- stunnel-users - stunnel.org

Stunnel 4.3 not forwarding to server socket
by Vladimir Stariradev 28 Jan '10

28 Jan '10

Dear Stunnel users, I'm running stunnel on my server which accepts connections from my mobile phone emulator (j2me) like so: midlet app -> port:5555 stunnel -> port:6666 server. My midlet, which can be treated as a java app, uses ssl://127.0.0.1:5555 to connect to stunnel. I can establish a connection between the stunnel and the app because I can get information on the certificate. The problem is that when I send data from the midlet to the server, the server doesn't accept it, nor does it signal that anything has been received even when I have double-checked that the streams are setup. I have pasted my config and log files below. Any suggestions are fully appreciated. Regards, Vladimir version: stunnel 4.30 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 stunnel.conf: cert = SecIM.pem debug = 7 ;output = stunnel.log [SecureIM] accept = 5555 connect = 6666 client = no Log file: 2010.01.28 17:51:09 LOG5[3828:1772]: Reading configuration from file stunnel.conf 2010.01.28 17:51:09 LOG7[3828:1772]: Snagged 64 random bytes from C:/.rnd 2010.01.28 17:51:09 LOG7[3828:1772]: Wrote 0 new random bytes to C:/.rnd 2010.01.28 17:51:09 LOG7[3828:1772]: RAND_status claims sufficient entropy for the PRNG 2010.01.28 17:51:09 LOG7[3828:1772]: PRNG seeded successfully 2010.01.28 17:51:09 LOG7[3828:1772]: Certificate: SecIM.pem 2010.01.28 17:51:09 LOG7[3828:1772]: Certificate loaded 2010.01.28 17:51:09 LOG7[3828:1772]: Key file: SecIM.pem 2010.01.28 17:51:11 LOG7[3828:1772]: Private key loaded 2010.01.28 17:51:11 LOG7[3828:1772]: SSL context initialized for service SecureIM 2010.01.28 17:51:11 LOG5[3828:1772]: Configuration successful 2010.01.28 17:51:11 LOG5[3828:1772]: No limit detected for the number of clients 2010.01.28 17:51:11 LOG7[3828:1772]: FD=168 in non-blocking mode 2010.01.28 17:51:11 LOG7[3828:1772]: Option SO_REUSEADDR set on accept socket 2010.01.28 17:51:11 LOG7[3828:1772]: Service SecureIM bound to 0.0.0.0:5555 2010.01.28 17:51:11 LOG7[3828:1772]: Service SecureIM opened FD=168 2010.01.28 17:51:11 LOG5[3828:1772]: stunnel 4.30 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.28 17:51:11 LOG5[3828:1772]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.28 17:52:13 LOG7[3828:2836]: Service SecureIM accepted FD=212 from 127.0.0.1:56133 2010.01.28 17:52:13 LOG7[3828:2836]: Creating a new thread 2010.01.28 17:52:13 LOG7[3828:2836]: New thread created 2010.01.28 17:52:13 LOG7[3828:3336]: Service SecureIM started 2010.01.28 17:52:13 LOG7[3828:3336]: FD=212 in non-blocking mode 2010.01.28 17:52:13 LOG7[3828:3336]: Option TCP_NODELAY set on local socket 2010.01.28 17:52:13 LOG5[3828:3336]: Service SecureIM accepted connection from 127.0.0.1:56133 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): before/accept initialization 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read client hello A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write server hello A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write certificate A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write server done A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 flush data 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read client key exchange A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read finished A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write change cipher spec A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write finished A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 flush data 2010.01.28 17:52:13 LOG7[3828:3336]: 1 items in the session cache 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client connects (SSL_connect()) 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client connects that finished 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client renegotiations requested 2010.01.28 17:52:13 LOG7[3828:3336]: 1 server connects (SSL_accept()) 2010.01.28 17:52:13 LOG7[3828:3336]: 1 server connects that finished 2010.01.28 17:52:13 LOG7[3828:3336]: 0 server renegotiations requested 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache hits 2010.01.28 17:52:13 LOG7[3828:3336]: 0 external session cache hits 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache misses 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache timeouts 2010.01.28 17:52:13 LOG6[3828:3336]: SSL accepted: new session negotiated 2010.01.28 17:52:13 LOG6[3828:3336]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2010.01.28 17:52:13 LOG7[3828:3336]: FD=424 in non-blocking mode 2010.01.28 17:52:13 LOG6[3828:3336]: connect_blocking: connecting 127.0.0.1:6666 2010.01.28 17:52:13 LOG7[3828:3336]: connect_blocking: s_poll_wait 127.0.0.1:6666: waiting 10 seconds 2010.01.28 17:52:13 LOG5[3828:3336]: connect_blocking: connected 127.0.0.1:6666 2010.01.28 17:52:13 LOG5[3828:3336]: Service SecureIM connected remote server from 127.0.0.1:56134 2010.01.28 17:52:13 LOG7[3828:3336]: Remote FD=424 initialized 2010.01.28 17:52:13 LOG7[3828:3336]: Option TCP_NODELAY set on remote socket 2010.01.28 17:54:02 LOG3[3828:3336]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2010.01.28 17:54:02 LOG5[3828:3336]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.01.28 17:54:02 LOG7[3828:3336]: Service SecureIM finished (0 left)

1 1

Re: [stunnel-users] need to restart stunnel if stunnel starts before network?
by Michal Trojnara 23 Jan '10

23 Jan '10

Zhang Weiwu wrote: > For developer how do you think make stunnel resolving the domain when > establishing connection? Sure. This is already implemented and described in the manual: http://stunnel.mirt.net/static/stunnel.html The option is: delay = yes Mike

1 0

FIPS compilation patch for stunnel 4.30
by Michal Trojnara 21 Jan '10

21 Jan '10

Dear Users, Please find a tiny patch for FIPS mode of stunnel 4.30: ftp://stunnel.mirt.net/stunnel/fips.patch BTW: Please consider making a donation if you appreciate my work on configuration file reloading feature. Use PayPal Donate button on http://stunnel.mirt.net/ Mike

1 0

Stunnel 4.30 released
by Michal Trojnara 21 Jan '10

21 Jan '10

The ChangeLog entry: Version 4.30, 2010.01.21, urgency: LOW/EXPERIMENTAL: * New features - Graceful configuration reload with HUP signal on Unix and with GUI on Windows. This release involves major modifications of the code. I expect some regression issues, so please make sure to test this version well before running it on your production systems. SHA-1 value for stunnel-4.30.tar.gz: 46d21c3ad0e761d697f4de8c258ef999287f13f9 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

need to restart stunnel if stunnel starts before network?
by Zhang Weiwu 20 Jan '10

20 Jan '10

Hello. One reason to opt for stunnel instead of ssh -L to secure a local non-ssl client is, that if user use stunnel, it can work transparently, start working only when a connection is listened, so user do not have to start ssh-L before using the client and do not have to shut it down after using the client. However these days through the use of NetworkManager, the network interfaces are often not brought up when stunnel started as a system service. Instead, the network interfaces are brought up by users, in case of wifi or wan, after user typed password. I found I have to first start network interfaces, and run /etc/init.d/stunnel restart to prepare to run the insecure client. Is there a way to run in stunnel in such a way it does nothing except listening, and can recover from network restart, which happens from time to time for road warriors like me? Thanks in advance. I didn't find answer on FAQ by the way.

2 1

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 20 Jan '10

20 Jan '10

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. _________________________________________________________________ Windows Live: Gör det enklare för dina vänner att se vad du håller på med på Facebook. http://www.microsoft.com/sverige/windows/windowslive/see-it-in-action/socia…

1 0

PKI certs
by Lendl, Daniel 13 Jan '10

13 Jan '10

Will stunnel will work with PKI certs vs self-signed? Dan Lendl 919-257-3062

2 1

Stunnel and RTMPS
by Nimrod Aviram 11 Jan '10

11 Jan '10

Hi, I'm currently trying to use rtmps, with Red5 and Stunnel, and it doesn't work with properly signed certificates: When I use a self-signed test certificate, everything works just fine. But when I use a proper certificate (2048 bits from godaddy.com, if that matters), NetConnection.connect just doesn't work - the server doesn't get a connection. https stil works though, and the browser treats the certificate as valid, so it's probably not a problem with the certificate. I saw some earlier posts on this problem, does anyone have a solution? Any comments are welcome... thanks, Nimrod

2 1

server refuses connection by STARTTLS
by Tsurutani Naoki 10 Jan '10

10 Jan '10

Hi, I want to connect to SMTP server by STARTTLS, from MUA who does not support STARTTLS. However, I cannot connect to the server with recent stunnel. On Windows XP, my stunnel.conf is the following: client=yes debug=notice output=C:\logs\stunnel.log service=stunnel [smtp_server] accept=127.0.0.1:10025 connect=smtp.example.com:587 protocol=smtp stunnel version 4.27 or 4.29 is started as service, by "C:\Network\stunnel\stunnel.exe" -service -install c:\home\turutani\INI\stunnel.conf I cannot connect with OpenSSL distributed via stunnel. Then I changed the OpenSSL DLL, and found that I can connect with OpenSSL older than 0.9.8i, while that newer than 0.9.8j fails. But it works by adding "sslVersion=all" or "sslVersion=SSLv2" to configuration file. I also ran stunnel on FreeBSD, and found the same result about SSL version. Here is a debug level log, with no "sslVersion=" or "sslVersion=SSLv3": 2010.01.08 09:50:06 LOG7[2372:3760]: RAND_status claims sufficient entropy for the PRNG 2010.01.08 09:50:06 LOG7[2372:3760]: PRNG seeded successfully 2010.01.08 09:50:06 LOG7[2372:3760]: SSL context initialized for service smtp_server 2010.01.08 09:50:06 LOG5[2372:3760]: stunnel 4.28 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.08 09:50:06 LOG5[2372:3760]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.08 09:50:06 LOG5[2372:2252]: No limit detected for the number of clients 2010.01.08 09:50:06 LOG7[2372:2252]: FD 236 in non-blocking mode 2010.01.08 09:50:06 LOG7[2372:2252]: SO_REUSEADDR option set on accept socket 2010.01.08 09:50:06 LOG7[2372:2252]: smtp_server bound to 127.0.0.1:10025 2010.01.08 09:50:34 LOG7[2372:2252]: smtp_server accepted FD=244 from 127.0.0.1:1953 2010.01.08 09:50:34 LOG7[2372:2252]: Creating a new thread 2010.01.08 09:50:34 LOG7[2372:2252]: New thread created 2010.01.08 09:50:34 LOG7[2372:1036]: smtp_server started 2010.01.08 09:50:34 LOG7[2372:1036]: FD 244 in non-blocking mode 2010.01.08 09:50:34 LOG5[2372:1036]: smtp_server accepted connection from 127.0.0.1:1953 2010.01.08 09:50:34 LOG7[2372:1036]: FD 268 in non-blocking mode 2010.01.08 09:50:34 LOG6[2372:1036]: connect_blocking: connecting 133.x.y.z:587 2010.01.08 09:50:34 LOG7[2372:1036]: connect_blocking: s_poll_wait 133.x.y.z:587: waiting 10 seconds 2010.01.08 09:50:34 LOG5[2372:1036]: connect_blocking: connected 133.x.y.z:587 2010.01.08 09:50:34 LOG5[2372:1036]: smtp_server connected remote server from 192.168.3.118:1954 2010.01.08 09:50:34 LOG7[2372:1036]: Remote FD=268 initialized 2010.01.08 09:50:34 LOG5[2372:1036]: Negotiations for smtp (client side) started 2010.01.08 09:50:37 LOG7[2372:1036]: <- 220 smtp.example.com ESMTP Postfix 2010.01.08 09:50:37 LOG7[2372:1036]: -> 220 smtp.example.com ESMTP Postfix 2010.01.08 09:50:37 LOG7[2372:1036]: -> EHLO localhost 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-smtp.example.com 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-PIPELINING 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-SIZE 51200000 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-VRFY 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-ETRN 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-STARTTLS 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250 8BITMIME 2010.01.08 09:50:37 LOG7[2372:1036]: -> STARTTLS 2010.01.08 09:50:37 LOG7[2372:1036]: <- 220 Ready to start TLS 2010.01.08 09:50:37 LOG5[2372:1036]: Protocol negotiations succeeded 2010.01.08 09:50:37 LOG7[2372:1036]: SSL state (connect): before/connect initialization 2010.01.08 09:50:37 LOG7[2372:1036]: SSL state (connect): SSLv3 write client hello A 2010.01.08 09:50:40 LOG3[2372:1036]: SSL_connect: Peer suddenly disconnected 2010.01.08 09:50:40 LOG5[2372:1036]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.01.08 09:50:40 LOG7[2372:1036]: smtp_server finished (0 left) with "sslVersion=all", 2010.01.08 09:45:33 LOG7[2664:3880]: RAND_status claims sufficient entropy for the PRNG 2010.01.08 09:45:33 LOG7[2664:3880]: PRNG seeded successfully 2010.01.08 09:45:34 LOG7[2664:3880]: SSL context initialized for service smtp_server 2010.01.08 09:45:34 LOG5[2664:3880]: stunnel 4.28 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.08 09:45:34 LOG5[2664:3880]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.08 09:45:34 LOG5[2664:2408]: No limit detected for the number of clients 2010.01.08 09:45:34 LOG7[2664:2408]: FD 236 in non-blocking mode 2010.01.08 09:45:34 LOG7[2664:2408]: SO_REUSEADDR option set on accept socket 2010.01.08 09:45:34 LOG7[2664:2408]: smtp_server bound to 127.0.0.1:10025 2010.01.08 09:46:05 LOG7[2664:2408]: smtp_server accepted FD=244 from 127.0.0.1:1944 2010.01.08 09:46:05 LOG7[2664:2408]: Creating a new thread 2010.01.08 09:46:05 LOG7[2664:2408]: New thread created 2010.01.08 09:46:05 LOG7[2664:2968]: smtp_server started 2010.01.08 09:46:05 LOG7[2664:2968]: FD 244 in non-blocking mode 2010.01.08 09:46:05 LOG5[2664:2968]: smtp_server accepted connection from 127.0.0.1:1944 2010.01.08 09:46:05 LOG7[2664:2968]: FD 268 in non-blocking mode 2010.01.08 09:46:05 LOG6[2664:2968]: connect_blocking: connecting 133.x.y.z:587 2010.01.08 09:46:05 LOG7[2664:2968]: connect_blocking: s_poll_wait 133.x.y.z:587: waiting 10 seconds 2010.01.08 09:46:05 LOG5[2664:2968]: connect_blocking: connected 133.x.y.z:587 2010.01.08 09:46:05 LOG5[2664:2968]: smtp_server connected remote server from 192.168.3.118:1945 2010.01.08 09:46:05 LOG7[2664:2968]: Remote FD=268 initialized 2010.01.08 09:46:05 LOG5[2664:2968]: Negotiations for smtp (client side) started 2010.01.08 09:46:05 LOG7[2664:2968]: <- 220 smtp.example.com ESMTP Postfix 2010.01.08 09:46:05 LOG7[2664:2968]: -> 220 smtp.example.com ESMTP Postfix 2010.01.08 09:46:05 LOG7[2664:2968]: -> EHLO localhost 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-smtp.example.com 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-PIPELINING 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-SIZE 51200000 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-VRFY 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-ETRN 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-STARTTLS 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250 8BITMIME 2010.01.08 09:46:05 LOG7[2664:2968]: -> STARTTLS 2010.01.08 09:46:05 LOG7[2664:2968]: <- 220 Ready to start TLS 2010.01.08 09:46:05 LOG5[2664:2968]: Protocol negotiations succeeded 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): before/connect initialization 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv2/v3 write client hello A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server hello A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server certificate A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server key exchange A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server done A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 write client key exchange A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 write change cipher spec A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 write finished A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 flush data 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read finished A 2010.01.08 09:46:05 LOG7[2664:2968]: 1 items in the session cache 2010.01.08 09:46:05 LOG7[2664:2968]: 1 client connects (SSL_connect()) 2010.01.08 09:46:05 LOG7[2664:2968]: 1 client connects that finished 2010.01.08 09:46:05 LOG7[2664:2968]: 0 client renegotiations requested 2010.01.08 09:46:05 LOG7[2664:2968]: 0 server connects (SSL_accept()) 2010.01.08 09:46:05 LOG7[2664:2968]: 0 server connects that finished 2010.01.08 09:46:05 LOG7[2664:2968]: 0 server renegotiations requested 2010.01.08 09:46:05 LOG7[2664:2968]: 0 session cache hits 2010.01.08 09:46:05 LOG7[2664:2968]: 0 external session cache hits 2010.01.08 09:46:05 LOG7[2664:2968]: 0 session cache misses 2010.01.08 09:46:05 LOG7[2664:2968]: 0 session cache timeouts 2010.01.08 09:46:05 LOG6[2664:2968]: SSL connected: new session negotiated 2010.01.08 09:46:05 LOG6[2664:2968]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2010.01.08 09:46:05 LOG7[2664:2968]: SSL socket closed on SSL_read 2010.01.08 09:46:05 LOG7[2664:2968]: Socket write shutdown 2010.01.08 09:46:05 LOG5[2664:2968]: Connection closed: 625 bytes sent to SSL, 286 bytes sent to socket 2010.01.08 09:46:05 LOG7[2664:2968]: smtp_server finished (0 left) 2010.01.08 09:50:06 LOG7[2372:3760]: RAND_status claims sufficient entropy for the PRNG with "sslVersion=SSLv2", 2010.01.08 09:50:50 LOG7[2692:3460]: RAND_status claims sufficient entropy for the PRNG 2010.01.08 09:50:50 LOG7[2692:3460]: PRNG seeded successfully 2010.01.08 09:50:50 LOG7[2692:3460]: SSL context initialized for service smtp_server 2010.01.08 09:50:50 LOG5[2692:3460]: stunnel 4.28 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.08 09:50:50 LOG5[2692:3460]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.08 09:50:50 LOG5[2692:2496]: No limit detected for the number of clients 2010.01.08 09:50:50 LOG7[2692:2496]: FD 236 in non-blocking mode 2010.01.08 09:50:50 LOG7[2692:2496]: SO_REUSEADDR option set on accept socket 2010.01.08 09:50:50 LOG7[2692:2496]: smtp_server bound to 127.0.0.1:10025 2010.01.08 09:51:04 LOG7[2692:2496]: smtp_server accepted FD=244 from 127.0.0.1:1955 2010.01.08 09:51:04 LOG7[2692:2496]: Creating a new thread 2010.01.08 09:51:04 LOG7[2692:2496]: New thread created 2010.01.08 09:51:04 LOG7[2692:2056]: smtp_server started 2010.01.08 09:51:04 LOG7[2692:2056]: FD 244 in non-blocking mode 2010.01.08 09:51:04 LOG5[2692:2056]: smtp_server accepted connection from 127.0.0.1:1955 2010.01.08 09:51:04 LOG7[2692:2056]: FD 268 in non-blocking mode 2010.01.08 09:51:04 LOG6[2692:2056]: connect_blocking: connecting 133.x.y.z:587 2010.01.08 09:51:04 LOG7[2692:2056]: connect_blocking: s_poll_wait 133.x.y.z:587: waiting 10 seconds 2010.01.08 09:51:04 LOG5[2692:2056]: connect_blocking: connected 133.x.y.z:587 2010.01.08 09:51:04 LOG5[2692:2056]: smtp_server connected remote server from 192.168.3.118:1956 2010.01.08 09:51:04 LOG7[2692:2056]: Remote FD=268 initialized 2010.01.08 09:51:04 LOG5[2692:2056]: Negotiations for smtp (client side) started 2010.01.08 09:51:04 LOG7[2692:2056]: <- 220 smtp.example.com ESMTP Postfix 2010.01.08 09:51:04 LOG7[2692:2056]: -> 220 smtp.example.com ESMTP Postfix 2010.01.08 09:51:04 LOG7[2692:2056]: -> EHLO localhost 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-smtp.example.com 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-PIPELINING 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-SIZE 51200000 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-VRFY 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-ETRN 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-STARTTLS 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250 8BITMIME 2010.01.08 09:51:04 LOG7[2692:2056]: -> STARTTLS 2010.01.08 09:51:04 LOG7[2692:2056]: <- 220 Ready to start TLS 2010.01.08 09:51:04 LOG5[2692:2056]: Protocol negotiations succeeded 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): before/connect initialization 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 write client hello A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 read server hello A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 write client master key A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 client start encryption 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 write client finished A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 read server verify A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 read server finished A 2010.01.08 09:51:04 LOG7[2692:2056]: 1 items in the session cache 2010.01.08 09:51:04 LOG7[2692:2056]: 1 client connects (SSL_connect()) 2010.01.08 09:51:04 LOG7[2692:2056]: 1 client connects that finished 2010.01.08 09:51:04 LOG7[2692:2056]: 0 client renegotiations requested 2010.01.08 09:51:04 LOG7[2692:2056]: 0 server connects (SSL_accept()) 2010.01.08 09:51:04 LOG7[2692:2056]: 0 server connects that finished 2010.01.08 09:51:04 LOG7[2692:2056]: 0 server renegotiations requested 2010.01.08 09:51:04 LOG7[2692:2056]: 0 session cache hits 2010.01.08 09:51:04 LOG7[2692:2056]: 0 external session cache hits 2010.01.08 09:51:04 LOG7[2692:2056]: 0 session cache misses 2010.01.08 09:51:04 LOG7[2692:2056]: 0 session cache timeouts 2010.01.08 09:51:04 LOG6[2692:2056]: SSL connected: new session negotiated 2010.01.08 09:51:04 LOG6[2692:2056]: Negotiated ciphers: DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 2010.01.08 09:51:04 LOG7[2692:2056]: SSL closed on SSL_read 2010.01.08 09:51:04 LOG7[2692:2056]: Socket write shutdown 2010.01.08 09:51:04 LOG7[2692:2056]: Socket closed on read 2010.01.08 09:51:04 LOG7[2692:2056]: SSL write shutdown 2010.01.08 09:51:04 LOG5[2692:2056]: Connection closed: 626 bytes sent to SSL, 286 bytes sent to socket 2010.01.08 09:51:04 LOG7[2692:2056]: smtp_server finished (0 left) However, with OpenSSL older than 0.9.8i it can connect without "sslVersion=all" or with "sslVersion=SSLv3", and log tells SSLv3 was used. Why stunnel cannot connect with OpenSSL newer than 0.9.8j ? --- Tsurutani Naoki turutani(a)scphys.kyoto-u.ac.jp

1 0

Re: [stunnel-users] https not working with debug level 4,5,6,7
by ankur.agarwal＠wipro.com 07 Jan '10

07 Jan '10

Hi, When debug level is set to 4 , 5 , 6 , 7,https connection is not working.we have environment where we run the stunnel on a unit and try conncting it from windows machine through https connection.But this connection is not working for any debug level >3.can anybody help me.my sample stunnel file is : ; Sample stunnel configuration file by Michal Trojnara 2003-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = /usr/local/etc/config/certs/cert.pem key = /usr/local/etc/config/certs/privkey.pem ; Some performance tunings ;socket = l:TCP_NODELAY=1 ;socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 1 ; Don't forget to c_rehash CApath CApath = /usr/local/etc/config/certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /tmp/stunnel.log ; Use it for client mode client = no ; Service-level configuration ; [pop3s] ; accept = 995 ; connect = 110 ; [imaps] ; accept = 993 ; connect = 143 ; [ssmtp] ; accept = 465 ; connect = 25 ;[https] accept = 443 connect = 80 TIMEOUTclose = 10 ; vim:ft=dosini Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Previous Post Please Disregard!
by johnnyb mee 03 Jan '10

03 Jan '10

I finally seem to have stunnel up ,and running with Agent ver 2.0 newsreader. I had to do some more research on this, and thru patience, and many config changes I believe stunnel is now supplying SSL for my agent newsreader. Not an easy task for a total windows dummy like me though. Never have got the Linux thing. I guess it is the having to deal with scripts issue continually that scares the hell out of me!! IF anyone needs the procedure in the future for this let me know and I will send it to them! jb

1 0

How to setup forte agent to work with stunnel latest version.
by johnnyb mee 03 Jan '10

03 Jan '10

I have been trying to get stunnel to work with Agent 2.0 newsreader so that I can use SSL from my news server. I have read the faq and gone thru alot of previous posts concerning this and found this one entry suggestion for the stunnel.config file in order to setup SSL to work with Agent which unfortunately has no SSL capabilities at all. It is suggested to use this entry to get both the newserver and client to work thru using stunnel as a proxy server service basically. c:\program files\stunnel -c -d 127.0.0.1:119 -r unlimited.newshosting.com:563 I copied and pasted the entry changing the usenet server to the above, and now I can no longer get stunnel to start at all. I am getting an error message stating I need to check the logfile to determine what is causing the error. The actual logfile error is as follows: 2010.01.02 23:12:59 LOG7[3456:1988]: RAND_status claims sufficient entropy for the PRNG 2010.01.02 23:12:59 LOG7[3456:1988]: PRNG seeded successfully 2010.01.02 23:12:59 LOG7[3456:1988]: Certificate: stunnel.pem 2010.01.02 23:12:59 LOG7[3456:1988]: Certificate loaded 2010.01.02 23:12:59 LOG7[3456:1988]: Key file: stunnel.pem 2010.01.02 23:12:59 LOG7[3456:1988]: Private key loaded 2010.01.02 23:12:59 LOG7[3456:1988]: SSL context initialized for service pop3s 2010.01.02 23:12:59 LOG7[3456:1988]: Certificate: stunnel.pem 2010.01.02 23:12:59 LOG7[3456:1988]: Certificate loaded 2010.01.02 23:12:59 LOG7[3456:1988]: Key file: stunnel.pem 2010.01.02 23:12:59 LOG7[3456:1988]: Private key loaded 2010.01.02 23:12:59 LOG7[3456:1988]: SSL context initialized for service imaps file stunnel.conf line 55: No '=' found 2010.01.02 23:12:59 LOG3[3456:1988]: Server is down As you can ascertain I am no linux expert at all so working with startup scripts such as this is challenging to say the least. Is the entry I pasted into the config file incorrect or not pointing to the right path for the config file directory or what do you think is missing? I am using Windows XP Pro and know that the actual file for the config resides in windows/system32 folder. Any input on this would be very much appreciated and thanks in advance all. jb

1 0

what's wrong? error=unable to get local issuer certificate
by Carsten Krüger 29 Dec '09

29 Dec '09

I think it should work, * should match homie 1. connected with "openssl s_client -connect mail.neroon.com:995", pasted cert to dreamhost.pem 2. used this -----------stunnel.conf------------- debug=7 client = yes [pop3] accept = 110 connect = homie.mail.dreamhost.com:995 verify=1 CAfile=c:\temp\dreamhost.pem -----------stunnel.conf------------- 3. connect to localost:110, got "unable to get local issuer certificate 2009.12.29 16:04:25 LOG7[3044:5700]: Snagged 64 random bytes from C:/.rnd 2009.12.29 16:04:25 LOG7[3044:5700]: Wrote 0 new random bytes to C:/.rnd 2009.12.29 16:04:25 LOG7[3044:5700]: RAND_status claims sufficient entropy for the PRNG 2009.12.29 16:04:25 LOG7[3044:5700]: PRNG seeded successfully 2009.12.29 16:04:25 LOG7[3044:5700]: Loaded verify certificates from c:\temp\dreamhost.pem 2009.12.29 16:04:25 LOG7[3044:5700]: Loaded c:\temp\dreamhost.pem revocation lookup file 2009.12.29 16:04:25 LOG7[3044:5700]: SSL context initialized for service pop3 2009.12.29 16:04:25 LOG5[3044:5700]: stunnel 4.29 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2009.12.29 16:04:25 LOG5[3044:5700]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.12.29 16:04:25 LOG5[3044:4320]: No limit detected for the number of clients 2009.12.29 16:04:25 LOG7[3044:4320]: FD 1832 in non-blocking mode 2009.12.29 16:04:25 LOG7[3044:4320]: SO_REUSEADDR option set on accept socket 2009.12.29 16:04:25 LOG7[3044:4320]: pop3 bound to 0.0.0.0:110 2009.12.29 16:04:40 LOG7[3044:4320]: pop3 accepted FD=1808 from 127.0.0.1:3257 2009.12.29 16:04:40 LOG7[3044:4320]: Creating a new thread 2009.12.29 16:04:40 LOG7[3044:4320]: New thread created 2009.12.29 16:04:40 LOG7[3044:2340]: pop3 started 2009.12.29 16:04:40 LOG7[3044:2340]: FD 1808 in non-blocking mode 2009.12.29 16:04:40 LOG5[3044:2340]: pop3 accepted connection from 127.0.0.1:3257 2009.12.29 16:04:40 LOG7[3044:2340]: FD 1768 in non-blocking mode 2009.12.29 16:04:40 LOG6[3044:2340]: connect_blocking: connecting 208.97.132.208:995 2009.12.29 16:04:40 LOG7[3044:2340]: connect_blocking: s_poll_wait 208.97.132.208:995: waiting 10 seconds 2009.12.29 16:04:40 LOG5[3044:2340]: connect_blocking: connected 208.97.132.208:995 2009.12.29 16:04:40 LOG5[3044:2340]: pop3 connected remote server from 192.168.0.2:3258 2009.12.29 16:04:40 LOG7[3044:2340]: Remote FD=1768 initialized 2009.12.29 16:04:40 LOG7[3044:2340]: SSL state (connect): before/connect initialization 2009.12.29 16:04:40 LOG7[3044:2340]: SSL state (connect): SSLv3 write client hello A 2009.12.29 16:04:40 LOG7[3044:2340]: SSL state (connect): SSLv3 read server hello A 2009.12.29 16:04:40 LOG4[3044:2340]: VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=US/ST=California/L=Brea/O=Dreamhost.com/OU=Security/CN=*.mail.dreamhost.com/emailAddress=support(a)dreamhost.com 2009.12.29 16:04:40 LOG7[3044:2340]: SSL alert (write): fatal: bad certificate 2009.12.29 16:04:40 LOG3[3044:2340]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2009.12.29 16:04:40 LOG5[3044:2340]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.12.29 16:04:40 LOG7[3044:2340]: pop3 finished (0 left)

2 1

Using stunnel instead of SSL API
by Vladimir Stariradev 24 Dec '09

24 Dec '09

Hi Guys, I'm working on a java mobile app (J2ME MIDP 2.0) which connects to a java server, which I created. The java mobile app is an instant messenger. I want to use stunnel to encrypt the communication between the app and the server. At the moment the server runs on my localhost on port 5555 and accepts connections from the mobile device emulator I have running on the same machine. Eventually I want to transfer the mobile app on to my mobile and use it from there. My machine is running the following versions stunnel 4.29 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l on Windows 7 x64. I have not yet configured a pam or config file but I would like to continue listening on port 5555 with my own certificate (but for now any will do). Will the fact that I'm running both my server and device emulator on one machine mean that it'll bypass stunnel and I'll never know if it works or not? Should I have my mobile app use SecureConnection (SSL encrypted) class? In that case, I'd have to make the server listen for SSL connections too. That would defeat the purpose of stunnel. Help on configuration is welcome. Thanks for reading, I'm looking forward to your replies Vladimir

2 1

privileges not dropped before libwrap processes are spawned
by Micah Anderson 21 Dec '09

21 Dec '09

Hi, I recently stumbled on http://mirt.net/pipermail/stunnel-users/2008-May/001977.html which is exactly what I am seeing with version 4.27 of stunnel, namely the daemon is not switching to the setuid/setgid specified in the config before it is spawned. This means that I get 6 processes, 5 run as root with only one (albeit the one lisenting on the specified sockets) dropping privs to the specified user. The follow-up response from Mike was: I'll modify stunnel to delay spawning libwrap processes until privileges are dropped. and indeed, I find in the Changelog file for version 4.25 the following Bugfixes: * Bugfixes - Spawning libwrap processes delayed until privileges are dropped. However, it seems that either this fix either didn't make it in, or it somehow managed to creep its way back out because it is happening in 4.27. Thanks, micah

2 3

BBwin hanging windows
by Gregory Wege 18 Dec '09

18 Dec '09

Hey Guys, We have the following problem: Bbwin is sending traffic to 2 monitoring servers and is encrypted via stunnel. If one of the monitoring servers goes down, the number of ports being used by bbwin client increases to the point where the box is unusable - no more ports available on the windows box being monitored. If we kill the bbwin process, the problem goes away temporarily - after a short period of time, the problem returns. The problem continues even after the failed hobbit server recovers, and only clears up when we kill the bbwin process. * Windows version Server 2003 * bbwin versions 0.11, 0.12 * stunnel version 4.25 * hobbit server version 4.2.2 Output of the stunnel log shows the following error: 2009.12.16 06:56:19 LOG7[2336:2460]: New thread created 2009.12.16 06:56:19 LOG7[2336:4016]: hobbit_ssl started 2009.12.16 06:56:19 LOG7[2336:4016]: FD 356 in non-blocking mode 2009.12.16 06:56:19 LOG7[2336:4016]: TCP_NODELAY option set on local socket 2009.12.16 06:56:19 LOG5[2336:4016]: hobbit_ssl accepted connection from 127.0.0.1:1725 2009.12.16 06:56:19 LOG7[2336:4016]: FD 396 in non-blocking mode 2009.12.16 06:56:19 LOG6[2336:4016]: connect_blocking: connecting 10.132.55.24:1982 2009.12.16 06:56:19 LOG3[2336:4016]: connect_blocking: connect 10.132.55.24:1982: No buffer space available (WSAENOBUFS) (10055) 2009.12.16 06:56:19 LOG5[2336:4016]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.12.16 06:56:19 LOG7[2336:4016]: hobbit_ssl finished (0 left) Can something be added to my stunnel.conf to prevent this from happening? Any help would be greatly appreciated. Thanks.

2 2

Hey Stunnel-Users, I forgot to mention...
by Sreejith Mohan Menon 17 Dec '09

17 Dec '09

1 0

Tunnel iPhone - Server
by LoLoVioLo 14 Dec '09

14 Dec '09

Hi all, It is my first post. Sorry if common question but didn't find answer in archives or google. The fact is that I am using an iPhone with a data plan that only allow ports 80 and 443 (http and https). My aim is to be able to use all ports (mail, ftp, msn, etc). The idea is to tunnel all TCP connections between my computer here and my server at home. iPhone <----port-443----> Linux Server <----all-ports----> Internet I know there is alternatives for each service (webmail, webmessenger, etc.) but I think that it is technically possible to have something running that allow using of usual software. I also know that this usage is typically VPN but there is no VPN client for iPhone that allow custom ports and not sure my data plan can route GRE protocol. By the way STunnel was ported to the iPhone. There is some hope. I am not sure Stunnel is the best way to do that and not even sure that Stunnel can do it but hope you can advice. Thanks for your help. LoLoVioLo

1 0

Question (simple one I think)
by Reinier van der Gugten 09 Dec '09

09 Dec '09

Question: On the server, port 443 is already in use by a different service. However I require STunnel to communicate also on port 443. I thought, that perhaps I can obtain a second IP address and forward that trafic from the router to port 444 (or any other avail port). Then I can let Stunnel listen to port 444 and thus it would work. The firewall has to translate the 444 back to the 443 when transmitting data ofcourse. Is this the right way to go? Or ca I do this using one and the same IP (but then there would be 2 services listning to the same port right)? Thanks. Reinier

3 2

Your opinion on sessiond
by Michal Trojnara 04 Dec '09

04 Dec '09

Dear Users, I'm eager to hear your comments, suggestions or issues regarding sessiond. Feel free to use the stunnel-users mailing list or the bug tracking system: https://stunnel.mirt.net/?page=bts Best regards, Mike

2 2

Stunnel 4.29 released
by Michal Trojnara 02 Dec '09

02 Dec '09

The ChangeLog entry: Version 4.29, 2009.12.02, urgency: MEDIUM: * New feature sponsored by Searchtech Limited http://www.astraweb.com/ - sessiond, a high performance SSL session cache was built for stunnel. A new service-level "sessiond" option was added. sessiond is available for download on ftp://stunnel.mirt.net/stunnel/sessiond/ . stunnel clusters will be a lot faster, now! * Bugfixes - "execargs" defaults to the "exec" parameter (thx to Peter Pentchev). - Compilation fixes added for AIX and old versions of OpenSSL. - Missing "fips" option was added to the manual. SHA-1 value for stunnel-4.29.tar.gz: f93ac9054c62b1db0dcf44f668d323d82cc0f413 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

Still having issues compiling Stunnel on aix 5.3. SOL_TCP not defined? Please help
by Geoff 02 Dec '09

02 Dec '09

I installed gcc and the latest version of openssl on my aix 5.3 server. I did the ./configure and all went well. When I did the make I recieved the following error. if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.28\" -DPACKAGE_STRING=\"stunnel\ 4.28\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.28\" -DHOST=\"powerpc-ibm-aix5.3.0.0\" -DCPU_POWERPC=1 -DVENDOR_IBM=1 -DOS_AIX5_3_0_0=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTS_AND_PTC=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/include -MT options.o -MD -MP -MF ".deps/options. Tpo" -c -o options.o options.c; then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c:1773: error: 'SOL_TCP' undeclared here (not in a function) make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. The SOL_TCP option is not defined on AIX. I am hoping this can be applied to SOL_SOCKET which is defined. So... I changed the following lines in the options.c program #ifdef TCP_KEEPCNT /* {"TCP_KEEPCNT", SOL_TCP, TCP_KEEPCNT, TYPE_INT, DEF_VALS}, */ {"TCP_KEEPCNT", SOL_SOCKET, TCP_KEEPCNT, TYPE_INT, DEF_VALS}, #endif #ifdef TCP_KEEPIDLE /* {"TCP_KEEPIDLE", SOL_TCP, TCP_KEEPIDLE, TYPE_INT, DEF_VALS}, */ {"TCP_KEEPIDLE", SOL_SOCKET, TCP_KEEPIDLE, TYPE_INT, DEF_VALS}, #endif #ifdef TCP_KEEPINTVL /* {"TCP_KEEPINTVL", SOL_TCP, TCP_KEEPINTVL, TYPE_INT, DEF_VALS},*/ {"TCP_KEEPINTVL", SOL_SOCKET, TCP_KEEPINTVL, TYPE_INT, DEF_VALS}, I can compile the code without error at this point. So... my question is has anyone else made a similar change to get the code to compile on AIX 5.3? If not, can you please tell me what configuration options you used to make stunnel work. Thanks for any help you can provide. I am at my wits end here and pretty much my capability in compiling code. Thanks in advance, Geoff

1 0

Upgrade From 4.27 to 4.28? Or Wait for Next Version?
by Jeff Salisbury 01 Dec '09

01 Dec '09

Greetings, I've noticed some problems with v4.28 (posted in this group). Is there any compelling reason to upgrade from 4.27 to 4.28? Or, should we wait for the problems in 4.28 to be fixed in a new version and then upgrade? Regards, Jeff

1 0

build problem with 4.28 on SLES9 (SSL again)
by Andreas Vetter 27 Nov '09

27 Nov '09

Hi, there is a build problem with 4.28 on a SLES 9. May be similar to the no_ticket problem. Here is the interesting part of build log: options.c: In function `parse_ssl_option': options.c:1714: error: `SSL_OP_NO_QUERY_MTU' undeclared (first use in this function) options.c:1714: error: (Each undeclared identifier is reported only once options.c:1714: error: for each function it appears in.) options.c:1715: error: `SSL_OP_COOKIE_EXCHANGE' undeclared (first use in this function) options.c:1724: error: `SSL_OP_SINGLE_ECDH_USE' undeclared (first use in this function) make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/usr/src/packages/BUILD/stunnel-4.28/src' any hints? -- Mit freundlichen Gruessen, Andreas Vetter Informations- und Kommunikationstechnik Fakultaet fuer Physik und Astronomie Universitaet Wuerzburg

2 2

Help in making stunnel please.
by Geoff 26 Nov '09

26 Nov '09

Compiling on aix 5.3 ./configure runs fine when I run make I get this error... I am using the latest version of ssl. # make Making all in src source='env.c' object='env.lo' libtool=yes DEPDIR=.deps depmode=aix /bin/sh ../auto/depcomp /bin/sh ../libtool --tag=CC --mode=compile cc -qlanglvl=ansi -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.28\" -DPACKAGE_STRING=\"stunnel\ 4.28\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.28\" -DHOST=\"powerpc-ibm-aix5.3.0.0\" -DCPU_POWERPC=1 -DVENDOR_IBM=1 -DOS_AIX5_3_0_0=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTS_AND_PTC=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -I/usr/include -c -o env.lo env.c cc -qlanglvl=ansi -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.28\" "-DPACKAGE_STRING=\"stunnel 4.28\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.28\" -DHOST=\"powerpc-ibm-aix5.3.0.0\" -DCPU_POWERPC=1 -DVENDOR_IBM=1 -DOS_AIX5_3_0_0=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTS_AND_PTC=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR=\"/usr/local/lib/stunnel\" -DCONFDIR=\"/usr/local/etc/stunnel\" -DPIDFILE=\"/usr/local/var/run/stunnel/stunnel.pid\" -g -I/usr/include -c -M env.c -DPIC -o .libs/env.o "/usr/include/sys/socket.h", line 141.9: 1506-213 (S) Macro name getpeername cannot be redefined. "/usr/include/sys/socket.h", line 141.9: 1506-358 (I) "getpeername" is defined on line 39 of env.c. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Here is the configure # ./configure configure: **************************************** initialization checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking build system type... powerpc-ibm-aix5.3.0.0 checking host system type... powerpc-ibm-aix5.3.0.0 checking for gcc... no checking for cc... cc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether cc accepts -g... yes checking for cc option to accept ISO C89... -qlanglvl=ansi checking for style of include used by make... GNU checking dependency style of cc -qlanglvl=ansi... aix checking for a BSD-compatible install... auto/install-sh -c checking whether make sets $(MAKE)... (cached) yes configure: **************************************** libtool checking for a sed that does not truncate output... /usr/bin/sed checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for non-GNU ld... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... no checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognize dependent libraries... pass_all checking how to run the C preprocessor... cc -qlanglvl=ansi -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for g++... no checking for c++... no checking for gpp... no checking for aCC... no checking for CC... no checking for cxx... no checking for cc++... no checking for cl.exe... no checking for FCC... no checking for KCC... no checking for RCC... no checking for xlC_r... no checking for xlC... no checking whether we are using the GNU C++ compiler... no checking whether g++ accepts -g... no checking dependency style of g++... none checking for g77... no checking for xlf... no checking for f77... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for xlf90... no checking for f90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for xlf95... no checking for f95... no checking for fort... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 18432 checking command to parse /usr/bin/nm -B output from cc -qlanglvl=ansi object... ok checking for objdir... .libs checking for ar... ar checking for ranlib... ranlib checking for strip... strip checking for cc -qlanglvl=ansi option to produce PIC... checking if cc -qlanglvl=ansi static flag -bnso -bI:/lib/syscalls.exp works... no checking if cc -qlanglvl=ansi supports -c -o file.o... yes checking whether the cc -qlanglvl=ansi linker (/usr/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... aix5.3.0.0 ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... no checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no configure: creating libtool appending configuration tag "CXX" to libtool appending configuration tag "F77" to libtool configure: **************************************** types checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 checking for socklen_t... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... no checking for "/dev/ptc"... yes configure: **************************************** entropy checking for "/dev/urandom"... yes configure: **************************************** default group checking for default group... nobody configure: **************************************** header files checking ucontext.h usability... yes checking ucontext.h presence... yes checking for ucontext.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking for struct msghdr.msg_control... yes configure: **************************************** libraries checking for library containing gethostbyname... none required checking for library containing yp_get_default_domain... none required checking for socket in -lsocket... no checking for openpty in -lutil... no checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for inflateEnd in -lz... yes configure: **************************************** thread model checking for pthread_create in -lc_r... no checking for pthread_create in -lpthread... yes configure: PTHREAD thread model detected configure: **************************************** library functions checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for setsid... yes checking for setgroups... yes checking for chroot... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for localtime_r... yes checking for getcontext... yes checking for __makecontext_v2... no checking for poll... yes checking for endhostent... yes checking for getnameinfo... yes checking for getaddrinfo... yes checking for broken poll() implementation... no configure: **************************************** SSL checking for SSL directory... /usr checking for obsolete RSAref library... no checking /usr/include/openssl/engine.h usability... yes checking /usr/include/openssl/engine.h presence... yes checking for /usr/include/openssl/engine.h... yes configure: **************************************** optional features checking whether to disable RSA support... no checking whether to enable DH support... no checking whether to enable IPv6 support... yes checking whether to disable TCP wrappers library support... autodetecting checking for hosts_access in -lwrap... no checking whether to enable FIPS mode support... autodetecting checking for FIPS_mode_set... no configure: **************************************** write the results configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/stunnel3 config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init config.status: executing depfiles commands configure: **************************************** success

2 1