- stunnel-users - stunnel.org

s_poll_wait timeout: connection reset
by manoj kumar 19 Jan '11

19 Jan '11

Hi, We have a problem in our production system. Need help to isolate the cause. Want to know whether issue is with stunnel. We are not in situation to upgrade, since we are in production. Your help is appreciated. Environment: 1) Client program(java in win desktops) connect to server (solaris) Stunnel port which is forwarded locally to an inetd program which connects to oracle database. ( 2 Tier Architecture ) 2) Setup worked for almost 2 years without any issue, suddenly since last September, we have connection reset issue on app clients intermittently. 3) almost lots of clients ( in 100's ) get reset and we find 100's of below messages in /var/adm/messages file of solaris. stunnel: [ID 821868 daemon.info] LOG6[21204:5272]: s_poll_wait timeout: connection reset stunnel: [ID 821868 daemon.notice] LOG5[21204:4804]: Connecti on reset: 1867341 bytes sent to SSL, 55211 bytes sent to socket 4) After reset, Client attempt to relogin works without any issue. there is no pattern of load, time, no of users. 5) all the database, inetd program, stunnel runs with oracle userid 6) No other OS related, resource related errors in /var/adm/messages. 7) At this point, i dont have stunnel debug log during the problem occurrence , since we have cron job that recycles logs. if required will send later. 8) Interms of change happend before the first occurance of issue, we did CPU/RAM upgrade, Oracle Database CPU Patch. But database team says no errors reported on oracle side during reset. 9) Max users on database is around 1024, which our max users is 300. ******************************************************************** Config: #/usr/local/bin/stunnel -version stunnel 4.25 on sparc-sun-solaris2.10 with OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!DHE-RSA-AES256-SHA:!DHE-DSS-AES256-SHA:!AES256-SHA:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------- #uname -a SunOS xxxxxxxxxx 5.10 Generic_144488-02 sun4u sparc SUNW,SPARC-Enterprise --------------------------------------------------------------------- # gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) ------------------------------------------------------------------------ # openssl version OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) ----------------------------------------------------------------------------- # more avaloq.conf ( Ssl config file we use /usr/local/bin/stunnel /opt/app/ssl/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/app/ssl/cert.pem key = /opt/app/ssl/cert.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /opt/app/ssl/avaloq_ssl/avaloq.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /db/avaloq/export/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [application] accept =7766 connect =localhost:7767 TIMEOUTconnect = 60 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini -------------------------------------------------------------------------------- #netstat -an |grep 7766 |wc -l 249 Regards, kumar

2 5

What legal issues come up if I use GPL-incompatible libraries with GPL software?
by Michal Trojnara 17 Jan '11

17 Jan '11

Dear Users, I just noticed some people declare GPL license on stunnel patches. Since stunnel uses GPL license *with OpenSSL exception* (OpenSSL license is not GPL-compatible), it cannot be distributed if it is linked against any GPL code (patches, libraries) without this exception. It is still legal to distribute stunnel with patches that use GPL license with OpenSSL exception. Such patches constitute forks of stunnel and will *never* be accepted to my source tree. Third party patches rarely meet my quality criteria, but I occasionally accept patches released as public domain or having their copyright ownership transferred to me. Also see: http://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs https://secure.wikimedia.org/wikipedia/en/wiki/Fork_%28software_development… Mike

1 0

Re: [stunnel-users] Multi Tunnel Support in STunnel
by Narendra Prasad Madanapalli 16 Jan '11

16 Jan '11

I'm sorry, if my previous mail explained the problem differently. Stunnel does load balancing when multiple connect statements are specified in a section as in the below mail. The scenario is something like http://mirt.net/pipermail/stunnel-users/2006-May/001139.html and explained below N servers each running a service of the same service-program (e.g: ip1:2345, ip2:2345, ... ipN:2345) A management server running on a different server (ipM:6789) is required to connect to all or a subset of the above servers through stunnel based on the user request. I couldn't find this feature supported by stunnel in the man page. I would appreciate if you provide any information on this. Thanks, Narendra. > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Narendra Prasad Madanapalli wrote: > > connect = ip1:5678,ip2:5678,ip3:5678,...ipn:5678 > > > > Anyone can please let me know the steps to configure the stunnel if > > the support is already in place or provide your thoughts on the new > > support? > > > Use multiple "connect" options within a single section: > connect = ip1:5678 > connect = ip2:5678 > connect = ip3:5678 > ... > connect = ipn:5678 > > Reading The Fine Manual would answer your question. It's not that > hard to read the manual for "connect" before proposing any extensions > for this option. > Thanks, Narendra.

2 1

Stunnel forwarding IP
by oscaruser＠programmer.net 15 Jan '11

15 Jan '11

Folks, For my server daemon process, I am accepting incoming requests only from pre-seeded IP addrs. Using Stunnel, I am finding connecting IPs are '127.0.0.1' or localhost. Is there any configuration or solution to represent incoming IPs for the given file descriptor belonging to their originating IP addrs? Thank you.

4 5

stunnel with FIPS and SIGHUP
by Eric Lambert 15 Jan '11

15 Jan '11

Hello, I am having difficulting when running stunnel in FIPS mode and using a SIGHUP to get stunnel to re-read it's configuration file (for instance if I've changed a port # or IP address for one of the connections). This causes stunnel to call the SSL routine FIPS_mode_set() a second time after receiving the SIGHUP, which in turn attempts to reinitialize SSL. Unfortunately, OpenSSL does not support calling FIPS_mode_set(1) more than once. The initialization of SSL becomes incomplete as a result of the 2nd call and subsequent attempts to use stunnel to establish encrypted connections fail. Does anyone have any suggestions on how I can make this work (besides killing and restarting stunnel)? If not, I have a proposed fix (and there are multiple ways that this could be addressed). Anyway, my suggestion is to add the following two lines to the ssl_configure() function (found in the file "ssl.c"), right before the current FIPS_mode_set() routine is called: FIPS_mode_set(0); RAND_set_rand_method(NULL); The function currently looks like: int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : } With the suggested fix, it would look as follows: int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS FIPS_mode_set(0); RAND_set_rand_method(NULL); if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : } Does the above seem reasonable. Could this change, or some other modification which would support using SIGHUP with FIPS, be considered for a future stunnel update? Thanks for your help.

2 1

Multi Tunnel Support in STunnel
by Narendra Prasad Madanapalli 15 Jan '11

15 Jan '11

Hi, Current stunnel implementation is based on peer-to-peer communication and it cannot be used in the environment where a management server wants to talk to multi-site server (i.e. an instance of server running in different sites). Multi Tunnel support for Stunnel enables a Management Server to communicate with Multisite Server. But it requires extending Stunnel with a new protocol whereby Management Server & Client Stunnel Process communicates. 1. The new stunnel conf for multi tunnel (keeping backward compatibility) look like [singleTunnelServiceName] accept = aport connect = ip:cport [serviceName] multitunnel = yes accept = 1234 connect = ip1:5678,ip2:5678,ip3:5678,...ipn:5678 Anyone can please let me know the steps to configure the stunnel if the support is already in place or provide your thoughts on the new support? Thanks, Narendra.

2 1

Re: [stunnel-users] Problem with a signed certificate by CA andcurl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

perfect! that made the trick!!! thank you for your time Saludos On Thu, Jan 13, 2011 at 3:00 PM, <josealf(a)rocketmail.com> wrote: > Maybe your curl client is trying to negotiate SSLv2... Did you try addding --sslv3 to the command line? Openssl fips disables sslv2.. > > > -----Original Message----- > From: Gabriel Sosa <sosagabriel(a)gmail.com> > Sender: stunnel-users-bounces(a)mirt.net > Date: Thu, 13 Jan 2011 01:39:15 > To: <stunnel-users(a)mirt.net> > Subject: [stunnel-users] Problem with a signed certificate by CA and > curl/wget > > hello, > > I bought an ssl certificate on thawte and installed to stunnel. > > When I go to the site with any browser the ssl is established without > any issue, however when I try to call an url using curl or wget I'm > not able to download the content > > here are the output of curl/wget > > [root@www ~]$ curl https://secure.example.com/test.php > curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 > [root@www1 ~]$ wget https://secure.example.com/test.php > --23:27:15-- https://secure.example.com/test.php > Resolving secure.example.com... xxx.xxx.xxx.xxx > Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. > Unable to establish SSL connection. > [root@www ~]$ > > > my stunnel config file looks like > > ;setuid=nobody > ;setgid=nobody > fips=no > > pid=/var/run/stunnel.pid > debug=3 > output=/var/log/stunnel.log > cert=/etc/ssl/certs/stunnel.pem > CAfile=/etc/ssl/certs/ssl123.crt > > socket=l:TCP_NODELAY=1 > socket=r:TCP_NODELAY=1 > > > [secure.example.com] > accept=xxx.xxx.xxx.xxx:443 > connect=zzz.zzz.zzz.zzz:8443 > TIMEOUTclose=0 > xforwardedfor=yes > > I'm using the version 4.34 + xforwardedfor patch > > the file ssl123.crt contains the root CA of thawte > > uname -a output > > Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 > EST 2009 x86_64 x86_64 x86_64 GNU/Linux > > gcc -v output > > Using built-in specs. > Target: x86_64-redhat-linux > Configured with: ../configure --prefix=/usr --mandir=/usr/share/man > --infodir=/usr/share/info --enable-shared --enable-threads=posix > --enable-checking=release --with-system-zlib --enable-__cxa_atexit > --disable-libunwind-exceptions --enable-libgcj-multifile > --enable-languages=c,c++,objc,obj-c++,java,fortran,ada > --enable-java-awt=gtk --disable-dssi --enable-plugin > --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre > --with-cpu=generic --host=x86_64-redhat-linux > Thread model: posix > gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) > > openssl version > > OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > > Does anyone have some clue about what could be causing the problem. > Any help will be really appreciated. > > Thank you > > -- > Gabriel Sosa > Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Re: [stunnel-users] Problem with a signed certificate by CA andcurl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

Jose, thanks for your reply here is the output of curl --verbose [root@www ~]$ curl --verbose https://secure.example.com/test.php * About to connect() to secure.example.com port 443 * Trying xxx.xxx.xxx.xxx... connected * Connected to secure.example.com (xxx.xxx.xxx.xxx) port 443 * successfully set certificate verify locations: * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * SSLv2, Client hello (1): Unknown SSL protocol error in connection to secure.example.com:443 * Closing connection #0 curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 if is there any other info you need please just let me know. Thank you On Thu, Jan 13, 2011 at 8:42 AM, <josealf(a)rocketmail.com> wrote: > Gabriel, > > Can you add the --verbose flag to your curl command and post the result? > > > Jose > -----Original Message----- > From: Gabriel Sosa <sosagabriel(a)gmail.com> > Sender: stunnel-users-bounces(a)mirt.net > Date: Thu, 13 Jan 2011 01:39:15 > To: <stunnel-users(a)mirt.net> > Subject: [stunnel-users] Problem with a signed certificate by CA and > curl/wget > > hello, > > I bought an ssl certificate on thawte and installed to stunnel. > > When I go to the site with any browser the ssl is established without > any issue, however when I try to call an url using curl or wget I'm > not able to download the content > > here are the output of curl/wget > > [root@www ~]$ curl https://secure.example.com/test.php > curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 > [root@www1 ~]$ wget https://secure.example.com/test.php > --23:27:15-- https://secure.example.com/test.php > Resolving secure.example.com... xxx.xxx.xxx.xxx > Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. > Unable to establish SSL connection. > [root@www ~]$ > > > my stunnel config file looks like > > ;setuid=nobody > ;setgid=nobody > fips=no > > pid=/var/run/stunnel.pid > debug=3 > output=/var/log/stunnel.log > cert=/etc/ssl/certs/stunnel.pem > CAfile=/etc/ssl/certs/ssl123.crt > > socket=l:TCP_NODELAY=1 > socket=r:TCP_NODELAY=1 > > > [secure.example.com] > accept=xxx.xxx.xxx.xxx:443 > connect=zzz.zzz.zzz.zzz:8443 > TIMEOUTclose=0 > xforwardedfor=yes > > I'm using the version 4.34 + xforwardedfor patch > > the file ssl123.crt contains the root CA of thawte > > uname -a output > > Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 > EST 2009 x86_64 x86_64 x86_64 GNU/Linux > > gcc -v output > > Using built-in specs. > Target: x86_64-redhat-linux > Configured with: ../configure --prefix=/usr --mandir=/usr/share/man > --infodir=/usr/share/info --enable-shared --enable-threads=posix > --enable-checking=release --with-system-zlib --enable-__cxa_atexit > --disable-libunwind-exceptions --enable-libgcj-multifile > --enable-languages=c,c++,objc,obj-c++,java,fortran,ada > --enable-java-awt=gtk --disable-dssi --enable-plugin > --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre > --with-cpu=generic --host=x86_64-redhat-linux > Thread model: posix > gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) > > openssl version > > OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > > Does anyone have some clue about what could be causing the problem. > Any help will be really appreciated. > > Thank you > > -- > Gabriel Sosa > Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Problem with a signed certificate by CA and curl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

hello, I bought an ssl certificate on thawte and installed to stunnel. When I go to the site with any browser the ssl is established without any issue, however when I try to call an url using curl or wget I'm not able to download the content here are the output of curl/wget [root@www ~]$ curl https://secure.example.com/test.php curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 [root@www1 ~]$ wget https://secure.example.com/test.php --23:27:15-- https://secure.example.com/test.php Resolving secure.example.com... xxx.xxx.xxx.xxx Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. Unable to establish SSL connection. [root@www ~]$ my stunnel config file looks like ;setuid=nobody ;setgid=nobody fips=no pid=/var/run/stunnel.pid debug=3 output=/var/log/stunnel.log cert=/etc/ssl/certs/stunnel.pem CAfile=/etc/ssl/certs/ssl123.crt socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [secure.example.com] accept=xxx.xxx.xxx.xxx:443 connect=zzz.zzz.zzz.zzz:8443 TIMEOUTclose=0 xforwardedfor=yes I'm using the version 4.34 + xforwardedfor patch the file ssl123.crt contains the root CA of thawte uname -a output Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 EST 2009 x86_64 x86_64 x86_64 GNU/Linux gcc -v output Using built-in specs. Target: x86_64-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,obj-c++,java,fortran,ada --enable-java-awt=gtk --disable-dssi --enable-plugin --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --with-cpu=generic --host=x86_64-redhat-linux Thread model: posix gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) openssl version OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Does anyone have some clue about what could be causing the problem. Any help will be really appreciated. Thank you -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Win32 FIPS Question
by pk＠cliffhanger.com 12 Jan '11

12 Jan '11

Hello, Greetings. I am new to STUNNEL and working on a proof of concept to compile the latest FIPS Compliant 1.2.2 OpenSSL with STUNNEL 4.34. in Windows 32 Bit environment. In the install.FIPS file it is mentioned that Win32 is not supported with FIPS. Is it still the case or it is fixed now? Have anybody done this? I greatly appreciate your time and help. Thank you. PK

1 0