Thank you for the reply...

On 15 May 2009 at 20:55, Michal (Michal Trojnara [email protected]) commented about Re: [stunnel-users] Can't connect to Yahoo POP3:

Gary Kuznitz wrote:

...

How can I get a god certificate for Stunnel to use? How would I set that up in Stunnel?

You don't really need a certificate for an SSL client. Just disable it.

How can I disable it?

You rather want to setup server certificate verification with "CAfile" and "verify".

I have un-commented: CAfile = certs.pem verify = 2

That gave me an error: 2009.05.15 12:38:13 LOG3[16278859:16279139]: Error loading verify certificates from certs.pem 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: B084002 : error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib 2009.05.15 12:38:13 LOG3[16278859:16279139]: error stack: 2006D080 : error:2006D080:BIO routines:BIO_new_file:no such file 2009.05.15 12:38:13 LOG3[16278859:16279139]: SSL_CTX_load_verify_locations: 2001002: error:02001002:system library:fopen:No such file or directory

...

; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1

IMHO it's not a good idea for non-interactive connections, e.g. pop3.

I will comment out both of the above.

...

[pop3_DslextremeGmail] accept = 127.0.0.1:11010 connect = pop.gmail.com:995 delay = yes

[pop3_Yahoo] accept = 127.0.0.1:11011 connect = pop.mail.yahoo.com:995 delay = yes

[cut]

...

2009.05.14 15:48:12 LOG7[16278859:16041803]: SSL context initialized for service pop3_Docfxit_Yahoo

I guess you use a different configuration file, as pop3_Docfxit_Yahoo is not defined in the one you sent.

I'm sorry. I'm really using [pop3_Yahoo]

After I make a change to the conf. file Do I have to re-boot the PC or is it enough to exit out of Stunnel and launch it again?

Thank you,

Gary Kuznitz

Best regards, Mike _______________________________________________ stunnel-users mailing list [email protected] http://stunnel.mirt.net/mailman/listinfo/stunnel-users

On Fri, 2009-05-15 20:55:12 +0200, Michal Trojnara wrote:

Gary Kuznitz wrote:

...

; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1

IMHO it's not a good idea for non-interactive connections, e.g. pop3.

On the contrary, I think Stunnel should disable Nagle by default:

If the Nagle algorithm is enabled, the TCP layer delays sending of small chunks of data for some ms in the expectation of other small chunks to be fed to the socket. The small chunks are then combined and sent in one single IP packet.

This is reasonable for connections that transport larger amounts of data without waiting for an explicit acknowledge from the receiver (on the application level). For e.g. POP3, this allows the application to feed the mail body line-by-line to the TCP socket, without sending silly small 80-byte packets over the wire.

For interactive connections (or even during the protocol handshake of POP3) the Nagle algorithm adds an extra delay to each round-trip. This is why it's up to the application to decide for or against Nagle.

However, the stunnel sockets are not connected to the application. Stunnel just forwards data from one socket to another (besides encrypting, of course). For that, it reads as much data as available from one socket and immediately feeds it to the other one. Provided the original application configured Nagle appropriately, there are no silly small packets on the wire. Thus, the size of the data chunks Stunnel reads and writes are suitable for the protocol already. I don't see a reason for additional delays.

I can imagine one situation where it was reasonable to have Nagle enabled for Stunnel: If the tunnel end point is on the same box as the application, and the TCP layer is clever enough to skip Nagle for 'local' connections, then Stunnel may have Nagle enabled on the socket connected to the 'remote' host.

Disabling Nagle on sockets to localhost should always be a good idea.

Ludolf

P.S. @Gary: Don't worry too much about setting TCP_NODELAY or not. The effect of the Nagle algorithm may be measurable, but I don't expect you to feel a difference while fetching e-mails.

Hi,

We need to support dual stack support for IPv6 and IPv4. We are currently using stunnel v4.25 to encrypt traffic between mod_jk connector and JBoss Application server. So one node in a cluster can be a IPv4 machine and other can have IPv6 address.

We would like to know if stunnel v4.25 supports both IPv4 and IPv6 setup.

Is exclusive support for IPv6 available in stunnel v4.25?

Thanks, Gaurav

Thanks for the response. I got answer to my queries.

When you say "IPv6-enabled stunnel", do you mean that we need to provide parameter "IPV6=on", during compile time. Is there any other parameter that we need to provide?

Is the support for IPv6 not turned on by default?

Is there any other configuration required for OpenSSL?

Thanks, Gaurav

-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Monday, May 18, 2009 1:36 PM To: [email protected] Subject: Re: [stunnel-users] Stunnel v4.25 support for IPv6

Bansal, Gaurav (Gaurav) wrote:

We need to support dual stack support for IPv6 and IPv4. We are currently using stunnel v4.25 to encrypt traffic between mod_jk connector and JBoss Application server. So one node in a cluster can

be

a IPv4 machine and other can have IPv6 address.

We would like to know if stunnel v4.25 supports both IPv4 and IPv6 setup.

IPv6-enabled stunnel gracefully handles both IPv4 and IPv6 addresses. You can accept connections on IPv4 and IPv6 addresses and your can connect IPv4 and IPv6 addresses without any special precautions.

Is exclusive support for IPv6 available in stunnel v4.25?

I'm not sure I understand what you mean by "exclusive support for IPv6"... If you only accept connections on an IPv6 address I guess you could say you "exclusively" support it.

Mike _______________________________________________ stunnel-users mailing list [email protected] http://stunnel.mirt.net/mailman/listinfo/stunnel-users