<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Oscar Usifer wrote:<div><br><div><div><blockquote type="cite"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><div style="font-family:helvetica,arial;font-size:10pt;color:black"><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><font color="black" face="Arial, Helvetica, sans-serif" size="2"><font><font color="black" face="Arial, Helvetica, sans-serif" size="2"><div>I am using the most current versions to date for each software stacks. All use the same stunnel.conf file. </div> </font></font></font></font></div></div></font></blockquote><div><br></div>Ok.</div><div><br><blockquote type="cite"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><div style="font-family:helvetica,arial;font-size:10pt;color:black"><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><font color="black" face="Arial, Helvetica, sans-serif" size="2"><font><font color="black" face="Arial, Helvetica, sans-serif" size="2"><div>setuid = root</div><div> <div>setgid = root</div></div></font></font></font></font></div></div></font></blockquote><div><br></div><div>Interesting. What did you want to achieve with these options?</div><br><blockquote type="cite"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><div style="font-family:helvetica,arial;font-size:10pt;color:black"><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><font color="black" face="Arial, Helvetica, sans-serif" size="2"><font><font color="black" face="Arial, Helvetica, sans-serif" size="2"><div> <div>rpminit# stunnel -version</div></div><div> <div>stunnel 4.33 on amd64-portbld-freebsd8.1 with OpenSSL 0.9.8n 24 Mar 2010</div></div></font></font></font></font></div></div></font></blockquote><div><br></div><div>"transparent" option is not currently supported on FreeBSD platform. The manual clearly lists supported platforms.</div><div><br></div><blockquote type="cite"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><div style="font-family:helvetica,arial;font-size:10pt;color:black"><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><font color="black" face="Arial, Helvetica, sans-serif" size="2"><font><font color="black" face="Arial, Helvetica, sans-serif" size="2"><div> </div> <div> <div><span class="Apple-style-span" style="font-size: 13px; ">[foo@localhost ~]$ uname -a</span></div></div><div><span class="Apple-style-span" style="font-size: 13px; "> <div>Linux localhost.localdomain 2.6.18-194.el5 #1 SMP Fri Apr 2 14:58:14 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux</div></span></div></font></font></font></font></div></div></font></blockquote><div><br></div><div><div>"transparent" option is not currently supported on this Linux 2.6 earlier than 2.6.28. You need to upgrade your kernel.</div><div><br></div></div><blockquote type="cite"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><div style="font-family:helvetica,arial;font-size:10pt;color:black"><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><font color="black" face="Arial, Helvetica, sans-serif" size="2"><font><font color="black" face="Arial, Helvetica, sans-serif" size="2"><div><span class="Apple-style-span" style="font-size: 13px; "> <div>stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008</div></span></div></font></font></font></font></div></div></font></blockquote><div><br></div><div>This stunnel is too old. You need at least version 4.28:</div><a href="http://stunnel.mirt.net/?page=ChangeLog_sdf">http://stunnel.mirt.net/?page=ChangeLog_sdf</a></div><div><br><blockquote type="cite"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><div style="font-family:helvetica,arial;font-size:10pt;color:black"><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><font color="black" face="Arial, Helvetica, sans-serif" size="2"><font><font color="black" face="Arial, Helvetica, sans-serif" size="2"><div><span class="Apple-style-span" style="font-size: 13px; "> </span><div style="font-size: 13px; "><span class="Apple-style-span" style="font-size: small; ">Linux ubuntu 2.6.35-24-generic #42-Ubuntu SMP Thu Dec 2 02:41:37 UTC 2010 x86_64 GNU/Linux</span></div><div style="font-size: 13px; "><span class="Apple-style-span" style="font-size: small;"><div> <div>Source: stunnel4</div></div> <div>Version: 3:4.29-1</div></span></div></div></font></font></font></font></div></div></font></blockquote><div><br></div><div>This one meets basic requirements. That's a good start.</div><br><blockquote type="cite"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><div style="font-family:helvetica,arial;font-size:10pt;color:black"><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><font color="black" face="Arial, Helvetica, sans-serif" size="2"><font><font color="black" face="Arial, Helvetica, sans-serif" size="2"><div><div style="font-size: 13px; "><span class="Apple-style-span" style="font-size: small;"> <div><span class="Apple-style-span" style="font-family: 'Helvetica Neue', 'Lucida Grande', Helvetica, Arial, Verdana, sans-serif; font-size: 14px; ">root@ubuntu:~# tcpdump -i any port 80</span></div></span></div><div style="font-size: 13px; "><span class="Apple-style-span" style="font-family: 'Helvetica Neue', 'Lucida Grande', Helvetica, Arial, Verdana, sans-serif; font-size: 14px; "> <div>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</div> <div>listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes</div> <div><br></div> <div>13:29:34.794295 IP 192.168.103.69.40886 > localhost.www: Flags [S], seq 3983439445, win 32792, options [mss 16396,sackOK,TS val 46696 ecr 0,nop,wscale 6], length 0</div> <div>13:29:37.801619 IP 192.168.103.69.40886 > localhost.www: Flags [S], seq 3983439445, win 32792, options [mss 16396,sackOK,TS val 46997 ecr 0,nop,wscale 6], length 0</div> <div>13:29:43.811568 IP 192.168.103.69.40886 > localhost.www: Flags [S], seq 3983439445, win 32792, options [mss 16396,sackOK,TS val 47598 ecr 0,nop,wscale 6], length 0</div></span></div></div></font></font></font></font></div></div></font></blockquote><div><br></div><div>SYN packets are properly generated (IP_TRANPARENT was issued by stunnel and accepted by kernel), but the no response is generated. We're almost there.</div><br><blockquote type="cite"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><div style="font-family:helvetica,arial;font-size:10pt;color:black"><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><font color="black" face="Arial, Helvetica, sans-serif" size="2"><font><font color="black" face="Arial, Helvetica, sans-serif" size="2"><div><div style="font-size: 13px; "><span class="Apple-style-span" style="font-family: 'Helvetica Neue', 'Lucida Grande', Helvetica, Arial, Verdana, sans-serif; font-size: 14px; "> <div><span class="Apple-style-span" style="font-family: Arial, Helvetica, sans-serif; font-size: small; ">2011.01.07 13:29:34 LOG6[990:140669015144192]: local_bind succeeded on the original port</span></div><div><font class="Apple-style-span" face="Arial, Helvetica, sans-serif"> <div style="font-size: small; ">2011.01.07 13:29:34 LOG6[990:140669015144192]: connect_blocking: connecting 127.0.0.1:80</div> <div style="font-size: small; ">2011.01.07 13:29:34 LOG7[990:140669015144192]: connect_blocking: s_poll_wait 127.0.0.1:80: waiting 10 seconds</div> <div style="font-size: small; ">2011.01.07 13:29:44 LOG3[990:140669015144192]: connect_blocking: s_poll_wait 127.0.0.1:80: timeout</div></font></div></span></div></div></font></font></font></font></div></div></font></blockquote><div><div><br>That's basically the same information as seen by stunnel.</div><br><div><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><div><div><div></div></div></div></div></div><div>My guess is that those SYN packets were rejected for some reasons.</div><div>In order to locate the mechanism that caused it you could try to:</div><div> - Check the output of "dmesg" for any rejected packets.</div><div> - Disable your firewall.</div><div> - Disable reverse patch filtering on other interfaces.</div><div> - Change the IP address of "connect" option to the IP of a different interface (other than loopback). You could also try to connect a service on a separate host (just make sure your stunnel host is a default gateway for this separate host).</div><div><br></div></div><blockquote type="cite"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><div style="font-family:helvetica,arial;font-size:10pt;color:black"><div id="AOLMsgPart_2_51d570f1-c983-4ebc-b4c6-1bccd96a9d89"><font color="black" size="2" face="Arial, Helvetica, sans-serif"><font color="black" face="Arial, Helvetica, sans-serif" size="2"><div>Yes. FYI as a test case, if it was as easy as reading the above document, there would be no RFC. In regards to, <a href="http://www.stunnel.org/faq/transparent.html">http://www.stunnel.org/faq/transparent.html</a></div></font></font></div></div></font></blockquote><div><br></div><div>Yes - stunnel.org is a serious problem to me. It's outdated, confusing, and it violates my trademark of "stunnel". I could use a help of a lawyer experienced in UDRP. Can anyone help me?</div><div><br></div></div>Mike</div></div></body></html>