Hi,

I’m running Hybrid-7.2 on two PCs, one of which has a dynamic IP, as Hybrid wants a static IP and not hostname in its connect section, we are trying to use stunnel to encrypt server<->server communication.

Server 1 specs (To which I’m connecting) running FreeBSD 6.3:

***********************************************

#stunnel -version

stunnel 4.05 on amd64-unknown-freebsd5.3 PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004

Global options

cert = /usr/local/etc/stunnel/stunnel.pem

ciphers = ALL:!ADH:+RC4:@STRENGTH

debug = 5

key = /usr/local/etc/stunnel/stunnel.pem

pid = /var/tmp/stunnel.pid

RNDbytes = 64

RNDfile = /dev/urandom

RNDoverwrite = yes

#gcc –v

Using built-in specs.

Configured with: FreeBSD/amd64 system compiler

Thread model: posix

gcc version 3.4.6 [FreeBSD] 20060305

#uname

FreeBSD 6.3-STABLE FreeBSD 6.3-STABLE #6: Tue Jan 22 13:23:51 GMT 2008

root@:/usr/obj/usr/src/sys/SVR1 amd64

Server 2 specs (From which I’m connecting via stunnel as a client) running OpenBSD 4.2:

******************************************************************

#stunnel -version

stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006

Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP

Global options

debug = 5

pid = /usr/local/var/run/stunnel/stunnel.pid

RNDbytes = 64

RNDfile = /dev/arandom

RNDoverwrite = yes

Service-level options

cert = /etc/stunnel/stunnel.pem

ciphers = ALL:!ADH:+RC4:@STRENGTH

key = /etc/stunnel/stunnel.pem

session = 300 seconds

sslVersion = SSLv3 for client, all for server

TIMEOUTbusy = 300 seconds

TIMEOUTclose = 60 seconds

TIMEOUTconnect = 10 seconds

TIMEOUTidle = 43200 seconds

verify = none

# gcc -v

Reading specs from /usr/lib/gcc-lib/i386-unknown-openbsd4.2/3.3.5/specs

Configured with:

Thread model: single

gcc version 3.3.5 (propolice)

# cat stunnel.conf:

cert = /etc/ssl/private/stunnel.pem

key = /etc/ssl/private/rsa.key

setuid = _stunnel

setgid = _stunnel

pid = /var/run/stunnel.pid

socket = l:TCP_NODELAY=1

socket = r:TCP_NODELAY=1

debug = 7

foreground = yes

[irc]

client = yes

accept = localhost:994

connect = xxx.xxx.xxx.xxx:994

Here’s the debug logged to stderr:

# stunnel

2008.02.08 19:34:54 LOG7[11904:2237644800]: Snagged 64 random bytes from /dev/arandom

2008.02.08 19:34:54 LOG7[11904:2237644800]: RAND_status claims sufficient entropy for the PRNG

2008.02.08 19:34:54 LOG7[11904:2237644800]: PRNG seeded successfully

2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate: /etc/ssl/private/stunnel.pem

2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate loaded

2008.02.08 19:34:54 LOG7[11904:2237644800]: Key file: /etc/ssl/private/rsa.key

2008.02.08 19:34:54 LOG7[11904:2237644800]: Private key loaded

2008.02.08 19:34:54 LOG7[11904:2237644800]: SSL context initialized for service irc

2008.02.08 19:34:54 LOG5[11904:2237644800]: stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006

2008.02.08 19:34:54 LOG5[11904:2237644800]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP

2008.02.08 19:34:54 LOG6[11904:2237644800]: file ulimit = 128 (can be changed with 'ulimit -n')

2008.02.08 19:34:54 LOG6[11904:2237644800]: poll() used - no FD_SETSIZE limit for file descriptors

2008.02.08 19:34:54 LOG5[11904:2237644800]: 61 clients allowed

2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 6 in non-blocking mode

2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 7 in non-blocking mode

2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 8 in non-blocking mode

2008.02.08 19:34:54 LOG7[11904:2237644800]: SO_REUSEADDR option set on accept socket

2008.02.08 19:34:54 LOG7[11904:2237644800]: irc bound to 127.0.0.1:994

2008.02.08 19:34:54 LOG7[11904:2237644800]: Created pid file /var/run/stunnel.pid

2008.02.08 19:35:15 LOG7[11904:2237644800]: irc accepted FD=9 from 127.0.0.1:8579

2008.02.08 19:35:15 LOG7[11904:2336256000]: irc started

2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 9 in non-blocking mode

2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on local socket

2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode

2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 11 in non-blocking mode

2008.02.08 19:35:15 LOG7[11904:2336256000]: Connection from 127.0.0.1:8579 permitted by libwrap

2008.02.08 19:35:15 LOG5[11904:2336256000]: irc accepted connection from 127.0.0.1:8579

2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode

2008.02.08 19:35:15 LOG7[11904:2336256000]: irc connecting 69.50.175.50:994

2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: waiting 10 seconds

2008.02.08 19:35:15 LOG7[11904:2237644800]: Cleaning up the signal pipe

2008.02.08 19:35:15 LOG6[11904:2237644800]: Child process 26562 finished with code 0

2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: connected

2008.02.08 19:35:15 LOG5[11904:2336256000]: irc connected remote server from 192.168.1.101:42954

2008.02.08 19:35:15 LOG7[11904:2336256000]: Remote FD=10 initialized

2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on remote socket

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): before/connect initialization

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client hello A

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server hello A

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server certificate A

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server done A

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client key exchange A

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write change cipher spec A

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write finished A

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 flush data

2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read finished A

2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 items in the session cache

2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects (SSL_connect())

2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects that finished

2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 client renegotiations requested

2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects (SSL_accept())

2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects that finished

2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server renegotiations requested

2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache hits

2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache misses

2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache timeouts

2008.02.08 19:35:15 LOG6[11904:2336256000]: SSL connected: new session negotiated

2008.02.08 19:35:15 LOG6[11904:2336256000]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1

2008.02.08 19:35:15 LOG3[11904:2336256000]: SSL_read: Connection reset by peer (54)

2008.02.08 19:35:15 LOG5[11904:2336256000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket

2008.02.08 19:35:15 LOG7[11904:2336256000]: irc finished (0 left)

What is going on here with “SSL_read: Connection reset by peer (54)”?

This process keeps repeating itself without the ircd’s linking.

- S