IMO the problem has nothing to do with the alias. Of course, this IP hosts the service. Both DNS names point to the same IP address as you can see below:

$ dig l4884-iflmap.hcisbp.eu1.hana.ondemand.com

l4884-iflmap.hcisbp.eu1.hana.ondemand.com. 0 IN CNAME EU1571393051174.ssl.ondemand.com. EU1571393051174.ssl.ondemand.com. 3361 IN A 155.56.210.164

You may try to set the *sni* = SERVER_NAME parameter to see if it helps.

https://www.stunnel.org/static/stunnel.html

Regards, Flo Rance

On Mon, Mar 19, 2018 at 5:56 AM, Tony nissan4x4@optusnet.com.au wrote:

Hi all,

I have a situation where I’m trying to use sTunnel as the client to connect to a service on a secure URL, but the hiccup is that the secure URL is load balanced.

If a do an nslookup on the URL, the response comes back as it being an alias.

Non-authoritative answer:

Name: eu1571393051174.ssl.ondemand.com

Address: 155.56.210.164

Aliases: l4884-iflmap.hcisbp.eu1.hana.ondemand.com

Looking at the sTunnel log, it resolves to the IP of the server. But the IP itself does not host the service so I’m getting http:503 errors.

2018.03.16 14:44:44 LOG7[18796]: Service [ssl-OSRdev] (FD=564) bound to 0.0.0.0:8085

2018.03.16 14:44:55 LOG7[18796]: Service [ssl-OSRdev] accepted (FD=572) from 192.168.0.22:61093

2018.03.16 14:44:55 LOG7[18796]: Creating a new thread

2018.03.16 14:44:55 LOG7[18796]: New thread created

2018.03.16 14:44:55 LOG7[30864]: Service [ssl-OSRdev] started

2018.03.16 14:44:55 LOG5[30864]: Service [ssl-OSRdev] accepted connection from 192.168.0.22:61093

2018.03.16 14:44:55 LOG6[30864]: s_connect: connecting *155.56.210.164:443 http://155.56.210.164:443*

2018.03.16 14:44:55 LOG7[30864]: s_connect: s_poll_wait 155.56.210.164:443: waiting 10 seconds

2018.03.16 14:44:56 LOG5[30864]: s_connect: connected 155.56.210.164:443

2018.03.16 14:44:56 LOG5[30864]: Service [ssl-OSRdev] connected remote server from 192.168.0.32:30269

2018.03.16 14:44:56 LOG7[30864]: Remote socket (FD=588) initialized

2018.03.16 14:44:56 LOG7[30864]: SNI: sending servername: *l4884-iflmap.hcisbp.eu1.hana.ondemand.com http://l4884-iflmap.hcisbp.eu1.hana.ondemand.com*

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): before/connect initialization

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv2/v3 write client hello A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server hello A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server key exchange A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate request A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server done A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client certificate A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client key exchange A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write certificate verify A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write change cipher spec A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write finished A

2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 flush data

2018.03.16 14:44:57 LOG7[30864]: SSL state (connect): SSLv3 read finished A

2018.03.16 14:44:57 LOG7[30864]: 1 items in the session cache

2018.03.16 14:44:57 LOG7[30864]: 1 client connects (SSL_connect())

2018.03.16 14:44:57 LOG7[30864]: 1 client connects that finished

2018.03.16 14:44:57 LOG7[30864]: 0 client renegotiations requested

2018.03.16 14:44:57 LOG7[30864]: 0 server connects (SSL_accept())

2018.03.16 14:44:57 LOG7[30864]: 0 server connects that finished

2018.03.16 14:44:57 LOG7[30864]: 0 server renegotiations requested

2018.03.16 14:44:57 LOG7[30864]: 0 session cache hits

2018.03.16 14:44:57 LOG7[30864]: 0 external session cache hits

2018.03.16 14:44:57 LOG7[30864]: 0 session cache misses

2018.03.16 14:44:57 LOG7[30864]: 0 session cache timeouts

2018.03.16 14:44:57 LOG7[30864]: Peer certificate was cached (3826 bytes)

2018.03.16 14:44:57 LOG6[30864]: SSL connected: new session negotiated

2018.03.16 14:44:57 LOG6[30864]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption)

2018.03.16 14:44:57 LOG6[30864]: Compression: null, expansion: null

2018.03.16 14:44:58 LOG6[30864]: SSL socket closed (SSL_read)

2018.03.16 14:44:58 LOG7[30864]: Sent socket write shutdown

2018.03.16 14:44:58 LOG5[30864]: Connection closed: 1730 byte(s) sent to SSL, 274 byte(s) sent to socket

2018.03.16 14:44:58 LOG7[30864]: Remote socket (FD=588) closed

2018.03.16 14:44:58 LOG7[30864]: Local socket (FD=572) closed

2018.03.16 14:44:58 LOG7[30864]: Service [ssl-OSRdev] finished (0 left)

2018.03.16 14:44:58 LOG7[30864]: str_stats: 3 block(s), 4294962489 data byte(s), 150 control byte(s)

2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:413

2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:412

2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:411

I have tested the service using SoapUI and it works.

Is it possible to have sTunnel follow the URL redirection?

Regards, Tony

---

stunnel-users mailing list stunnel-users@stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users