- stunnel-users - stunnel.org

Re: connect error 0 running on ARM platform
by FX35 15 Jan '14

15 Jan '14

> Message: 1 > Date: Tue, 14 Jan 2014 12:19:47 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] Fwd: Re: connect error 0 running on ARM > platform > Message-ID: <52D51D53.5030106(a)mirt.net> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > FWX wrote: >> errno is not updated ... >> >> So errno doen't reflect the real value. >> >> Map file of stunnel programm shows _errno_localion(), as you wrote. >> >> Perhaps is there a bug in uClib ? > > Something like this one: > http://www.mail-archive.com/[email protected]/msg05640.html > http://www.mail-archive.com/[email protected]/msg05641.html > or: > http://www.mail-archive.com/[email protected]/msg09301.html > ? > > It indeed looks like uclibc and stunnel use a different errno... > > Mike > > Thank you, Mike, I think you're right. It's ok using mode fork rather than pthread. Regards, FWX.

1 0

newbie question
by Ted Roeloffzen 15 Jan '14

15 Jan '14

Hello All, I'm new to STunnel and installed and setup STunnel. When someone tried to connect I get the following items in the log. SSL accepted: new session negotiated Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 FD 8 in non-blocking mode SL-test>Instelling connecting 127.0.0.1:8890 connect_wait: waiting 10 seconds connect_wait: connected Remote FD=8 initialized SSL alert (read): warning: close notify SSL closed on SSL_read Socket write shutdown SSL write shutdown SSL alert (write): warning: close notify SSL_shutdown successfully sent close_notify Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket SL-test>Instelling finished (0 left) As I'm reading this, there was an established connection but the connection party disconnected, for some reason or another. There was no data sent, but there also was no real error. Is this assumption correct or am I missing something? kind regards, Ted

1 0

Re: [stunnel-users] connect error 0 running on ARM platform
by FX35 14 Jan '14

14 Jan '14

> Message: 3 > Date: Fri, 10 Jan 2014 15:27:10 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] connect error 0 running on ARM platform > Message-ID: <52D0033E.1060109(a)mirt.net> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > On 01/09/2014 06:02 PM, FX35 wrote: >> Running stunnel 4.56 or 5.00 on an ARM platform (ARM926EJ) with Linux >> 2.6.36.4, I encounter the following error : the call to connect() >> return -1, but errno is set to 0 ! >> >> If stunnel is configured to use fork mode instead of pthread mode, >> the problem disapear. >> >> So it seems there is a problem, cross-compiling the program, with >> errno or __errno_location() in the program generated with pthread. >> >> I add the definition of _REENTRANT, without success ... >> >> (See $H1 at http://pauillac.inria.fr/~xleroy/linuxthreads/faq.html) >> >> Is somebody meet the same error ? > > The errno definition in the Android framework (as an example of > Linux/ARM platform) is: > > /* internal function returning the address of the thread-specific > errno */ > extern volatile int* __errno(void); > > /* a macro expanding to the errno l-value */ > #define errno (*__errno()) > > > It seems okay. > > How do you reproduce this problem? What are the stunnel debug logs when > it happens? > > Mike Hello Mike, It seems that the errno variable is not correcly set/updated in C library, using pthread mode. Sample: errno = -1; ret = connect(...); if( ret == -1 ) { printf("errno=%d\n",errno); } will displays value -1 for errno, not EINPROGRESS or EWOULDBLOCK ! errno is not updated ... So errno doen't reflect the real value. Map file of stunnel programm shows _errno_localion(), as you wrote. Perhaps is there a bug in uClib ? Here is the result of ldd command: # ldd stunnel libssl.so.1.0.0 => /usr/lib/libssl.so.1.0.0 (0x400f3000) libcrypto.so.1.0.0 => /usr/lib/libcrypto.so.1.0.0 (0x4013d000) libz.so.1 => /usr/lib/libz.so.1 (0x4027c000) libdl.so.0 => /lib/libdl.so.0 (0x4029b000) libutil.so.0 => /lib/libutil.so.0 (0x4009e000) libpthread.so.0 => /lib/libpthread.so.0 (0x400a7000) libc.so.0 => /lib/libc.so.0 (0x402a6000) libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x400c6000) ld-uClibc.so.0 => /lib/ld-uClibc.so.0 (0x4008f000) Thanks for help. Regards, FWX.

2 1

connect error 0 running on ARM platform
by FX35 10 Jan '14

10 Jan '14

Hello, Running stunnel 4.56 or 5.00 on an ARM platform (ARM926EJ) with Linux 2.6.36.4, I encounter the following error : the call to connect() return -1, but errno is set to 0 ! If stunnel is configured to use fork mode instead of pthread mode, the problem disapear. So it seems there is a problem, cross-compiling the program, with errno or __errno_location() in the program generated with pthread. I add the definition of _REENTRANT, without success ... (See $H1 at http://pauillac.inria.fr/~xleroy/linuxthreads/faq.html) Is somebody meet the same error ? Thanks for help. FWX.

2 1

What checks are made for verify=2
by Ender Erel 10 Jan '14

10 Jan '14

Hi All, I have been searching the web for information on what checks are made for verify=2 but I can't find any detailed information. What exactly goes on when I use verify=2 in client mode? Does stunnel only check if the certificate is signed by a valid CA? Or are any other X.509 attributes checked? Does it disallow settings like "CA=true"? I would really appreciate it if someone could point me where I can find about details of various verify levels. Thanks, Ender Erel

1 0

Stunnel cuts off message
by bernabei＠infinito.it 09 Jan '14

09 Jan '14

Hi,     I'd like to know why Stunnel cuts off messages. I use stunnel both the client and server side,the problem is that my client receives only a cutted off responce from the server,whose size turns out to be 18 KB. Hope an answer Thanks Chiara Bernabei

2 1

Error starting STunnel
by Ted Roeloffzen 09 Jan '14

09 Jan '14

Hi All, I've installed and configured my STunnel. But it won't start. The error i'm getting is: PEM_read_bio:no start line I use the certificate isn't valid, but it's a certificate that i received from a third party and should be correct. Do i have to add something to or alter the certificate so that STUnnel can work with it? kind regards, Ted

2 1

Stunnel should allow TLS v1.1, 1.2 in fips mode
by Douglas Harris (M) 07 Jan '14

07 Jan '14

Currently, stunnel only allows "sslVersion = TLSv1" when "fips = yes". TLSv1.1 and TLSv1.2 should also be permissible values for sslVersion in fips mode. -Doug

2 1

Invitation to connect on LinkedIn
by Manjula Hettiarachchi 30 Dec '13

30 Dec '13

LinkedIn ------------ stunnel, I'd like to add you to my professional network on LinkedIn. - Manjula Manjula Hettiarachchi CTO at UGEN Sri Lanka Confirm that you know Manjula Hettiarachchi: https://www.linkedin.com/e/7575ev-hptlhkon-2z/isd/18944228150/nRr0DNUW/?hs=… -- You are receiving Invitation to Connect emails. Click to unsubscribe: http://www.linkedin.com/e/7575ev-hptlhkon-2z/vyS7IfxEDIThLYYA4jSpNuY0D7kTJI… (c) 2012 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.

1 0

After upgrading OpenSSL, stunnel times out trying to receive emails
by James Brown 23 Dec '13

23 Dec '13

I've upgraded the OpenSSL on my test mail server, and recompiled Stunnel. Now when Stunnel receives an email it gets stuck on the "SSL state (accept): before/accept initialization" step and times out after a few minutes. Log: 2013.12.24 10:42:58 LOG7[86137:140735299320160]: Service [ssmtp] accepted (FD=3) from 192.168.1.10:54839 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] started 2013.12.24 10:42:58 LOG7[86137:4392841216]: Waiting for a libwrap process 2013.12.24 10:42:58 LOG7[86137:4392841216]: Acquired libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Releasing libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Released libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] permitted by libwrap from 192.168.1.10:54839 2013.12.24 10:42:58 LOG5[86137:4392841216]: Service [ssmtp] accepted connection from 192.168.1.10:54839 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): before/accept initialization 2013.12.24 10:42:58 LOG7[86137:4392841216]: SNI: no virtual services defined 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 read client hello A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write server hello A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write certificate A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write key exchange A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 write server done A 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): SSLv3 flush data 2013.12.24 10:42:58 LOG3[86137:4392841216]: SSL_accept: Peer suddenly disconnected 2013.12.24 10:42:58 LOG5[86137:4392841216]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.12.24 10:42:58 LOG7[86137:4392841216]: Local socket (FD=3) closed 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] finished (0 left) 2013.12.24 10:42:58 LOG7[86137:140735299320160]: Service [ssmtp] accepted (FD=3) from 192.168.1.10:54840 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] started 2013.12.24 10:42:58 LOG7[86137:4392841216]: Waiting for a libwrap process 2013.12.24 10:42:58 LOG7[86137:4392841216]: Acquired libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Releasing libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Released libwrap process #1 2013.12.24 10:42:58 LOG7[86137:4392841216]: Service [ssmtp] permitted by libwrap from 192.168.1.10:54840 2013.12.24 10:42:58 LOG5[86137:4392841216]: Service [ssmtp] accepted connection from 192.168.1.10:54840 2013.12.24 10:42:58 LOG7[86137:4392841216]: SSL state (accept): before/accept initialization 2013.12.24 10:47:58 LOG6[86137:4392841216]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.12.24 10:47:58 LOG5[86137:4392841216]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.12.24 10:47:58 LOG7[86137:4392841216]: Local socket (FD=3) closed 2013.12.24 10:47:58 LOG7[86137:4392841216]: Service [ssmtp] finished (0 left) Any suggestions? It was working fine before I upgraded OpenSSL to 1.00e. System is a Mac OS X 10.7.5 box. Thanks, James.

1 0