I’ve
spent days googling this and read everything relevant in
the archives.
I’m
developing a Windows 7 program that connects to a
financial trading exchange that expects all
communication to be SSL’d. Everything I read said that
stunnel is the answer because of ease of installation
and use. After a day of abortive attempts to link to the
exchange, I decided to create a much simpler test
environment involving two Windows 7 computers next to
each other here.
One,
let’s call it Riven-II (192.168.1.9), is set up with a
simple Listener program that listens on port 8000. From
stunnel’s viewpoint this will be a server. The second
machine, Lightning (192.168.1.158), has a simple Sender
program that sends a text message via port 7999 to
Riven-II (192.168.1.9:8000)
– this will be the Client. In the absence of stunnel,
all messages sent from Lightning/Sender appears on the
window of Listener. So far so good.
I’ve
downloaded and installed the very latest version (4.54)
of stunnel on both machines. On installation I entered
the same responses to the certificate generating
process.
On
the Server machine, hard wired to a Broadband Router, I
configured stunnel.conf as (removing comments for
simplicity)
debug
= 7
output
= stunnel.log
socket
= l:TCP_NODELAY=1
socket
= r:TCP_NODELAY=1
cert
= stunnel.pem
key
= stunnel.pem
options
= NO_SSLv2
taskbar=yes
[Listener]
connect=8000
accept=8001
On
the Client machine, connected to the router via wi-fi,
we have in stunnel.conf
debug
= 7
output
= stunnel.log
cert
= stunnel.pem
socket
= l:TCP_NODELAY=1
socket
= r:TCP_NODELAY=1
fips=no
options
= NO_SSLv2
delay=yes
taskbar=yes
client=yes
[sender]
accept
= 0.0.0.0:7999
(I’ve tried just 7999 and 192.168.1.158:7999,
here. Makes no difference)
connect
= 192.168.1.9:8001
I’ve
tried many variations with the same result, but the
above is where they have ended up.
My
understanding of this is that stunnel both ends will be
intercepting port 8000 on the Server and port 7999 on
the Client and presenting/receiving SSL encoded messages
across the wire on port 8001.
Starting
stunnel in the Server (not as a Windows service,
although I did try that as well) the following log
appears:
2012.11.16 22:34:08
LOG7[3484:6184]: No limit detected for the number of
clients
2012.11.16 22:34:08
LOG5[3484:6184]: stunnel 4.54 on x86-pc-msvc-1500
platform
2012.11.16 22:34:08
LOG5[3484:6184]: Compiled/running with OpenSSL
1.0.1c-fips 10 May 2012
2012.11.16 22:34:08
LOG5[3484:6184]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS
Auth:none Sockets:SELECT+IPv6
2012.11.16 22:34:08
LOG5[3484:6184]: Reading configuration from file
stunnel.conf
2012.11.16 22:34:08
LOG5[3484:6184]: FIPS mode is enabled
2012.11.16 22:34:08
LOG7[3484:6184]: Compression not enabled
2012.11.16 22:34:08
LOG7[3484:6184]: Snagged 64 random bytes from C:/.rnd
2012.11.16 22:34:08
LOG7[3484:6184]: Wrote 1024 new random bytes to
C:/.rnd
2012.11.16 22:34:08
LOG7[3484:6184]: PRNG seeded successfully
2012.11.16 22:34:08
LOG6[3484:6184]: Initializing service [Listener]
2012.11.16
22:34:08 LOG7[3484:6184]: Certificate: stunnel.pem
2012.11.16
22:34:08 LOG7[3484:6184]: Certificate loaded
2012.11.16
22:34:08 LOG7[3484:6184]: Key file: stunnel.pem
2012.11.16
22:34:08 LOG7[3484:6184]: Private key loaded
2012.11.16
22:34:08 LOG7[3484:6184]: Could not load DH parameters
from stunnel.pem
2012.11.16
22:34:08 LOG7[3484:6184]: Using hardcoded DH
parameters
2012.11.16
22:34:08 LOG7[3484:6184]: DH initialized with 2048-bit
key
2012.11.16
22:34:08 LOG7[3484:6184]: ECDH initialized with curve
prime256v1
2012.11.16
22:34:08 LOG7[3484:6184]: SSL options set: 0x01000004
2012.11.16
22:34:08 LOG5[3484:6184]: Configuration successful
2012.11.16
22:34:08 LOG7[3484:6184]: Service [Listener] (FD=272)
bound to 0.0.0.0:8001
On
the Client, the log shows:
2012.11.16
22:25:53 LOG7[4184:4948]: No limit detected for the
number of clients
2012.11.16
22:25:53 LOG5[4184:4948]: stunnel 4.54 on
x86-pc-msvc-1500 platform
2012.11.16
22:25:53 LOG5[4184:4948]: Compiled/running with
OpenSSL 1.0.1c-fips 10 May 2012
2012.11.16
22:25:53 LOG5[4184:4948]: Threading:WIN32
SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6
2012.11.16
22:25:53 LOG5[4184:4948]: Reading configuration from
file stunnel.conf
2012.11.16
22:25:53 LOG5[4184:4948]: FIPS mode is disabled
2012.11.16
22:25:53 LOG7[4184:4948]: Compression not enabled
2012.11.16
22:25:53 LOG7[4184:4948]: Snagged 64 random bytes from
C:/.rnd
2012.11.16
22:25:53 LOG7[4184:4948]: Wrote 1024 new random bytes
to C:/.rnd
2012.11.16
22:25:53 LOG7[4184:4948]: PRNG seeded successfully
2012.11.16
22:25:53 LOG6[4184:4948]: Initializing service
[sender]
2012.11.16
22:25:53 LOG7[4184:4948]: Certificate: stunnel.pem
2012.11.16
22:25:53 LOG7[4184:4948]: Certificate loaded
2012.11.16
22:25:53 LOG7[4184:4948]: Key file: stunnel.pem
2012.11.16
22:25:53 LOG7[4184:4948]: Private key loaded
2012.11.16
22:25:53 LOG7[4184:4948]: SSL options set: 0x01000004
2012.11.16
22:25:53 LOG5[4184:4948]: Configuration successful
2012.11.16
22:25:53 LOG7[4184:4948]: Service [sender] (FD=224)
bound to 0.0.0.0:7999
Running
the Listener on the Server and Sender on the Client adds
nothing to the log, and port sniffers on both machines
show traffic between 7999 and 8000 (exactly the same as
when stunnel is not running). No sign of the use of port
8001.
I’d
appreciate any input on this. I’m sure I must be doing
something stupid, but I’ve watched hours of YouTube
videos, read many hundreds of web pages, and been
through the documentation quite a few times, to no
avail.
I
have a Java based version, running in a JVM in the same
Windows machines, that talks perfectly to the exchange
using some inbuilt SSL capabilities of an included
library, so that should probably eliminate any
hardware/router issues?
Regards,
Hal