- stunnel-users - stunnel.org

OpenSSL - write:errno=131
by Andrzej Marecki 11 Jan '05

11 Jan '05

I managed to compile and install stunnel 4.06 under Solaris 2.6. (BTW, I use here the word "managed" becuase it was not straightforward: the up-to-date version - 4.07 - wouldn't compile under Solaris.) My stunnel.conf file reads: cert=/opt/etc/stunnel/pop3.pem chroot = /opt/var/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid output=/var/log/stunnel.log client = no [spop3] accept = localhost:995 connect = localhost:110 [ssmtp] accept = localhost:465 connect = localhost:25 -------------- /opt/etc/stunnel/pop3.pem has been set up according the instructions at: http://www.freebsd.hello.pl/files/modules.php?name=News&file=article&sid=5 ...so I do hope it's OK ;-). Anyway, stunnel daemon works - what I get in stunnel.log reads: stunnel 4.06 on sparc-sun-solaris2.6 PTHREAD+POLL with OpenSSL 0.9.7e 25 Oct 2004 29 clients allowed (Date & time of the messages quoted above are omitted.) Now I try to test stunnel: #/opt/bin/openssl s_client -connect localhost:995 -prexit ...and what I get is: CONNECTED(00000003) write:errno=131 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 148 bytes --- New, (NONE), Cipher is (NONE) --------------- I get the same when "openssl s_client -connect localhost:995" is issued by a non-privileged user. Needless to say I can't connect to port 995 using a bone fide MUA running on a PC under M$W (Thunderbird to be exact). Can you help me, please. Andrzej -- ----------------------------------------------------------------------------- Andrzej Marecki | Torun Centre for Astronomy | e-mail: amr(a)astro.uni.torun.pl N. Copernicus University | WWW: http://www.astro.uni.torun.pl ul. Gagarina 11 | tel: +48 56 6113032 PL-87-100 Torun, POLAND | fax: +48 56 6113009 ----------------------------------------------------------------------------- "If Bill Gates actually had to admin his own stuff, he'd shoot himself." -----------------------------------------------------------------------------

1 0

RE: [stunnel-users] Stunnel and DistCache Patch
by Kling, Kent M. 10 Jan '05

10 Jan '05

autoconf-2.13-14 was my installed version. I upgraded to autoconf-2.53-8 and it now works. Thanks for helping out. Kent -----Original Message----- From: Peter Pentchev [mailto:[email protected]] Sent: Monday, January 10, 2005 8:08 AM To: Senthil Prabu.S Cc: Kling, Kent M.; stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel and DistCache Patch On Mon, Jan 10, 2005 at 11:05:19AM +0530, Senthil Prabu.S wrote: > The problem is that,since the patch you applied have modified the configure.ac file, a brand new configure script should be generated to reflect the change done at the configure.ac. So run "autoconf" command to produce new configure script. > > This will solve your problem. Well, it... depends :) The original poster mentions that when he ran autoconf, he got an error stating that configure.in could not be found. This might mean that he's running an older version of autoconf, one that only looks for configure.in, not configure.ac. Kent, what does 'rpm -qa | fgrep auto' tell you? G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)cnsys.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 I am the meaning of this sentence. This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services.Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

Stunnel and DistCache Patch
by Kling, Kent M. 10 Jan '05

10 Jan '05

we have a RedHat 7.2 system and we are trying to apply the distcache_geoff.patch to enable distcache 1.4.5 with stunnel-4.04. We have run into a snag after the configure script is run and we attempt the "make", it complains that configure.in is missing. In step 2 is our "configure" line wrong? # make output: cd . && aclocal cd . && automake --gnu --include-deps Makefile cd . \ && CONFIG_FILES=Makefile CONFIG_HEADERS= /bin/sh ./config.status config.status: creating Makefile cd . && autoconf autoconf: configure.in: No such file or directory make: *** [configure] Error 1 Our work around is to change directory into the /usr/src/stunnel-4.04/src and run "make" from that directory to create our stunnel binary. Any idea why it won't work from the top directory. our stunnel source resides in /usr/src/stunnel-4.04, distcache_geoff.patch is in /usr/src and distcache-1.4.5 is in /usr/local/distcache-1.4.5. Our installation steps are below: step 1. # patch -p0 < distcache_geoff.patch output: patching file stunnel-4.04/configure.ac patching file stunnel-4.04/src/common.h patching file stunnel-4.04/src/options.c patching file stunnel-4.04/src/prototypes.h patching file stunnel-4.04/src/ssl.c step 2. # cd stunnel-4.04 # export CFLAGS="-DHAVE_DISTCACHE_DC_CLIENT_H -I/usr/local/distcache-1.4.5/include"; export LDFLAGS="-L/usr/local/distcache-1.4.5/lib -ldistcache -lnal"; ./configure --prefix=/usr/local/stunnel-4.04 --with-ssl=/usr/local/openssl-0.9.7e --with-tcp-wrappers --disable-shared output: checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking build system type... i686-pc-linux-gnu checking host system type... i686-pc-linux-gnu checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether make sets ${MAKE}... (cached) yes checking for ld used by GCC... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognise dependant libraries... pass_all checking command to parse /usr/bin/nm -B output... ok checking how to run the C preprocessor... gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... GNU/Linux ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... no checking whether to build static libraries... yes creating libtool checking for SSL directory... /usr/local/openssl-0.9.7e checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... no checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... yes checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... yes checking pty.h presence... yes checking for pty.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... yes checking for _getpty... no checking for daemon... yes checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init Thanks, Kent Kling This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services.Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

3 2

Error:1408F10B, Wrong Version Number
by Emily Mattes 10 Jan '05

10 Jan '05

I'm trying to set up STunnel 4.07 client-side for Qm (http://pyric.org/qm/) on Windows XP Pro, but when I try to send a message Qm times out and I get this error in the STunnel log: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Here's my config file: client = yes delay = yes [pop3] accept = 110 connect = pop.gmail.com:995 [smtp] accept = 25 connect = smtp.gmail.com:587 This is my first time trying to configure SSL for anything, so I really don't know what's going wrong. Any help would be greatly appreciated. Thank you very much! -- Emily -- schroedinger(a)gmail.com

1 0

Newbie trying to connect over a Microsoft Proxy
by Michael Blake 06 Jan '05

06 Jan '05

Hi All I'm a relative newbie to Stunnel, and am trying to set up a tunnel so I can Remote Desktop from work to my PC/server at home. I'm using versions 4.05 & 4.06 of the Windows binaries. A Microsoft Proxy Server v2.0 is used at work, and it proxies HTTP, Secure (is that SSL/port 443??), FTP and Gopher over port 800. I'm not sure if it proxies Socks, as there's no entry for it in Internet Explorer. I've tested the configuration and it works on my LAN, and it works from home when I enter my domain home (so my firewall is set up correctly). My config is as follows: #Client CAfile = stunnel.pem cert = stunnel.pem client = yes verify = 3 [rdp-80] accept = localhost:3390 connect = xxx.xxx.xxx.xxx:80 #Server CAfile = stunnel.pem cert = stunnel.pem client = yes verify = 3 [rdp-80] accept = 192.168.10.221:80 connect = 127.0.0.1:3389 Is there something I need to do to traverse this proxy? Any help would be greatly appreciated! Tks, Michael Blake IT Consultant | Headbyte Limited Tel: + 44 7909 844273 http://www.headbyte.co.uk

2 2

stunnel-4.07 on non-IPv6 systems
by Hans Werner Strube 04 Jan '05

04 Jan '05

On systems which do not yet support IPv6 and do not have getnameinfo (for instance, Solaris 7), also NI_NUMERICHOST and NI_NUMERICSERV are usually undefined. In stunnel-4.07, this causes compilation of src/network.c to fail. Patch: *** src/network.c.ORI Mon Jan 3 00:20:27 2005 --- src/network.c Tue Jan 4 14:46:10 2005 *************** *** 73,78 **** --- 73,84 ---- static const char *s_gai_strerror(int); #ifndef HAVE_GETNAMEINFO + #ifndef NI_NUMERICHOST + #define NI_NUMERICHOST 2 + #endif + #ifndef NI_NUMERICSERV + #define NI_NUMERICSERV 8 + #endif static int getnameinfo(const struct sockaddr *, socklen_t, char *, int , char *, int , int ); #endif

1 0

bugfix for the makefile of stunnel 4.07
by deepstar＠ulyssis.org 04 Jan '05

04 Jan '05

Hi, there appears to be a bug in the makefile (tools/Makefile) that installed files/directories in the wrong place when installing to another root directory (DESTDIR env var) The attached patch should fix it. greets, -- Steven Van Acker

1 0

Port forwarding based on application type
by Konda Ankireddyapalli 03 Jan '05

03 Jan '05

Hello all, Can stunnel forward the traffic to different ports based on an application type as opposed to by port? If yes, how can it be configured? My need is that on the client side we have many applications that share a single outgoing port. On the server side I want to demultiplex the stunnel traffic coming in on a single port to multiple applications after decryption. Thanks in advance, Konda

1 0

Stunnel 4.07 released
by Michal Trojnara 03 Jan '05

03 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 New release fixes several bugs introduced in version 4.06. ChangeLog entry: Version 4.07, 2005.01.03, urgency: MEDIUM: * Bugfixes - Problem with infinite poll() timeout negative, but not equal to -1 fixed. - Problem with a file descriptor ready to be read just after a non-blocking connect call fixed. - Compile error with EAI_NODATA not defined or equal to EAI_NONAME fixed. - IP address and TCP port textual representation length (IPLEN) increased to 128 bytes. - OpenSSL engine support is only used if engine.h header file exists. - Broken NT Service mode on WIN32 platform fixed. - Support for IPv4-only WIN32 machines restored. Homepage: http://stunnel.mirt.net/ Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFB2IcR/NU+nXTHMtERAn/hAJ42XjEtUrkyixamOeMV0rRGCvqwDACg21LB sYFF8L4teETWdrkLjfkdX2E= =qOfD -----END PGP SIGNATURE-----

1 0

A couple of patches against 4.06
by Peter Pentchev 31 Dec '04

31 Dec '04

Hi, First of all, thanks for writing and maintaining this great piece of software :) When I ported 4.06 to FreeBSD on Monday, there were three changes that needed to be made. One is the passing of -1, not -1000, to poll(2), which has already been discussed on this list (and which, by the way, is mandated by POSIX and the Single Unix Specification, as you can see at http://www.opengroup.org/onlinepubs/007908799/xsh/poll.html ) The other two can be seen in the patch below. The first one is related to the fact that EAI_NODATA is not present on all systems - it was actually obsoleted by the KAME implementation of IPv6 about an year ago. On some systems it is defined and has its own value - then stunnel builds just fine. On other systems it is not defined at all, while on yet other systems it is aliased to EAI_NONAME, so 'case EAI_NONAME' and 'case EAI_NODATA' would produce an error message from the compiler. Thus, the #ifdef and #if in the first chunk of the patch. This could not be done portably with a single statement, something like '#if defined(EAI_NODATA) && EAI_NODATA != EAI_NONAME', since there are some compilers that would barf on the second part if EAI_NODATA was not actually defined. The second chunk of the patch fixes getnameinfo() error reporting - just like with getaddrinfo(), getnameinfo() errors should be displayed using s_gai_strerror() instead of sockerror(). Keep up the good work! G'luck, Peter --- src/network.c.orig Thu Oct 14 18:03:49 2004 +++ src/network.c Wed Dec 29 14:16:06 2004 @@ -416,8 +416,12 @@ return "Temporary failure in name resolution (EAI_AGAIN)"; case EAI_FAIL: return "Non-recoverable failure in name resolution (EAI_FAIL)"; +#ifdef EAI_NODATA +#if EAI_NODATA != EAI_NONAME case EAI_NODATA: return "No address associated with nodename (EAI_NODATA)"; +#endif +#endif case EAI_FAMILY: return "ai_family not supported (EAI_FAMILY)"; case EAI_SOCKTYPE: @@ -562,10 +566,13 @@ /* getnameinfo() version */ char *s_ntop(char *text, SOCKADDR_UNION *addr) { char host[20], port[6]; + int err; - if(getnameinfo(&addr->sa, addr_len(*addr), - host, 20, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { - sockerror("getnameinfo"); + err = getnameinfo(&addr->sa, addr_len(*addr), + host, 20, port, 6, NI_NUMERICHOST|NI_NUMERICSERV); + if (err) { + s_log(LOG_ERR, "Error resolving the specified address: %s", + s_gai_strerror(err)); strcpy(text, "unresolvable IP"); return text; } -- Peter Pentchev roam(a)ringlet.net roam(a)cnsys.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 .siht ekil ti gnidaer eb d'uoy ,werbeH ni erew ecnetnes siht fI

2 5