stunnel-users

2 participants
3307 discussions

Poll/Descriptor Problem
by John O'Fallon 08 Jul '05

08 Jul '05

I am running Stunnel 4.09 on Mac OS X 10.4 to provide HTTPS service on the standard ports (accept on 443, connect to 80). All connections are either truncated or dropped entirely, with the following messages written to the log: ------------------------------------------ https connected from ... INTERNAL ERROR:s_poll_wait returned 1, but no descriptor is ready Connection reset: XXXXXX bytes sent to SSL, XXX bytes sent to socket ------------------------------------------ I've tried 4.10, but the result is exactly the same. Does anybody have any thoughts on what might be going on? Thanks, John

1 0

Re: [stunnel-users] Certificate renaming
by Paul Jones 07 Jul '05

07 Jul '05

>From the discussion here, I got the impression that it is still possible for Stunnel to run correctly and successful connections to be made if the certificate files are NOT renamed using the xxxxx.0 format, where xxxxx is the hash value of the certificate. So I simply placed the .crt files for all clients on the server (under the directory specified in the CApath field in the CONF file). Now, I've tried, tried, and tried, but it still doesn't work. I get a "bad certificate" error when attempting to connect from the client. Am I missing something? Note: I am running Stunnel on Win2K. Cheers. Paul _________________________________________________________________ Single? Start dating at Lavalife. Try our 7 day FREE trial! http://lavalife9.ninemsn.com.au/clickthru/clickthru.act?context=an99&locale…

1 0

Re: [stunnel-users] Stunnel for pop3 on solaris 2.6 (more info)
by Douglas Phillipson 06 Jul '05

06 Jul '05

Should I have "protocol = pop3" in my config file? When I do, I get this from the stunnel log: 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 1, FD=6, (IN)->() 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 2, FD=0, (IN)->(IN) 2005.07.06 12:46:54 LOG7[18045:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 1, FD=4, (IN)->() 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 1, FD=6, (IN)->() 2005.07.06 12:46:54 LOG7[18045:0]: CONTEXT 2, FD=0, (IN)->(IN) 2005.07.06 12:46:54 LOG7[18045:2]: <- .g.. 2005.07.06 12:46:54 LOG3[18045:2]: Client does not want TLS 2005.07.06 12:46:54 LOG5[18045:2]: Protocol negotiation failed 2005.07.06 12:46:54 LOG3[18045:2]: Protocol negotiations failed 2005.07.06 12:46:54 LOG7[18045:2]: pop3s finished (0 left) 2005.07.06 12:46:54 LOG7[18045:2]: Context 2 closed 2005.07.06 12:46:54 LOG7[18045:0]: Waiting -1 second(s) for 2 file descriptor(s) Doug P Douglas Phillipson wrote: > I'm not sure it it applies but if I do: > > openssl s_client -connect 172.20.12.59:995 > > I get the following error: > > CONNECTED(00000003) > 17964:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226: > > > Doug P > > > Douglas Phillipson wrote: > >> I have a Solaris 2.6 box and am trying to get pop3 over SSL running. I use: >> >> qpopper 4.0.5 >> openssl-0.9.7g >> stunnel 4.10 compiled with gcc 2.95.3 >> >> When I compiled stunnel it made a private ket and certificate in /usr/local/etc/stunnel/stunnel.pem. >> >> Do I need anything else? >> >> I have the following configuration: >> >> Inetd.conf: >> >> pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S -t /poplog >> >> stunnel.conf: >> >> cert = /usr/local/etc/stunnel/stunnel.pem >> key = /usr/local/etc/stunnel/stunnel.pem >> debug = 7 >> output = /stunnel.log >> pid = /stunnel.pid >> client = yes >> >> [pop3s] >> accept = 995 >> connect = 110 >> >> I run stunnel and get the following output: >> >> 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 >> 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd >> 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd >> 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy for the PRNG >> 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully >> 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem >> 2005.07.06 11:34:18 LOG7[17873:1]: Key file: /usr/local/etc/stunnel/stunnel.pem >> 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 'ulimit -n') >> 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for file descriptors >> 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed >> 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode >> 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode >> 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode >> 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket >> 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995 >> 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid >> 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file descriptor(s) >> >> >> I connect via pop3 in thunderbird with ssl and qpopper always says: >> (null) at localhost (127.0.0.1): -ERR Unknown command: "". >> (nulI/O error flushing output to client at localhost [127.0.0.1]: Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error >> >> Stunnel says: >> >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN) >> 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 172.20.10.7:45464 >> 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context >> 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created >> 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started >> 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode >> 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket >> 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464 >> 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode >> 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110 >> 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized >> 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket >> 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect initialization >> 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write client hello A >> 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file descriptor(s) >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->() >> 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN) >> >> The mail never gets delivered to either Thunderbird or outlook express. >> I get a certificate approval request from Thunderbird to which I grant, then nothing. If I disable ssl in thunderbird the mail gets accepted normally. >> >> What might I be doing wrong??? >> >> Thanks >> >> Doug P

1 0

Re: [stunnel-users] Stunnel for pop3 on solaris 2.6 ( Even more info)
by Douglas Phillipson 06 Jul '05

06 Jul '05

If I set "client = no" in stunnels config file I get the following from: openssl s_client -connect 172.20.12.59:995 CONNECTED(00000003) depth=0 /C=US/ST=Nevada/L=Las Vegas/O=Bechtel/OU=RSL/CN=test1 verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=Nevada/L=Las Vegas/O=Bechtel/OU=RSL/CN=test1 verify return:1 30463:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:226: Is a "self signed" Cert OK? I didn't sign anything though. Compiling stunnel created a cert. Installing openssl I think created a cert. Do these need to match somehow? If so how do you do that? I think I'm lost here... Regards Doug P Douglas Phillipson wrote: > I have a Solaris 2.6 box and am trying to get pop3 over SSL running. I use: > > qpopper 4.0.5 > openssl-0.9.7g > stunnel 4.10 compiled with gcc 2.95.3 > > When I compiled stunnel it made a private ket and certificate in /usr/local/etc/stunnel/stunnel.pem. > > Do I need anything else? > > I have the following configuration: > > Inetd.conf: > > pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S -t /poplog > > stunnel.conf: > > cert = /usr/local/etc/stunnel/stunnel.pem > key = /usr/local/etc/stunnel/stunnel.pem > debug = 7 > output = /stunnel.log > pid = /stunnel.pid > client = yes > > [pop3s] > accept = 995 > connect = 110 > > I run stunnel and get the following output: > > 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 > 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd > 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd > 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy for the PRNG > 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully > 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem > 2005.07.06 11:34:18 LOG7[17873:1]: Key file: /usr/local/etc/stunnel/stunnel.pem > 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 'ulimit -n') > 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for file descriptors > 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed > 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode > 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode > 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode > 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket > 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995 > 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid > 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file descriptor(s) > > > I connect via pop3 in thunderbird with ssl and qpopper always says: > (null) at localhost (127.0.0.1): -ERR Unknown command: "". > (nulI/O error flushing output to client at localhost [127.0.0.1]: Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error > > Stunnel says: > > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN) > 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 172.20.10.7:45464 > 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context > 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created > 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started > 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode > 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket > 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464 > 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode > 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110 > 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized > 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket > 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect initialization > 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write client hello A > 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file descriptor(s) > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->() > 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN) > > The mail never gets delivered to either Thunderbird or outlook express. > I get a certificate approval request from Thunderbird to which I grant, then nothing. If I disable ssl in thunderbird the mail gets accepted normally. > > What might I be doing wrong??? > > Thanks > > Doug P > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Stunnel for pop3 on solaris 2.6
by Douglas Phillipson 06 Jul '05

06 Jul '05

I have a Solaris 2.6 box and am trying to get pop3 over SSL running. I use: qpopper 4.0.5 openssl-0.9.7g stunnel 4.10 compiled with gcc 2.95.3 When I compiled stunnel it made a private ket and certificate in /usr/local/etc/stunnel/stunnel.pem. Do I need anything else? I have the following configuration: Inetd.conf: pop3 stream tcp nowait root /usr/local/sbin/popper qpopper -S -t /poplog stunnel.conf: cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem debug = 7 output = /stunnel.log pid = /stunnel.pid client = yes [pop3s] accept = 995 connect = 110 I run stunnel and get the following output: 2005.07.06 11:34:17 LOG5[17873:1]: stunnel 4.10 on sparc-sun-solaris2.6 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.07.06 11:34:18 LOG7[17873:1]: Snagged 64 random bytes from //.rnd 2005.07.06 11:34:18 LOG7[17873:1]: Wrote 1024 new random bytes to //.rnd 2005.07.06 11:34:18 LOG7[17873:1]: RAND_status claims sufficient entropy for the PRNG 2005.07.06 11:34:18 LOG6[17873:1]: PRNG seeded successfully 2005.07.06 11:34:18 LOG7[17873:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.07.06 11:34:18 LOG7[17873:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.07.06 11:34:18 LOG6[17873:1]: file ulimit = 64 (can be changed with 'ulimit -n') 2005.07.06 11:34:18 LOG6[17873:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.07.06 11:34:18 LOG5[17873:1]: 29 clients allowed 2005.07.06 11:34:18 LOG7[17873:1]: FD 4 in non-blocking mode 2005.07.06 11:34:18 LOG7[17873:1]: FD 5 in non-blocking mode 2005.07.06 11:34:18 LOG7[17873:1]: FD 6 in non-blocking mode 2005.07.06 11:34:18 LOG7[17873:1]: SO_REUSEADDR option set on accept socket 2005.07.06 11:34:18 LOG7[17873:1]: pop3s bound to 0.0.0.0:995 2005.07.06 11:34:18 LOG7[17874:1]: Created pid file /stunnel.pid 2005.07.06 11:34:18 LOG7[17874:0]: Waiting -1 second(s) for 2 file descriptor(s) I connect via pop3 in thunderbird with ssl and qpopper always says: (null) at localhost (127.0.0.1): -ERR Unknown command: "". (nulI/O error flushing output to client at localhost [127.0.0.1]: Broken pipe (32)l) at localhost (127.0.0.1): -ERR POP EOF or I/O Error Stunnel says: 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.07.06 11:37:13 LOG7[17884:1]: pop3s accepted FD=0 from 172.20.10.7:45464 2005.07.06 11:37:13 LOG7[17884:1]: Creating a new context 2005.07.06 11:37:13 LOG7[17884:1]: Context 2 created 2005.07.06 11:37:13 LOG7[17884:2]: pop3s started 2005.07.06 11:37:13 LOG7[17884:2]: FD 0 in non-blocking mode 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on local socket 2005.07.06 11:37:13 LOG5[17884:2]: pop3s connected from 172.20.10.7:45464 2005.07.06 11:37:13 LOG7[17884:2]: FD 1 in non-blocking mode 2005.07.06 11:37:13 LOG7[17884:2]: pop3s connecting 127.0.0.1:110 2005.07.06 11:37:13 LOG7[17884:2]: Remote FD=1 initialized 2005.07.06 11:37:13 LOG7[17884:2]: TCP_NODELAY option set on remote socket 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): before/connect initialization 2005.07.06 11:37:13 LOG7[17884:2]: SSL state (connect): SSLv3 write client hello A 2005.07.06 11:37:13 LOG7[17884:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=4, (IN)->() 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 1, FD=6, (IN)->() 2005.07.06 11:37:13 LOG7[17884:0]: CONTEXT 2, FD=1, (IN)->(IN) The mail never gets delivered to either Thunderbird or outlook express. I get a certificate approval request from Thunderbird to which I grant, then nothing. If I disable ssl in thunderbird the mail gets accepted normally. What might I be doing wrong??? Thanks Doug P

1 4

Certificate renaming
by Paul Jones 05 Jul '05

05 Jul '05

So what you are saying is that Stunnel will still work successfully and find the correct certificates if I do NOT name the certificate files using their hash values? And since my server will only have a maximum of 16 clients, finding the correct certificate shouldn't cause too many speed issues. Right? Cheers. Paul _________________________________________________________________ Sell your car for $9 on carpoint.com.au http://www.carpoint.com.au/sellyourcar

1 0

Certificate renaming
by Paul Jones 04 Jul '05

04 Jul '05

Hi all, I understand that in order for Stunnel to find a certificate, it has to be renamed to something like xxxxxx.0 (where xxxxxx is obtained by using the "openssl x509" command on the certificate). Why is this the case? I read somewhere that this helps Stunnel find the certificate quicker (i.e. Stunnel does not need to look at every certificate file before it knows which one it wants). Can someone provide me a better explanation please? Is there any way around this? Renaming the certificate file in such a manner causes confusion when searching for the certificate of a particular client... Cheers. Paul _________________________________________________________________ REALESTATE: biggest buy/rent/share listings http://ninemsn.realestate.com.au

4 4

AW: [stunnel-users] Reporting problems
by Smith, Derek John 01 Jul '05

01 Jul '05

Hi all, sorry to have to use the list for this, but it would appear to be the last option available. This is from a previous posting from Brian Hatch ... > As the maintenance man of the 3.x branch (yes, some folks do > use it still) > the official stance is this: > > * if it's a security bug, I'll patch it. > * if it's a bug and you have a patch that works, I'll probably > apply it > * if it's a bug and you don't have a patch, I probably don't > have the cycles to investigate it, sorry. > However, the reality is different. Yes, some people still do use release 3. I have customers who prefer proven stability over new innovation. This is meant to be understood in a general way (i.e. database upgrades, OS updates etc) and not specifically to stunnel. I have mailed Brian several times about problems concerning release 3.26 and not a single reply has been received. Maybe the mails never arrived, but I doubt it very much. Also, no changes have been made to the software, so the supplied patch never got applied. In the complete absence of any proof to the contrary, I can only assume that the following statement holds:- RELEASE 3 IS DEAD !!!!!!!!!! I welcome evidence refuting this, but won't hold my breath. In the meantime, testing will start on release 4. Brian, if you're reading this, I'm not trying to start a flame war, or dissing you. A simple mail would have sufficed ... Derek

2 1

4.10 Crashes with Multiple Connections
by Eddie Atherton 30 Jun '05

30 Jun '05

Hi. Just started to use stunnel for NNTP traffic to Giga on a gateway Linux 2.4 box that sits between Windows and my cable modem. The NewsReader I use is configured to open 4 connections at the same time. Downloaded and installed 4.10, then immediately hit the -lpthread problem. Edited the Makefile, did a "make clean", "make", and "make install". Tried again. Got an immediate crash. Tried a few more times. Sometimes it crashed, other times the NewsReader reported one connection as working, one as connected, but not pulling any data, and two connections as connecting. So, it looks like everything works with only one active connection, but it segfaults when 2 or more threads are pulling data. The problem is, I can't always get it to crash. Plus, cpu use of stunnel sometimes pegs at 99%, even after closing the connections, and again this isn't consistent. When I turn debug on, it has always only used one active connection, so I don't get the crash. Plus, when debug is on, and I terminate the connections from the NewsReader, the log file expanded to 18meg in less than a minute. I then downloaded and installed 4.9, and this appears to handle the 4 active connections without any problems. Any suggestions as to what kind of information I should try and collect for this. Cheers, Eddie

1 0

SSL_read returned WANT_ - retry
by Leach, Rich 30 Jun '05

30 Jun '05

Greetings all- I'm an internet developer (mainly ColdFusion, some Windows, database stuff, etc.) and I've just inherited a Windows system that is utilizing Stunnel (I believe it's version 3.4) and in the log files I'm seeing this error all over the place: "SSL_read returned WANT_ - retry" It's usually listed around other messages in the log file such as "socket closed", "connection closed", etc. I noticed these messages in our logs because I got a call to restart our web services; everything froze up and the site would not come up. I stopped and started the web services and everything came back up. For a long time everyone around here has been blaming our ColdFusion server (version 6.1) but it looks to me like the Stunnel is throwing a wrench and halting everything - does anyone know what these errors mean or could you direct me to a place on the stunnel site that could offer some insight? I tried looking around the FAQ section but didn't see my error listed. Any help or input you could provide would be most appreciated! Many thanks in advance, Rich

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users