connection from 127.0.0.1:2027 2009.06.14 14:03:11 LOG7[3348:1144]: FD 268 in non-blocking mode 2009.06.14 14:03:11 LOG6[3348:1144]: connect_blocking: connecting 216.97.239.60:995 2009.06.14 14:03:11 LOG7[3348:4060]: pop3 started 2009.06.14 14:03:11 LOG7[3348:4060]: FD 244 in non-blocking mode 2009.06.14 14:03:11 LOG5[3348:4060]: pop3 accepted connection from 127.0.0.1:2026 2009.06.14 14:03:11 LOG7[3348:4060]: FD 280 in non-blocking mode 2009.06.14 14:03:11 LOG6[3348:4060]: connect_blocking: connecting 216.97.239.60:995 2009.06.14 14:03:11 LOG7[3348:1144]: connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds 2009.06.14 14:03:11 LOG7[3348:4060]: connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds 2009.06.14 14:03:11 LOG5[3348:1144]: connect_blocking: connected 216.97.239.60:995 2009.06.14 14:03:11 LOG5[3348:1144]: pop3 connected remote server from 192.168.0.55:2028 2009.06.14 14:03:11 LOG7[3348:1144]: Remote FD=268 initialized 2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): before/connect initialization 2009.06.14 14:03:11 LOG7[3348:1144]: SSL state (connect): SSLv3 write client hello A 2009.06.14 14:03:11 LOG5[3348:4060]: connect_blocking: connected 216.97.239.60:995 2009.06.14 14:03:11 LOG5[3348:4060]: pop3 connected remote server from 192.168.0.55:2029 2009.06.14 14:03:11 LOG7[3348:4060]: Remote FD=280 initialized 2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): before/connect initialization 2009.06.14 14:03:11 LOG7[3348:4060]: SSL state (connect): SSLv3 write client hello A 2009.06.14 14:03:11 LOG7[3348:1144]: SSL alert (read): fatal: handshake failure 2009.06.14 14:03:11 LOG3[3348:1144]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2009.06.14 14:03:11 LOG5[3348:1144]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.14 14:03:11 LOG7[3348:1144]: pop3 finished (1 left) 2009.06.14 14:03:11 LOG7[3348:4060]: SSL alert (read): fatal: handshake failure 2009.06.14 14:03:11 LOG3[3348:4060]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2009.06.14 14:03:11 LOG5[3348:4060]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.14 14:03:11 LOG7[3348:4060]: pop3 finished (0 left)

1 0

Silence after "Acquired libwrap process"
by James Brown 12 Jun '09

12 Jun '09

I'm trying to use stunnel to send email with SSL authentication. Sending the email with Apple's Mail.app with 'use default ports' selected. stunnel.log output: 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2009.06.12 09:58:17 LOG7[41897:140735078037248]: RAND_status claims sufficient entropy for the PRNG 2009.06.12 09:58:17 LOG7[41897:140735078037248]: PRNG seeded successfully 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/ postfix/smtpd.cert 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/ postfix/smtpd.key 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context initialized for service ssmtp 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate: /etc/ postfix/smtpd.cert 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Certificate loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Key file: /etc/ postfix/smtpd.key 2009.06.12 09:58:17 LOG7[41897:140735078037248]: Private key loaded 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SSL context initialized for service ssmtp2 2009.06.12 09:58:17 LOG5[41897:140735078037248]: stunnel 4.27 on i686- apple-darwin9.7.0 with OpenSSL 0.9.7l 28 Sep 2006 2009.06.12 09:58:17 LOG5[41897:140735078037248]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP 2009.06.12 09:58:17 LOG6[41897:140735078037248]: file ulimit = 256 (can be changed with 'ulimit -n') 2009.06.12 09:58:17 LOG6[41897:140735078037248]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2009.06.12 09:58:17 LOG5[41897:140735078037248]: 125 clients allowed 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 10 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 11 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 12 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option set on accept socket 2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp bound to 0.0.0.0:465 2009.06.12 09:58:17 LOG7[41897:140735078037248]: FD 13 in non-blocking mode 2009.06.12 09:58:17 LOG7[41897:140735078037248]: SO_REUSEADDR option set on accept socket 2009.06.12 09:58:17 LOG7[41897:140735078037248]: ssmtp2 bound to 0.0.0.0:587 2009.06.12 09:58:17 LOG7[41903:140735078037248]: Created pid file /usr/ local/var/run/stunnel/stunnel.pid 2009.06.12 09:58:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14 from 192.168.1.10:64996 2009.06.12 09:58:56 LOG7[41903:4295561216]: ssmtp2 started 2009.06.12 09:58:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 09:58:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 09:58:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 09:58:56 LOG7[41903:4295561216]: Acquired libwrap process #0 2009.06.12 10:00:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=15 from 192.168.1.10:65006 2009.06.12 10:00:04 LOG7[41903:4295675904]: ssmtp2 started 2009.06.12 10:00:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:00:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:00:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:00:04 LOG7[41903:4295675904]: Acquired libwrap process #1 2009.06.12 10:01:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16 from 192.168.1.10:65013 2009.06.12 10:01:04 LOG7[41903:4295790592]: ssmtp started 2009.06.12 10:01:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode 2009.06.12 10:01:04 LOG7[41903:4295790592]: TCP_NODELAY option set on local socket 2009.06.12 10:01:04 LOG7[41903:4295790592]: Waiting for a libwrap process 2009.06.12 10:01:04 LOG7[41903:4295790592]: Acquired libwrap process #2 2009.06.12 10:03:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait timeout 2009.06.12 10:03:56 LOG5[41903:4295561216]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp2 finished (2 left) 2009.06.12 10:03:56 LOG7[41903:140735078037248]: ssmtp accepted FD=14 from 192.168.1.10:65022 2009.06.12 10:03:56 LOG7[41903:4295561216]: ssmtp started 2009.06.12 10:03:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 10:03:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 10:03:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 10:03:56 LOG7[41903:4295561216]: Acquired libwrap process #3 2009.06.12 10:05:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait timeout 2009.06.12 10:05:04 LOG5[41903:4295675904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp2 finished (2 left) 2009.06.12 10:05:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15 from 192.168.1.10:65028 2009.06.12 10:05:04 LOG7[41903:4295675904]: ssmtp started 2009.06.12 10:05:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:05:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:05:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:05:04 LOG7[41903:4295675904]: Acquired libwrap process #4 2009.06.12 10:06:04 LOG6[41903:4295790592]: read_blocking: s_poll_wait timeout 2009.06.12 10:06:04 LOG5[41903:4295790592]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp finished (2 left) 2009.06.12 10:06:04 LOG7[41903:140735078037248]: ssmtp accepted FD=16 from 192.168.1.10:65032 2009.06.12 10:06:04 LOG7[41903:4295790592]: ssmtp started 2009.06.12 10:06:04 LOG7[41903:4295790592]: FD 16 in non-blocking mode 2009.06.12 10:06:04 LOG7[41903:4295790592]: TCP_NODELAY option set on local socket 2009.06.12 10:06:04 LOG7[41903:4295790592]: Waiting for a libwrap process 2009.06.12 10:08:56 LOG6[41903:4295561216]: read_blocking: s_poll_wait timeout 2009.06.12 10:08:56 LOG5[41903:4295561216]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp finished (2 left) 2009.06.12 10:08:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=14 from 192.168.1.10:65040 2009.06.12 10:08:56 LOG7[41903:4295561216]: ssmtp2 started 2009.06.12 10:08:56 LOG7[41903:4295561216]: FD 14 in non-blocking mode 2009.06.12 10:08:56 LOG7[41903:4295561216]: TCP_NODELAY option set on local socket 2009.06.12 10:08:56 LOG7[41903:4295561216]: Waiting for a libwrap process 2009.06.12 10:10:04 LOG6[41903:4295675904]: read_blocking: s_poll_wait timeout 2009.06.12 10:10:04 LOG5[41903:4295675904]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp finished (2 left) 2009.06.12 10:10:04 LOG7[41903:140735078037248]: ssmtp accepted FD=15 from 192.168.1.10:65044 2009.06.12 10:10:04 LOG7[41903:4295675904]: ssmtp started 2009.06.12 10:10:04 LOG7[41903:4295675904]: FD 15 in non-blocking mode 2009.06.12 10:10:04 LOG7[41903:4295675904]: TCP_NODELAY option set on local socket 2009.06.12 10:10:04 LOG7[41903:4295675904]: Waiting for a libwrap process 2009.06.12 10:11:04 LOG7[41903:140735078037248]: ssmtp accepted FD=17 from 192.168.1.10:65048 2009.06.12 10:11:04 LOG7[41903:4295905280]: ssmtp started 2009.06.12 10:11:04 LOG7[41903:4295905280]: FD 17 in non-blocking mode 2009.06.12 10:11:04 LOG7[41903:4295905280]: TCP_NODELAY option set on local socket 2009.06.12 10:11:04 LOG7[41903:4295905280]: Waiting for a libwrap process 2009.06.12 10:13:56 LOG7[41903:140735078037248]: ssmtp accepted FD=18 from 192.168.1.10:65060 2009.06.12 10:13:56 LOG7[41903:4297134080]: ssmtp started 2009.06.12 10:13:56 LOG7[41903:4297134080]: FD 18 in non-blocking mode 2009.06.12 10:13:56 LOG7[41903:4297134080]: TCP_NODELAY option set on local socket 2009.06.12 10:13:56 LOG7[41903:4297134080]: Waiting for a libwrap process 2009.06.12 10:15:04 LOG7[41903:140735078037248]: ssmtp accepted FD=19 from 192.168.1.10:65063 2009.06.12 10:15:04 LOG7[41903:4297211904]: ssmtp started 2009.06.12 10:15:04 LOG7[41903:4297211904]: FD 19 in non-blocking mode 2009.06.12 10:15:04 LOG7[41903:4297211904]: TCP_NODELAY option set on local socket 2009.06.12 10:15:04 LOG7[41903:4297211904]: Waiting for a libwrap process 2009.06.12 10:18:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=20 from 192.168.1.10:65090 2009.06.12 10:18:56 LOG7[41903:4297326592]: ssmtp2 started 2009.06.12 10:18:56 LOG7[41903:4297326592]: FD 20 in non-blocking mode 2009.06.12 10:18:56 LOG7[41903:4297326592]: TCP_NODELAY option set on local socket 2009.06.12 10:18:56 LOG7[41903:4297326592]: Waiting for a libwrap process 2009.06.12 10:20:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=21 from 192.168.1.10:65093 2009.06.12 10:20:04 LOG7[41903:4297441280]: ssmtp2 started 2009.06.12 10:20:04 LOG7[41903:4297441280]: FD 21 in non-blocking mode 2009.06.12 10:20:04 LOG7[41903:4297441280]: TCP_NODELAY option set on local socket 2009.06.12 10:20:04 LOG7[41903:4297441280]: Waiting for a libwrap process 2009.06.12 10:23:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=22 from 192.168.1.10:65111 2009.06.12 10:23:56 LOG7[41903:4297555968]: ssmtp2 started 2009.06.12 10:23:56 LOG7[41903:4297555968]: FD 22 in non-blocking mode 2009.06.12 10:23:56 LOG7[41903:4297555968]: TCP_NODELAY option set on local socket 2009.06.12 10:23:56 LOG7[41903:4297555968]: Waiting for a libwrap process 2009.06.12 10:25:04 LOG7[41903:140735078037248]: ssmtp accepted FD=23 from 192.168.1.10:65113 2009.06.12 10:25:04 LOG7[41903:4297670656]: ssmtp started 2009.06.12 10:25:04 LOG7[41903:4297670656]: FD 23 in non-blocking mode 2009.06.12 10:25:04 LOG7[41903:4297670656]: TCP_NODELAY option set on local socket 2009.06.12 10:25:04 LOG7[41903:4297670656]: Waiting for a libwrap process 2009.06.12 10:28:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=24 from 192.168.1.10:65125 2009.06.12 10:28:56 LOG7[41903:4297785344]: ssmtp2 started 2009.06.12 10:28:56 LOG7[41903:4297785344]: FD 24 in non-blocking mode 2009.06.12 10:28:56 LOG7[41903:4297785344]: TCP_NODELAY option set on local socket 2009.06.12 10:28:56 LOG7[41903:4297785344]: Waiting for a libwrap process 2009.06.12 10:30:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=25 from 192.168.1.10:65128 2009.06.12 10:30:04 LOG7[41903:4297900032]: ssmtp2 started 2009.06.12 10:30:04 LOG7[41903:4297900032]: FD 25 in non-blocking mode 2009.06.12 10:30:04 LOG7[41903:4297900032]: TCP_NODELAY option set on local socket 2009.06.12 10:30:04 LOG7[41903:4297900032]: Waiting for a libwrap process 2009.06.12 10:33:56 LOG7[41903:140735078037248]: ssmtp2 accepted FD=26 from 192.168.1.10:65299 2009.06.12 10:33:56 LOG7[41903:4298014720]: ssmtp2 started 2009.06.12 10:33:56 LOG7[41903:4298014720]: FD 26 in non-blocking mode 2009.06.12 10:33:56 LOG7[41903:4298014720]: TCP_NODELAY option set on local socket 2009.06.12 10:33:56 LOG7[41903:4298014720]: Waiting for a libwrap process 2009.06.12 10:35:04 LOG7[41903:140735078037248]: ssmtp2 accepted FD=27 from 192.168.1.10:65326 2009.06.12 10:35:04 LOG7[41903:4298129408]: ssmtp2 started 2009.06.12 10:35:04 LOG7[41903:4298129408]: FD 27 in non-blocking mode 2009.06.12 10:35:04 LOG7[41903:4298129408]: TCP_NODELAY option set on local socket 2009.06.12 10:35:04 LOG7[41903:4298129408]: Waiting for a libwrap process 2009.06.12 10:40:04 LOG7[41903:140735078037248]: ssmtp accepted FD=28 from 192.168.1.10:65365 2009.06.12 10:40:04 LOG7[41903:4298244096]: ssmtp started 2009.06.12 10:40:04 LOG7[41903:4298244096]: FD 28 in non-blocking mode 2009.06.12 10:40:04 LOG7[41903:4298244096]: TCP_NODELAY option set on local socket 2009.06.12 10:40:04 LOG7[41903:4298244096]: Waiting for a libwrap process 2009.06.12 10:45:04 LOG7[41903:140735078037248]: ssmtp accepted FD=29 from 192.168.1.10:65377 2009.06.12 10:45:04 LOG7[41903:4298358784]: ssmtp started 2009.06.12 10:45:04 LOG7[41903:4298358784]: FD 29 in non-blocking mode 2009.06.12 10:45:04 LOG7[41903:4298358784]: TCP_NODELAY option set on local socket 2009.06.12 10:45:04 LOG7[41903:4298358784]: Waiting for a libwrap process 2009.06.12 10:50:04 LOG7[41903:140735078037248]: ssmtp accepted FD=30 from 192.168.1.10:65406 2009.06.12 10:50:04 LOG7[41903:4298473472]: ssmtp started 2009.06.12 10:50:04 LOG7[41903:4298473472]: FD 30 in non-blocking mode 2009.06.12 10:50:04 LOG7[41903:4298473472]: TCP_NODELAY option set on local socket 2009.06.12 10:50:04 LOG7[41903:4298473472]: Waiting for a libwrap process Stunnel is running on Mac OS X 10.5.7. Any help would be much appreciated. James.

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 08 Jun '09

08 Jun '09

Hello Carter, thank you very much for your help and nice examples. I will try it in my local network. Have a good day. Mia ---- Pôvodná správa ---- Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> Komu: aaa aaa <miamia(a)inMail.sk> Dátum: 8. 6. 2009 17:52:00 Predmet: Re: [stunnel-users] 1 server and more desktops Mia, I work in both Windows and Linux, so I use a Windows approach - copying files where in Linux a link would be more appropriate. Assume server.pem is the server full server certificate including the private key and client1.pem is a full client certificate including the key. The first step is to make a copy of the server certificate and delete the lines starting with -----BEGIN RSA PRIVATE KEY------ down through the blank line after -----END RSA PRIVATE KEY----- Initial I call this server-pub.pem The command: openssl x509 -in server-pub.pem -subject_hash -noout will print out the hash for the server key (as 8 hexadecimal digits), for example abcef012 Then I rename server-pub.pem to abcdef012.0 I repeat the same process for each client key, so that client1.pem in this example would have a public key named 987654fe.0 (assuming that the hash of 987654fe). In the client1 configuration: cert = client1.pem key = client1.pem verify = 3 cafile = abcdef012.0 In the server configuration cert = server1.pem key = server1.pem verify = 3 capath = capath In the capath directory is 987654fe.0 ... Plus the hashes of the other clients. In Windows, the capath is under the stunnel directory. The client certificates can also be concatenated in a single file. If you use a directory, it is not necessary to restart stunnel if you add a new client. If you use a concatenated file, you do have to restart stunnel if you add a client. There are some notes in the documentation about the structure of a concatenated file. I hope this helps. Carter Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890 aaa aaa wrote: > Hi Carter, > > thank you. I am trying to use scenario with self-signed certificates > exactly like you are using it. Could you please write me some examples > of config for server and clients? I don't know where to put private > keys and how to set up server for acceptation of certificates from > clients only - server must reject all communication without/or with > other certificates as are stored in his folder. > > thank you in advance > > regards, > mia > > ---- Pôvodná správa ---- > Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> > Komu: aaa aaa <miamia(a)inMail.sk> > Dátum: 8. 6. 2009 15:00:00 > Predmet: Re: [stunnel-users] 1 server and more desktops > > I do this using self-signed certificates and verify=2 or verify=3. The > remote computers would only have the servers public certificate their > CAfile (or CApath). The server must have all the remote computers > public certificates in its CAfile or CApath. See the rules about how to > build those. If you are only using self-signed certificates, you can > use verify=3, otherwise you will have to use verify=2. Each port that > you want to forward must be in you stunnel.conf file - without knowing > what you are trying to do, it is hard to be more specific. > > Carter > > Carter Browne > CBCS > cbrowne(a)cbcs-usa.com > 781-721-2890 > > > > aaa aaa wrote: > > hello Christophe, > > > > thanks for your answer. Sorry for any misunderstanding. Well, I just > > wanted to ask if it is able to set stunnel for working with more > > certificates? So it means that I don't want to have secured tunnel > > between remote and local computer only but also between one remote and > > many local computers with more certificates? Every local computer > > should have own certificate. > > > > Is this possible? > > > > thank you. > > > > ---- Pôvodná správa ---- > > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> > > Komu: aaa aaa <miamia(a)inmail.sk> > > Dátum: 7. 6. 2009 16:27:00 > > Predmet: Re: [stunnel-users] 1 server and more desktops > > > > Hello, > > > > Stunnel is an application oriented tunnel, not a machine oriented > > tunnel. Please, be more precise in your requests if you want someone > > to be able to help you. It seems also that the stunnel documentation > > pages are worh reading in your case. > > > > Regards, > > > > -- > > Christophe > > > > > > 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > > > Hello, > > > > > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: > > every pc > > > should communicate with server with his own certificate and server > > should > > > sends anwser back to the computer encrypted for this one pc only. > > > > > > Example: PC3 {with server's public key} sends data to server and > server > > > sends answer to PC3 (encrypted wiht unique PC3's public key). > > > then PC2 {with server's public key} sends data to server and server > > sends > > > answer to PC2 (encrypted wiht unique PC2's public key). and so > on... how > > > should I configure stunnel for this? > > > > > > And another question > how should I configure all computers (server, > > > pc1,pc2,pc3) to accept communication over secured stunnel only and > > drop all > > > other unsecured communication? > > > > > > > > > thank you in advance. > > > regards, Mia > > > ---------- > > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. > > Domena, > > > webhosting, e-mail a seo od 10 centov/denne. > > > > > > _______________________________________________ > > > stunnel-users mailing list > > > stunnel-users(a)mirt.net > > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > > > > ---------- > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > > centov/denne. > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > centov/denne. ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 08 Jun '09

08 Jun '09

Hi Carter, thank you. I am trying to use scenario with self-signed certificates exactly like you are using it. Could you please write me some examples of config for server and clients? I don't know where to put private keys and how to set up server for acceptation of certificates from clients only - server must reject all communication without/or with other certificates as are stored in his folder. thank you in advance regards, mia > ---- Pôvodná správa ---- > Od koho: Carter Browne <cbrowne(a)cbcs-usa.com> > Komu: aaa aaa <miamia(a)inMail.sk> > Dátum: 8. 6. 2009 15:00:00 > Predmet: Re: [stunnel-users] 1 server and more desktops > > I do this using self-signed certificates and verify=2 or verify=3. The > remote computers would only have the servers public certificate their > CAfile (or CApath). The server must have all the remote computers > public certificates in its CAfile or CApath. See the rules about how to > build those. If you are only using self-signed certificates, you can > use verify=3, otherwise you will have to use verify=2. Each port that > you want to forward must be in you stunnel.conf file - without knowing > what you are trying to do, it is hard to be more specific. > > Carter > > Carter Browne > CBCS > cbrowne(a)cbcs-usa.com > 781-721-2890 > > > > aaa aaa wrote: > > hello Christophe, > > > > thanks for your answer. Sorry for any misunderstanding. Well, I just > > wanted to ask if it is able to set stunnel for working with more > > certificates? So it means that I don't want to have secured tunnel > > between remote and local computer only but also between one remote and > > many local computers with more certificates? Every local computer > > should have own certificate. > > > > Is this possible? > > > > thank you. > > > > ---- Pôvodná správa ---- > > Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> > > Komu: aaa aaa <miamia(a)inmail.sk> > > Dátum: 7. 6. 2009 16:27:00 > > Predmet: Re: [stunnel-users] 1 server and more desktops > > > > Hello, > > > > Stunnel is an application oriented tunnel, not a machine oriented > > tunnel. Please, be more precise in your requests if you want someone > > to be able to help you. It seems also that the stunnel documentation > > pages are worh reading in your case. > > > > Regards, > > > > -- > > Christophe > > > > > > 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > > > Hello, > > > > > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: > > every pc > > > should communicate with server with his own certificate and server > > should > > > sends anwser back to the computer encrypted for this one pc only. > > > > > > Example: PC3 {with server's public key} sends data to server and > server > > > sends answer to PC3 (encrypted wiht unique PC3's public key). > > > then PC2 {with server's public key} sends data to server and server > > sends > > > answer to PC2 (encrypted wiht unique PC2's public key). and so > on... how > > > should I configure stunnel for this? > > > > > > And another question > how should I configure all computers (server, > > > pc1,pc2,pc3) to accept communication over secured stunnel only and > > drop all > > > other unsecured communication? > > > > > > > > > thank you in advance. > > > regards, Mia > > > ---------- > > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. > > Domena, > > > webhosting, e-mail a seo od 10 centov/denne. > > > > > > _______________________________________________ > > > stunnel-users mailing list > > > stunnel-users(a)mirt.net > > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > > > > ---------- > > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > > centov/denne. > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk > <http://www.inpage.sk/>. Domena, webhosting, e-mail a seo od 10 > centov/denne. ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Stunnel client hangs in background mode when smartcard is used
by John Abloyer 08 Jun '09

08 Jun '09

Hi! I have a problem when running ssh over stunnel in background mode ('foreground' out-commented in config file). In foreground mode, everything works fine. I'm using a modified OpenSSL, adding an engine that is dedicated to communicate with a smartcard reader. The scenario is: - Starting stunnel on server, extract from config file: [ssh] accept = myserver:122 connect = 22 - Starting stunnel on client, extract from config file: engine = myengine engineNum = 1 client = yes [ssh] accept = 22 connect = myserver:122 I come to here, than it hangs: ... 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server certificate A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server certificate request A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 read server done A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write client certificate A 2009.06.08 15:08:22 LOG7[472:3054680976]: SSL state (connect): SSLv3 write client key exchange A - - - - - - - But when I run in foreground mode, it all works fine and stunnel continues and I get the ssh login prompt. I'm running RHEL 5.2, OpenSSL 0.9.8*, stunnel 4.27 Any help would be appreciated Rgds JA

1 0

start parameters
by Sebastian Rose-Indorf 07 Jun '09

07 Jun '09

Hello, a short question: Which start parameters are there for Stunnel v4.xx? Thanks, Seb. _ ASCII ribbon campaign against HTML e-mail ( ) & proprietary e-mail formats X / \ www.asciiribbon.org

1 0

Re: [stunnel-users] 1 server and more desktops
by aaa aaa 07 Jun '09

07 Jun '09

hello Christophe, thanks for your answer. Sorry for any misunderstanding. Well, I just wanted to ask if it is able to set stunnel for working with more certificates? So it means that I don't want to have secured tunnel between remote and local computer only but also between one remote and many local computers with more certificates? Every local computer should have own certificate. Is this possible? thank you. ---- Pôvodná správa ---- Od koho: Christophe Nanteuil <christophe.nanteuil(a)gmail.com> Komu: aaa aaa <miamia(a)inmail.sk> Dátum: 7. 6. 2009 16:27:00 Predmet: Re: [stunnel-users] 1 server and more desktops Hello, Stunnel is an application oriented tunnel, not a machine oriented tunnel. Please, be more precise in your requests if you want someone to be able to help you. It seems also that the stunnel documentation pages are worh reading in your case. Regards, -- Christophe 2009/6/7 aaa aaa <miamia(a)inmail.sk>: > Hello, > > I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: every pc > should communicate with server with his own certificate and server should > sends anwser back to the computer encrypted for this one pc only. > > Example: PC3 {with server's public key} sends data to server and server > sends answer to PC3 (encrypted wiht unique PC3's public key). > then PC2 {with server's public key} sends data to server and server sends > answer to PC2 (encrypted wiht unique PC2's public key). and so on... how > should I configure stunnel for this? > > And another question > how should I configure all computers (server, > pc1,pc2,pc3) to accept communication over secured stunnel only and drop all > other unsecured communication? > > > thank you in advance. > regards, Mia > ---------- > Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, > webhosting, e-mail a seo od 10 centov/denne. > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

stunnel through httpd
by Chatty 07 Jun '09

07 Jun '09

Hello, I've got the crazy idea to run stunnel behind an existing, SSL-enabled, basic-auth-using httpd. Configuration would be as follows: 1. put some stunnel.cgi into /usr/www/cgi-bin which would call stunnel binary 2. start stunnel client with -r https://login:[email protected]/cgi-bin/stunnel.cgi Advantages (assumed you're behind a proxy which allows only 443 as outgoing port): a. You can still access other WebIFs on that server. b. You don't have to administer another web server including authentication, certificates and so on. May be stunnel is not the best tool for the above scenario (I reckon stunnel is currently unable to fulfill this)... I hope someone can shed some light on this. Cheers, Chatty.

1 0

1 server and more desktops
by aaa aaa 07 Jun '09

07 Jun '09

Hello, I have one server and 3 desktops (PC1,PC2,PC3). I need to do this: every pc should communicate with server with his own certificate and server should sends anwser back to the computer encrypted for this one pc only. Example: PC3 {with server's public key} sends data to server and server sends answer to PC3 (encrypted wiht unique PC3's public key). then PC2 {with server's public key} sends data to server and server sends answer to PC2 (encrypted wiht unique PC2's public key). and so on... how should I configure stunnel for this? And another question > how should I configure all computers (server, pc1,pc2,pc3) to accept communication over secured stunnel only and drop all other unsecured communication? thank you in advance. regards, Mia ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

2 1

securing OpenBSD/FreeBSD with stunnel
by aaa aaa 07 Jun '09

07 Jun '09

Hello guys, I would like to secure my OpenBSD/FreeBSD for communication over stunnel only. How should I configure BSD and stunnel when I want allow comminucation with one server only (data from pc encrypted with server's public certificate and allow data from this server to my pc encrypted with pc's public key) and drop all other communication (all other ports and certificates)? thank you, mia ---------- Sutaz s InPage o ceny za viac ako 2000 Euro. Info na www.inpage.sk. Domena, webhosting, e-mail a seo od 10 centov/denne.

1 0

Newbie question
by STEVEN BLAIR 02 Jun '09

02 Jun '09

I would be really grateful if someone could help me out with this problem. There appears to be a very high time between my client and server in transferring data. The log shows the following: 2009.06.02 12:32:59 LOG5[5824:5516]: TS3_GPRS accepted connection from 193.35.132.231:45050 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): before/accept initialization 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 read client hello A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 write server hello A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 write certificate A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 write certificate request A 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 flush data 2009.06.02 12:33:09 LOG5[5824:5516]: CRL: verification passed 2009.06.02 12:33:09 LOG5[5824:5516]: VERIFY OK: depth=1, /C=UK/ST=Fife/L=Dunfermline/O=TS3 Services Ltd/OU=Infrastructure/CN=TS3 Services Ltd/emailAddress=helpdesk(a)ts3services.co.uk 2009.06.02 12:33:09 LOG5[5824:5516]: CRL: verification passed 2009.06.02 12:33:09 LOG5[5824:5516]: VERIFY OK: depth=0, /C=UK/ST=Fife/O=TS3 Services Ltd/OU=Terminal/CN=TS3 Services Ltd/emailAddress=helpdesk(a)ts3services.co.uk 2009.06.02 12:33:09 LOG7[5824:5516]: SSL state (accept): SSLv3 read client certificate A 2009.06.02 12:33:09 LOG7[5824:5516]: SSL state (accept): SSLv3 read client key exchange A 2009.06.02 12:33:09 LOG7[5824:5516]: SSL state (accept): SSLv3 read certificate verify A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 read finished A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 write change cipher spec A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 write finished A 2009.06.02 12:33:10 LOG7[5824:5516]: SSL state (accept): SSLv3 flush data 2009.06.02 12:33:10 LOG7[5824:5516]: 2 items in the session cache 2009.06.02 12:33:10 LOG7[5824:5516]: 0 client connects (SSL_connect()) 2009.06.02 12:33:10 LOG7[5824:5516]: 0 client connects that finished 2009.06.02 12:33:10 LOG7[5824:5516]: 0 client renegotiations requested 2009.06.02 12:33:10 LOG7[5824:5516]: 2 server connects (SSL_accept()) 2009.06.02 12:33:10 LOG7[5824:5516]: 2 server connects that finished 2009.06.02 12:33:10 LOG7[5824:5516]: 0 server renegotiations requested 2009.06.02 12:33:10 LOG7[5824:5516]: 0 session cache hits 2009.06.02 12:33:10 LOG7[5824:5516]: 0 session cache misses 2009.06.02 12:33:10 LOG7[5824:5516]: 0 session cache timeouts 2009.06.02 12:33:10 LOG6[5824:5516]: SSL accepted: new session negotiated 2009.06.02 12:33:10 LOG6[5824:5516]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2009.06.02 12:33:10 LOG7[5824:5516]: FD 292 in non-blocking mode 2009.06.02 12:33:10 LOG7[5824:5516]: TS3_GPRS connecting 127.0.0.1:8139 2009.06.02 12:33:10 LOG7[5824:5516]: connect_wait: waiting 10 seconds 2009.06.02 12:33:10 LOG7[5824:5516]: connect_wait: connected 2009.06.02 12:33:10 LOG5[5824:5516]: TS3_GPRS connected remote server from 127.0.0.1:2273 2009.06.02 12:33:10 LOG7[5824:5516]: Remote FD=292 initialized 2009.06.02 12:33:31 LOG7[5824:5516]: Socket closed on read 2009.06.02 12:33:31 LOG7[5824:5516]: SSL write shutdown 2009.06.02 12:33:31 LOG7[5824:5516]: SSL alert (write): warning: close notify 2009.06.02 12:33:31 LOG6[5824:5516]: SSL socket closed on SSL_shutdown 2009.06.02 12:33:31 LOG7[5824:5516]: Socket write shutdown 2009.06.02 12:33:31 LOG5[5824:5516]: Connection closed: 65 bytes sent to SSL, 185 bytes sent to socket 2009.06.02 12:33:31 LOG7[5824:5516]: TS3_GPRS finished (0 left) The main issue for me is the time between the two lines: 2009.06.02 12:32:59 LOG7[5824:5516]: SSL state (accept): SSLv3 flush data 2009.06.02 12:33:09 LOG5[5824:5516]: CRL: verification passed The handshaking and certificate exchange appears to be pretty quick, but I need to understand why there is 10 second delay between these two lines. It seems horrendous amount of time for transferring data. It might be my lack of understanding on the SSL process, so any information on this would be greatly appreciated. Thanks in advance, Steven

1 0

Re: [stunnel-users] Stunnel for secure email connections
by Lee 25 May '09

25 May '09

Thanks again, Guy, I appreciate your efforts there. So I don't have to do anything regarding certificates or digital signatures, or anything along those lines? I just install OpenSSL and Stunnel, configure stunnel.conf, tweak Thunderbird's accounts settings and Avast's ports, and go with it? Guy wrote: > So what you have to do to proxy the connections through Avast! I don't > know, you'll need to show. > Do you *really* need to scan your outbound connections? > This whole thing is more of a challenge / experiment than anything else. Certainly, scanning my SMTP connection(s) is far from important. Off this specific Stunnel issue but related:- For the last day or so, I've gone back to my 'old' setup of TB + Popfile + Avast, and I've noticed that emails from my 'secure' POP connections are actually being scanned by Avast. They probably have been for some time and I didn't notice, but only recently have I turned on the 'adding of notes' in Avast's email scanner which adds an email footer along the lines of 'Avast found this message to be clean'. I assume this scanning of 'secure' emails is a convenient byproduct somehow or other of routing the secure connections through Popfile. For reference, Popfile is listening on its default port of 110, and the Avast email scanner currently also only has port 110 in its POP redirected ports settings. Thunderbird has the host for those accounts as 127.0.0.1, also on port 110, and the username is in the form of: pop_server:username:ssl which Popfile requires. The :ssl is required by Popfile to handle secure connections. I do notice that non-secure connections' emails end up with the scanning footer being added twice, suggesting Avast is double scanning them. Secure connections' emails only get the one footer added. So all told, all incoming email seems to be scanned by Avast, albeit some of it twice. > Your stunnel configuration file has 2 [popmail] service names, that > will be confusing. And why do you have a [popmail] and [pop3_sky] > connecting to the same MTA? > That is because I don't know what I'm doing :) I originally built stunnel.conf without catering for Popfile, then I wanted to introduce Popfile into the equation, so I found the below advice page regarding Popfile and Stunnel :- http://getpopfile.org/docs/howtos:stunnel It appears I wrongly guessed how to interpret that advice on what to add to stunnel.conf I have since had some clarification on this from a query I raised on this at the Popfile forums:- http://getpopfile.org/discussion/1/188 > Did you enable debugging within stunnel? > > Global options: > > debug = debug > output = stunnel.log > Yes, I did try that, and dabbled a little with the packet sniffers. However I didn't find it any easier to pinpoint what was actually going on regarding the prescence or otherwise of a secure connection. ie I don't know what I'm looking at/for. At the moment, my only method of 'testing' what is 'probably' going on, is to open or close parts of my local chain, and thereby build an apparent picture of what is happening. My original doubts of 'am I actually achieving a secure connection using Stunnel and my local chain' are not grounded in anything; I am/was just wanting to somehow avoid just assuming I had set everything up properly. Lee

1 0

Re: [stunnel-users] Stunnel for secure email connections
by Lee 24 May '09

24 May '09

Hello Guy and thanks for your reply. Guy wrote: > So you have... > Client (MUA) <=> Avast and/or Popfile <=> Stunnel <=> Server (MTA) > > > Yes, that's right. I've looked at the mail headers more, and tried some of the packet sniffing/log methods, but I'm not really having any more success in understanding / pinpointing a secure connection. I think I'm not going to be able to grasp the issues here, so maybe it is simpler if I could simply state what I have done, to check that it should be correct; I installed both OpenSLL and Stunnel. I haven't changed anything from the OpenSLL install. In stunnel.conf, I currently have the file shown at the bottom of this email. I have changed settings in Thunderbird's mail accounts (hosts and ports) and in Avast Anti-Virus email scanner. (its redirected ports settings) Adding Popfile (a local mail 'tagging' proxy) back into the equation has required some further tweaks to Thunderbird's ports and server usernames syntax. As I said earlier, all seems to be working, in that my 'chain' appears to be having an effect. However should I be considering anything else to make this process meaningful, such as certificates or security issues? My only motive for using Stunnel and OpenSSL is to allow Avast email scanner to scan _all_ emails, including those it normally cannot scan due to their servers requiring me to use a secure connection. So, if I am doing this 'new' process wrongly or opening up security issues due to not understanding it, I would be better off reverting to how it was previously, seeing as the mail servers I use state they do virus scanning anyway. Thanks again, Lee UK my current stunnel.conf :- client=yes service=popmail [popmail] accept = 127.0.0.1:210 connect = pop.mail.yahoo.co.uk:995 [popmail] accept = 127.0.0.1:310 connect = pop.tools.sky.com:995 [pop3_sky] accept = 127.0.0.1:1109 connect = pop.tools.sky.com:995 [pop3_yahoo] accept = 127.0.0.1:1108 connect = pop.mail.yahoo.co.uk:995 [smtp_sky] accept=127.0.0.1:259 connect=smtp.tools.sky.com:465 [smtp_yahoo] accept=127.0.0.1:258 connect=smtp.mail.yahoo.co.uk:465 [imap_sky] accept=127.0.0.1:1439 connect=imap.tools.sky.com:993 -------------------------------------------------------------------------- --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 090524-0, 24/05/2009 Tested on: 5/24/2009 15:38:38 avast! - copyright (c) 1988-2009 ALWIL Software. http://www.avast.com

1 0

Stunnel for secure email connections; email headers ?
by Lee 23 May '09

23 May '09

Hello, I have been dabbling with Stunnel in order to do the following: Connect with remote POP3, IMAP and SMTP servers using a secure connection; Path those connections on my Windows XP desktop pc through Avast Anti-Virus and/or Popfile to Mozilla Thunderbird. After much fiddling and grinding of my rusty mental muscles, I appear to have everything working and pathing properly. However I am not confident and some amount of luck has been involved in settling on the apparently correct pathing, ports settings and stunnel.conf So, my question here is; Can I look for anything in the email headers to verify that I am actually achieving a locally made secure connection using Stunnel? Or, if necessary, can I force something into the headers to show this? As I imply, results/clues suggest all is in place correctly, but part of me doesn't really believe I have actually done it. :) Thanks very much, Lee UK --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 090523-0, 23/05/2009 Tested on: 5/23/2009 23:25:18 avast! - copyright (c) 1988-2009 ALWIL Software. http://www.avast.com

1 0

Multiple SSL Versions
by Jeremy 22 May '09

22 May '09

Hi, Is there any way to make the sslVersion version take multiple options? I would like to restrict things to TLSv1 or SSLv3 but it seems only one option can be specified. I tried specifying this in the cipher section instead of ALL but couldn't seem to get it to work. Also here is something a little weird I've noticed, if anyone else has ran into it before and knows what's going on. With sites set to use TLSv1, sometimes while testing a HTTPS site using Firefox SSL (when both SSLv3 and TLSv1 is enabled in Firefox) sometimes the site won't come up. It feels like Firefox is using a weird SSL version to do the SSL certificate verification but once you trust the certificate it uses the right settings. I've set sslVersion = all, and trusted the SSL certificate in Firefox, then set sslVersion = TLSv1 again and I can get to the site ok at that point. Kind of weird. I'm probably just going to have to leave sslVersion = all, but Nessus and other security scans really like things locked down to just TLSv1 or SSLv3. stunnel: LOG5[17972:3086609296]: https-site01 accepted connection from 1.2.3.4:50878 stunnel: LOG3[17972:3086609296]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number stunnel: LOG5[17972:3086609296]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket

2 1

Can't connect to Yahoo POP3
by Gary Kuznitz 18 May '09

18 May '09

Hi, I wonder if you could possibly help me get Stunnel ver. 4.26 working with Yahoo.com email? I have been trying to get it working and can't see what the problem is. I do have it working with Gmail just fine. My email client is setup with: Email server 127.0.0.1 Email user: 127.0.0.1/11011/MuUserName(a)yahoo.com Email password: <InsertPassword> Port 9999 My email client is connecting to K9 K9 connects to Stunnel on port 11011 I'm running this in Win '98se I'm following the instructions to use Yahoo POP3 Free at: http://sajeevnairs.blogspot.com/2009/03/pop3-access-in-yahoo-mail-free.html I think it's saying: SSL alert (read): fatal: bad certificate How can I get a god certificate for Stunnel to use? How would I set that up in Stunnel? Conf: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3_DslextremeGmail] accept = 127.0.0.1:11010 connect = pop.gmail.com:995 delay = yes [pop3_Yahoo] accept = 127.0.0.1:11011 connect = pop.mail.yahoo.com:995 delay = yes Log: 2009.05.14 15:48:12 LOG7[16278859:16041803]: RAND_status claims sufficient entropy for the PRNG 2009.05.14 15:48:12 LOG7[16278859:16041803]: PRNG seeded successfully 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: Key file: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Private key loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized for service pop3_DslextremeDocfxitGmail 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Certificate loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: Key file: stunnel.pem 2009.05.14 15:48:12 LOG7[16278859:16041803]: Private key loaded 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized for service pop3_Docfxit_Yahoo 2009.05.14 15:48:12 LOG5[16278859:16041803]: stunnel 4.26 on x86-pc-mingw32-gnu with OpenSSL 0.9.8i 15 Sep 2008 2009.05.14 15:48:12 LOG5[16278859:16041803]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2009.05.14 15:48:12 LOG5[16278859:16039767]: No limit detected for the number of clients 2009.05.14 15:48:12 LOG7[16278859:16039767]: FD 56 in non-blocking mode 2009.05.14 15:48:12 LOG7[16278859:16039767]: SO_REUSEADDR option set on accept socket 2009.05.14 15:48:12 LOG7[16278859:16039767]: pop3_DslextremeDocfxitGmail bound to 127.0.0.1:11010 2009.05.14 15:48:12 LOG7[16278859:16039767]: FD 60 in non-blocking mode 2009.05.14 15:48:12 LOG7[16278859:16039767]: SO_REUSEADDR option set on accept socket 2009.05.14 15:48:12 LOG7[16278859:16039767]: pop3_Docfxit_Yahoo bound to 127.0.0.1:11011 2009.05.14 15:48:30 LOG7[16278859:16039767]: pop3_Docfxit_Yahoo accepted FD=64 from 127.0.0.1:1105 2009.05.14 15:48:30 LOG7[16278859:16039767]: Creating a new thread 2009.05.14 15:48:30 LOG7[16278859:16039767]: New thread created 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo started 2009.05.14 15:48:30 LOG7[16278859:16038719]: FD 64 in non-blocking mode 2009.05.14 15:48:30 LOG7[16278859:16038719]: TCP_NODELAY option set on local socket 2009.05.14 15:48:30 LOG5[16278859:16038719]: pop3_Docfxit_Yahoo accepted connection from 127.0.0.1:1105 2009.05.14 15:48:30 LOG7[16278859:16038719]: FD 76 in non-blocking mode 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo connecting 68.142.206.14:995 2009.05.14 15:48:30 LOG7[16278859:16038719]: connect_wait: waiting 10 seconds 2009.05.14 15:48:30 LOG7[16278859:16038719]: connect_wait: connected 2009.05.14 15:48:30 LOG5[16278859:16038719]: pop3_Docfxit_Yahoo connected remote server from 192.168.1.3:1106 2009.05.14 15:48:30 LOG7[16278859:16038719]: Remote FD=76 initialized 2009.05.14 15:48:30 LOG7[16278859:16038719]: TCP_NODELAY option set on remote socket 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): before/connect initialization 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client hello A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server hello A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server certificate A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server certificate request A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 read server done A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client certificate A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write client key exchange A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write certificate verify A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write change cipher spec A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 write finished A 2009.05.14 15:48:30 LOG7[16278859:16038719]: SSL state (connect): SSLv3 flush data 2009.05.14 15:48:30 LOG3[16278859:16038719]: SSL_connect: Peer suddenly disconnected 2009.05.14 15:48:30 LOG5[16278859:16038719]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.05.14 15:48:30 LOG7[16278859:16038719]: pop3_Docfxit_Yahoo finished (0 left) Thank you for looking at it... Gary

4 8

Re: [stunnel-users] Can't connect to Yahoo POP3
by Gary Kuznitz 15 May '09

15 May '09

I made some changes... On 15 May 2009 at 12:40, stunnel-users(a)mirt.net (Gary Kuznitz <docfxit(a)theoffice.la>) commented about Re: [stunnel-users] Can't connect t: > Thank you for the reply... > > On 15 May 2009 at 20:55, Michal (Michal Trojnara <Michal.Trojnara(a)mobi-com.net>) commented about Re: [stunnel-users] Can't connect to Yahoo POP3: > > > Gary Kuznitz wrote: > > > How can I get a god certificate for Stunnel to use? > > > How would I set that up in Stunnel? > > > > You don't really need a certificate for an SSL client. Just disable it. > > How can I disable it? > > > You rather want to setup server certificate verification with "CAfile" > > and "verify". > > I have un-commented: > CAfile = certs.pem I commented out the above line. Now I'm getting a new error. Here is the log: 2009.05.15 16:32:30 LOG7[16267607:16279139]: RAND_status claims sufficient entropy for the PRNG 2009.05.15 16:32:30 LOG7[16267607:16279139]: PRNG seeded successfully 2009.05.15 16:32:31 LOG7[16267607:16279139]: Certificate: stunnel.pem 2009.05.15 16:32:31 LOG7[16267607:16279139]: Certificate loaded 2009.05.15 16:32:31 LOG7[16267607:16279139]: Key file: stunnel.pem 2009.05.15 16:32:31 LOG7[16267607:16279139]: Private key loaded 2009.05.15 16:32:31 LOG3[16267607:16279139]: Either CApath or CAfile has to be used for authentication 2009.05.15 16:32:31 LOG3[16267607:16279139]: Server is down > verify = 2 > > That gave me an error: > 2009.05.15 12:38:13 LOG3[16278859:16279139]: Error loading verify certificates > from certs.pem > 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: B084002 : > error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib > 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: 2006D080 : > error:2006D080:BIO routines:BIO_new_file:no such file > 2009.05.15 12:38:13 LOG3[16278859:16279139]: SSL_CTX_load_verify_locations: > 2001002: error:02001002:system library:fopen:No such file or directory > > > > ; Some performance tunings > > > socket = l:TCP_NODELAY=1 > > > socket = r:TCP_NODELAY=1 > > > > IMHO it's not a good idea for non-interactive connections, e.g. pop3. > > I will comment out both of the above. > > > > [pop3_DslextremeGmail] > > > accept = 127.0.0.1:11010 > > > connect = pop.gmail.com:995 > > > delay = yes > > > > > > [pop3_Yahoo] > > > accept = 127.0.0.1:11011 > > > connect = pop.mail.yahoo.com:995 > > > delay = yes > > [cut] > > > 2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized > > > for service pop3_Docfxit_Yahoo > > > > I guess you use a different configuration file, as pop3_Docfxit_Yahoo > > is not defined in the one you sent. > > I'm sorry. I'm really using [pop3_Yahoo] > > After I make a change to the conf. file Do I have to re-boot the PC or is it > enough to exit out of Stunnel and launch it again? > > Thank you, > > Gary Kuznitz > > > Best regards, > > Mike > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)mirt.net > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

1 0

Preventing "choose a digital certificate" pop-up in IE
by Wallace Winfrey 08 May '09

08 May '09

Hello I have browsed the archives but have not found the answer to this question... I have stunnel set up to handle https connections. It sits on a CentOS server alongside HAProxy and works fine with every browser except for Internet Explorer. When I connect with Internet Explorer, I get a blank "Please choose a digital certificate" pop-up. I am pretty sure I have a configuration issue. Here's what I have: socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 options = NO_SSLv2 ciphers=ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM output = /var/log/stunnel.log [my.host.name] accept=my.external.IP:443 connect=127.0.0.1:8101 xforwardedfor=yes CAfile=/etc/stunnel/GlobalSign.pem cert=/etc/stunnel/my.host.name.pem verify=1 How do we turn off the request for the client certificate in IE? Here are my details....thanks in advance. w * stunnel-4.15-2.el5.1 * I am running it standalone: /usr/sbin/stunnel /etc/stunnel/stunnel.conf * /usr/sbin/stunnel -version stunnel 4.15 on i686-pc-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none * uname -a: Linux my.host.name 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 09:19:18 EDT 2009 i686 i686 i386 GNU/Linux * glibc version is 2.5-34 * gcc is not installed, using CentOS RPM * OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008

1 1

patch: TCP keep-alive socket options
by Ludolf Holzheid 08 May '09

08 May '09

Dear list, the attached patch allows for tweaking the TCP keep-alive socket options on Linux 2.4 and later. Thanks to the groundwork laid by Michal, this got fairly trivial. We use this to keep NAT table entries alive for connections that are expected to have idle periods longer than the NAT time-outs of the routers in involved. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Odd termination of stunnel process...
by Robert Nickel 08 May '09

08 May '09

We've been happily using stunnel for quite some time now and have run into a strange problem. At seemingly random intervals, stunnel just freaks out an dies. I don't know if it's getting overwhelmed or what but I'm not seeing anything in the logs for stunnel or any other process. Any help is appreciated. Stunnel is being used to wrap a service that was written without use of the ssl libraries directly and connects to two remote web servers (that happen to be running on the same host, separate ports). Config information: OS: CentOS 5.1 OpenSSL: 0.9.8b stunnel -version: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Config file contents: client=yes foreground=no pid=/var/run/pid chroot=/path/to/chroot setuid=non-priv-user setgid=non-priv-group [webservice1] accept=127.0.0.1:11000 connect=172.16.0.1:11000 [webservice2] accept=127.0.0.1:11001 connect=172.16.0.1:11001 Below are the log lines just before the process disappears: May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: Remote FD=15 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085786000]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085786000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: replay accepted FD=18 from 127.0.0.1:40308 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay started May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 18 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 19 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 26 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: Connection from 127.0.0.1:40308 permitted by libwrap May 4 19:49:18 host stunnel: LOG5[28683:3085786000]: replay connected from 127.0.0.1:40308 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: FD 19 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: replay connecting 160.33.167.33:11026 May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: connect_wait: waiting 10 seconds May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: Cleaning up the signal pipe May 4 19:49:18 host stunnel: LOG6[28683:3085928144]: Child process 13775 finished with code 0 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085646736]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085646736]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085716368]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: connect_wait: connected May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: Remote FD=17 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085855632]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: replay accepted FD=22 from 127.0.0.1:40310 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay started May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 22 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 23 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 26 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085928144]: Cleaning up the signal pipe May 4 19:49:18 host stunnel: LOG6[28683:3085928144]: Child process 13777 finished with code 0 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: Connection from 127.0.0.1:40310 permitted by libwrap May 4 19:49:18 host stunnel: LOG5[28683:3085646736]: replay connected from 127.0.0.1:40310 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: FD 23 in non-blocking mode May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: replay connecting 160.33.167.33:11026 May 4 19:49:18 host stunnel: LOG7[28683:3085646736]: connect_wait: waiting 10 seconds May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: connect_wait: connected May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: Remote FD=19 initialized May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL state (connect): before/connect initialization May 4 19:49:18 host stunnel: LOG7[28683:3085786000]: SSL state (connect): SSLv3 write client hello A May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085298576]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085298576]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085298576]: replay finished (8 left) May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write client key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write change cipher spec A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 write finished A May 4 19:49:18 host stunnel: LOG7[28683:3085507472]: SSL state (connect): SSLv3 flush data May 4 19:49:18 host stunnel: LOG7[28683:3085925264]: SSL alert (write): fatal: handshake failure May 4 19:49:18 host stunnel: LOG3[28683:3085925264]: SSL_connect: 1408C095: error:1408C095:SSL routines:SSL3_GET_FINISHED:digest check failed May 4 19:49:18 host stunnel: LOG5[28683:3085925264]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket May 4 19:49:18 host stunnel: LOG7[28683:3085925264]: replay finished (7 left) May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085368208]: SSL state (connect): SSLv3 read server done A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server hello A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server certificate A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server key exchange A May 4 19:49:18 host stunnel: LOG7[28683:3085577104]: SSL state (connect): SSLv3 read server done A [stunnel vanishes at this point. No core, no logs. POOF!] The lines that stand out to me are the SSL_connect digest errors, the finished lines (showing the number of queued requests in parenthesis?) and the fatal handshake failure. Another odd log entry that I'm seeing often is this transfer() loop error: May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: transfer() loop executes not transferring any data May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: please report the problem to Michal.Trojnara(a)mirt.net May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket open: rd=no wr=yes, ssl open: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket ready: rd=yes wr=no, ssl ready: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: ssl want: rd=no wr=no May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: socket input buffer: 0 byte(s), ssl input buffer: 29 byte(s) May 4 21:12:53 host stunnel: LOG3[14341:3085822864]: check_SSL_pending=0, ssl_closing=3 May 4 21:12:53 host stunnel: LOG5[14341:3085822864]: Connection reset: 238 bytes sent to SSL, 225 bytes sent to socket Don't know if it's related but might as well post it along as a possible symptom. Thanks, --Robert

2 1

[PATCH] Fix undefined aliasing in libwrap.c
by Miloslav Trmac 02 May '09

02 May '09

Hello, The attached patch changes the code not to access a part of a char[...] array using an int *, which is undefined in ISO C. Using memcpy() is safe. I would have posted it on in the BTS, but it doesn't allow me even to log in... Thank you, Mirek

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users