Sorry, my mistake for not being clearer: I do not want to use SSLv2, I want the automatic negotiation to work. The client does not get any kind of response from stunnel, instead, the TCP connection is closed! (RST packet)
I'm no expert for ssl, but it looks to me, like the client tried SSLv2 first, but offered TLSv1 also (please see screenshot of packet trace in my first mail). The server did not answer with it's capabilities, but simply closed the connection.
Is this really normal? Shouldn't stunnel answer, in protocol, that it only supports certain other encryption methods?
Greetings Markus Borst
Am 09.12.2011 19:14, schrieb Ludovic LEVET:
Hi,
Normal, SSLv2 is disable by default since version 4.40. (http://www.stunnel.org/?page=sdf_ChangeLog) To re-enable it add in your config file :
ciphers = ALL:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (or other) and sslVersion = all
Ludovic.
Le 09/12/2011 15:37, Markus Borst a écrit :
Hi,
we have a strange problem with newer stunnel versions (4.50 on windows), compared to older ones (known to work is version 4.35). The problem seems to be, that if a client sends a SSLv2 Helo message, the stunnel server simply resets the TCP connection, without trying to negotioate anything.
Setup: Stunnel is used top provide ssl/tls for imap, Hobbit is used to monitor service availability. The Hobbit module to monitor imaps seems to try SSLv2 first, but also supports newer versions (SSLv3 and TLSv1). The ssl connection never gets established, stunnel sends a tcp RST, hobbit never retries. We can force some hobbit modules to use TLSv1 exclusively, but not all of them. We fear that some older mailclients will also have problems initiating a connection, so we keep stunnel 4.35 running for now.
stunnel.conf:
fips = no debug = 7 output = stunnel.log
[imaps] accept = 130.83.174.1:993 connect = 127.0.0.1:143 cert = imap.xxx.company.yy.pem
stunnel.log:
2011.12.09 14:55:12 LOG5[6820:2144]: Service imaps accepted connection from xxx.yyy.zzz.105:45294 2011.12.09 14:55:12 LOG3[6820:2144]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.12.09 14:55:12 LOG5[6820:2144]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.12.09 14:55:12 LOG7[6820:2144]: Service imaps finished (0 left) 2011.12.09 14:55:12 LOG7[6820:2144]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s)
Wireshark Packet Trace (see attached image).
What's wrong here? Shouldn't client and server negotiate the methods used? The client seems to offer TLS ("Version: TLS 1.0 ..."), but instead of negotiating, the server simply closes the connection.
Greetings Markus Borst
stunnel-users mailing list stunnel-users@stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users