<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:'Courier New', courier, monaco, monospace, sans-serif;font-size:10pt"><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">Hi,</div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">We have a problem in our production system. Need help to isolate the cause. Want to know whether issue is with stunnel. We are not in situation to upgrade, since we are in production. Your help is appreciated.</div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif;
font-size: 10pt; "><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">Environment: </div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">1) Client program(java in win desktops) connect to server (solaris) Stunnel port which is forwarded locally to an inetd program which connects to oracle database. ( 2 Tier Architecture )</div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">2) Setup worked for almost 2 years without any issue, suddenly since last September, we have connection reset issue on app clients intermittently. </font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif"
size="2"><br></font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">3) almost lots of clients ( in 100's ) get reset and we find 100's of below messages in /var/adm/messages file of solaris.</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2"><br></font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">stunnel: [ID 821868 daemon.info] LOG6[21204:5272]: s_poll_wait timeout: connection reset</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2"><div>stunnel: [ID 821868 daemon.notice] LOG5[21204:4804]: Connecti</div><div>on reset: 1867341 bytes sent to SSL, 55211 bytes sent to socket</div></font></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif;
font-size: 10pt; "><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">4) After reset, Client attempt to relogin works without any issue. there is no pattern of load, time, no of users.</div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">5) all the database, inetd program, stunnel runs with oracle userid</div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">6) No other OS related, resource related errors in /var/adm/messages.</div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace,
sans-serif; font-size: 10pt; "><br></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">7) At this point, i dont have stunnel debug log during the problem occurrence , since we have cron job that recycles logs. if required will send later. </font></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">8) Interms of change happend before the first occurance of issue, we did CPU/RAM upgrade, Oracle Database CPU Patch. But database team says no errors reported on oracle side during reset.</div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace,
sans-serif; font-size: 10pt; ">9) Max users on database is around 1024, which our max users is 300. </div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">********************************************************************</div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">Config:</div><div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">#/usr/local/bin/stunnel -version</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">stunnel 4.25 on
sparc-sun-solaris2.10 with OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555)</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2"> </font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">Global options</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">debug = 5</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">pid
= /usr/local/var/run/stunnel/stunnel.pid</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">RNDbytes = 64</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">RNDfile = /dev/urandom</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">RNDoverwrite = yes</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2"> </font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">Service-level options</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">cert
= /usr/local/etc/stunnel/stunnel.pem</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">ciphers = ALL:!DHE-RSA-AES256-SHA:!DHE-DSS-AES256-SHA:!AES256-SHA:!ADH:+RC4:@STRENGTH</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">key = /usr/local/etc/stunnel/stunnel.pem</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">session = 300 seconds</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">stack = 65536 bytes</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">sslVersion
= SSLv3 for client, all for server</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">TIMEOUTbusy = 300 seconds</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">TIMEOUTclose = 60 seconds</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">TIMEOUTconnect = 10 seconds</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">TIMEOUTidle = 43200 seconds</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">verify = none</font></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt;
"><br></div></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; ">-------------------------------------------------</div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">#uname -a</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">SunOS xxxxxxxxxx 5.10 Generic_144488-02 sun4u sparc SUNW,SPARC-Enterprise</font></div><div><br></div><div>---------------------------------------------------------------------</div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2"># gcc -v</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif"
size="2">Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">Thread model: posix</font></div><div><font class="Apple-style-span" face="'Courier New', courier, monaco, monospace, sans-serif" size="2">gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath)</font></div><div><br></div><div>------------------------------------------------------------------------</div><div># openssl version</div><div>OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937
CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555)</div><div>-----------------------------------------------------------------------------</div><div><div># more avaloq.conf ( Ssl config file we use /usr/local/bin/stunnel /opt/app/ssl/stunnel.conf</div><div>; Sample stunnel configuration file by Michal Trojnara 2002-2006</div><div>; Some options used here may not be adequate for your particular configuration</div><div>; Please make sure you understand them (especially the effect of chroot jail)</div><div> </div><div>; Certificate/key is needed in server mode and optional in client mode</div><div>cert = /opt/app/ssl/cert.pem</div><div>key = /opt/app/ssl/cert.pem</div><div> </div><div>; Protocol version (all, SSLv2, SSLv3, TLSv1)</div><div>sslVersion = all</div><div> </div><div>; Some security enhancements for UNIX systems - comment them out on
Win32</div><div>;chroot = /usr/local/var/lib/stunnel/</div><div>;setuid = nobody</div><div>;setgid = nogroup</div><div>; PID is created inside chroot jail</div><div>pid = /opt/app/ssl/avaloq_ssl/avaloq.pid</div><div> </div><div>; Some performance tunings</div><div>socket = l:TCP_NODELAY=1</div><div>socket = r:TCP_NODELAY=1</div><div>;compression = rle</div><div> </div><div>; Workaround for Eudora bug</div><div>;options = DONT_INSERT_EMPTY_FRAGMENTS</div><div> </div><div>; Authentication stuff</div><div>;verify = 2</div><div>; Don't forget to c_rehash CApath</div><div>; CApath is located inside chroot jail</div><div>;CApath = /certs</div><div>; It's often easier to use CAfile</div><div>;CAfile = /usr/local/etc/stunnel/certs.pem</div><div>; Don't forget to c_rehash CRLpath</div><div>; CRLpath is located inside chroot jail</div><div>;CRLpath = /crls</div><div>; Alternatively you can use CRLfile</div><div>;CRLfile =
/usr/local/etc/stunnel/crls.pem</div><div> </div><div>; Some debugging stuff useful for troubleshooting</div><div>debug = 7</div><div>output = /db/avaloq/export/stunnel.log </div><div> </div><div>; Use it for client mode</div><div>;client = yes</div><div> </div><div>; Service-level configuration</div><div> </div><div>[application]</div><div>accept =7766</div><div>connect =localhost:7767</div><div>TIMEOUTconnect = 60</div><div> </div><div>;[pop3s]</div><div>;accept = 995</div><div>;connect = 110</div><div> </div><div>;[imaps]</div><div>;accept = 993</div><div>;connect = 143</div><div> </div><div>;[ssmtp]</div><div>;accept = 465</div><div>;connect = 25</div><div> </div><div>;[https]</div><div>;accept = 443</div><div>;connect = 80</div><div>;TIMEOUTclose = 0</div><div> </div><div>;
vim:ft=dosini</div><div>-------------------------------------------------------------------------------- </div></div><div>#netstat -an |grep 7766 |wc -l</div><div> 249</div><div><br></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><br><span class="Apple-style-span" style="font-family: 'comic sans ms'; font-size: medium; color: rgb(255, 0, 127); ">Regards,</span></div><div style="color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "><font color="#ff007f" face="comic sans ms" size="3"></font><span class="Apple-style-span" style="font-family: 'comic sans ms'; font-size: medium; color: rgb(0, 0, 255); ">kumar </span></div><div style="position: fixed; color: black; font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: 10pt; "></div>
</div><br></body></html>