<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi all!<div class=""><br class=""></div><div class="">We’ve been using stunnel as part of a vendor supplied product for some time to connect a large application running in an application server on Windows to Active Directory for authentication via LDAPS (for some reason, it only natively supports LDAP!).</div><div class=""><br class=""></div><div class="">Anyway, it’s been working fine until a couple of weeks ago when we started getting intermittent failures against all of our configured Domain Controllers (the upstream LDAPS servers).</div><div class=""><br class=""></div><div class="">With no change in STunnel or DC config, some connections would abort with the following log:</div><div class=""><br class=""></div><div class="">SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number</div><div class=""><br class=""></div><div class="">… while others worked fine.</div><div class=""><br class=""></div><div class="">The error is not limited to any one of the upstream DCs nor does it occur for every request.</div><div class=""><br class=""></div><div class="">We’ve updated STunnel to the latest version (5.31) and the problem remains running on Windows 2008 R2 SP1.</div><div class=""><br class=""></div><div class="">Below are two transactions from the same instance of STunnel connecting to the same DC one which works and one which doesn’t (IP addresses obfuscated).</div><div class=""><br class=""></div><div class="">Config in use:</div><div class="">{{{</div><div class=""><div class="">client = yes</div><div class="">debug = 7</div><div class="">output = e:\prog\stunnel\stunnel.log</div><div class="">options = NO_SSLv2</div><div class=""><br class=""></div><div class="">[ldaps]</div><div class="">accept = localhost:389</div><div class="">connect = domain.local:636</div></div><div class="">}}}</div><div class=""><br class=""></div><div class="">Any thoughts gratefully received!</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Matthew</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Fails</div><div class="">====</div><div class=""><br class=""></div><div class=""><div class="">2016.03.04 15:20:25 LOG7[14]: Service [ldaps] started</div><div class="">2016.03.04 15:20:25 LOG5[14]: Service [ldaps] accepted connection from 127.0.0.1:63130</div><div class="">2016.03.04 15:20:25 LOG6[14]: failover: round-robin, starting at entry #2</div><div class="">2016.03.04 15:20:25 LOG6[14]: s_connect: connecting 10.10.1.254:636</div><div class="">2016.03.04 15:20:25 LOG7[14]: s_connect: s_poll_wait 10.10.1.254:636: waiting 10 seconds</div><div class="">2016.03.04 15:20:25 LOG5[14]: s_connect: connected 10.10.1.254:636</div><div class="">2016.03.04 15:20:25 LOG5[14]: Service [ldaps] connected remote server from 10.10.1.225:63131</div><div class="">2016.03.04 15:20:25 LOG7[14]: Remote socket (FD=448) initialized</div><div class="">2016.03.04 15:20:25 LOG6[14]: SNI: sending servername: <a href="http://ad.kent.ac.uk" class="">ad.kent.ac.uk</a></div><div class="">2016.03.04 15:20:25 LOG7[14]: SSL state (connect): before/connect initialization</div><div class="">2016.03.04 15:20:25 LOG7[14]: SSL state (connect): SSLv3 write client hello A</div><div class="">2016.03.04 15:20:25 LOG7[14]: SSL alert (write): fatal: protocol version</div><div class="">2016.03.04 15:20:25 LOG3[14]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number</div><div class="">2016.03.04 15:20:25 LOG5[14]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket</div><div class="">2016.03.04 15:20:25 LOG7[14]: Remote socket (FD=448) closed</div><div class="">2016.03.04 15:20:25 LOG7[14]: Local socket (FD=492) closed</div><div class="">2016.03.04 15:20:25 LOG7[14]: Service [ldaps] finished (0 left)</div><div class=""><br class=""></div><div class="">Works</div><div class="">======</div><div class=""><br class=""></div><div class="">2016.03.02 18:18:01 LOG7[204]: Service [ldaps] started</div><div class="">2016.03.02 18:18:01 LOG5[204]: Service [ldaps] accepted connection from 127.0.0.1:52873</div><div class="">2016.03.02 18:18:01 LOG6[204]: failover: round-robin, starting at entry #0</div><div class="">2016.03.02 18:18:01 LOG6[204]: s_connect: connecting 10.10.1.254:636</div><div class="">2016.03.02 18:18:01 LOG7[204]: s_connect: s_poll_wait 10.10.1.254:636: waiting 10 seconds</div><div class="">2016.03.02 18:18:01 LOG5[204]: s_connect: connected 10.10.1.254:636</div><div class="">2016.03.02 18:18:01 LOG5[204]: Service [ldaps] connected remote server from 10.10.1.223:52874</div><div class="">2016.03.02 18:18:01 LOG7[204]: Remote socket (FD=492) initialized</div><div class="">2016.03.02 18:18:01 LOG6[204]: SNI: sending servername: <a href="http://ad.kent.ac.uk" class="">ad.kent.ac.uk</a></div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): before/connect initialization</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client hello A</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server hello A</div><div class="">2016.03.02 18:18:01 LOG6[204]: Certificate verification disabled</div><div class="">2016.03.02 18:18:01 LOG6[204]: Certificate verification disabled</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server certificate A</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server key exchange A</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server certificate request A</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server done A</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client certificate A</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client key exchange A</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write change cipher spec A</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write finished A</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 flush data</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read finished A</div><div class="">2016.03.02 18:18:01 LOG7[204]: 205 client connect(s) requested</div><div class="">2016.03.02 18:18:01 LOG7[204]: 205 client connect(s) succeeded</div><div class="">2016.03.02 18:18:01 LOG7[204]: 0 client renegotiation(s) requested</div><div class="">2016.03.02 18:18:01 LOG7[204]: 0 session reuse(s)</div><div class="">2016.03.02 18:18:01 LOG6[204]: SSL connected: new session negotiated</div><div class="">2016.03.02 18:18:01 LOG7[204]: Deallocating application specific data for addr index</div><div class="">2016.03.02 18:18:01 LOG6[204]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES256-SHA (256-bit encryption)</div><div class="">2016.03.02 18:18:01 LOG7[204]: Compression: null, expansion: null</div><div class="">2016.03.02 18:18:01 LOG6[204]: Read socket closed (readsocket)</div><div class="">2016.03.02 18:18:01 LOG7[204]: Sending close_notify alert</div><div class="">2016.03.02 18:18:01 LOG7[204]: SSL alert (write): warning: close notify</div><div class="">2016.03.02 18:18:01 LOG6[204]: SSL_shutdown successfully sent close_notify alert</div><div class="">2016.03.02 18:18:01 LOG3[204]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054)</div><div class="">2016.03.02 18:18:01 LOG5[204]: Connection reset: 276 byte(s) sent to SSL, 44 byte(s) sent to socket</div><div class="">2016.03.02 18:18:01 LOG7[204]: Remote socket (FD=492) closed</div><div class="">2016.03.02 18:18:01 LOG7[204]: Local socket (FD=456) closed</div><div class="">2016.03.02 18:18:01 LOG7[204]: Service [ldaps] finished (0 left)</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">-- </div><div class=""><b class="">Matthew Slowe</b><span class="Apple-converted-space"> </span>| Server Infrastructure Officer</div><div class="">IT Infrastructure, Information Services, University of Kent</div><div class="">Room S21, Cornwallis South</div><div class="">Canterbury, Kent, CT2 7NZ, UK</div><div class="">Tel: +44 (0)1227 824265</div><div class=""><br class=""></div><div class=""><a href="http://www.kent.ac.uk/is" class="">www.kent.ac.uk/is</a> | @UnikentUnseenIT | @UKCLibraryIt</div><div class="">PGP: <a href="https://keybase.io/fooflington" class="">https://keybase.io/fooflington</a></div></div></div></div>
</div>
<br class=""></div></body></html>