<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16640" name=GENERATOR></HEAD>
<BODY>
<DIV> </DIV>
<DIV>Hello, expert:</DIV>
<DIV> </DIV>
<DIV>I have a question. Can stunnel be used behind a router without the
router forwarding the port number? Recently I found one VNC can work this
way. Was wondering whether you can modify the config. file to make it
work.</DIV>
<DIV> </DIV>
<DIV>right now I set (serverside) the router forwarding port 8888 to the
desktop, the stunnel on the desktop listening for port 8888 and forward
this stream 8888 to VNC's 5955.</DIV>
<DIV> </DIV>
<DIV>My purpose is to bypassing the router forwarding part.</DIV>
<DIV> </DIV>
<DIV>Thanks for any input.</DIV>
<DIV> </DIV>
<DIV>J</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Thanks for the info. Turns out I caused my own problems. I added some features to stunnel that require ldap. That is what brought in the new openssl dependencies. I need to make a custom ldap library using the FIPS openssl libraries.</DIV>
<DIV> </DIV>
<DIV>Thanks again.</DIV>
<DIV>-Joe</DIV>
<DIV> </DIV>
<DIV>-----Original Message-----</DIV>
<DIV>From: stunnel-users-bounces@mirt.net [mailto:stunnel-users-bounces@mirt.net] On Behalf Of Luis Rodrigo Gallardo Cruz</DIV>
<DIV>Sent: Thursday, April 10, 2008 5:32 PM</DIV>
<DIV>To: stunnel-users@mirt.net</DIV>
<DIV>Subject: Re: [stunnel-users] Linux FIPS compile libary question</DIV>
<DIV> </DIV>
<DIV>On Thu, Apr 10, 2008 at 01:30:22PM -0400, Joe Kemp wrote:</DIV>
<DIV>> I guess the question is what will the linker do with a shared libssl</DIV>
<DIV>> in /lib and a static one in /usr/local/sslfips/lib. I ran the libtool</DIV>
<DIV>> with a -v. It gave tons of output and only had references to the</DIV>
<DIV>> library in /usr/local/sslfips.</DIV>
<DIV>></DIV>
<DIV>> So I am going to assume I am seeing the dependencies of other</DIV>
<DIV>> libraries used by stunnel. For instance libldap needs openssl and</DIV>
<DIV>> uses the shared version. It's a little nerve-wracking ensuring FIPS</DIV>
<DIV>> compliance.</DIV>
<DIV> </DIV>
<DIV>That sounds ... ugly. If your shared libraries can pull in a copy of libssl.so, you run the risk that some symbols might be resolved at run time against that copy, instead of against the static copy "inside"</DIV>
<DIV>the executable. Unless you were to link with -Bsymbolic, which is an advanced option invented with no other purpose than to trip inocent students of c linkage.</DIV>
<DIV> </DIV>
<DIV>For this kind of stuff, I'd advice you to compile an stunnel with as few external libraries as you can get away with, and relink *all* those libraries to use your static libssl. Even better, get static libraries for them all and link against that.</DIV>
<DIV> </DIV>
<DIV>> Is there a way to see just what the stunnel layer depends on? Ldd -v</DIV>
<DIV>> gave me more info but I am assuming it is still showing all levels of</DIV>
<DIV>> dependencies (stunnel's, libldap's, libsasl2, etc.).</DIV>
<DIV> </DIV>
<DIV> objdump -x /usr/bin/stunnel |grep NEEDED gives you the list of sonames embedded in the executable. ldd tells you how the dynamic linker will resolve them to actual .so files.</DIV>
<DIV>_______________________________________________</DIV>
<DIV>stunnel-users mailing list</DIV>
<DIV>stunnel-users@mirt.net</DIV>
<DIV><A
href="http://stunnel.mirt.net/mailman/listinfo/stunnel-users">http://stunnel.mirt.net/mailman/listinfo/stunnel-users</A></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>-- </DIV>
<DIV>Internal Virus Database is out-of-date.</DIV>
<DIV>Checked by AVG Free Edition. </DIV>
<DIV>Version: 7.5.516 / Virus Database: 269.22.5/1357 - Release Date: 4/3/2008 10:48 AM</DIV>
<DIV> </DIV></BODY></HTML>