stunnel-users

stunnel-users@stunnel.org

5 participants
3293 discussions

Trying to redirect with stunnel - seems to hang
by Len DiMaggio 26 Oct '06

26 Oct '06

'Evening everyone, I'm wondering if anyone has already seen a problem like this. Background - I'm trying to use stunnel to act as an SSL server and redirect connections so that I can use the JMeter script recorder to build automated tests for an app's web GUI. (The recorder does not support SSL.) The software versions are: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 I'm able to set up the redirection, and everything in the stunnel log looks OK - and, this is just making the connection manually - without JMeter - but trying to access the target app just hangs in the browser with a "connecting to..." status message. Here's the stunnel config file that I'm using - the log is attached. client=yes output=/tmp/stunnel.log debug=debug [8084] accept=hostname:8079 connect=hostname:8084 Interestingly - when I kill the stunnel process, the browser displays (most of) the target app's top level page. Thanks in advance, Len DiMaggio ldimaggi(a)redhat.com The stunnel log sez: 2006.10.24 04:58:33 LOG5[5869:3086362304]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2006.10.24 04:58:33 LOG5[5869:3086362304]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2006.10.24 04:58:33 LOG6[5869:3086362304]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.10.24 04:58:33 LOG6[5869:3086362304]: poll() used - no FD_SETSIZE limit for file descriptors 2006.10.24 04:58:33 LOG5[5869:3086362304]: 500 clients allowed 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 4 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 5 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 6 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: SO_REUSEADDR option set on accept socket 2006.10.24 04:58:33 LOG7[5869:3086362304]: 8084 bound to 10.15.49.274:8079 2006.10.24 04:58:33 LOG7[5870:3086362304]: Created pid file /var/run/stunnel.pid 2006.10.24 04:58:52 LOG7[5870:3086362304]: 8084 accepted FD=7 from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 started 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 7 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 9 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086362304]: Cleaning up the signal pipe 2006.10.24 04:58:52 LOG6[5870:3086362304]: Child process 5874 finished with code 0 2006.10.24 04:58:52 LOG7[5870:3086359440]: Connection from 172.16.83.99:58417 permitted by libwrap 2006.10.24 04:58:52 LOG5[5870:3086359440]: 8084 connected from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 connecting 10.15.49.274:8084 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: waiting 10 seconds 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: connected 2006.10.24 04:58:52 LOG7[5870:3086359440]: Remote FD=8 initialized 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): before/connect initialization 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server certificate A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server done A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client key exchange A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write change cipher spec A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 flush data 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 items in the session cache 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects (SSL_connect()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 client renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects (SSL_accept()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache hits 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache misses 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache timeouts 2006.10.24 04:58:52 LOG6[5870:3086359440]: SSL connected: new session negotiated 2006.10.24 04:58:52 LOG6[5870:3086359440]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 -- Len DiMaggio (ldimaggi(a)redhat.com) Red Hat USA 10 Technology Park Drive Westford, MA 01886 tel: 978.392.3179 cell: 617.872.3673 http://www.redhat.com

3 2

status of www.stunnel.org
by Steven Van Acker 26 Oct '06

26 Oct '06

Hi, I noticed how the website http://www.stunnel.org is out of sync with the latest releases of stunnel. Are there plans to update this site ? And if not, would it be possible to redirect its visitors to http://stunnel.mirt.net/ automatically ? kind regards, -- Steven Van Acker -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Stunnel client not sending data
by Jeremiah Martell 26 Oct '06

26 Oct '06

Hello, I have a program that opens up a connection to port 10000 of a server and sends it some data. It works normally. I'm trying to "stunnel" both ends. In my program I create a socket, connect to local port 7033, send my data, and close the socket. I verified that every function call returns success (socket, setsockopt (for TCP_NODELAY), gethostbyname, connect, and send). >From what the logs show below, it seems that server stunnel gets the connection from the client stunnel, they successfully negotiate the SSL stuff, then the client stunnel waits for any data to proxy to the server stunnel. The server stunnel is waiting too, and after 10 seconds of no data, it closes the socket. For some reason the client stunnel is not getting my data and therefore doesn't forward anything over to the server stunnel. I'm not sure why this is happening, because my program works normally and I've verified that everything returned success. Any ideas? - Jeremiah ----------------------------- ON CLIENT (1.2.3.60) Linux stunnel 4.16 OpenSSL 0.9.7c stunnel.conf is... pid = client = yes [7033] accept = 127.0.0.1:7033 connect = 1.2.3.70:7033 ----------------------------- ON SERVER (1.2.3.70) Windows stunnel 4.16 windows binary installer (Aug 31 2006) stunnel.conf is... cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 [7033] accept = 1.2.3.60:7033 connect = 127.0.0.1:10000 ----------------------------- On client I see this debug... Oct 24 14:38:22 stunnel: LOG5[2892:258]: 7033 connected from 127.0.0.1:10251 Oct 24 14:38:32 stunnel: LOG3[2892:258]: SSL_read: Connection reset by peer (104) Oct 24 14:38:32 stunnel: LOG5[2892:258]: Connection reset: 56 bytes sent to SSL, 0 bytes send to socket ----------------------------- On server I see this debug... 2006.10.24 14:43:08 LOG7[2596:4068]: 7033 accepted FD=196 from 1.2.3.60:10252 2006.10.24 14:43:08 LOG7[2596:4068]: Creating a new thread 2006.10.24 14:43:09 LOG7[2596:4068]: New thread created 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 started 2006.10.24 14:43:09 LOG7[2596:2372]: FD 196 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: TCP_NODELAY option set on local socket 2006.10.24 14:43:09 LOG5[2596:2372]: 7033 connected from 1.2.3.60:10252 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): before/accept initialization 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write certificate A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server done A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client key exchange A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: 3 items in the session cache 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects (SSL_connect()) 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects (SSL_accept()) 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 server renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache hits 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache misses 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache timeouts 2006.10.24 14:43:09 LOG6[2596:2372]: SSL accepted: new session negotiated 2006.10.24 14:43:09 LOG6[2596:2372]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.24 14:43:09 LOG7[2596:2372]: FD 180 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 connecting 127.0.0.1:10000 2006.10.24 14:43:09 LOG7[2596:2372]: connect_wait: waiting 10 seconds 2006.10.24 14:43:19 LOG6[2596:2372]: connect_wait: s_poll_wait timeout 2006.10.24 14:43:19 LOG5[2596:2372]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.24 14:43:19 LOG7[2596:2372]: 7033 finished (0 left)

3 4

[OT] Questions about OpenSSL
by Gonzalo Diethelm 25 Oct '06

25 Oct '06

Hello everyone, I have a slightly off-topic question but one I think stunnel's developers are in a good position to assist me with. I need to implement what amounts to an embedded web server for a process that will be deployed on a "hostile" server (Win32), meaning that I don't want the people in that server to mess around with either the process or the network traffic to/from the process. The goal is to deploy a binary and a set of DLLs to the hostile server (no configuration files). To this effect, I have found a couple of usable HTTP server libraries, and I have implemented the functionality I need over clean HTTP. Now, I would like to use SSL to encrypt the data coming and going to my process; alas, I have not found any open source HTTP library that also supports HTTPS. Therefore, I have come to the conclusion that I will have to integrate OpenSSL into one of the HTTP libraries myself. The first question is: how difficult is it to integrate OpenSSL in "server mode" into an application? I tried taking a peek at Apache's mod_ssl, but being unfamiliar with Apache's internals, I was completely lost. Then it occurred to me that stunnel must do something similar to what I need, and indeed I could follow the code in stunnel to a point; before going any further, I wanted to first hear comments, opinions and hints from the developers. It also occurred to me that I could do what I need if stunnel offered some kind of "in process" handling of requests: instead of forwarding to a certain host:port the requests it gets, maybe stunnel itself could be configured to process the requests somehow, generate the responses and send them back; for instance, what I need to do is basically query a MySQL DB and send some records back. I am pretty sure this is not supported in stunnel today, but if it is something that anyone (besides me) sees as useful, I could volunteer to do at least part of the development. Alternatively, please feel free to educate me on why this is a moronic idea... In any case, thanks for a great product and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

1 0

Connection problems and TCP frame checksum errors
by Tommi Nieminen 23 Oct '06

23 Oct '06

I have the following kind of test environment: SSL clients call a public ip address from which the calls are forwarded to a linux server with Stunnel. The linux server is in a private network. Stunnel decrypts the data and sends it forward. I have been testing this with a browser, monitoring the traffic on the server to see that Stunnel forwards the calls. Some strange things happen there that I can't explain. First of all: sometimes the calls go through the server as expected, sometimes the server doesn't respond in any way to the client. If I have two terminal windows open, one with tcpdump and another with tail -f stunnel.log - nothing comes into the log in spite of the incoming connections attempts. Then on other occasions when the calls come to the server, it forwards them beautifully to the address and port set in the configuration file. Does anyone have any clue, what this could be due to? I haven't been able to explain why it sometimes works and sometimes doesn't. Another thing that bothers me is, that sometimes there are TCP frames with incorrect checksum. I've monitored with Ethereal and tcpdump. Both show incorrect frames, and they are always from the stunnel-end of the connection. What could be the cause of those broken frames? Tommi Nieminen -------------------------------------------------------- My stunnel.conf looks like this: (any constructive criticism would be welcome :-)) CAfile = /home/tommi/cert/7/demoCA/cacert.pem cert = /home/tommi/cert/7/newcert.pem key = /home/tommi/cert/7/newkey.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 -------------------------------------------------------- A succesful connection from stunnel.log: 2006.10.09 18:01:43 LOG7[11889:3083744960]: https accepted FD=7 from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: https started 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 7 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on local socket 2006.10.09 18:01:43 LOG5[11889:3083742128]: https connected from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): before/accept initialization 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write certificate A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server done A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client key exchange A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: 2 items in the session cache 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects (SSL_connect()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 8 server connects (SSL_accept()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 7 server connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 server renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 4 session cache hits 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache misses 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache timeouts 2006.10.09 18:01:43 LOG6[11889:3083742128]: SSL accepted: new session negotiated 2006.10.09 18:01:43 LOG6[11889:3083742128]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 8 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: https connecting 192.168.10.17:5010 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: waiting 10 seconds 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: connected 2006.10.09 18:01:43 LOG7[11889:3083742128]: Remote FD=8 initialized 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on remote socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: Socket closed on read 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL write shutdown 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL alert (write): warning: close notify 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL_shutdown retrying 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL doesn't need to read or write 2006.10.09 18:02:45 LOG6[11889:3083742128]: s_poll_wait timeout: connection close 2006.10.09 18:02:45 LOG5[11889:3083742128]: Connection closed: 0 bytes sent to SSL, 405 bytes sent to socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: https finished (0 left) (and the failed connections leave also no mark in the log, but tcpdump sees the attempts on the server) -------------------------------------------------------- A sample of tcpdump's output with incorrect checksum: 18:02:45.150656 IP (tos 0x0, ttl 64, id 11218, offset 0, flags [DF], proto: TCP (6), length: 77) 192.168.20.18.https > 131.177.254.92.2689: P, cksum 0x5708 (incorrect (-> 0xf1bf), 1035:1072(37) ack 756 win 7504

2 6

Thank you very much for all your donations
by Michal Trojnara 21 Oct '06

21 Oct '06

Dear Users, I want you to know how much grateful I am for all your donations. Thank you very much. Some day stunnel may be full-time job. 8-) Even now sponsored features make a substantial addition to my budget. BTW: I have updated currency to USD. I hope it's more convenient. http://stunnel.mirt.net/ Best regards, Mike

1 0

error 1703, service already exists.
by Joop Blokker 20 Oct '06

20 Oct '06

Hello, I'm using sTunnel v4.18 under Windows XP as a client. I start the serv= ice with sTunnel -install -quiet If, for any reason, the same command is given again then the error mes= sage "Create service; error 1703; the specified service already exists= " pops up. In that case the -quiet parameter does not work. I do not w= ant to see that error message; if the service is running then it's oka= y. Q:. How can I suppress that error message? If that is not an option, h= ow can I detect that the sTunnel service is installed already? I'm programming in PowerBASIC - I know how to detect sTunnel once it h= as started with -start -quiet Thanks in advance for any idea! Joop. +++ Too far East is West. - Proverb (English) +++

2 1

stunnel client without any configuration
by Thomas Stegbauer 18 Oct '06

18 Oct '06

hi ml, i searched the list about an idea, but didn't find the complete answer, so i would ask: i am thinking about a https website (with logon), where you can download a completly preconfigured package (java-applet?) which checks HTTP_PROXY on unix and the msie registry settings on windows and connect a local port to a remote running stunnel, listening on port 443 (the stunnel ist running on a different ip). currently there are imho two points, which need solved: 1.) there is no proxy support, without a patch 2.) it is currently not possible to download a preconfigured package are there some thoughts? greetings thomas -- # Thomas Stegbauer # https://keyserver1.pgp.com/vkd/DownloadKey.event?keyid=0x9A3F1866FC68E91D # Key fingerprint = 5A2D FEDC 8A50 F1BB 25FB 967B 9A3F 1866 FC68 E91D

2 1

Infinite client timeout
by Dario Mariani 18 Oct '06

18 Oct '06

Hi all, i'm a new user :) I'm deploying stunnel into a big enterprise, so i have met a lot of interesting details about Stunnel :) I have a little problem now: a Stunnel channel connecting BEA Weblogic -> Oracle listener. BEA has the BIG problem of _completely locking_ when the connection goes down: when the connection comes up again, bea doesn't work. This is not an issue, because there's a keepalive feature that can be activated in BEA. In a case, we _cannot_ activate the keepalive, so we must try to keep the BEA -> stunnel client conection open indefinitely. I think this must apply to the other parts of the connection, but i'm not sure (if the bea -> client connection remains active, the client then can renegotiate the connection without bea noticing it? and the server -> oracle connection?) Ok, i'm a little confused here :) Can you help me with this issue? Bye, dario.

1 0

New feature - PayPal donations
by Michal Trojnara 16 Oct '06

16 Oct '06

Dear Users, Since PayPal finally decided to provide full support for users in Poland I've added a donation button on the web page. http://stunnel.mirt.net/ I really appreciate each donation. 8-) Best regards, Mike

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users