- stunnel-users - stunnel.org

PEM routines:PEM_read_bio Problem
by Metal Gear 28 Feb '05

28 Feb '05

Hi all, i was configuring my syslog-ng server with stunnel and it worked fine for somedays but after that i upgraded to new SSL libraries (OpenSSL 0.9.7e) from (OpenSSL 0x0090701f) then i m getting this "stunnel[2480]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio" error (i have given the link of stunnel binary in rc.local, to start at boot time, at i get this error in logs) i m using stunnel (stunnel 4.07). Can anyone has any idea about it. Thanks (sorry for sending same message twice)

1 0

PEM routines:PEM_read_bio Problem
by Metal Gear 28 Feb '05

28 Feb '05

Hi all, i was configuring my syslog-ng server with stunnel and it worked fine for somedays but after that i upgraded to new SSL libraries (OpenSSL 0.9.7e) from (OpenSSL 0x0090701f) then i m getting this "stunnel[2480]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio" error (i have given the link of stunnel binary in rc.local, to start at boot time, at i get this error in logs) i m using stunnel (stunnel 4.07). Can anyone has any idea about it. Thanks

1 0

Stunnel 4.08 released
by Michal Trojnara 27 Feb '05

27 Feb '05

Here is the ChangeLog entry for the new stunnel 4.08: Version 4.08, 2005.02.27, urgency: LOW: * New features - New -quiet option was added to install NT service without a message box. * Bugfixes - Using $(DESTDIR) in tools/Makefile.am. - Define NI_NUMERICHOST and NI_NUMERICSERV when needed. - Length of configuration file line increased from 256B to 16KB. - Stunnel sends close_notify when a close_notify is received from SSL peer and all remaining data is sent to SSL peer. - Some fixes for bugs detected by the watchdog. * Release notes - There were many changes in the transfer() function (the main loop). This version should be thoroughly tested before using it in the mission-critical environment. Home page & downloads: http://stunnel.mirt.net/ Best regards, Mike

1 0

Help Needed
by Alexander Lazic 25 Feb '05

25 Feb '05

Hi, i have try to add the X-Forwarded-For Header, based on http://www.stunnel.org/patches/desc/xforwardedfor_jrd.html, into stunnel 4.07, but i don't come to a solution :-( I have try to add i into 'client.c => transfer()'. Please can anybody review the attached Patch and point me to the right way ;-) I'am not shure that i add the 'insert' into the right place :-( Thanx for help ;-)) al ;-)

1 1

verify =3 error with certificate client
by Humberto Morell 25 Feb '05

25 Feb '05

Hello List I have stunnel 4.7 In the messages of the list I have not seen solution to my problem. This is VERIFY ERROR ONLY MY: no cert stunnel.log in Server ################## 2005.02.25 07:55:07 LOG5[2501:1076546480]: VERIFY OK: depth=1, /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Segurmatica/OU=Agencia de Certificacion/CN=Segurmatica/emailAddress=ca(a)segurmatica.cu 2005.02.25 07:55:07 LOG4[2501:1076546480]: VERIFY ERROR ONLY MY: no cert for /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Ministerio Informatica y Comunicaciones/OU=Segurmatica/CN=Humberto Morell/emailAddress=morell(a)seg.inf.cu 2005.02.25 07:55:07 LOG7[2501:1076546480]: SSL alert (write): fatal: certificate unknown ############# stunnel.conf in Server ############## #chroot = /var/lib/stunnel/ verify = 3 CApath = /etc/stunnel/certdb # or simply use CAfile instead: #CAfile = /etc/stunnel/certs.pem CAfile = /etc/stunnel/acsegurmatica.crt #cert = /etc/stunnel/stunnel.pem cert = /etc/stunnel/certstunnel.pem ################# File in /etc/stunnel ############### certdb morell.pem stunnel.prueba.pem certstunnel.pem stunnel.conf acsegurmatica.crt morell.crt stunnel.log certclient morell.key stunnel.pem ############### Link in /etc/stunnel/certdb ############### drwxr-xr-x 2 root root 176 Feb 25 11:06 . drwx------ 4 root root 472 Feb 25 10:52 .. lrwxrwxrwx 1 root root 24 Feb 25 11:00 2307a3fe.0 -> /etc/stunnel/stunnel.pem lrwxrwxrwx 1 root root 30 Feb 25 11:01 3f5b7ca8.0 -> /etc/stunnel/acsegurmatica.crt lrwxrwxrwx 1 root root 23 Feb 25 11:03 3fb3183e.0 -> /etc/stunnel/morell.pem lrwxrwxrwx 1 root root 28 Feb 25 11:06 d14abd18.0 -> /etc/stunnel/certstunnel.pem ################# client in Windows stunnel.conf ############## client = yes cert = d:\morell.pem debug = 7 output = d:\stunnel.log [lsd] accept = 9595 connect = 10.10.1.83:9500 [ssh] accept = 2222 connect = 10.10.1.83:9522 ##################### Note: I don't use chroot I have try, but idem error with. File morell.pem only client certificate and other time file morell.pem Key private crl Certificate With verify = 2 all is ok Please help Best regards Morell

1 0

openssl - generating stunnel.pem - stunnel.cnf
by k-i-r＠web.de 24 Feb '05

24 Feb '05

Using Stunnel under Windows I want to create a certificate (stunnel.pem) with Openssl. According to FAQ the syntax for creating a certificate with Openssl is openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem I use openssl for windows (as part of apache-windows-http-server) . Where do I get the file stunnel.cnf ? Or is this file not necessary for creating a certificate ? Thanks for help, k.

3 2

Stunnel and configuration
by Bohdan Linda 22 Feb '05

22 Feb '05

Hi all, I have configured stunnel to do the client authetication, but I have some question. I have used following config: cert = /etc/certificates/server.pem - file with signed server cert and key (passwordless) chroot = /var/run/stunnel/ CAfile = /etc/certificates/certs -file where first item is my CA certificate followed by list of all client certificates sgined by my CA. setuid = nobody setgid = nogroup pid = /stunnel.pid verify = 3 This setup is working, but this seems to me very "unlogical". If I create for me "more logic" setup: cert = /etc/certificates/server.pem chroot = /var/run/stunnel/ CAfile = /etc/certificates/CA/cacert.pem - only certificate of my CA CRLfile = /etc/certificates/crls - only certificates signed by my CA I get the following error: 2005.02.22 15:15:10 LOG5[22418:81926]: VERIFY OK: depth=1, /C= ..... 2005.02.22 15:15:10 LOG4[22418:81926]: VERIFY ERROR ONLY MY: no cert for /C= The question is ... why? Why CAfile has to contain all client certificates, when clients certs are not CA? Why I cannot have separate file for CA and separate file for certificates that I want accept? If I do the similar setup in mod_ssl, the configuration works as expected. Anyway, I'am newbie to deploy stunnel, thus I would like to ask you for giving me you opinion of this configuration, caveats and possible enhancements. Thanks for any comments, Bohdan Linda

3 4

SSL_read (ERROR_SYSCALL)
by Passreality 16 Feb '05

16 Feb '05

Hi Im trying to connect using mysql, there are no fw between the 2 boxes. I tested with stunnel 3.x and 4.x but when i use the 4.0.23 mysldb it just wount work. When i use the older db it works. Any ideas on how to solve this error ? /Christian Stunnel 4.07 Kernel 2.4.18 gcc version 3.3.5 (Debian 1:3.3.5-8) mysql Ver 12.22 Distrib 4.0.23 Dist Debian Testing Im using stunnel.pem (default one) Client Log 2005.02.16 15:04:19 LOG7[2147:16384]: mysql accepted FD=10 from 217.212.4.33:40797 2005.02.16 15:04:19 LOG7[2147:16384]: FD 10 in non-blocking mode 2005.02.16 15:04:19 LOG7[2322:49154]: mysql started 2005.02.16 15:04:19 LOG7[2322:49154]: TCP_NODELAY option set on local socket 2005.02.16 15:04:19 LOG5[2322:49154]: mysql connected from 217.212.4.33:40797 2005.02.16 15:04:19 LOG7[2322:49154]: FD 13 in non-blocking mode 2005.02.16 15:04:19 LOG7[2322:49154]: mysql connecting 217.212.4.198:3307 2005.02.16 15:04:19 LOG7[2322:49154]: connect_wait: waiting 10 seconds 2005.02.16 15:04:19 LOG7[2322:49154]: connect_wait: connected 2005.02.16 15:04:19 LOG7[2322:49154]: Remote FD=13 initialized 2005.02.16 15:04:19 LOG7[2322:49154]: TCP_NODELAY option set on remote socket 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): before/connect initialization 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write client hello A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read server hello A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read server certificate A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read server done A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write client key exchange A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write change cipher spec A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write finished A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 flush data 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read finished A 2005.02.16 15:04:19 LOG7[2322:49154]: 2 items in the session cache 2005.02.16 15:04:19 LOG7[2322:49154]: 3 client connects (SSL_connect()) 2005.02.16 15:04:19 LOG7[2322:49154]: 3 client connects that finished 2005.02.16 15:04:19 LOG7[2322:49154]: 0 client renegotiatations requested 2005.02.16 15:04:19 LOG7[2322:49154]: 0 server connects (SSL_accept()) 2005.02.16 15:04:19 LOG7[2322:49154]: 0 server connects that finished 2005.02.16 15:04:19 LOG7[2322:49154]: 0 server renegotiatiations requested 2005.02.16 15:04:19 LOG7[2322:49154]: 1 session cache hits 2005.02.16 15:04:19 LOG7[2322:49154]: 0 session cache misses 2005.02.16 15:04:19 LOG7[2322:49154]: 0 session cache timeouts 2005.02.16 15:04:19 LOG6[2322:49154]: SSL connected: new session negotiated 2005.02.16 15:04:19 LOG6[2322:49154]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.02.16 15:04:19 LOG3[2322:49154]: SSL_read (ERROR_SYSCALL): Connection reset by peer (104) 2005.02.16 15:04:19 LOG5[2322:49154]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2005.02.16 15:04:19 LOG7[2322:49154]: mysql finished (0 left) Server Log 2005.02.16 15:04:51 LOG7[29786:16384]: mysql accepted FD=10 from 217.212.4.33:40798 2005.02.16 15:04:51 LOG7[29786:16384]: FD 10 in non-blocking mode 2005.02.16 15:04:51 LOG7[29814:49154]: mysql started 2005.02.16 15:04:51 LOG7[29814:49154]: TCP_NODELAY option set on local socket 2005.02.16 15:04:51 LOG5[29814:49154]: mysql connected from 217.212.4.33:40798 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): before/accept initialization 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 read client hello A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write server hello A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write certificate A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write server done A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 flush data 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 read client key exchange A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 read finished A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write change cipher spec A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write finished A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 flush data 2005.02.16 15:04:51 LOG7[29814:49154]: 1 items in the session cache 2005.02.16 15:04:51 LOG7[29814:49154]: 0 client connects (SSL_connect()) 2005.02.16 15:04:51 LOG7[29814:49154]: 0 client connects that finished 2005.02.16 15:04:51 LOG7[29814:49154]: 0 client renegotiatations requested 2005.02.16 15:04:51 LOG7[29814:49154]: 3 server connects (SSL_accept()) 2005.02.16 15:04:51 LOG7[29814:49154]: 3 server connects that finished 2005.02.16 15:04:51 LOG7[29814:49154]: 0 server renegotiatiations requested 2005.02.16 15:04:51 LOG7[29814:49154]: 1 session cache hits 2005.02.16 15:04:51 LOG7[29814:49154]: 0 session cache misses 2005.02.16 15:04:51 LOG7[29814:49154]: 1 session cache timeouts 2005.02.16 15:04:51 LOG6[29814:49154]: SSL accepted: new session negotiated 2005.02.16 15:04:51 LOG6[29814:49154]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.02.16 15:04:51 LOG7[29814:49154]: FD 13 in non-blocking mode 2005.02.16 15:04:51 LOG7[29814:49154]: mysql connecting 127.0.0.1:3306 2005.02.16 15:04:51 LOG7[29814:49154]: connect_wait: waiting 10 seconds 2005.02.16 15:04:51 LOG3[29814:49154]: connect_wait: getsockopt: Connection refused (111) 2005.02.16 15:04:51 LOG3[29814:49154]: Failed to initialize remote connection 2005.02.16 15:04:51 LOG7[29814:49154]: mysql finished (0 left) __________________________________ Do you Yahoo!? The all-new My Yahoo! - What will yours do? http://my.yahoo.com

1 0

Stunnel on Open-WRT..
by Andrew Frazer 16 Feb '05

16 Feb '05

I have got Stunnel running under Open-wrt, on a Linksys WRT54GS. However I don't seem to be able to get it to run the transparent mode.. (a) is it possible? (b) If the answer is no, would be possible to modifty either open-wrt or stunnel to make it work? Regards A.

1 0

Re: [stunnel-users] read sock return size 0 situation( it cause http web server to wait timeout for long time)
by Michal Trojnara 15 Feb '05

15 Feb '05

On 2005-01-18, at 02:43, Stanley wrote: > 1.In our case, the web server sent TCP fin,ack to stunnel > but the stunnel just sent TCP ack, so it is TCP half close. > 2.The stunnel use read() function that try to read more data from > sock_fd > but return 0(EOF) because TCP half close. > 3.At this moment, the stunnel call SSL_shutdown() function > that sent close_notify alert but a broswer(IE6 or firefox1.0) return > no message. > > I just modify stunnel 4.07 client.c to set sock_wr=0 > that will close TCP connection from stunnel to web server when read() > EOF. I'm NOT going to break SSL protocol in stunnel to support broken SSL clients. Use: TIMEOUTclose = 0 configuration option instead. Best regards, Mike

1 0

multiple stunnel client
by Manila, Dinesh - Contractor 15 Feb '05

15 Feb '05

Hi, I am working in a project, whereas the EMS application need to be secured while communicating with NE. To make it secure, we have decided to go with stunnel and openSSL. I have following questions while using stunnel in my application: 1. I read that stunnel limits the number of clients to be connected to 125. Can I increase this number. If so, by increasing this number, what is the implication in performance of stuunel. 2. Since my EMS is capable of managing more than 1000 NEs, I would want to have multiple stunnel client running on the same workstation. Is this possible to have multiple stuunel process running on the same server. if so, how should my stunnle.conf file look like. I appreciate greatly, If I could get the answers for the above queries. Thanks and Regards, Dinesh Wipro Technologies. Bangalore.

2 1

Multiple listeners with just one instance of Stunnel?
by Michael Zarlenga 15 Feb '05

15 Feb '05

It doesn't seem possible to start 1 instance of Stunnel for multiple accept ports. Judging by the format of the Stunnel configuration file, it seems that I need to 1 instance of Stunnel for each port that accepts connections from the outside world. Is this true?

3 6

HELP!!! Problem uploading files
by Bhavesh Patel 14 Feb '05

14 Feb '05

Hi all, I'm using stunnel verstion 4.05 and openssl 0.9.7d. When trying to upload a large file say 1Meg I always get the following: 2005.01.27 14:30:40 LOG7[72667165:0]: stunnel accepted FD=0 from 136.157.232.120:3372 2005.01.27 14:30:40 LOG7[72667165:0]: FD 0 in non-blocking mode 2005.01.27 14:30:40 LOG7[79306780:0]: stunnel started 2005.01.27 14:30:40 LOG5[79306780:0]: stunnel connected from 136.157.232.120:3372 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): before/accept initialization 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 read client hello A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write server hello A 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: FD=0, DIR=read 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: ok 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 read client master key A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 server start encryption 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write server verify A 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: FD=0, DIR=read 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: ok 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 read client finished A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write request certificate A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write server finished A 2005.01.27 14:30:40 LOG7[79306780:0]: 1 items in the session cache 2005.01.27 14:30:40 LOG7[79306780:0]: 0 client connects (SSL_connect()) 2005.01.27 14:30:40 LOG7[79306780:0]: 0 client connects that finished 2005.01.27 14:30:40 LOG7[79306780:0]: 0 client renegotiatations requested 2005.01.27 14:30:40 LOG7[79306780:0]: 1 server connects (SSL_accept()) 2005.01.27 14:30:40 LOG7[79306780:0]: 1 server connects that finished 2005.01.27 14:30:40 LOG7[79306780:0]: 0 server renegotiatiations requested 2005.01.27 14:30:40 LOG7[79306780:0]: 0 session cache hits 2005.01.27 14:30:40 LOG7[79306780:0]: 1 session cache misses 2005.01.27 14:30:40 LOG7[79306780:0]: 0 session cache timeouts 2005.01.27 14:30:40 LOG6[79306780:0]: Negotiated ciphers: DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168 ) Mac=MD5 2005.01.27 14:30:40 LOG7[79306780:0]: FD 1 in non-blocking mode 2005.01.27 14:30:40 LOG7[79306780:0]: stunnel connecting 127.0.0.1:80 2005.01.27 14:30:40 LOG7[79306780:0]: remote connect #1: EINPROGRESS: retrying 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: FD=1, DIR=write 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: ok 2005.01.27 14:30:40 LOG7[79306780:0]: Remote FD=1 initialized 2005.01.27 14:30:40 LOG7[79306780:0]: SSL_read returned WANT_: retrying 2005.01.27 14:30:40 LOG7[79306780:0]: SSL closed on SSL_write 2005.01.27 14:30:40 LOG5[79306780:0]: Connection closed: 0 bytes sent to SSL, 668 bytes sent to socket 2005.01.27 14:30:40 LOG7[79306780:0]: removing pid file /usr/local/var/run/stunnel.pid 2005.01.27 14:30:40 LOG7[72667165:0]: Process 79306780 finished with code 0 (0 left) Specifically: I get SSL_read returned WANT_: retrying I am using sslv2 because sslV3 does not work with windows explorer. Any help would be appreciated. __________________________________ Do you Yahoo!? Read only the mail you want - Yahoo! Mail SpamGuard. http://promotions.yahoo.com/new_mail

2 1

using no certificate
by Zohar 14 Feb '05

14 Feb '05

Hi, I'm very new to all this issue of SSL, so I apologize if this question sounds stupid. I currently have a server that listens to connections on a TCP port. Clients that connect to it may do so using SSL v3 (mobile clients, which use their own SSL packages, so I have very little control over it). I want to add stunnel to my server's setting, to enable SSL communication. I have no need for the client to authenticate the server, I am only interested in the data being encrypted. I tried setting this up, but the client complains that my server certificate cannot be authenticated (I produced it using http://www.stunnel.org/pem/) Any pointers on how to set such a thing up (even for the time being, while I develop), without having to pay lots of money to a CA ?

3 2

Multiple Instances of stunnel
by dps_maillists＠mac.com 11 Feb '05

11 Feb '05

Hi everyone; Is it possible to run multiple instances of stunnel (v 4.07) in client mode on a single machine? We sould like to use stunnel to secure connections from a small number of client applications (1 to 10) connecting to a larger number of server applications (200 per client app). Ideally, we would like to use one instance of stunnel per client. Many thanks in advance. Doug

2 1

connect_wait: s_poll_wait timeout
by Alexander Lazic 07 Feb '05

07 Feb '05

Hi, we run stunnel on an solaris 9 with unlimited FD. Today we get the follwing error: connect_wait: s_poll_wait timeout With 'top' we see ~190-~220 threads and the client can't connect to our site. our config is: --- cert = /usr/local/apache/our.pem setuid = stunnel setgid = apache options = ALL pid = /usr/local/apache/logs/stunnel_netbanking.pid ciphers = ALL:!EXP1024-DHE-DSS-RC4-SHA:!EXP1024-RC4-SHA:!EXP1024-DHE-DSS-DES-CBC-SHA:!EXP1024-DES-CBC-SHA:!EXP1024-RC2-CBC-MD5:!EXP1024-RC4-MD5:!ADH:!EXP56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL:@STRENGTH debug = 6 output = /usr/local/apache/logs/stunnel_netbanking.log [https] accept = 10.3.169.208:443 connect = 10.3.169.208:10800 TIMEOUTclose = 0 xforwardedfor = yes --- stunnel 4.07 on sparc-sun-solaris2.9 PTHREAD+POLL+IPv4 with OpenSSL 0.9.7d 17 Mar 2004 PRNG seeded successfully file ulimit = 2147483647 (can be changed with 'ulimit -n') poll() used - no FD_SETSIZE limit for file descriptors 8388607 clients allowed --- Please can you help us to solve the problem. thx al ;-)

2 1

Problem downloading large files with sslv2
by Bhavesh Patel 04 Feb '05

04 Feb '05

Hi, I'm trying to download files from Internet Explorer using sslv2 and I keep getting the following message: 2005.02.04 16:45:04 LOG7[8237077:0]: FD 1 in non-blocking mode 2005.02.04 16:45:04 LOG7[8237077:0]: stunnel connecting 127.0.0.1:80 2005.02.04 16:45:04 LOG7[8237077:0]: remote connect #1: EINPROGRESS: retrying 2005.02.04 16:45:04 LOG7[8237077:0]: waitforsocket: FD=1, DIR=write 2005.02.04 16:45:04 LOG7[8237077:0]: waitforsocket: ok 2005.02.04 16:45:04 LOG7[8237077:0]: Remote FD=1 initialized 2005.02.04 16:45:04 LOG7[8237077:0]: SSL_read returned WANT_: retrying 2005.02.04 16:45:04 LOG7[8237077:0]: SSL closed on SSL_write 2005.02.04 16:45:04 LOG5[8237077:0]: Connection closed: 0 bytes sent to SSL, 669 bytes 2005.02.04 16:45:04 LOG7[8237077:0]: removing pid file /usr/local/var/run/stunnel.pid 2005.02.04 16:45:04 LOG7[2375710:0]: Process 8237077 finished with code 0 (0 left) Also does anyone know if that 10 TIMEOUTconnect for IE really works? Thanks, Bhavesh

1 0

concurrency request
by kevin 01 Feb '05

01 Feb '05

hi, I've recently set up stunnel for SSL connect. When I test its performance with siege with 700 concurrency request, I got this log: "Error: socket: connection timed out.: Operation now in progress" So, may I ask what is the upper limit of concurrency in stunnel, if the performance of the machine is good enough. and how can I increase the concurrency upper limit. thanks

2 1

Q: rereading configuration file?
by Heiko Nardmann 01 Feb '05

01 Feb '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Does stunnel offer a way to signal a need for rereading the configuration file, i.e. some kind of SIGHUP ? I would like to add services while running stunnel without stopping the program ... it should compare currently available services with the new list of services, stop the ones not available any more and start those which are new in the new/changed configuration ... - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 Besuchen Sie uns vom 10. - 16. März auf der CeBIT 2005 in Halle 7, Stand D38. Informationen zu unseren CeBIT-Themen finden Sie unter www.secunet.com <outbind://44/www.secunet.com> - wir freuen uns auf das Gespräch mit Ihnen. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFB/4Dzpm53PRScYygRAtg4AJ9Ku/8xfufFdrLq7cz2+1GDjrcvyQCffVLw v/2D0Fd8UtTHpssq7cgc71Y= =uG2t -----END PGP SIGNATURE-----

3 2

Q: error message during startup?
by Heiko Nardmann 01 Feb '05

01 Feb '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! I just got the following stunnel error message in my syslog: File descriptor out of range (1024>=1024) The reason is that I have tried to let stunnel create 2000 services. But where do I change the maximum for this range? (Linux) Kernel? Or stunnel? Thanks in advance! PS: I already changed ulimit to 4000. - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 Besuchen Sie uns vom 10. - 16. März auf der CeBIT 2005 in Halle 7, Stand D38. Informationen zu unseren CeBIT-Themen finden Sie unter www.secunet.com <outbind://44/www.secunet.com> - wir freuen uns auf das Gespräch mit Ihnen. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFB/4TWpm53PRScYygRAv2JAKCHTe6zNvhmWAkypK5xymm+LWstEACgt1vJ vSNr7eeFXUpRFCu2SiY/4ls= =huyB -----END PGP SIGNATURE-----

2 1

Q: need of restart after CRL/CA directory contents change?
by Heiko Nardmann 31 Jan '05

31 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Since I want to write CRL files from all relevant CAs based on a regular (daily) basis I wonder whether it is necessary to restart stunnel if the contents of the CRL or CA directory changes. The regular part is going to be handled by a cronjob which does an LDAP search which results in the CA certificate and crl files. How does stunnel work in this situation? Do I need a restart after a cron run or not? Thanks in advance! - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 Besuchen Sie uns vom 10. - 16. März auf der CeBIT 2005 in Halle 7, Stand D38. Informationen zu unseren CeBIT-Themen finden Sie unter www.secunet.com <outbind://44/www.secunet.com> - wir freuen uns auf das Gespräch mit Ihnen. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFB/j+kpm53PRScYygRArxfAJ4mXXvjL+qEh6lBJlhpJJfC/jSoEQCgx4ie Xjv5/K3xcL6qPxp5ZH3SzOk= =4/pC -----END PGP SIGNATURE-----

2 1

Re: [stunnel-users] Stunnel 4.05/4.07 Crash
by PinLee_Su＠azuretech.com.sg 31 Jan '05

31 Jan '05

Hi Michal, The initial lines look like this:- 2005.01.25 15:21:23 LOG5[1160:2612]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.01.25 15:21:24 LOG5[1160:1828]: No limit detected for the number of clients 2005.01.25 15:21:24 LOG5[1160:1476]: HTTP connected from 10.3.5.137:2013 2005.01.25 15:21:25 LOG3[1160:1476]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2005.01.25 15:21:25 LOG5[1160:1476]: Connection reset: 206 bytes sent to SSL, 250 bytes sent to socket 2005.01.25 15:21:25 LOG5[1160:2380]: HTTP connected from 10.3.5.137:2024 2005.01.25 15:21:25 LOG3[1160:2380]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2005.01.25 15:21:25 LOG5[1160:2380]: Connection reset: 206 bytes sent to SSL, 226 bytes sent to socket 2005.01.25 15:21:25 LOG5[1160:1992]: HTTP connected from 10.3.5.137:2056 2005.01.25 15:21:27 LOG5[1160:2220]: HTTP connected from 10.3.5.137:2084 2005.01.25 15:21:31 LOG5[1160:2220]: Connection closed: 4969 bytes sent to SSL, 41208 bytes sent to socket 2005.01.25 15:21:31 LOG5[1160:1028]: HTTP connected from 10.3.5.137:2104 2005.01.25 15:21:40 LOG5[1160:1028]: Connection closed: 2528 bytes sent to SSL, 31275 bytes sent to socket 2005.01.25 15:21:40 LOG5[1160:512]: HTTP connected from 10.3.5.137:2122 2005.01.25 15:21:43 LOG5[1160:1992]: Connection closed: 12539 bytes sent to SSL, 56951 bytes sent to socket 2005.01.25 15:21:45 LOG5[1160:512]: Connection closed: 1689 bytes sent to SSL, 21416 bytes sent to socket 2005.01.25 15:21:46 LOG5[1160:2044]: HTTP connected from 10.3.5.137:2154 2005.01.25 15:21:47 LOG5[1160:2148]: HTTP connected from 10.3.5.137:2160 I have 11 config files as each one has its own client certificate. each one contains the follow:- CAfile=c:\STunnel\config\root.pem cert=c:\STunnel\config\myCert_A.pem client=Yes debug=7 output=c:\STunnel\logs\myCert_A.log [HTTP] accept=3885 connect=10.70.1.81:443 thanks and rgds,spl "Azure Technologies is the IT solutions provider of Hutchison Whampoa Limited and a member of Hutchison Global Communications Holdings Limited." The message is for information purposes only and is not intended to create legally binding relations. The shareholders, directors and management of Azure Technologies and any of its group companies accept no responsibility and accordingly shall have no liability to any party whatsoever with respect to the contents of this message. This message (including any attachments) is intended only for the use of the addressee(s) named above. It may contain information that is PRIVILEGED and CONFIDENTIAL and should not be read, copied or otherwise used by any other person. If you are not the intended recipient, please erase all copies of the message (including attachments) and notify us immediately. PinLee_Su@azuretech .com.sg To: stunnel-users(a)mirt.net Sent by: cc: stunnel-users-bounc Subject: [stunnel-users] Stunnel 4.05/4.07 Crash es(a)mirt.net 01/28/2005 06:28 PM Hi, I've initiated 11 stunnel processes in the same server. Each of the stunnel process has its own client certificate to communicate to application server. However after sometime of execution, the stunnel processes are crached (dying off) one by one. below is the last portion of my log (with debug level 7). I don't see any critical error in the log. Would appreciate if someone could highlight to me what cause the problem or anyone has similar experience. 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1424]: 486 session cache hits 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache timeouts 2005.01.25 16:02:41 LOG7[2244:1424]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1804]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1804]: Connection closed: 716 bytes sent to SSL, 359 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1804]: HTTP finished (7 left) 2005.01.25 16:02:41 LOG7[2244:1424]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1424]: Connection closed: 716 bytes sent to SSL, 304 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1424]: HTTP finished (6 left) 2005.01.25 16:02:41 LOG7[2244:2240]: HTTP accepted FD=516 from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:2240]: FD 516 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:02:41 LOG7[2244:2240]: New thread created 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP started 2005.01.25 16:02:41 LOG5[2244:1252]: HTTP connected from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:1252]: FD 704 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP connecting 10.1.11.56:443 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: waiting 10 seconds 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: connected 2005.01.25 16:02:41 LOG7[2244:1252]: Remote FD=704 initialized 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): before/connect initialization 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: 241 items in the session cache 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects (SSL_connect()) 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 489 client renegotiatations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:41 LOG6[2244:1252]: SSL connected: previous session reused 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:42 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:42 LOG7[2244:1252]: 242 items in the session cache 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects (SSL_connect()) 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 490 client renegotiatations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:42 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:43 LOG7[2244:2428]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG7[2244:2284]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG5[2244:2428]: Connection closed: 606 bytes sent to SSL, 242 bytes sent to socket 2005.01.25 16:02:43 LOG5[2244:2284]: Connection closed: 7758 bytes sent to SSL, 23278 bytes sent to socket 2005.01.25 16:02:43 LOG7[2244:2428]: HTTP finished (6 left) 2005.01.25 16:02:43 LOG7[2244:2284]: HTTP finished (5 left) 2005.01.25 16:02:45 LOG7[2244:1188]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:45 LOG5[2244:1188]: Connection closed: 1485 bytes sent to SSL, 7307 bytes sent to socket 2005.01.25 16:02:47 LOG7[2244:2228]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:47 LOG5[2244:2228]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:49 LOG7[2244:1644]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:49 LOG5[2244:1644]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:50 LOG7[2244:2268]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:50 LOG5[2244:2268]: Connection closed: 418 bytes sent to SSL, 1375 bytes sent to socket 2005.01.25 16:11:14 LOG7[2244:2240]: HTTP accepted FD=796 from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:2240]: FD 796 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:11:14 LOG7[2244:2240]: New thread created 2005.01.25 16:11:14 LOG7[2244:992]: HTTP started 2005.01.25 16:11:14 LOG5[2244:992]: HTTP connected from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:992]: FD 632 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:992]: HTTP connecting 10.1.11.56:443 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: waiting 10 seconds 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: connected 2005.01.25 16:11:14 LOG7[2244:992]: Remote FD=632 initialized 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): before/connect initialization 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:14 LOG7[2244:992]: 242 items in the session cache 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects (SSL_connect()) 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 490 client renegotiatations requested 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects (SSL_accept()) 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 0 server renegotiatiations requested 2005.01.25 16:11:14 LOG7[2244:992]: 488 session cache hits 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache misses 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache timeouts 2005.01.25 16:11:14 LOG6[2244:992]: SSL connected: previous session reused 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:2268]: HTTP finished (5 left) thanks and rgds,spl _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Stunnel 4.05/4.07 Crash
by PinLee_Su＠azuretech.com.sg 28 Jan '05

28 Jan '05

Hi, I've initiated 11 stunnel processes in the same server. Each of the stunnel process has its own client certificate to communicate to application server. However after sometime of execution, the stunnel processes are crached (dying off) one by one. below is the last portion of my log (with debug level 7). I don't see any critical error in the log. Would appreciate if someone could highlight to me what cause the problem or anyone has similar experience. 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1424]: 486 session cache hits 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache timeouts 2005.01.25 16:02:41 LOG7[2244:1424]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1804]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1804]: Connection closed: 716 bytes sent to SSL, 359 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1804]: HTTP finished (7 left) 2005.01.25 16:02:41 LOG7[2244:1424]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1424]: Connection closed: 716 bytes sent to SSL, 304 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1424]: HTTP finished (6 left) 2005.01.25 16:02:41 LOG7[2244:2240]: HTTP accepted FD=516 from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:2240]: FD 516 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:02:41 LOG7[2244:2240]: New thread created 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP started 2005.01.25 16:02:41 LOG5[2244:1252]: HTTP connected from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:1252]: FD 704 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP connecting 10.1.11.56:443 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: waiting 10 seconds 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: connected 2005.01.25 16:02:41 LOG7[2244:1252]: Remote FD=704 initialized 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): before/connect initialization 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: 241 items in the session cache 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects (SSL_connect()) 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 489 client renegotiatations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:41 LOG6[2244:1252]: SSL connected: previous session reused 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:42 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:42 LOG7[2244:1252]: 242 items in the session cache 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects (SSL_connect()) 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 490 client renegotiatations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:42 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:43 LOG7[2244:2428]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG7[2244:2284]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG5[2244:2428]: Connection closed: 606 bytes sent to SSL, 242 bytes sent to socket 2005.01.25 16:02:43 LOG5[2244:2284]: Connection closed: 7758 bytes sent to SSL, 23278 bytes sent to socket 2005.01.25 16:02:43 LOG7[2244:2428]: HTTP finished (6 left) 2005.01.25 16:02:43 LOG7[2244:2284]: HTTP finished (5 left) 2005.01.25 16:02:45 LOG7[2244:1188]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:45 LOG5[2244:1188]: Connection closed: 1485 bytes sent to SSL, 7307 bytes sent to socket 2005.01.25 16:02:47 LOG7[2244:2228]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:47 LOG5[2244:2228]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:49 LOG7[2244:1644]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:49 LOG5[2244:1644]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:50 LOG7[2244:2268]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:50 LOG5[2244:2268]: Connection closed: 418 bytes sent to SSL, 1375 bytes sent to socket 2005.01.25 16:11:14 LOG7[2244:2240]: HTTP accepted FD=796 from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:2240]: FD 796 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:11:14 LOG7[2244:2240]: New thread created 2005.01.25 16:11:14 LOG7[2244:992]: HTTP started 2005.01.25 16:11:14 LOG5[2244:992]: HTTP connected from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:992]: FD 632 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:992]: HTTP connecting 10.1.11.56:443 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: waiting 10 seconds 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: connected 2005.01.25 16:11:14 LOG7[2244:992]: Remote FD=632 initialized 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): before/connect initialization 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:14 LOG7[2244:992]: 242 items in the session cache 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects (SSL_connect()) 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 490 client renegotiatations requested 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects (SSL_accept()) 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 0 server renegotiatiations requested 2005.01.25 16:11:14 LOG7[2244:992]: 488 session cache hits 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache misses 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache timeouts 2005.01.25 16:11:14 LOG6[2244:992]: SSL connected: previous session reused 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:2268]: HTTP finished (5 left) thanks and rgds,spl

2 1

Stunnel 4.05/4.07 Crash
by PinLee_Su＠azuretech.com.sg 28 Jan '05

28 Jan '05

Hi, I've initiated 11 stunnel processes in the same server. Each of the stunnel process has its own client certificate to communicate to application server. However after sometime of execution, the stunnel processes are crached (dying off) one by one. below is the last portion of my log (with debug level 7). I don't see any critical error in the log. Would appreciate if someone could highlight to me what cause the problem or anyone has similar experience. 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1424]: 486 session cache hits 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache timeouts 2005.01.25 16:02:41 LOG7[2244:1424]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1804]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1804]: Connection closed: 716 bytes sent to SSL, 359 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1804]: HTTP finished (7 left) 2005.01.25 16:02:41 LOG7[2244:1424]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1424]: Connection closed: 716 bytes sent to SSL, 304 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1424]: HTTP finished (6 left) 2005.01.25 16:02:41 LOG7[2244:2240]: HTTP accepted FD=516 from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:2240]: FD 516 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:02:41 LOG7[2244:2240]: New thread created 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP started 2005.01.25 16:02:41 LOG5[2244:1252]: HTTP connected from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:1252]: FD 704 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP connecting 10.1.11.56:443 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: waiting 10 seconds 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: connected 2005.01.25 16:02:41 LOG7[2244:1252]: Remote FD=704 initialized 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): before/connect initialization 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: 241 items in the session cache 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects (SSL_connect()) 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 489 client renegotiatations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:41 LOG6[2244:1252]: SSL connected: previous session reused 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:42 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:42 LOG7[2244:1252]: 242 items in the session cache 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects (SSL_connect()) 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 490 client renegotiatations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:42 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:43 LOG7[2244:2428]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG7[2244:2284]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG5[2244:2428]: Connection closed: 606 bytes sent to SSL, 242 bytes sent to socket 2005.01.25 16:02:43 LOG5[2244:2284]: Connection closed: 7758 bytes sent to SSL, 23278 bytes sent to socket 2005.01.25 16:02:43 LOG7[2244:2428]: HTTP finished (6 left) 2005.01.25 16:02:43 LOG7[2244:2284]: HTTP finished (5 left) 2005.01.25 16:02:45 LOG7[2244:1188]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:45 LOG5[2244:1188]: Connection closed: 1485 bytes sent to SSL, 7307 bytes sent to socket 2005.01.25 16:02:47 LOG7[2244:2228]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:47 LOG5[2244:2228]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:49 LOG7[2244:1644]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:49 LOG5[2244:1644]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:50 LOG7[2244:2268]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:50 LOG5[2244:2268]: Connection closed: 418 bytes sent to SSL, 1375 bytes sent to socket 2005.01.25 16:11:14 LOG7[2244:2240]: HTTP accepted FD=796 from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:2240]: FD 796 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:11:14 LOG7[2244:2240]: New thread created 2005.01.25 16:11:14 LOG7[2244:992]: HTTP started 2005.01.25 16:11:14 LOG5[2244:992]: HTTP connected from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:992]: FD 632 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:992]: HTTP connecting 10.1.11.56:443 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: waiting 10 seconds 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: connected 2005.01.25 16:11:14 LOG7[2244:992]: Remote FD=632 initialized 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): before/connect initialization 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:14 LOG7[2244:992]: 242 items in the session cache 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects (SSL_connect()) 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 490 client renegotiatations requested 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects (SSL_accept()) 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 0 server renegotiatiations requested 2005.01.25 16:11:14 LOG7[2244:992]: 488 session cache hits 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache misses 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache timeouts 2005.01.25 16:11:14 LOG6[2244:992]: SSL connected: previous session reused 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:2268]: HTTP finished (5 left) thanks and rgds,spl

1 0

Re: [stunnel-announce] cannot create pid
by higuita 27 Jan '05

27 Jan '05

Hi On Tue, 25 Jan 2005 14:15:45 -0500 "Humberto Morell" <morell(a)seg.inf.cu> wrote: > Hello list please use the stunnel-users instead of stunnel-anounce 8) > Cannot create pid file /var/run/stunnel.pid (...) > prueba:/usr/local/etc/stunnel # ls -l /var/run (...) > chroot = /var/lib/stunnel/ (...) > pid = /var/run/stunnel.pid so you cant create the pid, and you think that /var/run is correct, but you are forgeting that you enabled the chroot, so you have to check the /var/run inside the chroot, not your main /var/run directory (that the chroot stunnel cant access) check the /var/lib/stunnel/var/run and you will find that you dont have that directory or it have the wrong permissions good luck higuita -- Daniel Mota Leite Gestor de Sistemas/System Manager Centro de Computação Gráfica Tel: +351 253 439 300 Rua Teixeira de Pascoais, 596 Fax: +351 253 439 348 4800-073 Guimarães Portugal CCG and University of Minho are Members of the INI-GraphicsNet

1 0

Hi
by UHRA 27 Jan '05

27 Jan '05

Hi, I have problem with stunnel. I like to create stunnel on my server. I want to create SSL connection on IRCD server. I am using UnrealIRCD. I have installed Stunnel 4.07 and OpenSSL 0.9.7e. I have created certificates. I use this command stunnel -c -d 6668 -r irc.myserver.sk:6697 and then when I run ircd then display me thist error: [Mon Jan 24 18:27:49 2005] - Error binding stream socket to IP 0.0.0.0 port 6668 - irc.myserver.sk[]:Address already in use Can you help me ? thanks

3 2

Profiling STunnel
by Mark Swann 26 Jan '05

26 Jan '05

All, I need to do some performance profiling on STunnel. I assume gcov and gprof are the correct tools for this. Does anyone have any experience profiling STunnel? Any advice on how to do it properly would be appreciated. Thanks Mark Swann

1 0

Cannot find License.CM file
by Ranjit Mallick 26 Jan '05

26 Jan '05

Hi , I am new to stunnel , one of the previous develoeper has developed a application using Stunnel, essentially this app will work as a proxy to outside world and tunnel back to the remote server. On the server side the Stunnel has License.cm file and when ever I bring stunnel in CMD mode, it shows a message cannot find the License.cm file(even though it is there), Obviously the License file has expired or corrupted. How do I tell this tunnel.exe not to look for that file or how can I generate a license file(.cm)? Pls note that the tunnel has all the required files in it's directory tunnel.pem,tunnel.conf,ssleay32.dll,libeay32.dll,ssleay32.exp), pls help this is a show stopper and is effecting the client.Any leads or direction will be much appreciated. Thank you Ranjit __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

win32 stunnel - quiet service install
by joe smith 22 Jan '05

22 Jan '05

I would like to request the following feature be included in subsequent releases of stunnel. Cheers, Jeff Greetings, It would be great if while installing as a service on win32, there was an option to install quietly - i.e. only pop up a dialog box to the user if there's a problem. Any chance of somebody nice compiling me a binary that does this? :) M. -- Michael Brown {0x527670C0} | `One of the main causes of the fall of Systems Administrator | the Roman Empire was that, lacking zero, +1 519 888 7111 x2339 | they had no way to indicate successful michaelb at opentext.com | termination of their C programs.' - Firth --------------------------------- Do you Yahoo!? Yahoo! Search presents - Jib Jab's 'Second Term'

2 1

stunnel and verify
by Brian Hirt 21 Jan '05

21 Jan '05

Hi, I've recently set up stunnel for a remote vnc connection, and it's working great. However, I would like to restrict access based on cert (only allow access a single public key), because nobody else should be accessing it besides my one machine. It seems what i want is to set verify = 3, but I'm using self-signed certs on my client, so verify = 3 fails. Is there some way to verify the client public key without doing the self signed test too? I'm sorry if this is a faq -- i searched the lists and read the faq and couldn't find anything. Thanks! (I'm running stunnel 4.04 on fedora1, and stunnel 4.04 on mac 10.3.7, installed via fink) my stunnel.conf is pretty simple. client conf is (sans connection info) client = yes cert = /sw/etc/stunnel/stunnel.pem chroot = /var/run/stunnel/ pid = /stunnel.pid setuid = stunnel setgid = stunnel server conf is: client = no cert = /etc/stunnel/stunnel.pem CApath = /etc/stunnel/clientdb chroot = /var/run/stunnel/ verify=3 pid = /stunnel.pid setuid = stunnel setgid = stunnel -------------------------------------------- MobyGames http://www.mobygames.com The world's largest and most comprehensive gaming database project

1 0

Re: [stunnel-users] Activating Stunnel After Exiting (Newbie)
by Andre Tertling 20 Jan '05

20 Jan '05

[...] >Pack 2.) After close Agent, I right-click the Stunnel icon on the task >bar and choose Exit. If I try to activate Stunnel later, by >double-clicking its desktop icon, I am presented with an error window >headed "stunnel 4.07 on Win32" with the following message: "Failed to >create a new service". Looking at Properties on the desktop, I see that >the Target is "C:\stunnel\stunnel-4.07.exe -install". This looks wrong, >as it appears to be the option for initial installation of the program. I >assume I need to change this, or discover another method of re- [...] You already found the culprit. The command line option "-install" attempts to install the stunnel service. As it is already present in the services list, this has to fail. You can easily start and stop stunnel using the net command from a command line window: net start stunnel to start stunnel, or: net stop stunnel to shut it down again. You could make up a batch file to launch stunnel automatically for the time agent is running: --file runagent.cmd begin-- @echo off net stunnel start C:\Program Files\Agent!\Agent32.exe net stunnel stop --file runagent.cmd end-- Just edit the path for agent32.exe to match the path where you have Forté Agent installed, and you're done. P.S. I know net stunnel start can complain about that the service is already running, but that's just cosmetical and I was too lazy to implement logic to check if the service is already running ;) Best regards, Andre

1 1

Activating Stunnel After Exiting (Newbie)
by mhrtmhd94＠att.net 20 Jan '05

20 Jan '05

Hi. I just installed Stunnel, in order to be able to continue Agent as my mews reader. This works well. Based on the cautions on the website, I have decided to keep Stunnel active only when I am using Agent. Stunnel opens when I boot Windows - (XP Home Edition with Service Pack 2.) After close Agent, I right-click the Stunnel icon on the task bar and choose Exit. If I try to activate Stunnel later, by double-clicking its desktop icon, I am presented with an error window headed "stunnel 4.07 on Win32" with the following message: "Failed to create a new service". Looking at Properties on the desktop, I see that the Target is "C:\stunnel\stunnel-4.07.exe -install". This looks wrong, as it appears to be the option for initial installation of the program. I assume I need to change this, or discover another method of re-opening stunnel. As it stands now, I have to reboot to accomplish this. Any assistance will be appreciated. Thanks.

1 0

[email protected]
by eric wyzerski 17 Jan '05

17 Jan '05

Hi, Im trying to bind my 465 port tu my 25 port to have a ssl-smtp with the following command: stunnel -p /etc/stunnel.pem2 -d 465 -r localhost:25 However when I try to connect to port 465, I get the following error, stunnel[3443]: SSL_accept: Peer suddenly disconnected Any idea? Thank you Eric _________________________________________________________________ Take advantage of powerful junk e-mail filters built on patented Microsoft® SmartScreen Technology. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

2 1

Problem with zlib compression
by Allan Guild 13 Jan '05

13 Jan '05

I'm having problems with zlib compression - stunnel 4.07 on my client machne crashes whenever I try and start a session. With compression set to rle or not defined, there is no problem. I am securing a MySQL connection between a Windows client and Mandrake Linux 10.1 server. Client Configuration: Stunnel 4.07 and openssl 0.9.7e-zlib binaries downloaded from Stunnel website stunnel.conf ------------ cert=./Allan_Guild_Work.pem key=./Allan_Guild_Work_key.pem client=yes compression=zlib [Primary Club] accept=3306 connect=195.137.78.107:3307 TIMEOUTbusy=5 ------------- Server Configuration: Stunnel 4.07 and openssl 0.9.7e (compiled with zlib support) rebuilt from Mandrake Cooker SRPMS stunnel.conf ------------ CApath=/etc/ssl/stunnel/certs/ cert=/etc/ssl/stunnel/CAcert.pem key=/etc/ssl/stunnel/CAkey.pem client=no foreground=yes pid=/var/run/stunnel.pid verify=0 compression=zlib [Primary Club] accept=3307 connect=3306 ------------ When I try and connect, I get the following output from the client (which then crashes): ------------- 2005.01.11 19:04:14 LOG5[308:2172]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.01.11 19:04:14 LOG5[308:1688]: No limit detected for the number of clients 2005.01.11 19:04:16 LOG5[308:804]: Primary Club connected from 127.0.0.1:4769 ------------- and the following from the server: ------------- 2005.01.11 19:21:30 LOG5[25439:1076523680]: stunnel 4.07 on i586-mandrake-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 2005.01.11 19:21:30 LOG5[25439:1076523680]: 500 clients allowed 2005.01.11 19:21:53 LOG5[25439:1073900464]: Primary Club connected from 212.135.219.66:3974 2005.01.11 19:21:53 LOG5[25439:1073900464]: VERIFY IGNORE: depth=0, /C=UK/ST=Some-State/L=London/O=Primary Club/CN=Allan Guild/emailAddress=allan.guild(a)bitsnpieces.org.uk 2005.01.11 19:21:53 LOG5[25439:1073900464]: VERIFY IGNORE: depth=0, /C=UK/ST=Some-State/L=London/O=Primary Club/CN=Allan Guild/emailAddress=allan.guild(a)bitsnpieces.org.uk 2005.01.11 19:21:57 LOG3[25439:1073900464]: SSL_read (ERROR_SYSCALL): Connection reset by peer (104) 2005.01.11 19:21:57 LOG5[25439:1073900464]: Connection reset: 3843 bytes sent to SSL, 55 bytes sent to socket ------------- Any advice would be greatly appreciated (Do I need a zlib dll?), Allan

2 2

stunnel dropping connection with media wiki
by christopher＠baus.net 12 Jan '05

12 Jan '05

Hi all, I've been using stunnel with SMTP, IMAP, and HTTP with out a problem. Yesterday I installed media wiki on Fedora Core 2 w/ Apache. It works fine if I access it directly, but if I access the site via stunnel, the proxy drops connection. I was wondering if anybody else has seen this type of problem. I am tempted to dig into it, but I am honestly short on time right now. I think it might have something to do with the redirects that Media wiki uses, but that's just a wild guess. Christopher Baus ======== Implementing an HTTP proxy? Consider a fast, secure alternative http://www.baus.net/ads/license

1 0

Re: [stunnel-users] OpenSSL - write:errno=131
by Hans Werner Strube 11 Jan '05

11 Jan '05

> (BTW, I use here the word "managed" becuase it was not straightforward: the > up-to-date version - 4.07 - wouldn't compile under Solaris.) For this special problem, try my patch from 04 Jan 05 in this list, Subject: stunnel-4.07 on non-IPv6 systems

1 0

openssl and a pkcs#11 device
by Edward 11 Jan '05

11 Jan '05

Hello, Has anyone ever tried to build stunnel using openssl with a pkcs#11 crypto device? Regards, Edward Stempel -- "The responsibility of a citizen is to keep his mouth open." - Gunther Grass

1 0

OpenSSL - write:errno=131
by Andrzej Marecki 11 Jan '05

11 Jan '05

I managed to compile and install stunnel 4.06 under Solaris 2.6. (BTW, I use here the word "managed" becuase it was not straightforward: the up-to-date version - 4.07 - wouldn't compile under Solaris.) My stunnel.conf file reads: cert=/opt/etc/stunnel/pop3.pem chroot = /opt/var/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid output=/var/log/stunnel.log client = no [spop3] accept = localhost:995 connect = localhost:110 [ssmtp] accept = localhost:465 connect = localhost:25 -------------- /opt/etc/stunnel/pop3.pem has been set up according the instructions at: http://www.freebsd.hello.pl/files/modules.php?name=News&file=article&sid=5 ...so I do hope it's OK ;-). Anyway, stunnel daemon works - what I get in stunnel.log reads: stunnel 4.06 on sparc-sun-solaris2.6 PTHREAD+POLL with OpenSSL 0.9.7e 25 Oct 2004 29 clients allowed (Date & time of the messages quoted above are omitted.) Now I try to test stunnel: #/opt/bin/openssl s_client -connect localhost:995 -prexit ...and what I get is: CONNECTED(00000003) write:errno=131 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 148 bytes --- New, (NONE), Cipher is (NONE) --------------- I get the same when "openssl s_client -connect localhost:995" is issued by a non-privileged user. Needless to say I can't connect to port 995 using a bone fide MUA running on a PC under M$W (Thunderbird to be exact). Can you help me, please. Andrzej -- ----------------------------------------------------------------------------- Andrzej Marecki | Torun Centre for Astronomy | e-mail: amr(a)astro.uni.torun.pl N. Copernicus University | WWW: http://www.astro.uni.torun.pl ul. Gagarina 11 | tel: +48 56 6113032 PL-87-100 Torun, POLAND | fax: +48 56 6113009 ----------------------------------------------------------------------------- "If Bill Gates actually had to admin his own stuff, he'd shoot himself." -----------------------------------------------------------------------------

1 0

RE: [stunnel-users] Stunnel and DistCache Patch
by Kling, Kent M. 10 Jan '05

10 Jan '05

autoconf-2.13-14 was my installed version. I upgraded to autoconf-2.53-8 and it now works. Thanks for helping out. Kent -----Original Message----- From: Peter Pentchev [mailto:[email protected]] Sent: Monday, January 10, 2005 8:08 AM To: Senthil Prabu.S Cc: Kling, Kent M.; stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel and DistCache Patch On Mon, Jan 10, 2005 at 11:05:19AM +0530, Senthil Prabu.S wrote: > The problem is that,since the patch you applied have modified the configure.ac file, a brand new configure script should be generated to reflect the change done at the configure.ac. So run "autoconf" command to produce new configure script. > > This will solve your problem. Well, it... depends :) The original poster mentions that when he ran autoconf, he got an error stating that configure.in could not be found. This might mean that he's running an older version of autoconf, one that only looks for configure.in, not configure.ac. Kent, what does 'rpm -qa | fgrep auto' tell you? G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)cnsys.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 I am the meaning of this sentence. This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services.Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

Stunnel and DistCache Patch
by Kling, Kent M. 10 Jan '05

10 Jan '05

we have a RedHat 7.2 system and we are trying to apply the distcache_geoff.patch to enable distcache 1.4.5 with stunnel-4.04. We have run into a snag after the configure script is run and we attempt the "make", it complains that configure.in is missing. In step 2 is our "configure" line wrong? # make output: cd . && aclocal cd . && automake --gnu --include-deps Makefile cd . \ && CONFIG_FILES=Makefile CONFIG_HEADERS= /bin/sh ./config.status config.status: creating Makefile cd . && autoconf autoconf: configure.in: No such file or directory make: *** [configure] Error 1 Our work around is to change directory into the /usr/src/stunnel-4.04/src and run "make" from that directory to create our stunnel binary. Any idea why it won't work from the top directory. our stunnel source resides in /usr/src/stunnel-4.04, distcache_geoff.patch is in /usr/src and distcache-1.4.5 is in /usr/local/distcache-1.4.5. Our installation steps are below: step 1. # patch -p0 < distcache_geoff.patch output: patching file stunnel-4.04/configure.ac patching file stunnel-4.04/src/common.h patching file stunnel-4.04/src/options.c patching file stunnel-4.04/src/prototypes.h patching file stunnel-4.04/src/ssl.c step 2. # cd stunnel-4.04 # export CFLAGS="-DHAVE_DISTCACHE_DC_CLIENT_H -I/usr/local/distcache-1.4.5/include"; export LDFLAGS="-L/usr/local/distcache-1.4.5/lib -ldistcache -lnal"; ./configure --prefix=/usr/local/stunnel-4.04 --with-ssl=/usr/local/openssl-0.9.7e --with-tcp-wrappers --disable-shared output: checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking build system type... i686-pc-linux-gnu checking host system type... i686-pc-linux-gnu checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether make sets ${MAKE}... (cached) yes checking for ld used by GCC... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognise dependant libraries... pass_all checking command to parse /usr/bin/nm -B output... ok checking how to run the C preprocessor... gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... GNU/Linux ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... no checking whether to build static libraries... yes creating libtool checking for SSL directory... /usr/local/openssl-0.9.7e checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... no checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... yes checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... yes checking pty.h presence... yes checking for pty.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... yes checking for _getpty... no checking for daemon... yes checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init Thanks, Kent Kling This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services.Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

3 2

Error:1408F10B, Wrong Version Number
by Emily Mattes 09 Jan '05

09 Jan '05

I'm trying to set up STunnel 4.07 client-side for Qm (http://pyric.org/qm/) on Windows XP Pro, but when I try to send a message Qm times out and I get this error in the STunnel log: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Here's my config file: client = yes delay = yes [pop3] accept = 110 connect = pop.gmail.com:995 [smtp] accept = 25 connect = smtp.gmail.com:587 This is my first time trying to configure SSL for anything, so I really don't know what's going wrong. Any help would be greatly appreciated. Thank you very much! -- Emily -- schroedinger(a)gmail.com

1 0

Newbie trying to connect over a Microsoft Proxy
by Michael Blake 05 Jan '05

05 Jan '05

Hi All I'm a relative newbie to Stunnel, and am trying to set up a tunnel so I can Remote Desktop from work to my PC/server at home. I'm using versions 4.05 & 4.06 of the Windows binaries. A Microsoft Proxy Server v2.0 is used at work, and it proxies HTTP, Secure (is that SSL/port 443??), FTP and Gopher over port 800. I'm not sure if it proxies Socks, as there's no entry for it in Internet Explorer. I've tested the configuration and it works on my LAN, and it works from home when I enter my domain home (so my firewall is set up correctly). My config is as follows: #Client CAfile = stunnel.pem cert = stunnel.pem client = yes verify = 3 [rdp-80] accept = localhost:3390 connect = xxx.xxx.xxx.xxx:80 #Server CAfile = stunnel.pem cert = stunnel.pem client = yes verify = 3 [rdp-80] accept = 192.168.10.221:80 connect = 127.0.0.1:3389 Is there something I need to do to traverse this proxy? Any help would be greatly appreciated! Tks, Michael Blake IT Consultant | Headbyte Limited Tel: + 44 7909 844273 http://www.headbyte.co.uk

2 2

stunnel-4.07 on non-IPv6 systems
by Hans Werner Strube 04 Jan '05

04 Jan '05

On systems which do not yet support IPv6 and do not have getnameinfo (for instance, Solaris 7), also NI_NUMERICHOST and NI_NUMERICSERV are usually undefined. In stunnel-4.07, this causes compilation of src/network.c to fail. Patch: *** src/network.c.ORI Mon Jan 3 00:20:27 2005 --- src/network.c Tue Jan 4 14:46:10 2005 *************** *** 73,78 **** --- 73,84 ---- static const char *s_gai_strerror(int); #ifndef HAVE_GETNAMEINFO + #ifndef NI_NUMERICHOST + #define NI_NUMERICHOST 2 + #endif + #ifndef NI_NUMERICSERV + #define NI_NUMERICSERV 8 + #endif static int getnameinfo(const struct sockaddr *, socklen_t, char *, int , char *, int , int ); #endif

1 0

bugfix for the makefile of stunnel 4.07
by deepstar＠ulyssis.org 04 Jan '05

04 Jan '05

Hi, there appears to be a bug in the makefile (tools/Makefile) that installed files/directories in the wrong place when installing to another root directory (DESTDIR env var) The attached patch should fix it. greets, -- Steven Van Acker

1 0

Port forwarding based on application type
by Konda Ankireddyapalli 03 Jan '05

03 Jan '05

Hello all, Can stunnel forward the traffic to different ports based on an application type as opposed to by port? If yes, how can it be configured? My need is that on the client side we have many applications that share a single outgoing port. On the server side I want to demultiplex the stunnel traffic coming in on a single port to multiple applications after decryption. Thanks in advance, Konda

1 0

Stunnel 4.07 released
by Michal Trojnara 02 Jan '05

02 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 New release fixes several bugs introduced in version 4.06. ChangeLog entry: Version 4.07, 2005.01.03, urgency: MEDIUM: * Bugfixes - Problem with infinite poll() timeout negative, but not equal to -1 fixed. - Problem with a file descriptor ready to be read just after a non-blocking connect call fixed. - Compile error with EAI_NODATA not defined or equal to EAI_NONAME fixed. - IP address and TCP port textual representation length (IPLEN) increased to 128 bytes. - OpenSSL engine support is only used if engine.h header file exists. - Broken NT Service mode on WIN32 platform fixed. - Support for IPv4-only WIN32 machines restored. Homepage: http://stunnel.mirt.net/ Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFB2IcR/NU+nXTHMtERAn/hAJ42XjEtUrkyixamOeMV0rRGCvqwDACg21LB sYFF8L4teETWdrkLjfkdX2E= =qOfD -----END PGP SIGNATURE-----

1 0

A couple of patches against 4.06
by Peter Pentchev 31 Dec '04

31 Dec '04

Hi, First of all, thanks for writing and maintaining this great piece of software :) When I ported 4.06 to FreeBSD on Monday, there were three changes that needed to be made. One is the passing of -1, not -1000, to poll(2), which has already been discussed on this list (and which, by the way, is mandated by POSIX and the Single Unix Specification, as you can see at http://www.opengroup.org/onlinepubs/007908799/xsh/poll.html ) The other two can be seen in the patch below. The first one is related to the fact that EAI_NODATA is not present on all systems - it was actually obsoleted by the KAME implementation of IPv6 about an year ago. On some systems it is defined and has its own value - then stunnel builds just fine. On other systems it is not defined at all, while on yet other systems it is aliased to EAI_NONAME, so 'case EAI_NONAME' and 'case EAI_NODATA' would produce an error message from the compiler. Thus, the #ifdef and #if in the first chunk of the patch. This could not be done portably with a single statement, something like '#if defined(EAI_NODATA) && EAI_NODATA != EAI_NONAME', since there are some compilers that would barf on the second part if EAI_NODATA was not actually defined. The second chunk of the patch fixes getnameinfo() error reporting - just like with getaddrinfo(), getnameinfo() errors should be displayed using s_gai_strerror() instead of sockerror(). Keep up the good work! G'luck, Peter --- src/network.c.orig Thu Oct 14 18:03:49 2004 +++ src/network.c Wed Dec 29 14:16:06 2004 @@ -416,8 +416,12 @@ return "Temporary failure in name resolution (EAI_AGAIN)"; case EAI_FAIL: return "Non-recoverable failure in name resolution (EAI_FAIL)"; +#ifdef EAI_NODATA +#if EAI_NODATA != EAI_NONAME case EAI_NODATA: return "No address associated with nodename (EAI_NODATA)"; +#endif +#endif case EAI_FAMILY: return "ai_family not supported (EAI_FAMILY)"; case EAI_SOCKTYPE: @@ -562,10 +566,13 @@ /* getnameinfo() version */ char *s_ntop(char *text, SOCKADDR_UNION *addr) { char host[20], port[6]; + int err; - if(getnameinfo(&addr->sa, addr_len(*addr), - host, 20, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { - sockerror("getnameinfo"); + err = getnameinfo(&addr->sa, addr_len(*addr), + host, 20, port, 6, NI_NUMERICHOST|NI_NUMERICSERV); + if (err) { + s_log(LOG_ERR, "Error resolving the specified address: %s", + s_gai_strerror(err)); strcpy(text, "unresolvable IP"); return text; } -- Peter Pentchev roam(a)ringlet.net roam(a)cnsys.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 .siht ekil ti gnidaer eb d'uoy ,werbeH ni erew ecnetnes siht fI

2 5

xforwardfor-patch
by Alexander Lazic 30 Dec '04

30 Dec '04

Hi, i have attached my xforwardfor-patch for stunnel-4.06 ;-) al ;-)

2 2

stunnel 4.0.6 stunnel uid/gid removal
by Noah 30 Dec '04

30 Dec '04

stunnel-4.0.6 FreeBSD-4.9 I just installed stunnel 4.0.6 and noticed during the portinstall that the defualt behavior was to remove the stunnel uid and gid. can somebody clue me in as to why this was the Process? I cant find any relevant information on the web. cheers, Noah

2 1

engine-patch
by Alexander Lazic 29 Dec '04

29 Dec '04

Hi, we have a the following openssl: --- OpenSSL 0.9.7d 17 Mar 2004 built on: Wed Nov 3 13:28:35 CET 2004 platform: solaris-sparcv9-gcc options: bn(64,32) md2(int) rc4(ptr,char) des(idx,cisc,16,long) idea(int) blowfish(ptr) compiler: gcc -DOPENSSL_SYSNAME_ULTRASPARC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_KRB5 -DOPENSSL_NO_ENGINE -m32 -mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DMD5_ASM --- We don't have the engine enabled therefore the current stunnel don't compile :-( I have attached the patch for the current (4.06) stunnel version. BTW: I need the 'X-Forwarded-For' header, in where is the right position to add it in the 4.06 version. I think in 'src/client.c => transfer()' but i'am not sure, where there ;-) Thanx for help ;-) al ;-)

2 2