- stunnel-users - stunnel.org

Temporary failure in name resolution
by Phil Wieland 26 Apr '11

26 Apr '11

I think I've done something stupid but I can't work out what. I'm running stunnel4 version 4.29 on an Ubuntu server box, using it to tunnel smtp connections to my ISP's mail server. Everything works perfectly until I reboot the server, when it stops working. In syslog, I get: Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: ssmtp accepted connection from 127.0.0.1:50681 Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: Error resolving 'smtp.blueyonder.co.uk': Temporary failure in name resolution (EAI_AGAIN) Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: No host resolved Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket every time I attempt to send mail. I can ping smtp.blueyonder.co.uk no problem. The problem persists until I restart stunnel4, after which it works perfectly for weeks on end. Looking at syslog for boot time, it looks like stunnel tries to resolve smtp.blueyonder.co.uk as soon as it starts, but dhcp hasn't finished at this time so it fails. It seems to cache something from the failure and not try again? Even though the error is "Temporary". All advice gratefully received. Phil Wieland Liverpool, UK. ###@friedbread:~$ stunnel4 -version stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ###@friedbread:~$ cat /etc/stunnel/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 55899 connect = smtp.blueyonder.co.uk:465 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini ###@friedbread:~$

3 2

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 26 Apr '11

26 Apr '11

Thank you for helping, but both logs r not presented in my var/log/ dir. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 16:25:20 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > Are you sure that's entire log? check /var/log/daemons.log and > syslog.log as well. > > On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > It anyone knows how to fix Stunnel stuck at SSL state (accept): > > before/accept initialization??? > > > > Here is the log: > > ----------------------------------------------------------------------------------------------------------- > > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient > > entropy for the PRNG > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > > /etc/stunnel/CA > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > > /etc/stunnel/CRL > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > > service 3proxy > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > > Sockets:POLL,IPv6 Auth:LIBWRAP > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > > changed with 'ulimit -n') > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > > limit for file descriptors > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > > accept socket > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > > /var/run/stunnel.pid > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > > with code 0 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > > xx.xxx.xxx.xx:41165 permitted by libwrap > > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > > before/accept initialization <-----------------------Stuck here > > forever!!! > > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > > disconnected > > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent > > to SSL, 0 bytes sent to socket > > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating > > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > > /var/run/stunnel.pid > > [root@vps1 ~]# > > ----------------------------------------------------------------------------------------------------------- > > stunnel.conf: > > cert = /etc/stunnel/stunnel.pem > > key = /etc/stunnel/stunnel.pem > > CApath = /etc/stunnel/CA > > CRLpath = /etc/stunnel/CRL > > debug = 7 > > foreground = yes > > verify = 1 > > # > > [3proxy] > > accept = 30001 > > connect = 127.0.0.1:33135 > > ----------------------------------------------------------------------------------------------------------- > > > > I am hosting with CentOS 5.5, and installed Stunnel via yum. > > Planning to use it with 3Proxy. However I experience the problem above, can > > someone please help with that? > > Thank you very much! > > > > > > > > Mr. Jack > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

I installed the 4.35 one into my CentOS, it seems like the same problem still exist. Is there anything I can do to fix it? Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

Thank you! Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 25 Apr '11

25 Apr '11

It anyone knows how to fix Stunnel stuck at SSL state (accept): before/accept initialization??? Here is the log: ----------------------------------------------------------------------------------------------------------- [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient entropy for the PRNG 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to /etc/stunnel/CA 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to /etc/stunnel/CRL 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for service 3proxy 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be changed with 'ulimit -n') 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE limit for file descriptors 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on accept socket 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file /var/run/stunnel.pid 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished with code 0 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from xx.xxx.xxx.xx:41165 permitted by libwrap 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): before/accept initialization <-----------------------Stuck here forever!!! 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly disconnected 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file /var/run/stunnel.pid [root@vps1 ~]# ----------------------------------------------------------------------------------------------------------- stunnel.conf: cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem CApath = /etc/stunnel/CA CRLpath = /etc/stunnel/CRL debug = 7 foreground = yes verify = 1 # [3proxy] accept = 30001 connect = 127.0.0.1:33135 ----------------------------------------------------------------------------------------------------------- I am hosting with CentOS 5.5, and installed Stunnel via yum. Planning to use it with 3Proxy. However I experience the problem above, can someone please help with that? Thank you very much! Mr. Jack

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

Possible leak in client.c:init_ssl()
by Sven Ulland 16 Apr '11

16 Apr '11

Quick summary: Stunnel 4.35 configured with four services. As clients connect, the main stunnel process grows a lot in vsz/rss memory. With a lot of clients connecting, it quickly grows to several gigabytes rss. The use case is quite special: The multithreaded download accelerator 'axel' is used to download large files using 800 simultaneous threads. The downloads are from China, so the network performance is horrible, and connections are reset/broken all the time, so there is lots of new connections created constantly. Up to four axel instances run at the same time, so we're talking 3200 simultaneous connections. Over a short 2h timespan, nearly 30000 connections have been set up (ref attached stunnel.log). The memory use increases over time, often in very large steps. As connections finish and the transfers stop (i.e. no active connections at all), the memory is not released. A similar issue was reported in 2008 [1]. Attached are the following files: stunnel.conf: Four services, no special config. Debug level 5. massif.out.excerpt.txt: Valgrind Massif output. The Massif log indicates that most of the memory is allocated through client.c:init_ssl(), by libssl and zlib. I haven't looked too much at the code yet, but could this be related to the high rate of connection resets/timeouts, combined with connection/session reuse? sven [1]: possible stunnel memory leak Message-ID: <47E8E0AD.8010709(a)eu.citrix.com> http://www.stunnel.org/pipermail/stunnel-users/2008-March/001903.html

4 5

Re: [stunnel-users] Weird error when trying to use 512bit RSA key
by Leandro Avila 12 Apr '11

12 Apr '11

The problem seems to be the key size If you use a 512 key for stunnel it works However, when the key used by stunnel is 1024 and you try to use the EXP-RC4-MD5 cipher, a temporary 512 key is generated BUT that fails. So I tested: Stunnel 4.35 and OpenSSL 1.0.0d Using a 512 RSA key and EXP-RC4-MD5 works Using a 1025 RSA key and EXP-RC4-MD5 fails Looks more like an OpenSSL thing. I'm uncertain about how this situation is handled in the protocol spec. When the server has a 1024 key but the client wants to negotiate with a smaller key. Cheers ----------------- Leandro Avila ----- Original Message ----- From:Outofwall.com <root(a)outofwall.com> To:stunnel-users-bounces@stunnel.org; stunnel-users(a)stunnel.org Cc: Sent:Monday, April 11, 2011 10:39 PM Subject:Re: [stunnel-users] Weird error when trying to use 512bit RSA key In fact, I'm using TLSv1, just use the custom ciphers list. Here's what I have on the server side: ciphers EXP-RC4-MD5:ALL and test sunyc@www:~$ openssl s_client -tls1 -connect ssl.sgivpn.info:443 -cipher EXP-RC4-MD5 CONNECTED(00000003) depth=0 /C=US/ST=CA/O=XXX verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=CA/O=XXX verify return:1 32684:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1093:SSL alert number 40 32684:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: Error: Apr 11 18:57:35 localhost stunnel: LOG3[8319:139884220368640]: SSL_accept: 1409B11A: error:1409B11A:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:error generating tmp rsa key Both client and server is running ubuntu 10.04, with openssl 0.9.8k I think. Cheers. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Weird error when trying to use 512bit RSA key
by Outofwall.com 12 Apr '11

12 Apr '11

In fact, I'm using TLSv1, just use the custom ciphers list. Here's what I have on the server side: ciphers EXP-RC4-MD5:ALL and test sunyc@www:~$ openssl s_client -tls1 -connect ssl.sgivpn.info:443 -cipher EXP-RC4-MD5 CONNECTED(00000003) depth=0 /C=US/ST=CA/O=XXX verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=CA/O=XXX verify return:1 32684:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1093:SSL alert number 40 32684:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: Error: Apr 11 18:57:35 localhost stunnel: LOG3[8319:139884220368640]: SSL_accept: 1409B11A: error:1409B11A:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:error generating tmp rsa key Both client and server is running ubuntu 10.04, with openssl 0.9.8k I think. Cheers.

1 0

The verify=3 option in client mode
by Philipp Hartwig 09 Apr '11

09 Apr '11

Hello, I'm using stunnel in client mode to provide an SSL connection for offlineimap[1] which does not support verification of SSL certificates. As I've read stunnel does not compare the name of the server offering the certificate to the server name mentioned in the certificate (in the CN field for example). So if I used the following section in my stunnel.conf client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile = /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt verify = 2 stunnel would happily accept any certificate signed by Equifax for an arbitrary website. Is this correct? So I've switched to using the verify=3 option and I just want to make sure I configured it correctly. I'm now using the following section client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile= /home/ph/.certs/imaps.pem verify = 3 imaps.pem is a file containing two certificates, namely the first and the last certificate in the certificate chain of imap.gmail.com, that is the Equifax CA certificate and the server certificate itself. I then use offlineimap to establish an unencrypted connection to 127.0.0.1:4322. My understanding is that stunnel will now exclusively accept the server certificate stored in the imaps.pem file rendering all MITM attacks impossible. I'd be grateful if someone could confirm that this setup makes sense. Is this the way the verify=3 option is supposed to use? First I thought that it should be enough to just provide the server certificate in the imaps.pem file, but then openssl would complain about a self-signed certificate, so I included the CA certificate as well. Regards, Philipp [1] https://github.com/jgoerzen/offlineimap/wiki/

2 3

Is local mode on WIN32 working?
by Joerg Behrend 09 Apr '11

09 Apr '11

The changelog of stunnel 4.33 states that "Experimental support for local mode on WIN32 platform" is working and that should be tried exec = c:\windows\system32\cmd.exe In practice, it is for me not working, a connection is accepted but always reset with the stunnel log message: readsocket: Connection reset by peer (WSAECONNRESET) (10054) It was tested using the 4.35 Windows installer. Are there other requirements or settings necessary? Is a recompilation with special options senseful? Thanks! Joerg

1 0

issue making stunnel 4.35 use an apache http proxy to go out?
by Matt Wise 08 Apr '11

08 Apr '11

I've got an Apache proxy on port 3128 that will allow our clients to get outbound with a 'CONNECT" to a few services.. I'm trying to make stunnel use this service, and it seems to be ignoring my configuration completely. Tcpdumps show NO packets going outbound on port 3128... any ideas what i'm doing wrong? This config allows an inbound connection to port 1234 to hit port 2345 (a local service), while also handling the setup of an inbound connection to localhost:514 to a remote host on port 1514... debug = 7 pid = /var/run/stunnel.pid service = stunnel syslog = yes foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 fips = no # Localhost:1234 hits localhost:2345 [cseservices] client = no accept = 1234 connect = 127.0.0.1:2345 CAfile = /etc/stunnel/ssl/tunnel-CAs.cert.pem cert = /etc/stunnel/ssl/server.pub key = /etc/stunnel/ssl/server.key verify = 2 ## Localhost:514 hits remotehost:1514 [syslog] client = yes accept = 514 connect = xxx:1514 CAfile = /var/lib/puppet/ssl/certs/ca.pem key = /var/lib/puppet/ssl/private_keys/xxx.pem cert = /var/lib/puppet/ssl/certs/xxx.pem session = 5 TIMEOUTidle = 600 TIMEOUTbusy = 600 TIMEOUTclose = 300 TIMEOUTconnect = 10 verify = 2 protocol=connect protocolHost=proxy:3128 protocolAuthentication=basic —Matt

1 1

Re: [stunnel-users] stunnel through elb.. need packets sent semi-frequently
by Leandro Avila 08 Apr '11

08 Apr '11

Hi I'm not sure this will work, but have you checked the option TIMEOUTidle = <num_seconds> ? Sounds to me like the setting you might be looking for ----------------- Leandro Avila ----- Original Message ----- From:Matt Wise <mwise(a)netflix.com> To:"stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Cc: Sent:Thursday, April 7, 2011 6:04 PM Subject:Re: [stunnel-users] stunnel through elb.. need packets sent semi-frequently I'm using stunnel to pass some data through an Amazon ELB. Unfortunately, there are times when the session times out due to packets not passing for 60 seconds (an amazon ELB timeout). I'm wondering whether theres some way I can configure stunnel itself to pass some whitespaces or something back and forth every few seconds to make sure the session stays open and live? (and yes, I'm posing the same question to the app developer who's ap we're passing through.. but I'm looking at both avenues.. ) _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

3 2

stunnel through elb.. need packets sent semi-frequently
by Matt Wise 08 Apr '11

08 Apr '11

I'm using stunnel to pass some data through an Amazon ELB. Unfortunately, there are times when the session times out due to packets not passing for 60 seconds (an amazon ELB timeout). I'm wondering whether theres some way I can configure stunnel itself to pass some whitespaces or something back and forth every few seconds to make sure the session stays open and live? (and yes, I'm posing the same question to the app developer who's ap we're passing through.. but I'm looking at both avenues.. )

2 2

Re: [stunnel-users] STunnel server handshake fails
by Leandro Avila 08 Apr '11

08 Apr '11

Hello, I think you probably want to use the sslVersion = TLSv1 setting in your configuration. Instead of the options for OpenSSL Hope that helps ----------------- Leandro Avila ________________________________ From: John C. Kadyk <jckadyk(a)pacbell.net> To: stunnel-users(a)stunnel.org Sent: Thursday, April 7, 2011 7:06 PM Subject: Re: [stunnel-users] STunnel server handshake fails STunnel server handshake fails I'm trying to set up STunnel so our non-SSL network scanner can email scans through our email server, which requires TLS. A desktop email client with the same server/port settings can send email OK. I think I have STunnel configured correctly, but there's a handshake failure when it tries to connect to the server. STunnel seems to be attempting an SSLv3 connection even though I turned that option off in the config file. I want to force it to use TLS but not sure how to do that. Any suggestions greatly appreciated. Here's the config file: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 1025 connect = mail022-1.exch022.serverdata.net:1025 <http://mail022-1.exch022.serverdata.net:1025> ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini and here's the log: 2011.04.07 16:41:04 LOG5[3744:516]: Reading configuration from file stunnel.conf 2011.04.07 16:41:04 LOG7[3744:516]: Snagged 64 random bytes from C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: Wrote 1024 new random bytes to C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: PRNG seeded successfully 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service pop3s 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service imaps 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service ssmtp 2011.04.07 16:41:04 LOG5[3744:516]: Configuration successful 2011.04.07 16:41:04 LOG5[3744:516]: No limit detected for the number of clients 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=136 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s bound to 0.0.0.0:995 <http://0.0.0.0:995> 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s opened FD=136 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=124 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps bound to 0.0.0.0:993 <http://0.0.0.0:993> 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps opened FD=124 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=148 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp bound to 0.0.0.0:1025 <http://0.0.0.0:1025> 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp opened FD=148 2011.04.07 16:41:04 LOG5[3744:516]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.04.07 16:41:04 LOG5[3744:516]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2011.04.07 16:41:17 LOG7[3744:2436]: local socket: FD=232 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG7[3744:2436]: Service ssmtp accepted FD=232 from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:2436]: Creating a new thread 2011.04.07 16:41:17 LOG7[3744:2436]: New thread created 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp started 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on local socket 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp accepted connection from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:4012]: remote socket: FD=268 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG6[3744:4012]: connect_blocking: connecting 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: connect_blocking: connected 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp connected remote server from 10.10.17.249:4081 <http://10.10.17.249:4081> 2011.04.07 16:41:17 LOG7[3744:4012]: Remote FD=268 initialized 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on remote socket 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): before/connect initialization 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): SSLv3 write client hello A 2011.04.07 16:41:17 LOG7[3744:4012]: SSL alert (write): fatal: handshake failure 2011.04.07 16:41:17 LOG3[3744:4012]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.04.07 16:41:17 LOG5[3744:4012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp finished (0 left) Any suggestions greatly appreciated. Thanks! John _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

STunnel server handshake fails
by John C. Kadyk 08 Apr '11

08 Apr '11

I'm trying to set up STunnel so our non-SSL network scanner can email scans through our email server, which requires TLS. A desktop email client with the same server/port settings can send email OK. I think I have STunnel configured correctly, but there's a handshake failure when it tries to connect to the server. STunnel seems to be attempting an SSLv3 connection even though I turned that option off in the config file. I want to force it to use TLS but not sure how to do that. Any suggestions greatly appreciated. Here's the config file: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 1025 connect = mail022-1.exch022.serverdata.net:1025 <http://mail022-1.exch022.serverdata.net:1025> ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini and here's the log: 2011.04.07 16:41:04 LOG5[3744:516]: Reading configuration from file stunnel.conf 2011.04.07 16:41:04 LOG7[3744:516]: Snagged 64 random bytes from C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: Wrote 1024 new random bytes to C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: PRNG seeded successfully 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service pop3s 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service imaps 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service ssmtp 2011.04.07 16:41:04 LOG5[3744:516]: Configuration successful 2011.04.07 16:41:04 LOG5[3744:516]: No limit detected for the number of clients 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=136 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s bound to 0.0.0.0:995 <http://0.0.0.0:995> 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s opened FD=136 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=124 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps bound to 0.0.0.0:993 <http://0.0.0.0:993> 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps opened FD=124 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=148 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp bound to 0.0.0.0:1025 <http://0.0.0.0:1025> 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp opened FD=148 2011.04.07 16:41:04 LOG5[3744:516]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.04.07 16:41:04 LOG5[3744:516]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2011.04.07 16:41:17 LOG7[3744:2436]: local socket: FD=232 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG7[3744:2436]: Service ssmtp accepted FD=232 from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:2436]: Creating a new thread 2011.04.07 16:41:17 LOG7[3744:2436]: New thread created 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp started 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on local socket 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp accepted connection from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:4012]: remote socket: FD=268 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG6[3744:4012]: connect_blocking: connecting 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: connect_blocking: connected 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp connected remote server from 10.10.17.249:4081 <http://10.10.17.249:4081> 2011.04.07 16:41:17 LOG7[3744:4012]: Remote FD=268 initialized 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on remote socket 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): before/connect initialization 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): SSLv3 write client hello A 2011.04.07 16:41:17 LOG7[3744:4012]: SSL alert (write): fatal: handshake failure 2011.04.07 16:41:17 LOG3[3744:4012]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.04.07 16:41:17 LOG5[3744:4012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp finished (0 left) Any suggestions greatly appreciated. Thanks! John

1 0

Can't get transparent mode to work from remote IP
by Ben Schmidt 02 Apr '11

02 Apr '11

Hello stunnel Mailinglist, I'm new to stunnel and so far it works just fine. What impressed me the most is that is faster then Apache's mod_ssl. My only Problem is that I can't get stunnel to work in transparent mode. When I try to access it from a remote IP I get timeouts connecting to the Non-SSL Server. I'm prettymuch relying on the manual in section "transparent": http://www.stunnel.org/static/stunnel.html Scenario: local 10.0.0.0/22 > Server with stunnel (10.0.3.48/22) > local apache My config: http://pastebin.com/BQmXeT5b Log: http://pastebin.com/enQTAWB9 "stunnel -sockets": http://pastebin.com/Zbz9FTr6 "iptables -L -v": http://pastebin.com/0b90Nay8 executing iptables, again: http://pastebin.com/T87cGPBX The apache listening on port 80 reporting hits from the Computers private IP but not from any remote IPs in the same network. Firewalls and stuff like that are not the Problem. The remote Computer can access port 80 without any Problems and it works fine when I switch from stunnel to apaches mod_ssl. My Testsetup is using 4.29 on ubuntu 10.10 GNU/Linux amd64 with kernel 2.6.35 and OpenSSL 0.9.8o Could anybody please point me in the rigth direction, I know that I'm missing something but I just can't figure it out. Thanks a lot, Ben

1 0

stunnel maximum clients to server
by bruce bushby 26 Mar '11

26 Mar '11

Hi I'm about to add stunnel to my buildroot embedded project (ARM926EJ-S) and I was hoping the list could answer a few performance questions? I've been looking for a way to encrypt the connections between my embedded units and my server. From what I understood about openvpn, the server starts to give problems beyond 1024 "concurrent sessions" .... I'm looking at a design that can handle 4K concurrent sessions....although it'll take a few years to get that big. My embedded devices have a GSM modem and setup a ppp0 interface over gprs. I'm considering stunnel in the hope that I could have up to 3000 stunnel connections coming into my servers. I say 3K because by the tike I reach this figure I hope to have implemented better switches and off load the overhead of the encrypted connection to the switch. The requirement is that the embedded "non-ssl aware client" will be able to communicate with the server over a secure tunnel. Am I completely on the wrong road? .... could stunnel cater for something like this? Thanks in advance!

3 2

Certificate request popup when clicking on MS Office links in a stunnel HTTPS redirect to Domino HTTP server?
by Josiah Fizer 25 Mar '11

25 Mar '11

We have a Lotus Domino server hosting some Microsoft Office documents. For improved security, I started using stunnel to redirect pacts from the HTTP servers via HTTPS. Everything works perfectly, however when a user clicks a document link they are prompted for login credentials or a certificate. This would seem to be because MS Office is trying to open the remote document in edit mode rather then downloading it locally or opening it in read mode. I've tried a number of stunnel configuration options but nothing seems to work. At current I am using the following simple configuration. Any insight into the issue would be appreciated. cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify=0 [https] accept = 443 connect = localhost:80 TIMEOUTclose = 0

1 0

Re: [stunnel-users] Windows Firewall has blocked some features of thisprogram
by jay＠experts-exchange.com 22 Mar '11

22 Mar '11

Hi Josealf, Thank you for your response and for this information. Is there a VB script or other method I can use for this purpose? I use a signed Java applet to download, install, and execute stunnel, but can insert a step to run a VB or other script on the host prior. I suspect the stunnel installer may do this already, but after looking, did not see anything. Thank you > You can add the required firewall exceptions as part of your installation > tasks. You just need to allow connections to the incoming port(s) your > stunnel config use. > > -----Original Message----- > From: jay(a)experts-exchange.com > Sender: stunnel-users-bounces(a)stunnel.org > Date: Mon, 21 Mar 2011 17:39:11 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Windows Firewall has blocked some features of > this > program > > Folks, > > While bundling stunnel with my user application, upon kick off I see this > error message.*1 Is there a way to avoid this security warning? I am > trying to figure out if signing the binaries will escape this situation, > or if it is related to the binary not containing a string table. I > investigated linking the win32 binary with MS Visual Studio 2005 to see > if > the presence of the version string info in the binary would help*2, but > so > far I have been unable to directly link. I originally built stunnel using > cygwin's mingw32-gcc*3, so linking using MSDEV is not too easy.*4 > > Thanks > > > Refs: > *1 "Windows Security Alert. To help protect your computer, Windows > Firewall has blocked some features of this program. Do you want to keep > blocking this program? Name: stunnel Publisher: Unknown" > > *2 stunnel/src/version.rc, > > // pdelaage TODO 20101111: this file works with MS VC / EVC > // But with MINGW, properties are NOT displayed in Windows Explorer > // although they are embedded in the final exe program. > // anyway, using a .o coming from MS VC does not change anything, > // and linking the gcc version.o with ms tools works! > // so the problem is in fact in gcc-linking, not in version.o. > > > *2 mingw64-i686-gcc-core 4.5.1-2 > > Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src > $ i686-w64-mingw32-gcc-4.5.1 -s -o stunnel.exe file.obj client.obj > log.obj > options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj > verify.obj sthreads.obj stunnel.obj gui.obj resources.obj > -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 > -lcrypto.dll > -lssl.dll -lz -lws2_32 -lgdi32 -mwindows -v > Using built-in specs. > COLLECT_GCC=i686-w64-mingw32-gcc-4.5.1 > COLLECT_LTO_WRAPPER=/usr/lib/gcc/i686-w64-mingw32/4.5.1/lto-wrapper.exe > Target: i686-w64-mingw32 > Configured with: > /cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1/configure > --srcdir=/cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1 > --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin > --libexecdir=/usr/lib --datadir=/usr/share --localstatedir=/var > --sysconfdir=/etc --datarootdir=/usr/share > --docdir=/usr/share/doc/mingw64-i686-gcc -C --build=i686-pc-cygwin > --host=i686-pc-cygwin --target=i686-w64-mingw32 > --with-sysroot=/usr/i686-w64-mingw32/sys-root > --with-build-sysroot=/usr/i686-w64-mingw32/sys-root --disable-multilib > --disable-win32-registry > --enable-languages=c,ada,c++,fortran,objc,obj-c++ > --enable-fully-dynamic-strings --enable-libgomp --enable-sjlj-exceptions > --enable-version-specific-runtime-libs --with-dwarf2 > --enable-decimal-float=bid --enable-lto > Thread model: win32 > gcc version 4.5.1 (GCC) > COMPILER_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/bin/ > LIBRARY_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/:/usr/i686-w64-mingw32/sys-root/mingw/lib/ > COLLECT_GCC_OPTIONS='-s' '-o' 'stunnel.exe' '-L/cygdrive/c/openssl/lib' > '-L/cygdrive/c/dl/stunnel/zlib-1.2.5' '-mwindows' '-v' '-mtune=generic' > '-march=pentiumpro' > /usr/lib/gcc/i686-w64-mingw32/4.5.1/collect2.exe > --sysroot=/usr/i686-w64-mingw32/sys-root -m i386pe --subsystem windows > -Bdynamic -o stunnel.exe -s > /usr/i686-w64-mingw32/sys-root/mingw/lib/crt2.o > /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtbegin.o -L/cygdrive/c/openssl/lib > -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1 > -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32 > -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib > -L/usr/i686-w64-mingw32/sys-root/mingw/lib file.obj client.obj log.obj > options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj > verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -lcrypto.dll > -lssl.dll -lz -lws2_32 -lgdi32 -lmingw32 -lgcc_eh -lgcc -lmoldname > -lmingwex -lmsvcrt -lgdi32 -lcomdlg32 -luser32 -lkernel32 -ladvapi32 > -lshell32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt > /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtend.o > > Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src > $ > > *4 Link attempt under windows: > > C:\dl\stunnel\stunnel-4.35\src>link /libpath:"C:\openssl\lib" > /libpath:"c:\dl\stunnel\zlib-1.2.5" /machine:I386 /nologo > /out:"stunnel.exe" /incremental:no /release /mapinfo:exports > /subsystem:windows /opt:ref /opt:icf wsock32.lib kernel32.lib user32.lib > gdi32.lib comdlg32.lib advapi32.lib shell32.lib msvcrt.lib libcmt.lib > libcrypto.a libssl.a libz.a file.obj client.obj log.obj options.obj > protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj > sthreads.obj stunnel.obj gui.obj resources.obj > msvcrt.lib(_stat.obj) : warning LNK4078: multiple '.drectve' sections > found with different attributes (00000A00) > options.obj : error LNK2019: unresolved external symbol ___chkstk > referenced in function _parse_conf > gui.obj : error LNK2019: unresolved external symbol _strdup referenced in > function _WinMain@16 > libcrypto.a(asn_mime.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(bss_file.o) : error LNK2019: unresolved external symbol > __alloca referenced in function _BIO_new_file > libcrypto.a(cryptlib.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(err_prn.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(bn_prime.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol > ___umoddi3 referenced in function _fmtint > libcrypto.a(bn_word.o) : error LNK2001: unresolved external symbol > ___umoddi3 > libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol > ___udivdi3 referenced in function _fmtint > stunnel.exe : fatal error LNK1120: 5 unresolved externals > > C:\dl\stunnel\stunnel-4.35\src> > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 1

Windows Firewall has blocked some features of this program
by jay＠experts-exchange.com 22 Mar '11

22 Mar '11

Folks, While bundling stunnel with my user application, upon kick off I see this error message.*1 Is there a way to avoid this security warning? I am trying to figure out if signing the binaries will escape this situation, or if it is related to the binary not containing a string table. I investigated linking the win32 binary with MS Visual Studio 2005 to see if the presence of the version string info in the binary would help*2, but so far I have been unable to directly link. I originally built stunnel using cygwin's mingw32-gcc*3, so linking using MSDEV is not too easy.*4 Thanks Refs: *1 "Windows Security Alert. To help protect your computer, Windows Firewall has blocked some features of this program. Do you want to keep blocking this program? Name: stunnel Publisher: Unknown" *2 stunnel/src/version.rc, // pdelaage TODO 20101111: this file works with MS VC / EVC // But with MINGW, properties are NOT displayed in Windows Explorer // although they are embedded in the final exe program. // anyway, using a .o coming from MS VC does not change anything, // and linking the gcc version.o with ms tools works! // so the problem is in fact in gcc-linking, not in version.o. *2 mingw64-i686-gcc-core 4.5.1-2 Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src $ i686-w64-mingw32-gcc-4.5.1 -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -lcrypto.dll -lssl.dll -lz -lws2_32 -lgdi32 -mwindows -v Using built-in specs. COLLECT_GCC=i686-w64-mingw32-gcc-4.5.1 COLLECT_LTO_WRAPPER=/usr/lib/gcc/i686-w64-mingw32/4.5.1/lto-wrapper.exe Target: i686-w64-mingw32 Configured with: /cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1/configure --srcdir=/cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1 --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --libexecdir=/usr/lib --datadir=/usr/share --localstatedir=/var --sysconfdir=/etc --datarootdir=/usr/share --docdir=/usr/share/doc/mingw64-i686-gcc -C --build=i686-pc-cygwin --host=i686-pc-cygwin --target=i686-w64-mingw32 --with-sysroot=/usr/i686-w64-mingw32/sys-root --with-build-sysroot=/usr/i686-w64-mingw32/sys-root --disable-multilib --disable-win32-registry --enable-languages=c,ada,c++,fortran,objc,obj-c++ --enable-fully-dynamic-strings --enable-libgomp --enable-sjlj-exceptions --enable-version-specific-runtime-libs --with-dwarf2 --enable-decimal-float=bid --enable-lto Thread model: win32 gcc version 4.5.1 (GCC) COMPILER_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/bin/ LIBRARY_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/:/usr/i686-w64-mingw32/sys-root/mingw/lib/ COLLECT_GCC_OPTIONS='-s' '-o' 'stunnel.exe' '-L/cygdrive/c/openssl/lib' '-L/cygdrive/c/dl/stunnel/zlib-1.2.5' '-mwindows' '-v' '-mtune=generic' '-march=pentiumpro' /usr/lib/gcc/i686-w64-mingw32/4.5.1/collect2.exe --sysroot=/usr/i686-w64-mingw32/sys-root -m i386pe --subsystem windows -Bdynamic -o stunnel.exe -s /usr/i686-w64-mingw32/sys-root/mingw/lib/crt2.o /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtbegin.o -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib -L/usr/i686-w64-mingw32/sys-root/mingw/lib file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -lcrypto.dll -lssl.dll -lz -lws2_32 -lgdi32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt -lgdi32 -lcomdlg32 -luser32 -lkernel32 -ladvapi32 -lshell32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtend.o Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src $ *4 Link attempt under windows: C:\dl\stunnel\stunnel-4.35\src>link /libpath:"C:\openssl\lib" /libpath:"c:\dl\stunnel\zlib-1.2.5" /machine:I386 /nologo /out:"stunnel.exe" /incremental:no /release /mapinfo:exports /subsystem:windows /opt:ref /opt:icf wsock32.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib msvcrt.lib libcmt.lib libcrypto.a libssl.a libz.a file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj msvcrt.lib(_stat.obj) : warning LNK4078: multiple '.drectve' sections found with different attributes (00000A00) options.obj : error LNK2019: unresolved external symbol ___chkstk referenced in function _parse_conf gui.obj : error LNK2019: unresolved external symbol _strdup referenced in function _WinMain@16 libcrypto.a(asn_mime.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(bss_file.o) : error LNK2019: unresolved external symbol __alloca referenced in function _BIO_new_file libcrypto.a(cryptlib.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(err_prn.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(bn_prime.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol ___umoddi3 referenced in function _fmtint libcrypto.a(bn_word.o) : error LNK2001: unresolved external symbol ___umoddi3 libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol ___udivdi3 referenced in function _fmtint stunnel.exe : fatal error LNK1120: 5 unresolved externals C:\dl\stunnel\stunnel-4.35\src>

2 1

stunnel in DMZ : accept=22 / connect=other.server.net:22 - gets stuck! - need help!
by Bernhard.Baeumle＠mt.com 17 Mar '11

17 Mar '11

Hi I use stunnel on a DMZ server for tunnelling/forwarding/proxying... (whatever term is correct). The situation is as follows: Hardware : External PC <==> DMZ server <==> company-internal server Operational : https://xxx.yy.zz (443) <==> (443) stunnel (80) <==> (80) SVN Server listening on port 80 NEW/NEED HELP : plink (22) <==> (22) stunnel (22) <==> (22) sshd listening on port 22 stunnel.conf (on the DMZ server) looks like this: cert = my_tunnel.pem key = my_tunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = a:SO_REUSEADDR=0 debug = 7 output = C:\Program Files (x86)\stunnel\stunnel.log ;client = yes [forward_443_to_80] accept = 443 connect = my.company-server.net:80 [forward_22] accept = 22 connect = my.company-server.net:22 NOTE: Forwarding 443 to my.company-server.net:80 => WORKS FINE! NOW I try SSH with my PC connected to the company's network (without hopping at the DMZ): "plink -A -v -l username -i cert_file -P 22 dmz-server-name.net" => THIS WORKS FINE! NOW I try SSH with my PC from external network (which needs hopping at the DMZ): "plink -A -v -l username -i cert_file -P 22 dmz-server-name.net" Firewalls and ports seem to be open. The stunnel.log looks like this: <<starting stunnel service>> 2011.03.17 15:27:09 LOG5[4772:3852]: Reading configuration from file stunnel.conf 2011.03.17 15:27:09 LOG7[4772:3852]: Snagged 64 random bytes from C:/.rnd 2011.03.17 15:27:09 LOG7[4772:3852]: Wrote 1024 new random bytes to C:/.rnd 2011.03.17 15:27:09 LOG7[4772:3852]: PRNG seeded successfully 2011.03.17 15:27:09 LOG6[4772:3852]: Could not load DH parameters from my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: ECDH initialized 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate loaded 2011.03.17 15:27:09 LOG7[4772:3852]: Key file: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Private key loaded 2011.03.17 15:27:09 LOG7[4772:3852]: SSL context initialized for service forward_443_to_80 2011.03.17 15:27:09 LOG6[4772:3852]: Could not load DH parameters from my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: ECDH initialized 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate loaded 2011.03.17 15:27:09 LOG7[4772:3852]: Key file: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Private key loaded 2011.03.17 15:27:09 LOG7[4772:3852]: SSL context initialized for service forward_22 2011.03.17 15:27:09 LOG5[4772:3852]: Configuration successful 2011.03.17 15:27:09 LOG5[4772:3852]: No limit detected for the number of clients 2011.03.17 15:27:09 LOG7[4772:3852]: accept socket: FD=168 allocated (non-blocking mode) 2011.03.17 15:27:09 LOG7[4772:3852]: Option SO_REUSEADDR set on accept socket 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_443_to_80 bound to 0.0.0.0:443 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_443_to_80 opened FD=168 2011.03.17 15:27:09 LOG7[4772:3852]: accept socket: FD=280 allocated (non-blocking mode) 2011.03.17 15:27:09 LOG7[4772:3852]: Option SO_REUSEADDR set on accept socket 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_22 bound to 0.0.0.0:22 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_22 opened FD=280 2011.03.17 15:27:09 LOG5[4772:3852]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.03.17 15:27:09 LOG5[4772:3852]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 <<calling plink...>> 2011.03.17 15:27:26 LOG7[4772:4208]: local socket: FD=320 allocated (non-blocking mode) 2011.03.17 15:27:26 LOG7[4772:4208]: Service forward_22 accepted FD=320 from 123.4.5.6:2950 2011.03.17 15:27:26 LOG7[4772:4208]: Creating a new thread 2011.03.17 15:27:26 LOG7[4772:4208]: New thread created 2011.03.17 15:27:26 LOG7[4772:4756]: Service forward_22 started 2011.03.17 15:27:26 LOG7[4772:4756]: Option TCP_NODELAY set on local socket 2011.03.17 15:27:26 LOG5[4772:4756]: Service forward_22 accepted connection from 123.4.5.6:2950 2011.03.17 15:27:26 LOG7[4772:4756]: SSL state (accept): before/accept initialization <<and here it gets stuck!!!!!!!>> plink says: Looking up host "dmz-server-name.net" Connecting to 123.12.1.1 port 22 <<and here it gets stuck!!!!!!!>> PLEASE HELP!!!

2 1

SSL_read: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call
by Julian Ramirez 16 Mar '11

16 Mar '11

Hello all, I am using stunnel in order to send encrypted http request/response messages to an external system called Tradeweb. Our python program sends the message to stunnel and stunnel sends it to Tradeweb through a proxy. My version of stunnel is the following stunnel 4.35 on sparc-sun-solaris2.10 with OpenSSL 0.9.8r 8 Feb 2011 and it has been installed in a Solaris 10 operating system. My configuration file looks like this CAfile=/home/aps/tfk/stunnel/etc/stunnel/tradeweb_ca.cer client=yes verify=2 debug=7 output=stunnel.log [TradeXpress] # Port on which STUNNEL listens for local connections accept=stunnelserveripaddress:17000 # Destination address and port of TW data-center libwrap=no connect=proxyipaddress:80 protocol=connect protocolHost=tradewebipaddress:443 I have a python program that sends a http post message to stunnel. When I send the message I can see the following in the log (see below) The message gets to the other end (tradeweb system), but it looks like the encryption does not work properly. The relevant lines of the log are (see full log below) 2011.03.14 18:24:19 LOG7[6089:2]: SSL alert (write): warning: no certificate 2011.03.14 18:29:25 LOG3[6089:2]: SSL_read: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call 2011.03.14 18:29:25 LOG5[6089:2]: Connection reset: 521 bytes sent to SSL, 0 bytes sent to socket Do you know what is the problem? Thank you, Julian 2011.03.14 18:23:54 LOG5[6083:1]: Reading configuration from file stunnel.conf 2011.03.14 18:23:54 LOG7[6083:1]: Snagged 64 random bytes from /home/usr/vptfk/.rnd 2011.03.14 18:23:54 LOG7[6083:1]: Wrote 1024 new random bytes to /home/usr/vptfk/.rnd 2011.03.14 18:23:54 LOG7[6083:1]: PRNG seeded successfully 2011.03.14 18:23:54 LOG7[6083:1]: Loaded verify certificates from /home/aps/tfk/stunnel/etc/stunnel/tradeweb_ca.cer 2011.03.14 18:23:54 LOG7[6083:1]: Loaded /home/aps/tfk/stunnel/etc/stunnel/tradeweb_ca.cer revocation lookup file 2011.03.14 18:23:54 LOG7[6083:1]: SSL context initialized for service TradeXpress 2011.03.14 18:23:54 LOG5[6083:1]: Configuration successful 2011.03.14 18:23:54 LOG5[6083:1]: No limit detected for the number of clients 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=5 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=6 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=7 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=8 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=9 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: signal_pipe: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: signal_pipe: FD=10 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: accept socket: FD=11 allocated (non-blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: Option SO_REUSEADDR set on accept socket 2011.03.14 18:23:54 LOG7[6083:1]: Service TradeXpress bound to 0.0.0.0:17000 2011.03.14 18:23:54 LOG7[6083:1]: Service TradeXpress opened FD=11 2011.03.14 18:23:54 LOG7[6089:1]: Created pid file /home/aps/tfk/stunnel/var/run/stunnel/stunnel.pid 2011.03.14 18:23:54 LOG5[6089:1]: stunnel 4.35 on sparc-sun-solaris2.10 with OpenSSL 0.9.8r 8 Feb 2011 2011.03.14 18:23:54 LOG5[6089:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.03.14 18:23:54 LOG7[6089:1]: Dispatching signals from the signal pipe 2011.03.14 18:23:54 LOG7[6089:1]: Signal pipe is empty 2011.03.14 18:24:19 LOG7[6089:1]: local socket: FD=0 allocated (non-blocking mode) 2011.03.14 18:24:19 LOG7[6089:1]: Service TradeXpress accepted FD=0 from stunnelserveripaddress:61449 2011.03.14 18:24:19 LOG7[6089:2]: Service TradeXpress started 2011.03.14 18:24:19 LOG5[6089:2]: Service TradeXpress accepted connection from stunnelserveripaddress:61449 2011.03.14 18:24:19 LOG7[6089:2]: remote socket: FD=1 allocated (non-blocking mode) 2011.03.14 18:24:19 LOG6[6089:2]: connect_blocking: connecting proxyipaddress:80 2011.03.14 18:24:19 LOG7[6089:2]: connect_blocking: s_poll_wait proxyipaddress:80: waiting 10 seconds 2011.03.14 18:24:19 LOG5[6089:2]: connect_blocking: connected proxyipaddress:80 2011.03.14 18:24:19 LOG5[6089:2]: Service TradeXpress connected remote server from stunnelserveripaddress:61450 2011.03.14 18:24:19 LOG7[6089:2]: Remote FD=1 initialized 2011.03.14 18:24:19 LOG5[6089:2]: Negotiations for connect (client side) started 2011.03.14 18:24:19 LOG7[6089:2]: -> CONNECT tradewebipaddress:443 HTTP/1.1 2011.03.14 18:24:19 LOG7[6089:2]: -> Host: tradewebipaddress:443 2011.03.14 18:24:19 LOG7[6089:2]: -> 2011.03.14 18:24:19 LOG7[6089:2]: <- HTTP/1.1 200 Connection established 2011.03.14 18:24:19 LOG6[6089:2]: CONNECT request accepted 2011.03.14 18:24:19 LOG7[6089:2]: <- 2011.03.14 18:24:19 LOG5[6089:2]: Protocol negotiations succeeded 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): before/connect initialization 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write client hello A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server hello A 2011.03.14 18:24:19 LOG7[6089:2]: Starting certificate verification: depth=1, /C=US/ST=New York/L=New York/O=TradeWeb LLC - The Online Bond Markets/OU=Network Administration/CN=TradeWeb LLC - The Online Bond Markets/emailAddress=bruce.mackinnon(a)tradeweb.c 2011.03.14 18:24:19 LOG5[6089:2]: Certificate accepted: depth=1, /C=US/ST=New York/L=New York/O=TradeWeb LLC - The Online Bond Markets/OU=Network Administration/CN=TradeWeb LLC - The Online Bond Markets/emailAddress=bruce.mackinnon(a)tradeweb.com 2011.03.14 18:24:19 LOG7[6089:2]: Starting certificate verification: depth=0, /C=US/ST=New Jersey/L=Jersey City/O=TradeWeb LLC - The Online Bond Markets/OU=STP Production/CN=62.189.50.234 2011.03.14 18:24:19 LOG5[6089:2]: Certificate accepted: depth=0, /C=US/ST=New Jersey/L=Jersey City/O=TradeWeb LLC - The Online Bond Markets/OU=STP Production/CN=62.189.50.234 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server certificate A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server certificate request A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server done A 2011.03.14 18:24:19 LOG7[6089:2]: SSL alert (write): warning: no certificate 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write client certificate A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write client key exchange A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write change cipher spec A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write finished A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 flush data 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read finished A 2011.03.14 18:24:19 LOG7[6089:2]: 0 items in the session cache 2011.03.14 18:24:19 LOG7[6089:2]: 1 client connects (SSL_connect()) 2011.03.14 18:24:19 LOG7[6089:2]: 1 client connects that finished 2011.03.14 18:24:19 LOG7[6089:2]: 0 client renegotiations requested 2011.03.14 18:24:19 LOG7[6089:2]: 0 server connects (SSL_accept()) 2011.03.14 18:24:19 LOG7[6089:2]: 0 server connects that finished 2011.03.14 18:24:19 LOG7[6089:2]: 0 server renegotiations requested 2011.03.14 18:24:19 LOG7[6089:2]: 0 session cache hits 2011.03.14 18:24:19 LOG7[6089:2]: 0 external session cache hits 2011.03.14 18:24:19 LOG7[6089:2]: 0 session cache misses 2011.03.14 18:24:19 LOG7[6089:2]: 0 session cache timeouts 2011.03.14 18:24:19 LOG6[6089:2]: SSL connected: new session negotiated 2011.03.14 18:24:19 LOG6[6089:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2011.03.14 18:29:25 LOG3[6089:2]: SSL_read: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call 2011.03.14 18:29:25 LOG5[6089:2]: Connection reset: 521 bytes sent to SSL, 0 bytes sent to socket 2011.03.14 18:29:25 LOG7[6089:2]: Service TradeXpress finished (0 left) RAMIREZ Julián Technical Consultant Wall Street Systems <http://www.wallstreetsystems.com/> - Empowering Treasury, Trading and Settlement

1 0

Stunnel configuration for multiple domains on single IP
by Amol 11 Mar '11

11 Mar '11

I was trying to configure stunnel to work for multiple domains on the same IP address, just wanted to know how to configure stunnel to listen on different ports? has anyone done it yet? [https-lo] cert=/etc/stunnel/ssl/group-cert.pem key = /etc/stunnel/ssl/lo.key accept=x.x.x.x:443 connect=x.xxx.xx.11:8000 TIMEOUTclose=0 xforwardedfor=yes [https-lo2] cert=/etc/stunnel/ssl/group2-cert.pem key = /etc/stunnel/ssl/lo2.key accept=xx.xx.xx.xx:444 connect=x.xxx.xx.11:80 TIMEOUTclose=0 xforwardedfor=yes but i still get this error when i access the second domain (lo2) (Error code: ssl_error_bad_cert_domain)

1 1

Periodic stunnel 4.34 core dumps on AIX 5.3
by Allex, Paul M (USA E D EA STS) 11 Mar '11

11 Mar '11

Hello, I have noticed that stunnel will periodically core dump on AIX 5.3. My configuration: stunnel 4.34 AIX 5.3 OpenSSL 0.9.8m After some initial investigation, I did find the following post about stunnel core dumps on AIX 5.3: http://www.stunnel.org/pipermail/stunnel-users/2007-April/001528.html Some of the core dumps were definitely due to this issue, so I rebuilt stunnel using the steps outlined in the post. Now I do not see the stack overflow core dumps, however I am still seeing other cores. These cores have little to no valuable information in them, so I do not have a lot to go off of. The one thing I have noticed is that stunnel seems to be consuming more and more memory over time. I set up several tests to see what would be causing this. Tests: 1. Send large amounts of data through stunnel using a simple client and server. This seemed to have no affect on the long term memory usage of stunnel. 2. Repeatedly create and drop connections to stunnel. For this I wrote a short script that simply creates a connection to stunnel using telnet in a a tight loop. I did not start anything for the stunnel instance to connect to, so telnet would create a connection and get it closed immediately. telnet --> stunnel --> nothing The process started with a size of 836 KB and seems to increase by about .1 to .2 KB per connection. $ count=1; while true; do tn localhost 10500; echo $count; count=$(( count + 1 )); done Trying... Escape character is '^T'. Connection closed. 1 ... Trying... Connected to loopback. Escape character is '^T'. Connection closed. 15475 Trying... Connected to loopback. Escape character is '^T'. Connection closed. 15476 Trying... Connected to loopback. Escape character is '^T'. Connection closed. 15477 $ monitor_process test_stunnel Size: 836 ... Size: 2556 Size: 2564 Size: 2564 Size: 2564 Size: 2568 Size: 2572 Size: 2572 Size: 2592 I have not dug into the code yet, so I suppose that will be my next task. If anyone has any ideas or suggestions on what else to look at, I would really appreciate it. Thanks, Paul Allex

2 2