- stunnel-users - stunnel.org

FW: [stunnel-users] stunnel on HP-UX
by Stephen Tanner 07 Jun '05

07 Jun '05

I forgot to make sure this went to the list. -----Original Message----- From: Stephen Tanner Sent: Tuesday, June 07, 2005 8:36 AM To: 'Jan Meijer' Subject: RE: [stunnel-users] stunnel on HP-UX Negative, the private key is not protected with a passphrase. If I use the startup script to start stunnel and syslog-ng manually, everything works. But on boot stunnel does not seem to properly establish a connection, and I must stop it and restart it to resolve the issue. Stephen -----Original Message----- From: Jan Meijer [mailto:[email protected]] Sent: Tuesday, June 07, 2005 3:08 AM To: Stephen Tanner Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel on HP-UX On Tue, 31 May 2005, Stephen Tanner wrote: > I'm running stunnel on a HP-UX 11.11 system so that I can securely > transfer logs with syslog-ng. I have stunnel and syslog-ng both > starting in rc2.d at S537. Every time I have rebooted the server I get > a broken pipe as if stunnel is having an issue establishing a tunnel, > and I am forced to restart stunnel and syslog-ng. Are there any > specific daemons that need to be running before stunnel starts? I'm > trying to avoid having this start too late, so that I don't miss logs on > some daemons. There are no specific daemons that need to run. Network is practical for DNS resolving if that's needed. To rule out the obvious: you would not have protected your stunnel private key with a passphrase would you? Jan -- http://www.surfnet.nl/organisatie/jame

1 0

stunnel on HP-UX
by Stephen Tanner 07 Jun '05

07 Jun '05

I'm running stunnel on a HP-UX 11.11 system so that I can securely transfer logs with syslog-ng. I have stunnel and syslog-ng both starting in rc2.d at S537. Every time I have rebooted the server I get a broken pipe as if stunnel is having an issue establishing a tunnel, and I am forced to restart stunnel and syslog-ng. Are there any specific daemons that need to be running before stunnel starts? I'm trying to avoid having this start too late, so that I don't miss logs on some daemons. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

2 1

Reinstalling Stunnel
by mxrtmxd72＠att.net 06 Jun '05

06 Jun '05

I followed the Agent/Stunnel instructions on WURD. I reached the point where I added a space, followed by -install to the shortcut target path. When I attempted to execute this, a message appeared: "Failed to create a new service." I want to thank all those who answered my previous request. I am hoping that someone with experience using Stunnel in conjunction with Agent might be able to help me. I can't for the life of me figure out what I did differently from the first time I installed Stunnel to run with Agent. One person who replied to my previous request asked if I had uninstalled the previous installation of Stunnel. The only way I could do this was to delete all of the programs in the Stunnel directory, because Stunnel does not appear on the list of programs under Add and Delete Programs via Control Panel. Note: I originally was using version 4.07. I am now attempting to use version 4.10. Could this be the problem? Thanks in advance to anyone who can help. Mort Middleman

1 0

[PATCH] Fix inetd mode
by Miloslav Trmac 05 Jun '05

05 Jun '05

Hello, the attached patch fixes inetd mode. signal_pipe[] is not used in inetd mode, so it was left default-initialized to {0, 0}. Emptying "the pipe" would eat all input data. The second hunk was already posted here by Michal Trojnara. Mirek

2 1

slightly OT: starting up multiple instances
by Colin McKinnon 01 Jun '05

01 Jun '05

Hi all, I realise this is slightly OT (the problem seems to be in a different program) but thought that someobdy out there may have solved this one already. I'm trying to run a second instance of stunnel (different 'verify' level) on a SuSE 8.2 box. The second instance just doesn't start. What I did was to copy the supplied /etc/init.d/stunnel script to 'stunnelv' and referenced different config and PID files. After I had fixed bug in the startup script (the line which started the process - using startproc - didn't pass the conf file, and didn't get told to use the PID file) I still got the same error. Now, if I run '/etc/init.d/stunnel start' I get /var/run/stunnel.pid. If I then run '/etc/init.d/stunnelv start' it reports 'OK' but didn't really start. If I start them the other way around 'stunnelv' works and I get /var/run/stunnelv.pid but then 'stunnel' won't start. Thinking that 'startproc' is seeing 'stunnel' already running in the processlist, I tried creating a symbolic link '/usr/sbin/stunelv' to /usr/bin/stunnel and changed '/etc/init.d/stunnelv' to run that instead of '/usr/sbin/stunnel'. Looking in 'ps' it is reported as 'stunnelv' but I still can't get the second instance to start. The error seems to be with 'startproc' - it seems to think that the intended process is running when it's not. If I just type in the line which starts up stunnel as shown below I get the same behaviour. startproc -v -l /var/log/rc.stunnelv.log -p /var/run/stunnelv.pid /usr/sbin/stunnelv /etc/stunnel/verified_clients.conf Unfortunately, the '-v' option doesn't seem to work. Anybody any suggestions? TIA, Colin

2 1

[PATCH] Reject inetd mode with no client specification
by Miloslav Trmac 01 Jun '05

01 Jun '05

Hello, when stunnel is started in inetd mode without specifying connect = nor exec =, it attempts to execl(NULL) and the child SIGSEGVs. The attached patch adds a check to reject such configurations. Mirek

1 0

Problems with Stunnel4.05 on Linux Servers
by vasudha.upadhyaya＠convergys.com 27 May '05

27 May '05

Hi, We have been using stunnel 4.05 with OpenSSL 0.97d for quite sometime on Linux Servers and now suddenly we have been getting this error: 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 8506606B : error:8506606B:lib(133):AEP_GET_CONNECTION:init failure 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 85068069 : error:85068069:lib(133):AEP_MOD_EXP:get handle failed 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 8506606B : error:8506606B:lib(133):AEP_GET_CONNECTION:init failure 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 85068069 : error:85068069:lib(133):AEP_MOD_EXP:get handle failed 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 8506606B : error:8506606B:lib(133):AEP_GET_CONNECTION:init failure 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 85068069 : error:85068069:lib(133):AEP_MOD_EXP:get handle failed 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 8506606B : error:8506606B:lib(133):AEP_GET_CONNECTION:init failure 2005.05.27 14:07:39 LOG3[23121:59395]: error stack: 85069069 : error:85069069:lib(133):AEP_MOD_EXP_CRT:get handle failed Attached is the stunnel.conf file. (See attached file: stunnel.conf) Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0

Stunnel - Transfer loop executes not transferring any data.
by Glenn Stowe 27 May '05

27 May '05

Hi, did you find a resolution to this problem? I'm getting the same thing, and found your post while googling the user group.. Thx, Glenn -- CubeWerx Inc. | It's never too late to Glenn Stowe - Sales Techie Guy, | have a happy childhood. gstowe(a)cubewerx.com www.cubewerx.com | -- Tom Robbins, "Still Ph:(819) 771-6552 Fax:(819) 772-4838 | Life with Woodpecker"

1 0

stunnel terminates unexpectedly on FreeBSD 5.4
by Christian Wittenhorst 26 May '05

26 May '05

Bug Report: description: stunnel just terminated after exactly two incoming SSL connections. No error is logged, no core dump. affected versions: (plain ./configure) stunnel-4.04: works fine stunnel-4.05: crashes stunnel-4.08: crashes stunnel-4.10: crashes uname -a: FreeBSD db.kanti-zug.ch 5.4-RELEASE-p1 FreeBSD 5.4-RELEASE-p1 #0: Thu May 26 15:36:18 CEST 2005 [email protected]:/usr/src/sys/i386/compile/db i386 log: 2005.05.26 16:28:43 LOG5[20644:1]: stunnel 4.10 on i386-unknown-freebsd5.4 UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 2005.05.26 16:28:43 LOG7[20644:1]: RAND_status claims sufficient entropy for the PRNG 2005.05.26 16:28:43 LOG6[20644:1]: PRNG seeded successfully 2005.05.26 16:28:43 LOG7[20644:1]: Certificate: /db/server.crt 2005.05.26 16:28:43 LOG7[20644:1]: Key file: /db/server.key 2005.05.26 16:28:43 LOG6[20644:1]: file ulimit = 11095 (can be changed with 'ulimit -n') 2005.05.26 16:28:43 LOG6[20644:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.05.26 16:28:43 LOG5[20644:1]: 5417 clients allowed 2005.05.26 16:28:43 LOG7[20644:1]: FD 4 in non-blocking mode 2005.05.26 16:28:43 LOG7[20644:1]: FD 5 in non-blocking mode 2005.05.26 16:28:43 LOG7[20644:1]: FD 6 in non-blocking mode 2005.05.26 16:28:43 LOG7[20644:1]: SO_REUSEADDR option set on accept socket 2005.05.26 16:28:43 LOG7[20644:1]: postgres bound to 85.158.25.7:5430 2005.05.26 16:28:43 LOG7[20644:1]: No pid file being created 2005.05.26 16:28:43 LOG7[20644:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:1]: postgres accepted FD=7 from 212.203.73.19:55038 2005.05.26 16:28:46 LOG7[20644:1]: Creating a new context 2005.05.26 16:28:46 LOG7[20644:1]: Context 2 created 2005.05.26 16:28:46 LOG7[20644:2]: postgres started 2005.05.26 16:28:46 LOG7[20644:2]: FD 7 in non-blocking mode 2005.05.26 16:28:46 LOG5[20644:2]: postgres connected from 212.203.73.19:55038 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): before/accept initialization 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 read client hello A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write server hello A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write certificate A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write certificate request A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 flush data 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:2]: SSL alert (read): warning: no certificate 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 read client key exchange A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 read finished A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write change cipher spec A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 write finished A 2005.05.26 16:28:46 LOG7[20644:2]: SSL state (accept): SSLv3 flush data 2005.05.26 16:28:46 LOG7[20644:2]: 1 items in the session cache 2005.05.26 16:28:46 LOG7[20644:2]: 0 client connects (SSL_connect()) 2005.05.26 16:28:46 LOG7[20644:2]: 0 client connects that finished 2005.05.26 16:28:46 LOG7[20644:2]: 0 client renegotiatations requested 2005.05.26 16:28:46 LOG7[20644:2]: 1 server connects (SSL_accept()) 2005.05.26 16:28:46 LOG7[20644:2]: 1 server connects that finished 2005.05.26 16:28:46 LOG7[20644:2]: 0 server renegotiatiations requested 2005.05.26 16:28:46 LOG7[20644:2]: 0 session cache hits 2005.05.26 16:28:46 LOG7[20644:2]: 1 session cache misses 2005.05.26 16:28:46 LOG7[20644:2]: 0 session cache timeouts 2005.05.26 16:28:46 LOG6[20644:2]: SSL accepted: new session negotiated 2005.05.26 16:28:46 LOG6[20644:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.05.26 16:28:46 LOG7[20644:2]: FD 8 in non-blocking mode 2005.05.26 16:28:46 LOG7[20644:2]: postgres connecting 127.0.0.1:5432 2005.05.26 16:28:46 LOG7[20644:2]: connect_wait: waiting 10 seconds 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:2]: connect_wait: connected 2005.05.26 16:28:46 LOG7[20644:2]: Remote FD=8 initialized 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=8, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->() 2005.05.26 16:28:46 LOG7[20644:2]: Socket closed on read 2005.05.26 16:28:46 LOG7[20644:2]: SSL write shutdown 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 60 second(s) for 3 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:46 LOG7[20644:2]: SSL alert (write): warning: close notify 2005.05.26 16:28:46 LOG7[20644:2]: SSL_shutdown retrying 2005.05.26 16:28:46 LOG7[20644:2]: SSL doesn't need to read or write 2005.05.26 16:28:46 LOG7[20644:0]: Waiting 60 second(s) for 3 file descriptor(s) 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:46 LOG7[20644:0]: CONTEXT 2, FD=7, (IN)->(IN) 2005.05.26 16:28:46 LOG7[20644:2]: SSL alert (read): warning: close notify 2005.05.26 16:28:46 LOG7[20644:2]: SSL closed on SSL_read 2005.05.26 16:28:46 LOG7[20644:2]: Socket write shutdown 2005.05.26 16:28:46 LOG5[20644:2]: Connection closed: 550 bytes sent to SSL, 446 bytes sent to socket 2005.05.26 16:28:46 LOG7[20644:2]: postgres finished (0 left) 2005.05.26 16:28:46 LOG7[20644:2]: Context 2 closed 2005.05.26 16:28:46 LOG7[20644:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:1]: postgres accepted FD=7 from 212.203.73.19:55040 2005.05.26 16:28:48 LOG7[20644:1]: Creating a new context 2005.05.26 16:28:48 LOG7[20644:1]: Context 3 created 2005.05.26 16:28:48 LOG7[20644:3]: postgres started 2005.05.26 16:28:48 LOG7[20644:3]: FD 7 in non-blocking mode 2005.05.26 16:28:48 LOG5[20644:3]: postgres connected from 212.203.73.19:55040 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): before/accept initialization 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 read client hello A 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 write server hello A 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 write change cipher spec A 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 write finished A 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 flush data 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:3]: SSL state (accept): SSLv3 read finished A 2005.05.26 16:28:48 LOG7[20644:3]: 1 items in the session cache 2005.05.26 16:28:48 LOG7[20644:3]: 0 client connects (SSL_connect()) 2005.05.26 16:28:48 LOG7[20644:3]: 0 client connects that finished 2005.05.26 16:28:48 LOG7[20644:3]: 0 client renegotiatations requested 2005.05.26 16:28:48 LOG7[20644:3]: 2 server connects (SSL_accept()) 2005.05.26 16:28:48 LOG7[20644:3]: 2 server connects that finished 2005.05.26 16:28:48 LOG7[20644:3]: 0 server renegotiatiations requested 2005.05.26 16:28:48 LOG7[20644:3]: 1 session cache hits 2005.05.26 16:28:48 LOG7[20644:3]: 1 session cache misses 2005.05.26 16:28:48 LOG7[20644:3]: 0 session cache timeouts 2005.05.26 16:28:48 LOG6[20644:3]: SSL accepted: previous session reused 2005.05.26 16:28:48 LOG7[20644:3]: FD 8 in non-blocking mode 2005.05.26 16:28:48 LOG7[20644:3]: postgres connecting 127.0.0.1:5432 2005.05.26 16:28:48 LOG7[20644:3]: connect_wait: waiting 10 seconds 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 10 second(s) for 3 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:3]: connect_wait: connected 2005.05.26 16:28:48 LOG7[20644:3]: Remote FD=8 initialized 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 43200 second(s) for 4 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->() 2005.05.26 16:28:48 LOG7[20644:3]: Socket closed on read 2005.05.26 16:28:48 LOG7[20644:3]: SSL write shutdown 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 60 second(s) for 3 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (INOUT)->(OUT) 2005.05.26 16:28:48 LOG7[20644:3]: SSL alert (write): warning: close notify 2005.05.26 16:28:48 LOG7[20644:3]: SSL_shutdown retrying 2005.05.26 16:28:48 LOG7[20644:3]: SSL doesn't need to read or write 2005.05.26 16:28:48 LOG7[20644:0]: Waiting 60 second(s) for 3 file descriptor(s) 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.26 16:28:48 LOG7[20644:0]: CONTEXT 3, FD=7, (IN)->(IN) 2005.05.26 16:28:48 LOG7[20644:3]: SSL alert (read): warning: close notify 2005.05.26 16:28:48 LOG7[20644:3]: SSL closed on SSL_read 2005.05.26 16:28:48 LOG7[20644:3]: Socket write shutdown 2005.05.26 16:28:48 LOG5[20644:3]: Connection closed: 550 bytes sent to SSL, 446 bytes sent to socket 2005.05.26 16:28:48 LOG7[20644:3]: postgres finished (0 left)

2 2

Installing Stunnel
by mhrtmhd94＠att.net 26 May '05

26 May '05

I installed (actually re-installed) Stunnel. I got as far as creating the shortcut as follows: c:\stunnel\stunnel-4.10.exe -install. The message "Failed to Create a New Service" appeared. I need some help. Thanks.

2 1

Patch: verify_depth and remote_subj
by Michael Smith 26 May '05

26 May '05

Hi, I've attached a patch against stunnel 4.10. It adds two verification options to the global configuration: === remote_subj = expected subject for the remote certificate If set, the remote certificate's subject must match this string. You can obtain the subject in the proper format by running openssl x509 -in servercert.pem -noout -subject Example: remote_subj = /C=CA/ST=Ontario/CN=gw Requires verify=2 or greater. verify_depth = maximum number of CA certificates in chain Specifies the maximum certificate chain depth when verifying the peer certificate: 0: peer certificate must be self-signed 1: peer certificate must be signed by a root CA 2: peer certificate can be signed by at most one intermediate CA The stunnel default depth is 9 for backwards compatibility. Please note that Apache/SSL defaults to 1. If your non-CA certificates are marked with the X509v3 basic constraint "CA:FALSE", you probably do not need to worry about chain depth. This is the default behaviour for most CA tools, including the scripts that ship with OpenSSL. === remote_subj probably belongs in per-service config, not global, but the SSL verification setup is global and I didn't want to start messing with it. Mike

1 0

Upstream Connect
by Justin Alexander 25 May '05

25 May '05

Is there a way with stunnel for a client to connect to a server (hopping a firewall), forming a secured SSL/TCP connection, that will allow the server to connect back to the client machine over that tunnel? So far, all I've read is that stunnel only allows connections to start on the client and connect down stream (through the tunnel) to the server. I need to reverse this pattern.

1 0

How to install Intermediate certificate on Stunnel
by Srinivas B 19 May '05

19 May '05

Hi, Can any one help me how to register the Intermediate.cer certificate, which i have obtain from verisign on Stunnel 3.8 i have used openssl 0.9.6 for creation of the certificate on windows NT4.0 Thanks.... Srinivas Yahoo! India Matrimony: Find your life partneronline.

2 1

Re: unexpected shutdown of stunnel
by Paul Dekkers 18 May '05

18 May '05

Hi, For what it's worth: >I use Freebsd and made an update from stunnel 4.8 to stunnel 4.10 from >the ports today. Now I noticed that stunnel stops after a while. > > I experienced the same, only my configuration ran in server- instead of client-mode. The only thing that I did while building the port was using -DWITH_IPV6, but I assume that shouldn't be a problem. >And these are the last lines of the log:005.05.15 10:34:00 > > I used debug = 5, and I didn't see anything usefull in the logs. I'm glad someone has the same problem and has better logging then I have ;-) The last log line was the incoming session, that's it. >Everything went fine with 4.8, now stunnel is not running anymore after >a short period of time (few minutes). > > I'm back to the 4.7 we had previously. We're using this in production, so I couldn't really experiment much with the 4.10. Regards, Paul

1 0

CN field of server cert
by spambox＠poczta.onet.pl 16 May '05

16 May '05

Hi stunnel-users, There is example configuration:  I don't know how to enforce stunnel to verify CN field from server provided certificate. Even if i change "connect" field to next one stunnel will not complain. So, am I wrong that when someone hijack (mitm) this connection and provide any server cert signed by ThawteServerCA then I loose? Please add this verification to stunnel when verify is set to 2 or better as an separate option "verify_cn?" which could be used in service-level context. Usting this option with that described below I can drop 'verify' and 'CAfile' at all and feel much better. :) There is another verification method that could be added - not related to verify option. In most cases I know public cert of remote server. So I also know sha1/md5 fingerprint of that cert. Security could improve v.much by just adding these lines to my example configuration: fingerprint_md5=F5:BD:C3:C8:D5:4B:03:EA:57:BB:81:72:46:6B:26:54 fingerprint_sha1=CE:3A:0D:3E:DA:4B:77:A3:53:C0:9E:A8:65:B7:F8:C2:09:71:43:41 Another good service-level option? There are some other good options that could be ported from openssl/s_client: "-ssl2, -ssl3, -tls1, -no_ssl2, -no_ssl3, -no_tls1" Regards.

3 3

unexpected shutdown of stunnel
by Daniel Graupner 15 May '05

15 May '05

Hello, I use Freebsd and made an update from stunnel 4.8 to stunnel 4.10 from the ports today. Now I noticed that stunnel stops after a while. Here is my conf: chroot = /usr/local/stunnel pid = /stunnel.pid setuid = stunnel setgid = stunnel debug = 7 output = /usr/local/stunnel/stunnel.log client = yes [https] accept = localhost:9999 connect = <ssl-apache>:443 TIMEOUTclose = 0 And these are the last lines of the log:005.05.15 10:34:00 LOG7[60990:0]: Waiting 0 second(s) for 3 file descriptor(s) 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.15 10:34:00 LOG7[60990:3]: SSL alert (write): warning: close notify 2005.05.15 10:34:00 LOG7[60990:3]: SSL_shutdown retrying 2005.05.15 10:34:00 LOG7[60990:3]: SSL doesn't need to read or write 2005.05.15 10:34:00 LOG7[60990:0]: Waiting 0 second(s) for 3 file descriptor(s) 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.15 10:34:00 LOG7[60990:3]: SSL alert (read): warning: close notify 2005.05.15 10:34:00 LOG7[60990:3]: SSL closed on SSL_read 2005.05.15 10:34:00 LOG7[60990:3]: Socket write shutdown 2005.05.15 10:34:00 LOG5[60990:3]: Connection closed: 197 bytes sent to SSL, 784 bytes sent to socket 2005.05.15 10:34:00 LOG7[60990:3]: https finished (0 left) 2005.05.15 10:34:00 LOG7[60990:3]: removing pid file /stunnel.pid Everything went fine with 4.8, now stunnel is not running anymore after a short period of time (few minutes). Regards, Daniel.

1 0

Problems with stunnel 4.10 compilation
by Oleg Ivanov 14 May '05

14 May '05

Hello. I've compiled stunnel 4.10 without any problems on my Gentoo workstation and RedHat server. But now I need to install it into my old legacy Mandrake 8.2 server and here I've got into troubles. I've updated zlib and openssl (configuring it with "zlib" option) to their latest versions, then tried to make stunnel and got following errors: --- /usr/lib/libcrypto.a(c_zlib.o): In function `zlib_compress_block': c_zlib.o(.text+0x48): undefined reference to `compress' /usr/lib/libcrypto.a(c_zlib.o): In function `zz_uncompress': c_zlib.o(.text+0x145): undefined reference to `inflateInit_' c_zlib.o(.text+0x159): undefined reference to `inflate' c_zlib.o(.text+0x16c): undefined reference to `inflateEnd' c_zlib.o(.text+0x18b): undefined reference to `inflateEnd' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make: *** [all-recursive] Error 1 --- It seems like problems with zlib so I've double-checked it - but zlib 1.2.2 is really installed. If I recompile openssl without "zlib" option then I can make stunnel but it can't initialize zlib compression algorithm that I really need. And if I compile openssl with zlib - stunnel fails on make with errors. Can anyone help with it please? I really stuck 8( PS: My system's parameters according to support page requirements: # uname -a Linux localhost 2.4.27-vs1.29 #2 SMP Tue Oct 5 15:51:37 CDT 2004 i686 unknown glibc version: 2.2.4 # gcc -v Reading specs from /usr/lib/gcc-lib/i586-mandrake-linux-gnu/2.96/specs gcc version 2.96 20000731 (Mandrake Linux 8.2 2.96-0.76mdk) # openssl version OpenSSL 0.9.7g 11 Apr 2005 Best Regards, Oleg Ivanov. -- Oleg Ivanov mailto: saruman(a)unigsm.com

1 1

Connection details patch for 4.10
by Oleg Ivanov 14 May '05

14 May '05

Hello. I've modified the old "conndetails_peter" patch by Peter D. Gray to let it work with stunnel 4.10. I've also added to it information about compression (available compression methods and negotiated method). Patch creates a file "conn.LOCAL_HOST:LOCAL_PORT" in a configurable temp directory (config file: "infodir" option). The file is deleted when the client disconnects. Full description of original can be found at: http://www.stunnel.org/patches/desc/conndetails_peter.html Hope it will be useful for someone. Best Regards, Oleg Ivanov. -- Oleg Ivanov mailto: saruman(a)unigsm.com diff -cr ../stunnel-4.10.orig/src/client.c src/client.c *** ../stunnel-4.10.orig/src/client.c 2005-05-13 00:43:24.000000000 -0200 --- src/client.c 2005-05-13 01:34:36.000000000 -0200 *************** *** 94,99 **** --- 94,114 ---- c->opt=opt; c->local_rfd.fd=rfd; c->local_wfd.fd=wfd; + + if(options.info_dir) { + sprintf(c->info_fname, "%s/pid.%d", options.info_dir, getpid()); + c->info_file = fopen(c->info_fname, "w"); + if(!c->info_file) { + s_log(LOG_ERR, "failed to create: %s (continuing)", c->info_fname); + c->info_fname[0] = 0; + } else { + s_log(LOG_DEBUG, "connection detail to be written to: %s", + c->info_fname); + fprintf(c->info_file, "# connection details\n" + "STUNNEL_PID=%d\n", getpid()); + } + } + return c; } *************** *** 203,208 **** --- 218,228 ---- s_log(LOG_NOTICE, "%s connected from %s", c->opt->servname, c->accepting_address); } + if(c->info_file) { + fprintf(c->info_file, "SERVICE=\"%s\"\n", c->opt->servname); + fprintf(c->info_file, "REMOTE_HOST=\"%s\"\nREMOTE_PORT=%d\n", + c->accepting_address, ntohs(c->peer_addr.addr[0].in.sin_port)); + } return 0; /* OK */ } *************** *** 237,242 **** --- 257,289 ---- } #endif s_log(LOG_DEBUG, "Remote FD=%d initialized", fd); + if(c->info_file) { + struct sockaddr_in addr; + int addrlen = sizeof(addr); + if(getsockname(fd, (struct sockaddr *)&addr, &addrlen)) { + // ignore error + } else { + char newname[STRLEN]; + + /* record our end of the tunnel, and change name of file to match */ + enter_critical_section(CRIT_NTOA); /* inet_ntoa is not mt-safe */ + fprintf(c->info_file, "LOCAL_HOST=\"%s\"\nLOCAL_PORT=%d\n", + inet_ntoa(addr.sin_addr), ntohs(addr.sin_port)); + sprintf(newname, "%s/conn.%s:%d", + options.info_dir, + inet_ntoa(addr.sin_addr), ntohs(addr.sin_port)); + leave_critical_section(CRIT_NTOA); + + /* done with file, close it now */ + fprintf(c->info_file, "# EOF\n"); + fclose(c->info_file); + c->info_file = NULL; + + /* rename so it's easy for the client to find */ + rename(c->info_fname, newname); + strcpy(c->info_fname, newname); + } + } c->remote_fd.fd=fd; c->remote_fd.is_socket=1; /* Always! */ if(set_socket_options(fd, 2)<0) *************** *** 674,679 **** --- 721,737 ---- reset(c->local_wfd.fd, "linger (local_wfd)"); } } + /* Cleanup connection info file which isn't useful anymore */ + if(options.info_dir) { + if(c->info_file) { + fclose(c->info_file); + c->info_file = NULL; + } + if(c->info_fname) { + unlink(c->info_fname); /* ignore errors */ + s_log(LOG_INFO, "removed info file: %s", c->info_fname); + } + } } static void print_cipher(CLI *c) { /* print negotiated cipher */ *************** *** 683,689 **** #else SSL_CIPHER *cipher; char buf[STRLEN]; ! int len; cipher=SSL_get_current_cipher(c->ssl); SSL_CIPHER_description(cipher, buf, STRLEN); --- 741,748 ---- #else SSL_CIPHER *cipher; char buf[STRLEN]; ! int len, cnt; ! SSL_COMP *comp=NULL; cipher=SSL_get_current_cipher(c->ssl); SSL_CIPHER_description(cipher, buf, STRLEN); *************** *** 691,696 **** --- 750,809 ---- if(len>0) buf[len-1]='\0'; s_log(LOG_INFO, "Negotiated ciphers: %s", buf); + + if(c->info_file) { + X509 *peer; + + fprintf(c->info_file, "CIPHER_DESC=\"%s\"\n", buf); + fprintf(c->info_file, "CIPHER_ALGO=\"%s\"\n", + SSL_CIPHER_get_name(cipher)); + fprintf(c->info_file, "CIPHER_BITS=%d\n", + SSL_CIPHER_get_bits(cipher, NULL)); + // Show compression info + if (c->ssl->ctx->comp_methods == NULL) { + // No compression methods available + fprintf(c->info_file, "No compression methods available\n"); + } else { + int cntMethods = sk_SSL_COMP_num(c->ssl->ctx->comp_methods); + fprintf(c->info_file, "%d compression method(s) available:\n", cntMethods); + for (cnt=0; cnt<cntMethods; cnt++) { + comp=sk_SSL_COMP_value(c->ssl->ctx->comp_methods, cnt); + fprintf(c->info_file, "%d\t%s ", comp->id, comp->name); + switch (comp->id) { + case 0xe0: + fprintf(c->info_file, "(zlib)\n"); break; + case 0xe1: + fprintf(c->info_file, "(rle)\n"); break; + default: + fprintf(c->info_file, "(unknown)\n"); break; + } + } + } + if (c->ssl->s3->tmp.new_compression == NULL) { + fprintf(c->info_file, "SSL_COMP=NULL\n"); + } else { + fprintf(c->info_file, "SSL_COMP.id=%d ", + c->ssl->s3->tmp.new_compression->id); + switch (comp->id) { + case 0xe0: + fprintf(c->info_file, "(zlib)\n"); break; + case 0xe1: + fprintf(c->info_file, "(rle)\n"); break; + default: + fprintf(c->info_file, "(unknown)\n"); break; + } + } + peer = SSL_get_peer_certificate(c->ssl); + if(peer) { + X509_NAME_oneline(X509_get_subject_name(peer), buf, STRLEN); + fprintf(c->info_file, "SSL_CLIENT_DN=\"%s\"\n", buf); + + X509_NAME_oneline(X509_get_issuer_name(peer), buf, STRLEN); + fprintf(c->info_file, "SSL_CLIENT_I_DN=\"%s\"\n", buf); + + X509_free(peer); + } + } #endif } *************** *** 953,958 **** --- 1066,1075 ---- s_ntop(c->connecting_address, &addr); s_log(LOG_DEBUG, "%s connecting %s", c->opt->servname, c->connecting_address); + if(c->info_file) { + fprintf(c->info_file, "TUNNEL_HOST=\"%s\"\nTUNNEL_PORT=%d\n", + c->connecting_address, ntohs(addr.in.sin_port)); + } if(!connect(s, &addr.sa, addr_len(addr))) return s; /* no error -> success (should not be possible) */ error=get_last_socket_error(); Only in src: client.c.orig Only in src: client.c~ diff -cr ../stunnel-4.10.orig/src/options.c src/options.c *** ../stunnel-4.10.orig/src/options.c 2005-05-13 00:43:24.000000000 -0200 --- src/options.c 2005-05-13 00:44:16.000000000 -0200 *************** *** 664,669 **** --- 664,693 ---- break; } + /* infodir */ + switch(cmd) { + case CMD_INIT: + options.info_dir=NULL; + break; + case CMD_EXEC: + if(strcasecmp(opt, "infodir")) + break; + if(arg[0]) { /* not empty */ + if(strlen(arg) > STRLEN - 20) return "infodir pathname too long"; + options.info_dir=stralloc(arg); + } else { + options.info_dir=NULL; + } + return NULL; /* OK */ + case CMD_DEFAULT: + break; + case CMD_HELP: + log_raw("%-15s = writable directory to store connection info into", + "infodir"); + break; + } + + if(cmd==CMD_EXEC) return option_not_found; return NULL; /* OK */ diff -cr ../stunnel-4.10.orig/src/prototypes.h src/prototypes.h *** ../stunnel-4.10.orig/src/prototypes.h 2005-05-13 00:43:24.000000000 -0200 --- src/prototypes.h 2005-05-13 00:47:03.000000000 -0200 *************** *** 113,118 **** --- 113,119 ---- int verify_level; int verify_use_only_my; long ssl_options; + char *info_dir; /* directory for connection info */ /* some global data for stunnel.c */ #ifndef USE_WIN32 *************** *** 264,269 **** --- 265,272 ---- FD *ssl_rfd, *ssl_wfd; /* Read and write SSL descriptors */ int sock_bytes, ssl_bytes; /* Bytes written to socket and ssl */ s_poll_set fds; /* File descriptors */ + FILE *info_file; /* text file with connection information */ + char info_fname[STRLEN]; /* file name (full path) for info_file */ } CLI; extern int max_clients; *************** *** 305,311 **** /**************************************** Prototypes for sthreads.c */ typedef enum { ! CRIT_KEYGEN, CRIT_INET, CRIT_CLIENTS, CRIT_WIN_LOG, CRIT_SESSION, CRIT_SECTIONS } SECTION_CODE; --- 308,314 ---- /**************************************** Prototypes for sthreads.c */ typedef enum { ! CRIT_KEYGEN, CRIT_INET, CRIT_CLIENTS, CRIT_WIN_LOG, CRIT_SESSION, CRIT_NTOA, CRIT_SECTIONS } SECTION_CODE;

1 0

syslog on Solaris2.9
by Geoff LeBoldus 13 May '05

13 May '05

I can't seem to get stunnel-4.10 to log properly to syslog. Stunnel logs the startup, but doesn't log any individual tunnel information. If I specify its own file and debug = 7, it logs everything as expected. I've tried a number of different configuration combinations without success. Any thoughts? Here's my current config snippets - stunnel.conf debug = local0.debug -syslog.conf local0.debug /var/log/syslog Stunnel startup from /var/log/syslog May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] stunnel 4.10 on sparc-sun-solaris2.9 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] stunnel 4.10 on sparc-sun-solaris2.9 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Snagged 64 random bytes from /home/geoff/.rnd May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Wrote 1024 new random bytes to /home/geoff/.rnd May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] RAND_status claims sufficient entropy for the PRNG May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.info] PRNG seeded successfully May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Certificate: /opt/local/etc/stunnel/stunnel.pem May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Key file: /opt/local/etc/stunnel/stunnel.pem May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.info] file ulimit = 1024 (can be changed with 'ulimit -n') May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.info] poll() used - no FD_SETSIZE limit for file descriptors May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] 500 clients allowed May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] 500 clients allowed May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] FD 5 in non-blocking mode May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] FD 6 in non-blocking mode May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] FD 7 in non-blocking mode May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] SO_REUSEADDR option set on accept socket May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] ldaps bound to 0.0.0.0:1212 May 13 15:31:31 server_name stunnel[4577]: [ID 702911 local0.debug] Created pid file /stunnel.pid May 13 15:31:31 server_name stunnel[4577]: [ID 702911 local0.debug] Waiting -1 second(s) for 2 file descriptor(s) -- Geoff LeBoldus Systems Programmer Information Technology Services

1 0

Session Reuse Information for Stunnel
by vasudha.upadhyaya＠convergys.com 11 May '05

11 May '05

I know that Stunnel reuses sessions. Can anyone tell me the default time that stunnel reuses the old session. And to set a value for session timeout do I use the option: session = timeout session cache timeout Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

2 1

zlib compression
by Oleg Ivanov 09 May '05

09 May '05

Hello. I have installed stunnel 4.09 both as client (on my computer) and as server (on server). Both has zlib compression enabled and I can see that zlib initializes properly in the logs (it says "Compression enabled using zlib method"). But when I send any data over that tunnel I can't see any signs of compression - amount of traffic is almost the same as over plain connection. Am I doing something wrong? Or I'm misunderstanding the purpose of this compression ability? And if the traffic indeed must be reduced - why I can't see that and how can I make it work properly? Thank you for your answers. Best Regards, Oleg Ivanov. -- Oleg Ivanov mailto: saruman(a)unigsm.com

2 2

connect ip = accept ip on multihomed server ?
by Dennis Spreen 09 May '05

09 May '05

hi all, with a configuration (stunnel4.10) like this [conc1] accept = 100 connect = 99 stunnel accepts all requests on all ips on port 100 but connects with the localhost to port 99. is it possible to configure stunnel that if it accepts a connection on 1.2.3.4:100 it connects to 1.2.3.4:99 ? I know it is possible to use accept = 1.2.3.4:100 connect = 1.2.3.4:99 .... accept = 1.2.3.250:100 connect = 1.2.3.250:99 but i'm on a c-class and that would require about 250 entries in the config file. Is there a better way to do this? regards dennis

1 0

Problems in Stunnel4.10
by vasudha.upadhyaya＠convergys.com 06 May '05

06 May '05

Hi, We have been using stunnel 4.05 and recently downloded the stunnel 4.10 and deployed in our environmrnt. All the traffice is going via the Load Balancer Cisco CSS with SSL Module to the unix server(with stunnel4.10 on them). We also 4.10 deployed on the Windows2000 as a client. The CSS sends keep Alives to check the health of the servers(whether they are up or not).And I guess due to this the stunnel on unix servers crashes immediately and there is a access violation error. Attached is the truss output for one of the unix servers.Stunnel4.10 was compiled using OpenSSL0.97d and OpenSSL0.97g, and still we get the same problem.Attached is the stunnel.conf also.[attachment "stunnel.conf" deleted by Vasudha Upadhyaya/CCMG/CVG] (See attached file: truss.out) (See attached file: stunnel.conf) Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0

qmail+tcpserver+stunnel-4.x
by Scott Geiger 06 May '05

06 May '05

Does anyone have a good link to setting up qmail to use stunnel for pop3s? I have found a few, but so far nothing seems to work from me. When I test with telnet it closes the connection immediately and tcpserver exits with status 11. tcpserver: status: 0/20 tcpserver: status: 1/20 tcpserver: pid 32660 from 128.226.61.66 tcpserver: ok 32660 242.70-84-9.reverse.theplanet.com:70.84.9.242:995 :128.226.61.66::26733 2005.05.06 15:37:18 LOG5[32660:1]: stunnel 4.10 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.05.06 15:37:18 LOG7[32660:1]: Snagged 64 random bytes from /root/.rnd 2005.05.06 15:37:18 LOG7[32660:1]: Wrote 1024 new random bytes to /root/.rnd 2005.05.06 15:37:18 LOG7[32660:1]: RAND_status claims sufficient entropy for the PRNG 2005.05.06 15:37:18 LOG6[32660:1]: PRNG seeded successfully 2005.05.06 15:37:18 LOG7[32660:1]: Configuration SSL options: 0x01000000 2005.05.06 15:37:18 LOG7[32660:1]: SSL options set: 0x01000000 2005.05.06 15:37:18 LOG7[32660:1]: Certificate: /etc/stunnel/stunnel.pem 2005.05.06 15:37:18 LOG7[32660:1]: Key file: /etc/stunnel/stunnel.pem 2005.05.06 15:37:18 LOG7[32660:1]: stunnel started 2005.05.06 15:37:18 LOG7[32660:1]: FD 0 in non-blocking mode 2005.05.06 15:37:18 LOG7[32660:1]: FD 1 in non-blocking mode 2005.05.06 15:37:18 LOG6[32660:1]: Local mode child started (PID=32661) 2005.05.06 15:37:18 LOG5[32660:1]: stunnel connected from 127.0.0.1:41860 2005.05.06 15:37:18 LOG7[32660:1]: FD 3 in non-blocking mode 2005.05.06 15:37:18 LOG7[32660:1]: stunnel connecting 127.0.0.1:110 2005.05.06 15:37:18 LOG7[32660:1]: connect_wait: waiting 10 seconds 2005.05.06 15:37:18 LOG7[32660:0]: Waiting 10 second(s) for 1 file descriptor(s) tcpserver: end 32660 status 11 tcpserver: status: 0/20 If is use openssl's s_client (openssl s_client -connect mail.bcmediagroup.com:995 -state) I get: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:error in SSLv2/v3 read server hello A write:errno=104 Scott Geiger

1 0

Newbie windows user needs help patching/compiling with mingw
by Geoff Elmer 04 May '05

04 May '05

Can anyone point me to some documentation on how to use mingw to patch and make stunnel? Specifically, I want to apply connect-proxy_dunbar.patch to v4.05 source and compile it. As I am not really a coder (yet) and am not yet very *nix knowledgeable, any help would be much appreciated. Situation is: I am trying to traverse a MS ISA server (running as a proxy) and the v4.10 stunnel doesn't allow me to specify a proxy to route thru. Thanks in advance, Geoff __________________________________ Do you Yahoo!? Yahoo! Mail - Find what you need with new enhanced search. http://info.mail.yahoo.com/mail_250

1 0

[Newbie] Set up question
by Geoff Sheridan 02 May '05

02 May '05

I have compiled and installed stunnel 4.10 under Mac OS X 10.3. I want to set up stunnel to connect a non-ssl newsreader client to an ssl nntp server. The newsreader client is Unison and the server is Easynews SSL server. I don't really know how to do this. I wonder if anyone can point me in the right direction. Thanks Geoff ___________ PS I did various searches of the list archive and read TFM, but still need guidance! I am asked to include some details: $ /usr/local/sbin/stunnel -version stunnel 4.10 on powerpc-apple-darwin7.7.0 PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7b 10 Apr 2003 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds $ uname -a Darwin My-Computer.local 7.7.0 Darwin Kernel Version 7.7.0: Sun Nov 7 16:06:51 PST 2004; root:xnu/xnu-517.9.5.obj~1/RELEASE_PPC Power Macintosh powerpc $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1640)

2 1

[Newbie] Set up question
by retrocool 30 Apr '05

30 Apr '05

I have compiled and installed stunnel 4.10 under Mac OS X 10.3. I want to set up stunnel to connect a non-ssl newsreader client to an ssl nntp server. The newsreader client is Unison and the server is Easynews SSL server. I don't really know how to do this. I wonder if anyone can point me in the right direction. Thanks Geoff ___________ PS I did various searches of the list archive and read TFM, but still need guidance! I am asked to include some details: $ /usr/local/sbin/stunnel -version stunnel 4.10 on powerpc-apple-darwin7.7.0 PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7b 10 Apr 2003 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds $ uname -a Darwin My-Computer.local 7.7.0 Darwin Kernel Version 7.7.0: Sun Nov 7 16:06:51 PST 2004; root:xnu/xnu-517.9.5.obj~1/RELEASE_PPC Power Macintosh powerpc $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1640)

1 0

ldaps error "unknown protocol"
by Mike Partyka 29 Apr '05

29 Apr '05

Hello, Description of problem is as follows: I have a email server package called Scalix, which when installed came with openldap. On the same server i am also running Stunnel, which is already successfully ssl wrapping imap,pop, and smtp protocols. The ldap directory is very handy for an address book internally but we also have people that will be outside the corporate lan and to provide the directory securely would be desirable so i added the lines in the stunnel.conf to wrap ldap as well. I can see the stunnel daemon listening on port 636. But when i try to connect from any ssl aware mail client, such as evolution, or entourage, i get an error indicating failure to authenticate, which i know is not really the problem because the ldap directory is anonymous read access enabled. Debug logging gives more information about what is occurring, here is the conversion when attempting to connect: 2005.04.28 12:15:05 LOG5[27926:1076812720]: ldaps connected from 71.4.124.200:43012 2005.04.28 12:15:05 LOG7[27926:1076812720]: SSL state (accept): before/accept initialization 2005.04.28 12:15:05 LOG7[27926:1076812720]: waitforsocket: FD=14, DIR=read 2005.04.28 12:15:05 LOG7[27926:1076812720]: waitforsocket: ok 2005.04.28 12:15:05 LOG3[27926:1076812720]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2005.04.28 12:15:05 LOG7[27926:1076812720]: ldaps finished (6 left) Searching the archive is saw someone suggesting that either the ldap server or ldap client was not compiled with ssl support. I know the email clients i am trying to connect with are ssl compatible and maybe someone can set me straight here but i didn't think that the ldap server had to be ssl aware and that was the advantage of stunnel is that it can wrap services that are do not have ssl support? At any rate i believe the ldap server does have ssl support becuase i can see the binary omslapd (provided by Scalix, preceding "om" is there because Scalix is based on HP's Open Mail) links to the ssl library using the ldd command, here is the output, note the bolded line: msp1intmx01:~ # ldd /opt/scalix/bin/omslapd linux- gate.so.1 => (0xffffe000) libom_er.so => /opt/scalix/lib/libom_er.so (0x40018000) libom_ext.so => /opt/scalix/lib/libom_ext.so (0x40023000) libom_ldapth.so => /opt/scalix/lib/libom_ldapth.so (0x4002d000) libom_mdc.so => /opt/scalix/lib/libom_mdc.so (0x4004f000) libom_omldap.so => /opt/scalix/lib/libom_omldap.so (0x4005c000) libom_os.so => /opt/scalix/lib/libom_os.so (0x40079000) libom_sdl.so => /opt/scalix/lib/libom_sdl.so (0x40087000) libom_str.so => /opt/scalix/lib/libom_str.so (0x4008e000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x400a9000) libc.so.6 => /lib/tls/libc.so.6 (0x400b9000) libom_cvc.so => /opt/scalix/lib/libom_cvc.so (0x401ce000) libom_go.so => /opt/scalix/lib/libom_go.so (0x401e2000) libom_t61.so => /opt/scalix/lib/libom_t61.so (0x401e6000) libom_tfl.so => /opt/scalix/lib/libom_tfl.so (0x401eb000) libom_gcl.so => /opt/scalix/lib/libom_gcl.so (0x401f1000) libom_ccs.so => /opt/scalix/lib/libom_ccs.so (0x401f5000) libdl.so.2 => /lib/libdl.so.2 (0x40203000) libom_cl.so => /opt/scalix/lib/libom_cl.so (0x40206000) libom_cust.so => /opt/scalix/lib/libom_cust.so (0x40215000) libom_da.so => /opt/scalix/lib/libom_da.so (0x4021c000) libom_dit.so => /opt/scalix/lib/libom_dit.so (0x40244000) libom_dr.so => /opt/scalix/lib/libom_dr.so (0x4024a000) libom_hash.so => /opt/scalix/lib/libom_hash.so (0x4027b000) libom_lng.so => /opt/scalix/lib/libom_lng.so (0x4027e000) libom_mes.so => /opt/scalix/lib/libom_mes.so (0x40282000) libom_mim.so => /opt/scalix/lib/libom_mim.so (0x4028a000) libom_ml.so => /opt/scalix/lib/libom_ml.so (0x4029d000) libom_pam.so => /opt/scalix/lib/libom_pam.so (0x402a6000) libom_pwdl.so => /opt/scalix/lib/libom_pwdl.so (0x402b4000) libom_ul.so => /opt/scalix/lib/libom_ul.so (0x402b9000) libom_uni.so => /opt/scalix/lib/libom_uni.so (0x402cc000) libom_im.so => /opt/scalix/lib/libom_im.so (0x402e3000) libom_sfl.so => /opt/scalix/lib/libom_sfl.so (0x402ee000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x4030c000) libom_sml.so => /opt/scalix/lib/libom_sml.so (0x4033d000) libom_tfo.so => /opt/scalix/lib/libom_tfo.so (0x40340000) libom_enc.so => /opt/scalix/lib/libom_enc.so (0x40343000) libom_lkf.so => /opt/scalix/lib/libom_lkf.so (0x40347000) libom_nm.so => /opt/scalix/lib/libom_nm.so (0x4034b000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) libom_uscv.so => /opt/scalix/lib/libom_uscv.so (0x40352000) libom_fstr.so => /opt/scalix/lib/libom_fstr.so (0x4035a000) libom_gen.so => /opt/scalix/lib/libom_gen.so (0x4035c000) libom_xdse.so => /opt/scalix/lib/libom_xdse.so (0x40362000) libom_acl.so => /opt/scalix/lib/libom_acl.so (0x40365000) libom_cdl.so => /opt/scalix/lib/libom_cdl.so (0x4036c000) libom_drsc.so => /opt/scalix/lib/libom_drsc.so (0x40374000) libom_inet.so => /opt/scalix/lib/libom_inet.so (0x40379000) libom_vi.so => /opt/scalix/lib/libom_vi.so (0x40388000) libom_akt.so => /opt/scalix/lib/libom_akt.so (0x40399000) libom_q.so => /opt/scalix/lib/libom_q.so (0x403a1000) libom_date.so => /opt/scalix/lib/libom_date.so (0x403a6000) libom_ssn.so => /opt/scalix/lib/libom_ssn.so (0x403a8000) libom_orname.so => /opt/scalix/lib/libom_orname.so (0x403ac000) libom_culb.so => /opt/scalix/lib/libom_culb.so (0x403af000) libom_dstring.so => /opt/scalix/lib/libom_dstring.so (0x403b3000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0x403b6000) libom_ufcv.so => /opt/scalix/lib/libom_ufcv.so (0x403e7000) libom_vista.so => /opt/scalix/lib/libom_vista.so (0x4040d000) libom_rda.so => /opt/scalix/lib/libom_rda.so (0x40439000) libom_rdudp.so => /opt/scalix/lib/libom_rdudp.so (0x4043e000) libom_rsl.so => /opt/scalix/lib/libom_rsl.so (0x40444000) libom_mp.so => /opt/scalix/lib/libom_mp.so (0x40456000) libom_mpl.so => /opt/scalix/lib/libom_mpl.so (0x4045e000) libom_msg.so => /opt/scalix/lib/libom_msg.so (0x40466000) libom_qml.so => /opt/scalix/lib/libom_qml.so (0x4046c000) libom_tf.so => /opt/scalix/lib/libom_tf.so (0x40471000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0x4047b000) libom_fmem.so => /opt/scalix/lib/libom_fmem.so (0x4056b000) libom_acf.so => /opt/scalix/lib/libom_acf.so (0x40570000) libom_cvr.so => /opt/scalix/lib/libom_cvr.so (0x40575000) libom_ct.so => /opt/scalix/lib/libom_ct.so (0x40589000) libom_bb.so => /opt/scalix/lib/libom_bb.so (0x405cc000) libom_rtfl.so => /opt/scalix/lib/libom_rtfl.so (0x405e1000) libom_isl.so => /opt/scalix/lib/libom_isl.so (0x405f2000) libom_nf.so => /opt/scalix/lib/libom_nf.so (0x405fc000) libom_nfda.so => /opt/scalix/lib/libom_nfda.so (0x40602000) libom_nsl.so => /opt/scalix/lib/libom_nsl.so (0x40607000) libom_exual.so => /opt/scalix/lib/libom_exual.so (0x4060d000) Stunnel version information is as follows: stunnel 4.05 on i686-suse-linux-gnu PTHREAD with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Stunnel is running in stand-alone mode and is being started without any parameters that i am aware of, i just used the init script supplied SuSE for their Enterprise 9 server product. Output of "stunnel -f -D 7 is: msp1intmx01:~ # stunnel -f -D 7 2005.04.29 08:27:24 LOG3[3326:1076392064]: -f: No such file or directory (2) Output of "stunnel -V is: msp1intmx01:~ # stunnel -V 2005.04.29 08:30:49 LOG3[3368:1076392064]: -V: No such file or directory (2) Output of "uname -a" msp1intmx01:~ # uname -a Linux msp1intmx01 2.6.5-7.151-smp #1 SMP Fri Mar 18 11:31:21 UTC 2005 i686 i686 i386 GNU/Linux Libc version is 2.3.3 Output of "gcc -v" msp1intmx01:~ # gcc -v Reading specs from /usr/lib/gcc-lib/i586-suse-linux/3.3.3/specs Configured with: ../configure --enable-threads=posix -- prefix=/usr --with-local-prefix=/usr/local -- infodir=/usr/share/info --mandir=/usr/share/man --enable- languages=c,c++,f77,objc,java,ada --disable-checking -- libdir=/usr/lib --enable-libgcj --with-gxx-include- dir=/usr/include/g++ --with-slibdir=/lib --with-system-zlib -- enable-shared --enable-__cxa_atexit i586-suse-linux Thread model: posix gcc version 3.3.3 (SuSE Linux) Openssl version is: msp1intmx01:~ # openssl version OpenSSL 0.9.7d 17 Mar 2004 Regards, -- Michael W. Partyka Jumpnode Systems, LLC Systems Administrator 612.605.5056 Desk 651.208.5734 Cell

1 0

stunnel with pop-3 over SSL, port 995?
by conover＠rahul.net 27 Apr '05

27 Apr '05

Can stunnel be used to connect to a pop-3 over SSL server on port 995? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

1 0

SIGSEGV in init_ssl stunnel 4.10 on solaris 8
by Toni Schmidbauer 27 Apr '05

27 Apr '05

hi, we've got the following problem: - compiled stunnel 4.10 with openssl-0.9.7g - stunnel receives a SIGSEGV when connecting i am really not a C or gdb guru, but running stunnel 4.10 under gdb shows this: # gdb src/stunnel GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.8"... (gdb) set args /usr/local/stunnel-4.10/etc/stunnel/stunnel.conf (gdb) run Starting program: /usr/local/src/stunnel-4.10/src/stunnel /usr/local/stunnel-4.10/etc/stunnel/stunnel.conf [New LWP 1] [New LWP 2] [New LWP 3] [New LWP 4] Program received signal SIGSEGV, Segmentation fault. 0x0002a32c in init_ssl (c=0x11e008) at client.c:298 298 s_poll_add(&c->fds, c->ssl_rfd->fd, (gdb) bt #0 0x0002a32c in init_ssl (c=0x11e008) at client.c:298 #1 0x00029f30 in do_client (c=0x11e008) at client.c:147 #2 0x00029dd8 in client (arg=0x126270) at client.c:120 (gdb) p c->ssl_rfd $1 = (FD *) 0x1 (gdb) so it seems c->ssl_rfd points to nowhere. further investigation reveals that c->ssl_rfd gets overwritten after the call to SSL_accept. stunnel 4.09 works. is this a problem with UCONTEXT? ************************************************************************ information as request on the support page: openssl version: OpenSSL 0.9.7g 11 Apr 2005 uname -a: SunOS coti 5.8 Generic_117350-05 sun4u sparc SUNW,UltraAX-i2 gcc -v: Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.8/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls --disable-libgcj --enable-languages=c,c++ Thread model: posix gcc version 3.3.2 stunnel log with debug=7: 2005.04.27 08:41:33 LOG5[24386:1]: stunnel 4.10 on sparc-sun-solaris2.8 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.04.27 08:41:33 LOG7[24386:1]: RAND_status claims sufficient entropy for the PRNG 2005.04.27 08:41:33 LOG6[24386:1]: PRNG seeded successfully 2005.04.27 08:41:33 LOG7[24386:1]: Configuration SSL options: 0x00000FFF 2005.04.27 08:41:33 LOG7[24386:1]: SSL options set: 0x00000FFF 2005.04.27 08:41:33 LOG7[24386:1]: Certificate: /usr/local/stunnel-4.10/etc/stunnel/stunnel.pem 2005.04.27 08:41:33 LOG7[24386:1]: Key file: /usr/local/stunnel-4.10/etc/stunnel/stunnel.pem 2005.04.27 08:41:33 LOG6[24386:1]: file ulimit = 256 (can be changed with 'ulimit -n') 2005.04.27 08:41:33 LOG6[24386:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.04.27 08:41:33 LOG5[24386:1]: 125 clients allowed 2005.04.27 08:41:33 LOG7[24386:1]: FD 5 in non-blocking mode 2005.04.27 08:41:33 LOG7[24386:1]: FD 6 in non-blocking mode 2005.04.27 08:41:33 LOG7[24386:1]: FD 7 in non-blocking mode 2005.04.27 08:41:33 LOG7[24386:1]: SO_REUSEADDR option set on accept socket 2005.04.27 08:41:33 LOG7[24386:1]: https bound to 0.0.0.0:443 2005.04.27 08:41:33 LOG7[24386:1]: Created pid file /usr/local/stunnel-4.10/var/stunnel/stunnel.pid 2005.04.27 08:41:33 LOG7[24386:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.04.27 08:41:35 LOG7[24386:0]: CONTEXT 1, FD=5, (IN)->() 2005.04.27 08:41:35 LOG7[24386:0]: CONTEXT 1, FD=7, (IN)->(IN) 2005.04.27 08:41:35 LOG7[24386:1]: https accepted FD=9 from 162.25.222.252:35728 2005.04.27 08:41:35 LOG7[24386:1]: Creating a new context 2005.04.27 08:41:35 LOG7[24386:1]: Context 2 created 2005.04.27 08:41:35 LOG7[24386:2]: https started 2005.04.27 08:41:35 LOG7[24386:2]: FD 9 in non-blocking mode 2005.04.27 08:41:35 LOG5[24386:2]: https connected from 162.25.222.252:35728 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): before/accept initialization 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 read client hello A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 write server hello A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 write certificate A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 write server done A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 flush data ************************************************************************ thanks for your time and help regards toni -- Wer es einmal so weit gebracht hat, dass er nicht | toni at stderror dot at mehr irrt, der hat auch zu arbeiten aufgehoert | Toni Schmidbauer -- Max Planck |

1 1

stunnel crash when multiple connections
by Debin Chen 27 Apr '05

27 Apr '05

Hi, I will appreciate greatly if you can diagnose the following crash problem: I am using stunnel 4.05, working with webserver thttpd to provide a https solution, in linux environment. First I wrote down some noticeable behavior of stunnel. 1) stunnel each time spawns a thread to handle the https connection then destroy the thread. If I browse a lot of pages, then internally a lot of thread ( or process) got created and destroyed. 2) Sometimes after a https request is completed, the thread is still there. Only following request will trigger the thread got destroyed. Normally if there is no activity, just 2 threads left. The problem: During some stress testing, such as multiple ( in my case, actually just 2 or 3) web browser simultaneously issues request to the web server in https, I found out in certain moment stunnel spawns more than 5 or 6 threads to handle the connections, sometimes it crashed without giving out any serious debug error messages. When it crashed, system resource of CPU and memory is still sufficient. Note than I already set timeoutclose=0, that should be done. Best Regards Debin Chen ======================================== Advanced Storage Division Promise Technology, Inc. 580 Cottonwood Drive, Milpitas, CA 95035 Tel: 408-228-1529 CONFIDENTIALITY NOTICE: The information contained in or attached to this email message is either proprietary and/or confidential information, or information intended solely for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by email and delete the original message from your computer/server with confirmation to us that you have done so. Thank you.

1 0

connect directly to unix domain socket?
by Marty Lamb 25 Apr '05

25 Apr '05

Hello, Sorry for the newb question, but I've done quite a bit of searching and haven't found a definitive answer either way - and I doubt I'm the first to ask about this. Is there any way to connect an incoming connection directly to a unix domain socket? Some sort of service level option like: connect = /path/to/socket would be ideal, and hopefully I'm just missing something in the docs. If this is not available, I can just exec socat - but that seems like an unnecessary step. Thanks much, Marty

1 0

Newbie question
by Rick Kubowic 25 Apr '05

25 Apr '05

I'm trying to implement a secure TCP tunnel from one PC to another. I've been looking for quite some time and can't seem to find the problem. I've been following the following example of how to start a server service: stunnel -p /path/to/stunnel.pem -d pop3s -r bar:pop3 I've created a generic certificate, but I get the error: Failed to open configuration file -p What am I doing wrong?? Rick Kubowicz ITG Canada Corp. 416-874-0834

2 1

Mailing list web interface
by Michal Trojnara 24 Apr '05

24 Apr '05

Dear Users, I'm glad to announce that mirt.net server is now fully moved to the new location. I hope you'll enjoy the speed. 8-) The mailing list management web interface is operational, again. Best regards, Mike

1 0

Stunnel 4.10 released
by Michal Trojnara 23 Apr '05

23 Apr '05

Here is the ChangeLog entry: Version 4.10, 2005.04.23, urgency: LOW/EXPERIMENTAL: * DLLs for OpenSSL 0.9.7g. * Bugfixes - Missing locking on Win32 platform was added (thx to Yi Lin <yi.lin(a)convergys.com>) - Some problems with closing SSL fixed. * New features - New UCONTEXT user-level non-preemptive threads model is used on systems that support SYSV-compatible ucontext.h. - Improved stunnel3 script with getopt-compatible syntax. * Release notes - This version should be thoroughly tested before using it in the mission-critical environment. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

Patch: Windows version of stunnel 4.09 is not thread-safe
by yi.lin＠convergys.com 23 Apr '05

23 Apr '05

We have been using stunnel on Windows as a SSL proxy to connect to HTTPS server but stunnel kept crashing randomly under load. After some investigation, we found the following: according to OpenSSL document (http://www.openssl.org/docs/crypto/threads.html), "OpenSSL can safely be used in multi-threaded applications provided that at least two callback functions are set. locking_function(int mode, int n, const char *file, int line) is needed to perform locking on shared data structures. (Note that OpenSSL uses a number of global data structures that will be implicitly shared whenever multiple threads use OpenSSL.) Multi-threaded applications will crash at random if it is not set. " The original stunnel package only implements a POSIX Pthread version of locking callback functions, but doesn't provide any implementation for Windows. This has caused random crashes during our testing because the way we use stunnel requires frequent creation/destruction of threads and stunnel is not thread-safe without the locking callbacks. The attached fix attempts to address the problem by implementing the Windows version of locking callbacks using Windows native CRITICAL_SECTION object. =============================================================================================================================== *** sthreads.c Fri Dec 31 02:55:40 2004 --- sthreads_w32.c Thu Apr 14 08:29:07 2005 *************** *** 121,126 **** --- 121,127 ---- #ifdef USE_WIN32 CRITICAL_SECTION stunnel_cs[CRIT_SECTIONS]; + static CRITICAL_SECTION lock_cs[CRYPTO_NUM_LOCKS]; void enter_critical_section(SECTION_CODE i) { EnterCriticalSection(stunnel_cs+i); *************** *** 130,141 **** --- 131,161 ---- LeaveCriticalSection(stunnel_cs+i); } + static void locking_callback(int mode, int type, + #ifdef HAVE_OPENSSL + const /* Callback definition has been changed in openssl 0.9.3 */ + #endif + char *file, int line) { + if(mode&CRYPTO_LOCK) + EnterCriticalSection(lock_cs+type); + else + LeaveCriticalSection(lock_cs+type); + } + + void sthreads_init(void) { int i; /* Initialize stunnel critical sections */ for(i=0; i<CRIT_SECTIONS; i++) InitializeCriticalSection(stunnel_cs+i); + + /* Initialize OpenSSL locking callback */ + for(i=0; i<CRYPTO_NUM_LOCKS; i++) + InitializeCriticalSection(lock_cs+i); + CRYPTO_set_locking_callback(locking_callback); + + } unsigned long stunnel_process_id(void) { (See attached file: sthread_diff) Yi Lin Convergys Corporation yi.lin(a)convergys.com (703)885-5767 -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

2 1

connection refsed (111)
by RAJADURAI D 20 Apr '05

20 Apr '05

hi I am trying to connect using mysql, there are no fw between the 2 boxes. I tested with stunnel latest version 4.08 in red hat 9,it shows the last message as connection refused (111) after the cipher negotiation Any ideas on how to solve this error plz help me, to short out this problem ? i am using ==> Stunnel 4.08 redhat 9 Kernel 2.4.20-8 mysql Ver 11.18 Distrib 3.23.54,for redhat-linux-gnu(i386) I am using stunnel.pem generated while installing stunnel 4.08 SERVER SIDE [root@scorpion src]# ./stunnel 2005.03.30 12:23:19 : stunnel with OpenSSL 0.9.7a Feb 19 2003 2005.03.30 12:23:19 : Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.03.30 12:23:19 : Key file: /usr/local/etc/stunnel/stunnel.pem 2005.03.30 12:23:19 : 500 clients allowed 2005.03.30 12:23:19 : SO_REUSEADDR option set on accept socket 2005.03.30 12:23:19 : mysqls bound to 0.0.0.0:3307 2005.03.30 12:23:19 : Created pid file /stunnel.pid 2005.03.30 12:27:01 : mysqls accepted FD=7 from 192.168.2.175:33091 2005.03.30 12:27:01 : mysqls started 2005.03.30 12:27:01 : mysqls connected from 192.168.2.175:33091 2005.03.30 12:27:01 : SSL state (accept): before/accept initialization 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read client hello A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write server hello A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write certificate A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write server done A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 flush data 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read client key exchange A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read finished A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write change cipher spec A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write finished A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 flush data 2005.03.30 12:27:01 : 1 items in the session cache 2005.03.30 12:27:01 : 0 client connects (SSL_connect()) 2005.03.30 12:27:01 : 0 client connects that finished 2005.03.30 12:27:01 : 0 client renegotiatations requested 2005.03.30 12:27:01 : 1 server connects (SSL_accept()) 2005.03.30 12:27:01 : 1 server connects that finished 2005.03.30 12:27:01 : 0 server renegotiatiations requested 2005.03.30 12:27:01 : 0 session cache hits 2005.03.30 12:27:01 : 0 session cache misses 2005.03.30 12:27:01 : 0 session cache timeouts 2005.03.30 12:27:01 : SSL accepted: new session negotiated 2005.03.30 12:27:01 : Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.30 12:27:01 : mysqls connecting 127.0.0.1:3306 2005.03.30 12:27:01 : connect_wait: waiting 10 seconds 2005.03.30 12:27:01 : connect_wait: getsockopt: Connection refused (111) 2005.03.30 12:27:01 : Failed to initialize remote connection 2005.03.30 12:27:01 : mysqls finished (0 left) ====================================================== CLIENT SIDE [root@redhat src]# ./stunnel 2005.03.30 23:24:42 LOG5[7383:1075999904]: stunnel 4.08 on i686-pc-linux-gnu PTH READ+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2005.03.30 23:24:42 LOG7[7383:1075999904]: RAND_status claims sufficient entropy for the PRNG 2005.03.30 23:24:42 LOG6[7383:1075999904]: PRNG seeded successfully 2005.03.30 23:24:42 LOG7[7383:1075999904]: Certificate: /usr/local/etc/stunnel/s tunnel.pem 2005.03.30 23:24:42 LOG7[7383:1075999904]: Key file: /usr/local/etc/stunnel/stun nel.pem 2005.03.30 23:24:42 LOG6[7383:1075999904]: file ulimit = 1024 (can be changed wi th 'ulimit -n') 2005.03.30 23:24:42 LOG6[7383:1075999904]: poll() used - no FD_SETSIZE limit for file descriptors 2005.03.30 23:24:42 LOG5[7383:1075999904]: 500 clients allowed 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 4 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 5 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 6 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: SO_REUSEADDR option set on accept soc ket 2005.03.30 23:24:42 LOG7[7383:1075999904]: mysqls bound to 0.0.0.0:3306 2005.03.30 23:24:42 LOG7[7383:1075999904]: Created pid file /stunnel.pid 2005.03.30 23:32:19 LOG7[7383:1075999904]: mysqls accepted FD=7 from 127.0.0.1:3 3090 2005.03.30 23:32:19 LOG7[7383:1075999904]: FD 7 in non-blocking mode 2005.03.30 23:32:19 LOG7[7383:1076067520]: mysqls started 2005.03.30 23:32:20 LOG5[7383:1076067520]: mysqls connected from 127.0.0.1:33090 2005.03.30 23:32:20 LOG7[7383:1076067520]: FD 8 in non-blocking mode 2005.03.30 23:32:20 LOG7[7383:1076067520]: mysqls connecting 192.168.2.210:3307 2005.03.30 23:32:20 LOG7[7383:1076067520]: connect_wait: waiting 10 seconds 2005.03.30 23:32:20 LOG7[7383:1076067520]: connect_wait: connected 2005.03.30 23:32:20 LOG7[7383:1076067520]: Remote FD=8 initialized 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): before/connect initialization 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write client hello A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server hello A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server certificate A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server done A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write client key exchange A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write finished A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 flush data 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read finished A 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 items in the session cache 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 client connects (SSL_connect()) 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 client connects that finished 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 client renegotiatations requeste d 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server connects (SSL_accept()) 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server connects that finished 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server renegotiatiations request ed 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache hits 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache misses 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache timeouts 2005.03.30 23:32:20 LOG6[7383:1076067520]: SSL connected: new session negotiated 2005.03.30 23:32:20 LOG6[7383:1076067520]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.30 23:32:20 LOG3[7383:1076067520]: SSL_read: Connection reset by peer (1 04) 2005.03.30 23:32:20 LOG5[7383:1076067520]: Connection reset: 0 bytes sent to SSL , 0 bytes sent to socket 2005.03.30 23:32:20 LOG7[7383:1076067520]: mysqls finished (0 left) RUNNING mysqL IN AN SEPARATE TERMINAL [root@redhat bharathi]# mysql -h 127.0.0.1 -u anirudh -p Enter password: ERROR 2013: Lost connection to MySQL server during query

2 2

Disabling IPv6
by Punitha 20 Apr '05

20 Apr '05

Hello Everyone !! I need to build Stunnel-4.09 in HP-UX11.11 without the support of IPv6. I did not use --enable-ipv6 option. In the configure log I could see the reference of getaddrinfo and getnameinfo functions. Is that refers any of the system file or the function defined in the souce code? I used `nm stunnel | grep getaddrinfo` and it shows the following. $ nm stunnel | grep getaddrinfo getaddrinfo | |undef |code | getaddrinfo | 118768|uext |stub | $ I need to confirm the source(from where they are taken) of getaddrinfo and getnameinfo functions. Is that related with the support of ipv6 in any way? Any of you please make me clear. Thanx in ADVANCE. Regards, Punitha.

2 1

Disabling IPv6
by Punitha 20 Apr '05

20 Apr '05

Hello Everyone !! I need to build Stunnel-4.09 in HP-UX11.11 without the support of IPv6. I did not use --enable-ipv6 option. In the configure log I could see the reference of getaddrinfo and getnameinfo functions. Is that refers any of the system file or the function defined in the souce code? I used `nm stunnel | grep getaddrinfo` and it shows the following. $ nm stunnel | grep getaddrinfo getaddrinfo | |undef |code | getaddrinfo | 118768|uext |stub | $ I need to confirm the source(from where they are taken) of getaddrinfo and getnameinfo functions. Is that related with the support of ipv6 in any way? Any of you please make me clear. Thanx in ADVANCE. Regards, Punitha.

1 0

Reporting problems
by Michal Trojnara 19 Apr '05

19 Apr '05

Dear Users, Please stop reporting problems with obsolete versions of stunnel. You should always upgrade to the latest stunnel and OpenSSL first, than repeat your tests and report a problem. Best regards, Mike

2 1

Stunnel - Transfer loop executes not transferring any data.
by Michel Esber 19 Apr '05

19 Apr '05

Hello All, I am running a proprietary daemon on port 443 that accepts incoming connections. We are experiencing problems when activating stunnel on our production box. Everytime that we run our daemon with stunnel, our CPU and memory/swap area consumption is extremely intensive. Each stunnel process consumes approximately 37Mb of RSS memory. I have browsed through my logs and here is what I found: 2005.04.18 14:35:00 LOG3[15242:1245336]: transfer() loop executes not transferring any data 2005.04.18 14:35:06 LOG3[15242:1245336]: please report the problem to Michal.Trojnara(a)mirt.net 2005.04.18 14:35:06 LOG3[15242:1245336]: socket open rd=yes wr=yes, ssl open rd=yes wr=yes 2005.04.18 14:35:06 LOG3[15242:1245336]: socket ready rd=no wr=no, ssl ready rd=no wr=no 2005.04.18 14:35:06 LOG3[15242:1245336]: check_SSL_pending=0, ssl_closing=0 2005.04.18 14:35:06 LOG5[15242:1245336]: Connection reset: 258 bytes sent to SSL, 153319 bytes sent to socket Some details: a) My configuration file: [https] accept = 443 exec = /path/to/daemon execargs = daemon -ssl stunnel 4.07 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.6b [engine] 9 Jul 2001 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds b) glibc-2.2.4-31.7 glibc-devel-2.2.4-32.8 libcap-1.10-6 glibc-common-2.2.4-31.7 c) uname -a Linux myserver 2.4.9-e.57enterprise #1 SMP Thu Dec 2 20:45:51 EST 2004 i686 unknown d) gcc -v gcc version 2.96 20000731 (Red Hat Linux 7.2 2.96-118.7.2) e) openssl version OpenSSL 0.9.6b [engine] 9 Jul 2001 Can anyone shred some light? I believe I should upgrade some of my core components (gcc / openssl). I just need to make sure this is the right direction. Thanks in advance, X------------------- Michel Esber MCSE, MCSA, MCDBA Automatos - www.automatos.com US: 1 (866) 2293584

2 1

stunnel generating defuncts
by Serxio Barral 19 Apr '05

19 Apr '05

Hi there! I'm using stunnel as client with SuSE SLES 8. Usually after several days working OK (up to two weeks) it begins to generate defunct processes for every transfer. At first, stunnel version was 3.14 (the one that comes out of the box with SLES 8), but now I have downloaded an compiled 3.26 and it just happens the same. killing stunnel won't help, since relaunching it again turns on generating defuncts. Situation does not come back to normal until rebooting the server. Any hint on this issue? Thanks in advance, Serxio Barral.

1 0

stunnel generating defuncts
by SERXIO BARRAL PAN/ Generali-España 19 Apr '05

19 Apr '05

Hi there! I'm using stunnel as client with SuSE SLES 8. Usually after several days working OK (up to two weeks) it begins to generate defunct processes for every transfer. At first, stunnel version was 3.14 (the one that comes out of the box with SLES 8), but now I have downloaded an compiled 3.26 and it just happens the same. killing stunnel won't help, since relaunching it again turns on generating defuncts. Situation does not come back to normal until rebooting the server. Any hint on this issue? Thanks in advance, Serxio Barral.

1 0

Please Help! I keep getting the same error.
by Theodore W. Hildebrandt 11 Apr '05

11 Apr '05

Refer to my submission of 03/24/05: "error:1408F10B:SSL . . . " I had hoped that someone would tell me how to get around this error, but no message has appeared in the stunnel Archive. I have now ftp'd version 4.09 and tried it, with the same results. I wait and wait for a connection, and finally interrupt the process, since it's not going anywhere. And then I get the "error:1408F10B. . ." message in the stunnel log. Since I seem to be able to send e-mail from my old Pentium II computer (Windows 98SE) I'm, using it so send this message. [Note that I can still receive e-mail on the new Dell Pentium IV machine (Windows XP Home). I just can't send anything.] Doesn't anyone have answers? Ted Hildebrandt

1 0

Unexpected closed connections
by Rory Campbell-Lange 11 Apr '05

11 Apr '05

Hi Everyone We have been very happily using stunnel for about 5 months connecting a site office back to a main office, tunnelling imap connections. We are suddenly seeing lots of disconnection messages and people at a. can no longer see their mail on d. The server suffers a "socket write shutdown" condition and shuts down the associated process. We have restarted the routers and firewalls and all seems to be working fine, other than stunnel. I'd be grateful for any insight or further help. Many thanks Rory Present arrangement: a. site client | b. site server port forwarded to c. | | internet | | c. main office server port forwarded to d. | d. imap server Server b forwards imap connections securely to the main office server, which then passes on on the imap connections to the imap server. Server b connects through the following inetd line: imaph stream tcp nowait nobody /usr/sbin/stunnel /usr/sbin/stunnel -c -r server_c_address:imap We are running version 3.26 on debian: stunnel 3.26 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Server shows following disconnect messages: 2005.04.11 13:21:46 LOG7[13320:163848]: SSL alert (read): warning: close notify 2005.04.11 13:21:46 LOG7[13320:163848]: SSL closed on SSL_read 2005.04.11 13:21:46 LOG7[13320:163848]: SSL alert (write): warning: close notify 2005.04.11 13:21:46 LOG7[13320:163848]: SSL write shutdown (output buffer empty) 2005.04.11 13:21:46 LOG7[13320:163848]: Socket write shutdown (output buffer empty) 2005.04.11 13:21:46 LOG5[13320:163848]: Connection closed: 92 bytes sent to SSL, 0 bytes sent to socket 2005.04.11 13:21:46 LOG7[13320:163848]: 10.0.0.24.imap finished (6 left) Client logs: Apr 11 15:50:26 hald stunnel[4672]: server_b.imaps connected from 10.0.1.54:49301 Apr 11 15:55:05 hald stunnel[4672]: SSL_connect: Peer suddenly disconnected ... Apr 11 15:49:55 hald stunnel[4655]: 195.172.252.146.imaps connected from 10.0.1.52:49819 Apr 11 15:54:08 hald stunnel[4655]: SSL_connect: Peer suddenly disconnected -- Rory Campbell-Lange <rory(a)campbell-lange.net> <www.campbell-lange.net>

1 0

Re: [stunnel-users] Pass IP Attn: Alexander Lazic
by Tim Brown 10 Apr '05

10 Apr '05

Nope...I see Cygwin is a Linux-like environment for Windows. Can you send me the stunnel.exe that already has this patch compiled? This works for windows? thanks. ----- Original Message ----- From: "Alexander Lazic" <al-stunnel(a)none.at> To: "Tim Brown" <tbrown2376(a)adelphia.net> Sent: Sunday, April 10, 2005 12:06 PM Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic > On Son 10.04.2005 10:24, Tim Brown wrote: >>Al....not following how to do this from Windows..cmd prompt? > > Don't you use cygwin? > > al ;-) > >>From: "Alexander Lazic" <al-stunnel(a)none.at> >>To: "Tim Brown" <tbrown2376(a)adelphia.net> >>Cc: <stunnel-users(a)mirt.net> >>Sent: Sunday, April 10, 2005 4:28 AM >>Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic >> >> >>>On Son 10.04.2005 00:33, Tim Brown wrote: >>>>Al...how do I install this patch? ...I running stunnel 4.07 >>> >>>Have you ever used the program 'patch'? >>> >>>>Thanks for your help. >>> >>>get stunnel-4.07.tar.gz >>>extract stunnel-4.07.tar.gz >>>get the patch >>>call patch -p0 < the_patch_file >>> >>>al ;-) >>> >>>>From: "Alexander Lazic" <al-stunnel(a)none.at> >>>>To: <tbrown2376(a)adelphia.net> >>>>Cc: <stunnel-users(a)mirt.net> >>>>Sent: Saturday, April 09, 2005 3:54 AM >>>>Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic >>>> >>>> >>>>>Hi, >>>>> >>>>>On Fre 08.04.2005 12:48, tbrown2376(a)adelphia.net wrote: >>>>>>Attn: Alexander Lazic >>>>>> >>>>>>Can you please send me the patch for: >>>>>>patch for HTTP => X-Forwarded-For Header >>>>>> >>>>>>to: tbrown2376(a)adelphia.net >>>>> >>>>>You can get it from: >>>>> >>>>>http://stunnel.mirt.net/pipermail/stunnel-users/2005-February/000331.html >>>>> >>>>>or you can wait for monday, then i can send you the patch. >>>>> >>>>>al ;-) >>>>> >>>>_______________________________________________ >>>>stunnel-users mailing list >>>>stunnel-users(a)mirt.net >>>>http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >>_______________________________________________ >>stunnel-users mailing list >>stunnel-users(a)mirt.net >>http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

stunnel 4.09 error message-- s_poll_wait:invalid argurment <WSAEINVAL> <10022>
by Ed Huckins 10 Apr '05

10 Apr '05

Occurs when I upgraded from stunnel 4.08 to 4.09. Using OpenSSL 0.9.7f . Stunnel.conf looks like # We're running as a client to SSLify the POP & IMAP connections client=yes # POP3 service, listens on localhost:11110 [dslx-pop3s] accept=localhost:11110 connect=mail.dslextreme.com:995 What do I need to add when going from 4.08 to 4.09? Everything seems to work; just a reset of the connection occurs instead of a close. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0514-3, 04/10/2005 Tested on: 4/10/2005 10:40:50 AM

1 0

Pass IP Attn: Alexander Lazic
by tbrown2376＠adelphia.net 10 Apr '05

10 Apr '05

Attn: Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-)

3 4

Pass IP Attn: Alexander Lazic
by Tim Brown 09 Apr '05

09 Apr '05

Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-) Tim Brown VP Network Services Florida Telco Credit Union Ph: 904.723.6315 Toll Free: 800.342.2352 ext. 6315 Fax: 904.722.6615 <mailto:[email protected]> tbrown(a)floridatelco.org Confidentiality Notice: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately delete this message and attachments (including all copies) and notify the sender by return e-mail or by phone at 904.723.6300.

3 3

stunnel and NNTP on windows - best practices
by Sir Thanksalot 08 Apr '05

08 Apr '05

Hi all, I am trying to use stunnel for SSL access to a NNTP newserver and found quite a few pages that list ways of doing that. I personally am using xnews as my newsreader, and I have seen variations of the same instructions with different software (Agent, Free Agent for newsreaders, Pegasus Mail as your mail application etc.). For completeness sake, here are some of the ones that I've found - http://www.cotse.net/users/putty/ssl (for Xnews and stunnel 4.x) http://www.geocities.com/d4vidb/x_setup13.html (for Xnews and stunnel 3.x - doesn't use the stunnel.conf file necessary in stunnel 4.x) http://www.noderunner.net/~llin/old/nntp-ssl.html (for a newsreader and stunnel 3.x. It also has links to a stunnel.conf file for stunnel 4.x users) In all these instructions (whether using the stunnel 3.x commandline options or using the stunnel.conf file for stunnel 4.x), I haven't seen any instructions about creating any certificates or public/private keys or a passphrase. Also there doesn't seem to be any writeup on what algorithm actually ends up getting used or even a way to pick which algorithm to use. What's the best practise for users? Should they do anything extra? Set up key pairs? Choose a default algorithm? Thanks. -- _______________________________________________ NEW! Lycos Dating Search. The only place to search multiple dating sites at once. http://datingsearch.lycos.com

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users