- stunnel-users - stunnel.org

Stunnel on WIndows Server 2008 R2 SP1 x 64 fails - Microsoft.VC90.CRT.MANIFEST
by Rüdiger Konte 15 Jul '12

15 Jul '12

Hi Stunnel users, I am trying to run stunnel "4.53 installer.exe" on a MS Windows Server 2008 R2 SP1 64 Bit (under VMWARE Workstation 6.5 as a virtual system; Physical Host OS is WIN7 Ultimate 32 BIT) The installation of stunnel was done as an "Administrator" and it ran through without issues. But I cannot se any service running. And when I try to launch the stunnel shortcut on the desktop, i got a error message like: "The application was unable to start correctly (0xc0150002). Click OK to close the application." I assume it has something to do with the Microsoft.VC90.CRT.MANIFEST file. But i am not an expert. This is shown in the Event log: ########################## Protokollname: Application Quelle: SideBySide Datum: 15.07.2012 12:17:01 Ereignis-ID: 35 Aufgabenkategorie:Keine Ebene: Fehler Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: WIN-C1K2E115MV1 Beschreibung: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\stunnel\LIBEAY32.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST" in Zeile 4. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Ereignis-XML: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="SideBySide" /> <EventID Qualifiers="49409">35</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2012-07-15T10:17:01.000000000Z" /> <EventRecordID>197</EventRecordID> <Channel>Application</Channel> <Computer>WIN-C1K2E115MV1</Computer> <Security /> </System> <EventData> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"</Data> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"</Data> <Data>C:\Program Files (x86)\stunnel\LIBEAY32.dll</Data> <Data>C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST</Data> <Data>4</Data> ########################## I ran the MS tool sxstrace.exe to get more details: See the outcome below: ######################################### INFORMATION: Die Manifestsdefinitionsidentität ist "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"". FEHLER: Die im Manifest gefundene Komponentenidentität stimmt nicht mit der Identität der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". FEHLER: Bei der Generierung des Aktivierungskontextes ist ein Fehler aufgetreten. Beendet die Generierung des Aktivierungskontextes. ######################################### Is anything missing? .NET or another library ? Note: I installed on the same server in a different snapshot stunnel version 4.4 and it seems to work, at least no error message. But i want to use the latest version. Any help would be nice. Best Rudi

1 0

Conf question: HTTP to HTTPS with SNI
by John Moser 03 Jul '12

03 Jul '12

I have a particular task I need to accomplish in which an HTTP-only caching proxy server is to accept SSL. The architecture in mind is as follows: - Receive request { HTTP request: - Received by caching proxy at localhost:80 HTTPS request: - Received by Pound - Decoded to HTTP - X-FROM-SSL header added - Forwarded to localhost:80 (caching proxy) } Proxy receives HTTP request - Perform caching - If X-FROM-SSL, forward to localhost:8088 - Else forward to HTTP server It is at this point that two design options come into play, both using stunnel. Either use SNI or use stunnel and HTTP. Via SNI, this would appear as follows: Stunnel receives HTTP request - Forward to https://http-server:443/ with SNI This of course requires that stunnel can read the 'Host' header out of an HTTP request and use that for SNI automatically (there's some 300 virtual hosts on that server). If not, this is infeasible. Which is my question, of course: can this be done? If this isn't an option, then the next logical way to handle this problem is: Stunnel receives HTTP request: - SSL encrypt - Forward to http-server:8443 http-server receives HTTP over stunnel - stunnel receives on http-server:8443 - Decrypt and forward to http://localhost:80/ In this way the entire connection would be encrypted, and the HTTP server would see the Host: header and use that to figure out the virtual host etc. Is that the better/only way?

1 0

more than 1000 concurrent connections?
by Trenton Ashburn 03 Jul '12

03 Jul '12

Hi There - I'd like to use stunnel as the SSL termination point for a bunch of persistent TCP connections. I'm running it on an EC2 instance and it's only allowing me about 1000 concurrent connections. It doesn't matter if the connections come from one client IP or two. How can I raise this limit? I've already raised the OS tcp connection limit with ulimit and it doesn't improve things. Thanks, T

4 5

Re: [stunnel-users] Interoperability problems with .net client software
by josealf＠rocketmail.com 30 Jun '12

30 Jun '12

Not as far as I know. You need to check with the client application developers. Maybe they can use a debugger to trace the program flow and see where and why it fails (assuming they understand the protocols and the tools). The application must be coded to present the certificate, and my guess (just a guess), is that it isn't or is blocking before getting to that point. -----Original Message----- From: ProPharma Systems AG - Gregor Bürgisser <g.buergisser(a)propharma.ch> Date: Fri, 29 Jun 2012 06:59:14 To: <josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Interoperability problems with .net client software Yes I did. Also the CA used to sign the server cert. All to no avail. Do you know if there are any (known) interoperability issues between stunnel and .net applications? On 06/28/2012 02:05 PM, josealf(a)rocketmail.com wrote: > Looks like your client is not presenting the certificate to the stunnel server. Maybe because it does not trust the server certificate? Did you import your stunnel server cert into windows certificate store? > > > -----Original Message----- > From: ProPharma Systems AG - Gregor Bürgisser > <g.buergisser(a)propharma.ch> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Thu, 28 Jun 2012 12:48:53 > To:<stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Interoperability problems with .net client software > > Hi all, > > I'm using stunnel 4.53 under Linux to secure a service. There are two > different clients connecting to this service: My own client, also Linux > based and using libcurl and another (third party!) client being > developed using Microsoft .net stuff. > > Of course with my own client all works well. But we are not able to get > the Microsoft client running. stunnel keeps on telling: > > SSL_accept: 140890C7: error:140890C7:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > We have tried diffierent things... I will outline them here if you think > it is helpful (in short: tried using certificates generated on the > Microsoft side, then tried using certificates created on the Linux side). > If "verify" ist set to 0 or 1 it works (of course) but with a higher > value the above message is logged. > > Are there any known pitfalls, problems or whatsoever when using stunnel > with a .net client? > Any advice would be appreciated! > > Regards, > Gregor > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

clean installation on Windows
by John 29 Jun '12

29 Jun '12

Hello. I would like to install stunnel on 64-bit Win7, and I would like to know whether it is possible to do so by just unzipping the downloaded files into one folder and then clicking on the main executable, that is, to avoid making registry entries, etc. I would like to have a minimal impact to whatever extent is possible. Can it be done in this way, or does it need the whole shebang installer procedure to be run?

4 5

Stunnel, Pan and the SSL23_GET_SERVER_HELLO:unknown protocol
by mike 28 Jun '12

28 Jun '12

Hello All, Running Debian 6.0, stunnel4 and Pan 0.133 I have set up Pan and installed stunnel so that I can use ssl with nntp. Installing Pan and stunnel was easy. I've edited Pan to use localhost:119 and edited my config file in stunnel to point to my nntp server. I have allowed nntp in my hosts.allow for ALL:ALL. The problem I am running into is that Pan does not connect. I get the following error: Error reading from localhost. Connection reset by peer Checking with the following openssl command produced this error: root@triglav:/etc/stunnel# openssl s_client -ssl3 -connect localhost:119 CONNECTED(00000003) write:errno=104 Looking at the logs for stunnel I see many repetitions of this message: 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp started 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 13 in non-blocking mode 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on local socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: Waiting for a libwrap process 2012.06.25 14:18:26 LOG7[16355:3074153328]: Acquired libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Releasing libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Released libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp permitted by libwrap from 127.0.0.1:59451 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp accepted connection from 127.0.0.1:59451 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 14 in non-blocking mode 2012.06.25 14:18:26 LOG6[16355:3074153328]: connect_blocking: connecting 209.197.15.238:119 2012.06.25 14:18:26 LOG7[16355:3074153328]: connect_blocking: s_poll_wait 209.197.15.238:119: waiting 10 seconds 2012.06.25 14:18:26 LOG5[16355:3074153328]: connect_blocking: connected 209.197.15.238:119 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp connected remote server from 192.168.2.56:51455 2012.06.25 14:18:26 LOG7[16355:3074153328]: Remote FD=14 initialized 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on remote socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): before/connect initialization 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): SSLv2/v3 write client hello A 2012.06.25 14:18:26 LOG3[16355:3074153328]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2012.06.25 14:18:26 LOG5[16355:3074153328]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp finished (0 left) Anyone know what is missing? It almost looks like it cant talk in either SSLv2 or v3 which makes no sense. Here is my stunnel config: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log foreground = no ; Use it for client mode client = yes ; Service-level configuration [nntp] accept = localhost:119 connect = news.aliant.net:119 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

2 4

Interoperability problems with .net client software
by ProPharma Systems AG - Gregor Bürgisser 28 Jun '12

28 Jun '12

Hi all, I'm using stunnel 4.53 under Linux to secure a service. There are two different clients connecting to this service: My own client, also Linux based and using libcurl and another (third party!) client being developed using Microsoft .net stuff. Of course with my own client all works well. But we are not able to get the Microsoft client running. stunnel keeps on telling: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate We have tried diffierent things... I will outline them here if you think it is helpful (in short: tried using certificates generated on the Microsoft side, then tried using certificates created on the Linux side). If "verify" ist set to 0 or 1 it works (of course) but with a higher value the above message is logged. Are there any known pitfalls, problems or whatsoever when using stunnel with a .net client? Any advice would be appreciated! Regards, Gregor

2 1

Accept on same port to ethernet aliases
by John Morrison 27 Jun '12

27 Jun '12

Hi, Is it possible to configure stunnel to use the same port on different IP addresses that are Ethernet aliases? I have successfully set up a configuration file accepting SSL connections. Firstly I did this on all IP addresses by using the following configuration lines: accept = 443 connect = 80 This worked correctly. I then attempted to setup a second configuration file on an aliased Ethernet address. The configuration file settings are: test1.conf accept = 10.168.1.132:443 connect = 10.168.1.132:80 test2.conf accept = 10.168.1.133:443 connect = 10.168.1.133:80 Stunnel is able to start the first configuration file, but not the second. The error message I can see when I run the second configuration file in the foreground is: accept socket: FD=11 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Error binding https to 10.168.1.133:443 bind: Address already in use (98) and if I telnet to 10.168.1.133 on port 443 the connection is accepted. I have attempted to use the binding socket options in the configuration files as described in the manual: socket = a:SO_BINDTODEVICE=eth0:0 and socket = a:SO_BINDTODEVICE=eth0:1 However in this case stunnel will not start either configuration file. The error message I receive is: Option SO_REUSEADDR set on accept socket SO_BINDTODEVICE: No such device (19) Is there a different way to configure stunnel to allow this to work? My ipconfig settings are below. I am running the ubuntu 10.04 version of stunnel. The version output is: stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Thanks, John eth0:0 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.132 Bcast:10.168.1.132 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800 eth0:1 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.133 Bcast:10.168.1.133 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800

2 2

Confused about stunnel + haproxy
by Robin Lee Powell 27 Jun '12

27 Jun '12

I've set up stunnel + haproxy using the "protocol = proxy" method, but stunnel doesn't seem to pass to haproxy any information about the source IP of the original connection, which I thought was the point of using this method? Can someone tell me what I'm missng? I just want to have haproxy with SSL support without losing the client IP information completely. -Robin -- http://singinst.org/ : Our last, best hope for a fantastic future. .i ko na cpedu lo nu stidi vau loi jbopre .i danfu lu na go'i li'u .e lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i na'i li'u .e lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu sofybakni li'u

1 1

socket status
by Dee Ayy 21 Jun '12

21 Jun '12

My socket in Eiffel will report that it is connected, but when it tries to write to the socket, it will fail and report Connection reset by peer I/O error The syslog shows 1) ... accepted connection from 127.0.0.1:.. 2) connect_blocking: getsockopt A_REMOTE_IP:A_REMOTE_PORT: Connection refused (111) 3) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I believe that my socket is connecting locally fine 127.0.0.1:.. in step 1, and then the remote connection via stunnel is failing in step 2, but I have tried to write to the socket in between steps 1 and 2. Is this proper behavior? How can I know the status of the remote connection? Wait a while and then test? Is the socket state really just the state of the local stunnel connection? Should stunnel report a different state (as seen by my socket) until it determines the remote socket state?

1 0