- stunnel-users - stunnel.org

Re: [stunnel-users] RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 23 Aug '06

23 Aug '06

Michal Trojnara wrote: > On 2006-08-22, at 10:55, Hans Werner Strube wrote: > > Instead of waiting, a better method would > > be to have a finer timeout resolution than 1 sec in > > s_poll_wait(...,...); > > setting the timeout to 1 (sec) would be too embarrassing for TLS > > connections. But this would require major changes in the sources. > > I'm going to do it the hard way and add another parameter to > s_poll_wait() function. > > IMHO the timeout should be between 100ms and 500ms. What do you think? I have not tested the minimum required. However, it should be as short as possible, since for a client using TLS, the full delay will always occur on starting a connection. It should be documented somewhere how this new constant could be configured in compilation.

1 0

RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 23 Aug '06

23 Aug '06

In protocol.c, function smtp_server(), a test for plain SSL or STARTTLS usage (RFC 2487) is based on the availability of data from the client (c->local_rfd.fd). This works well in fast LANs but often fails for WAN connections through slow V90 modems. Especially with new Mozilla-based clients (also KMail and Evolution reported by other users) under Windows XP SP2 the test for data fails almost always, incorrectly resulting in an RFC 2487 handshake with error "Unknown client EHLO". This depends to some extent on the client: Outlook Express mostly works, Mozilla 1.7.x often worked after initial failure, SeaMonkey 1.x always fails. This seems to be a timing problem. I tried inserting a "usleep(50000);" before the switch(s_poll_wait(...)), which made SSL work with SeaMonkey (but often not for the first mail-sending attempt). Unfortunately, in Solaris 7 (where I tested stunnel), usleep is not yet thread-safe, maybe nanosleep(...,...) is preferable. Instead of waiting, a better method would be to have a finer timeout resolution than 1 sec in s_poll_wait(...,...); setting the timeout to 1 (sec) would be too embarrassing for TLS connections. But this would require major changes in the sources.

2 1

accept is not allowed in inetd mode
by vonom 23 Aug '06

23 Aug '06

Hello When i try to run stunnel by scripts or by hand stunnel /etc/stunnel/stunnel.conf (or other config) i see something like that: -bash-3.1# stunnel /etc/stunnel/pop3s.conf 2006.08.23 01:45:17 LOG7[24189:3083933376]: RAND_status claims sufficient entropy for the PRNG 2006.08.23 01:45:17 LOG6[24189:3083933376]: PRNG seeded successfully 2006.08.23 01:45:17 LOG7[24189:3083933376]: Certificate: /etc/stunnel/host-cert.pem 2006.08.23 01:45:17 LOG7[24189:3083933376]: Key file: /etc/stunnel/host-key.pem 2006.08.23 01:45:17 LOG7[24189:3083933376]: SSL context initialized for service stunnel file /etc/stunnel/pop3s.conf line 64: accept is not allowed in inetd mode No stunnel sesion, open ports or anything. I was very happy when I find out that I have stunnel-inetd-4.15-1 in my disto and it runs and ports are open. Everything great but when i try to send or receive email (postfix) it dont work. I spend a lot of time and a while ago i write telnet localhost 465 (or 995), ehlo hostname and see: -bash-3.1# telnet localhost 465 Trying 127.0.0.1.465... Connected to localhost. Escape character is '^]'. 2006.08.23 01:56:20 LOG7[24343:3083708096]: RAND_status claims sufficient entropy for the PRNG 2006.08.23 01:56:20 LOG6[24343:3083708096]: PRNG seeded successfully 2006.08.23 01:56:20 LOG7[24343:3083708096]: Certificate: /etc/stunnel/host-cert.pem 2006.08.23 01:56:20 LOG7[24343:3083708096]: Key file: /etc/stunnel/host-key.pem 2006.08.23 01:56:20 LOG7[24343:3083708096]: SSL context initialized for service stunnel file /etc/stunnel/smtps.conf line 64: accept is not allowed in inetd mode Connection closed by foreign host. When I write telnet localhost 25 -bash-3.1# telnet localhost 25 Trying 127.0.0.1.25... Connected to localhost. Escape character is '^]'. 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250 8BITMIME So It's OK I think. file /etc/stunnel/smtps.conf line 64: accept is not allowed in inetd mode Connection closed by foreign host. -line 64 point just last line of config file. I have no idea what it could be. Anyone know how to fix that?

2 1

Protocol using Connect
by Hutchison, Alan 21 Aug '06

21 Aug '06

I am trying to use the protocol entries in the config file as shown below (xyz substituted to protect employer & vendor). Below is the log. Stunnel abends as it is trying to authenticate to our corporate proxy. The network guys are seeing the attempt to authenticate but it does not appear to complete. Any thoughts? key=maxstpb.crt debug=7 output=stunnel.log client=yes [MarketAxess] accept=127.0.0.1:12345 delay=yes TIMEOUTbusy=120 TIMEOUTconnect=120 connect=xyz.xyz.com:80 protocol=connect protocolHost=xyz.xyz.com:443 protocolCredentials=xyz:xyz 2006.08.21 15:13:24 LOG5[2520:1312]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.08.21 15:13:24 LOG5[2520:1312]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2006.08.21 15:13:24 LOG5[2520:3184]: No limit detected for the number of clients 2006.08.21 15:13:24 LOG7[2520:3184]: FD 192 in non-blocking mode 2006.08.21 15:13:24 LOG7[2520:3184]: SO_REUSEADDR option set on accept socket 2006.08.21 15:13:24 LOG7[2520:3184]: MarketAxess bound to 127.0.0.1:12345 2006.08.21 15:14:00 LOG7[2520:3184]: MarketAxess accepted FD=200 from 127.0.0.1:4200 2006.08.21 15:14:00 LOG7[2520:3184]: Creating a new thread 2006.08.21 15:14:00 LOG7[2520:3184]: New thread created 2006.08.21 15:14:00 LOG7[2520:2560]: MarketAxess started 2006.08.21 15:14:00 LOG7[2520:2560]: FD 200 in non-blocking mode 2006.08.21 15:14:00 LOG5[2520:2560]: MarketAxess connected from 127.0.0.1:4200 2006.08.21 15:14:00 LOG7[2520:2560]: FD 416 in non-blocking mode 2006.08.21 15:14:00 LOG7[2520:2560]: MarketAxess connecting xyz.xyz.xyz.xyz:80 2006.08.21 15:14:00 LOG7[2520:2560]: connect_wait: waiting 120 seconds 2006.08.21 15:14:00 LOG7[2520:2560]: connect_wait: connected 2006.08.21 15:14:00 LOG7[2520:2560]: Remote FD=416 initialized 2006.08.21 15:14:00 LOG5[2520:2560]: Negotiations for connect (client side) started 2006.08.21 15:14:00 LOG7[2520:2560]: -> CONNECT xyz.xyz.com:443 HTTP/1.1 Alan R. Hutchison 515-362-1272 -----Message Disclaimer----- This e-mail message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by reply email to Connect(a)principal.com and delete or destroy all copies of the original message and attachments thereto. Email sent to or from the Principal Financial Group or any of its member companies may be retained as required by law or regulation. Nothing in this message is intended to constitute an Electronic signature for purposes of the Uniform Electronic Transactions Act (UETA) or the Electronic Signatures in Global and National Commerce Act ("E-Sign") unless a specific statement to the contrary is included in this message. While this communication may be used to promote or market a transaction or an idea that is discussed in the publication, it is intended to provide general information about the subject matter covered and is provided with the understanding that The Principal is not rendering legal, accounting, or tax advice. It is not a marketed opinion and may not be used to avoid penalties under the Internal Revenue Code. You should consult with appropriate counsel or other advisors on all matters pertaining to legal, tax, or accounting obligations and requirements.

1 0

limit connections per certificate
by Eric H. Jung 14 Aug '06

14 Aug '06

Hi, I'd like to limit the number of connections to stunnel (in server mode) by client certificate. In other words, I want all clients to only have 1 open socket connection to the server at a time. Is this possible with stunnel out-of-the-box, or must I write a patch to handle it? Thank you, grimholtz

1 0

stunnel through xinetd: process not terminating after use
by Alex Forrow 07 Aug '06

07 Aug '06

Hi, Im using stunnel through xinetd to forward some local unencrypted ldap connections to our ssl ldap server. Seems to work ok but after each use the stunnel process does not terminate, so I end up with losts of processes not doing anything. After a few days, these processes reach a limit and connections fail. As you can see, the connection has finished, but the process still exists: [root@lynx stunnel]# ps -e | grep stunnel 2396 ? 00:00:00 stunnel 2517 ? 00:00:00 stunnel 2575 ? 00:00:00 stunnel 2576 ? 00:00:00 stunnel [root@lynx stunnel]# netstat -p | grep stunnel tcp 0 0 lynx.seekit.co.uk:ldaplo lynx.seekit.co.uk:60390 CLOSE_WAIT 2396/stunnel unix 2 [ ] DGRAM 3204569 2576/stunnel unix 2 [ ] DGRAM 3204562 2575/stunnel unix 2 [ ] DGRAM 3203127 2517/stunnel unix 2 [ ] DGRAM 3202108 2396/stunnel Heres the xinetd configuration for stunnel (/etc/xinetd.d/ldaplo): # default: on # description: Stunnel to connect to LDAP for an insecure local session service ldaplo { disable = no #flags = REUSE port = 390 socket_type = stream wait = no user = nobody server = /usr/sbin/stunnel server_args = /etc/stunnel/ldap.conf # log_on_failure += USERID } Heres the stunnel configuration file (/etc/stunnel/ldap.conf): client = yes connect = 636 Cheers, Alex Forrow

1 0

Stunnel without certificates
by Shane 04 Aug '06

04 Aug '06

Hi, I am new to this group and also to Stunnel utility. I would like to use Stunnel to secure my http connections. Here is a twist. I just want to encrypt the link and don't bother much about the authentication. 1. Can I use Stunnel without certificates? 2. If certificate is mandatory, can I use only the file which contains "keys" but not use other authentication credentials? 3. Can I use anonymous DH Ciphers so that authentication phase is assumed done and both client and servers generate the keys? Any help and guidance will useful. Thanks, -Ravi Joshi __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

TIMEOUTbusy
by Martin Beauchamp 02 Aug '06

02 Aug '06

Hi List, I'm running Stunnel 4.15 under win32 in client mode. Can someone give me a better idea about what TIMEOUTbusy does? The docs state that it is "time to wait for expected data." But what does Stunnel do after this period? Does it disconnect from the remote server? Does it attempt another SSL session after some interval? Thanks for any addition information! Martin -- Martín Beauchamp Systems Engineer Park Slope Food Coop, Inc. (718) 783-2187 (718) 622-5685 Fax

1 0

stunnel crashing on connect
by Kevin King 24 Jul '06

24 Jul '06

Hi, I am attempting to run stunnel on Windows XP Pro but it is crashing as soon as anything connects to it. I am using it to create a secure TLS tunnel in front of an SMTP mail server and from what I read I should be able to do this and stunnel will handle the STARTLS commands. I downloaded the following windows binary: 562589 Mar 11 13:02:35 2006 stunnel-4.15-installer.exe I made minimal changes to stunnel.conf: 1) added the line "protocol = smtp" 2) uncommented the debug lines (still crashes if I leave these lines alone) I then start stunnel, either as a service or from cmd line - same thing happens >From a command prompt I then "telnet localhost 465" and send "EHLO mydomain.com hi" Stunnel responds with "250-EHLO mydomain.com hi Welcome". I am also running hMailServer on the same machine listening on port 25. It looks like stunnel is forwarded the initial EHLO to hMailServer, then hMailServer responds correctly and stunnel forwards that response back to me. Then stunnel crashes immediatly. Following is the log: 2006.07.20 10:28:41 LOG7[112:1656]: RAND_status claims sufficient entropy for the PRNG 2006.07.20 10:28:41 LOG6[112:1656]: PRNG seeded successfully 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service pop3s 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service imaps 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service ssmtp 2006.07.20 10:28:41 LOG5[112:1656]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.07.20 10:28:41 LOG5[112:1656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.07.20 10:28:41 LOG5[112:2564]: No limit detected for the number of clients 2006.07.20 10:28:41 LOG7[112:2564]: FD 1884 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: pop3s bound to 0.0.0.0:995 2006.07.20 10:28:41 LOG7[112:2564]: FD 1872 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: imaps bound to 0.0.0.0:993 2006.07.20 10:28:41 LOG7[112:2564]: FD 1864 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: ssmtp bound to 0.0.0.0:465 2006.07.20 10:28:59 LOG7[112:2564]: ssmtp accepted FD=1840 from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2564]: Creating a new thread 2006.07.20 10:28:59 LOG7[112:2564]: New thread created 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp started 2006.07.20 10:28:59 LOG7[112:2936]: FD 1840 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on local socket 2006.07.20 10:28:59 LOG5[112:2936]: ssmtp connected from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2936]: FD 1812 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp connecting 127.0.0.1:25 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: waiting 10 seconds 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: connected 2006.07.20 10:28:59 LOG7[112:2936]: Remote FD=1812 initialized 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on remote socket 2006.07.20 10:28:59 LOG5[112:2936]: Negotiations for smtp (server side) started 2006.07.20 10:28:59 LOG7[112:2936]: RFC 2487 detected 2006.07.20 10:28:59 LOG7[112:2936]: <- 220 hmailserver ESMTP 2006.07.20 10:28:59 LOG7[112:2936]: -> 220220 hmailserver ESMTP + stunnel 2006.07.20 10:29:09 LOG7[112:2936]: <- EHLO mydomain.com hi 2006.07.20 10:29:09 LOG7[112:2936]: -> 250-EHLO mydomain.com hi Welcome Here is the output of stunnel -version: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = 5 RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 2006.07.20 10:25:04 LOG3[3256:3456]: Server is down I tried building the source and debugging it but I only found some batch files refering to the MS embedded compiler. Why would I want to compile this for an embedded or mobile device? That is what that compiler is for. What makefile or compiler should I be using on windows if I wish to build stunnel on windows? Which I would rather not have to do, I would like to just use the binary but it is crashing before I ever get a chance to test it. Any help would greatly be appreciated. thanks, -Kevin

1 0

stunnel version issue?
by NobbyNoMates 22 Jul '06

22 Jul '06

Dear all - I am trying to set up an stunnel connection on an Ubuntu Dapper box. This system seems to give me (stunnel -V) : stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 and no matter where I look. I cannot seem to find an option to specify a config file when starting stunnel. Unfortunately, the instructions which I have received for setting up my (Direct Connect) client, contain such a config file which is supposed to be needed. It contains the following: client = yes delay = yes output = stunnel.log debug = notice pid = stunnel.pid [DC Server] connect = server.address.org:AAAAA accept = 127.0.0.1:BBBBB where of course the AAAA and BBBB are port numbers. Now I wonder if there is any way to make my stunnel version function in the specified way without the config file? Or is there some alternative way to specify this kind of config? Any suggestion would be much appreciated! Best regards, Erik

2 2

Clearer and Detailed version of the mail Stunnel for HTTP encription
by LoopBack Inc 20 Jul '06

20 Jul '06

Hello. I rewrote some parts of the question, and illustrated it by a small ASCII picture to clearifiy the whole situation. I don't know why I haven't got a single answer, because over 350 people are subscribed to the list, so I hope that I'll get some help now. It would be grateful. I use SocksCap to forward the iexplore cnnections to another port, a port on which stunnel listens. On PC1, the client, stunnel is listening on port 500. So when I start iexplore.exe with SocksCap every connection goes to 127.0.0.1:500. PC1 connects to PC2, with connect = 192.168.0.2:123 On PC2, the server, stunnel listens on port 500. then is connects to the internet with connect = 127.0.0.1:80. Here is the problem, stunnel doesn't connect to the internet over 127.0.0.1:80. I don't know why, but it doesnt. ---Stunnel.conf SERVER--- .. [inet] accept = 127.0.0.1:123 connect = 127.0.0.1:80 ---Stunnel.conf CLIENT--- .. [inet] accept = 127.0.0.1:500 connect = 192.168.0.2:123 LOGs from the SERVER: 2006.07.18 16:56:07 LOG7[2332:2720]: inet accepted FD=208 from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:2720]: Creating a new thread 2006.07.18 16:56:07 LOG7[2332:2720]: New thread created 2006.07.18 16:56:07 LOG7[2332:1880]: inet started 2006.07.18 16:56:07 LOG7[2332:1880]: FD 208 in non-blocking mode 2006.07.18 16:56:07 LOG5[2332:1880]: inet connected from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): before/accept initialization 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read client hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write server hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write change cipher spec A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write finished A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 flush data 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read finished A 2006.07.18 16:56:07 LOG7[2332:1880]: 1 items in the session cache 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects (SSL_connect()) 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects (SSL_accept()) 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 server renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 5 session cache hits 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache misses 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache timeouts 2006.07.18 16:56:07 LOG6[2332:1880]: SSL accepted: previous session reused 2006.07.18 16:56:07 LOG7[2332:1880]: FD 244 in non-blocking mode 2006.07.18 16:56:07 LOG7[2332:1880]: inet connecting 127.0.0.1:80 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: waiting 10 seconds 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: connected 2006.07.18 16:56:07 LOG7[2332:1880]: Remote FD=244 initialized After nothing happend for 52 seconds I aborted in the iexplore.exe to open the page. 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (read): warning: close notify 2006.07.18 16:56:59 LOG7[2332:1880]: SSL closed on SSL_read 2006.07.18 16:56:59 LOG7[2332:1880]: Socket write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (write): warning: close notify 2006.07.18 16:56:59 LOG6[2332:1880]: SSL_shutdown successfully sent close_notify 2006.07.18 16:56:59 LOG5[2332:1880]: Connection closed: 0 bytes sent to SSL, 3 bytes sent to socket 2006.07.18 16:56:59 LOG7[2332:1880]: inet finished (0 left) LOGs from the CLIENT: 2006.07.18 17:10:11 LOG7[1756:4756]: inet accepted FD=444 from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:4756]: Creating a new thread 2006.07.18 17:10:11 LOG7[1756:4756]: New thread created 2006.07.18 17:10:11 LOG7[1756:2840]: inet started 2006.07.18 17:10:11 LOG7[1756:2840]: FD 444 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on local socket 2006.07.18 17:10:11 LOG5[1756:2840]: inet connected from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:2840]: FD 348 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: inet connecting 192.168.0.2:123 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: waiting 10 seconds 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: connected 2006.07.18 17:10:11 LOG7[1756:2840]: Remote FD=348 initialized 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on remote socket 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): before/connect initialization 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write client hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read server hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write change cipher spec A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 flush data 2006.07.18 17:10:11 LOG7[1756:2840]: 17 items in the session cache 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects (SSL_connect()) 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 client renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects (SSL_accept()) 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 48 session cache hits 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache misses 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache timeouts 2006.07.18 17:10:11 LOG6[1756:2840]: SSL connected: previous session reused Nothing happendend, I aborted iexplore.exe 2006.07.18 17:10:25 LOG7[1756:2840]: Socket closed on read 2006.07.18 17:10:25 LOG7[1756:2840]: SSL write shutdown 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (write): warning: close notify 2006.07.18 17:10:25 LOG7[1756:2840]: SSL_shutdown retrying 2006.07.18 17:10:25 LOG7[1756:2840]: SSL doesn't need to read or write 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (read): warning: close notify 2006.07.18 17:10:26 LOG7[1756:2840]: SSL closed on SSL_read 2006.07.18 17:10:26 LOG7[1756:2840]: Socket write shutdown 2006.07.18 17:10:26 LOG5[1756:2840]: Connection closed: 3 bytes sent to SSL, 0 bytes sent to socket 2006.07.18 17:10:26 LOG7[1756:2840]: inet finished (0 left) So the problem is that stunnel doesn't connect to the internet on PC2. I think i have to use something different than connect = 127.0.0.1:80 on PC2, but not sure. The version of stunnel is 4.15 I'm using Windows. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

4 3

Re: [stunnel-users] Clearer and Detailed version of the mail Stunnelfor HTTP enc
by Ian 20 Jul '06

20 Jul '06

On 20 Jul 2006 at 14:50, LoopBack Inc wrote: > Hello Ian, > > > Yes thats excatly what I want to do. > > In fact, if possible, this I haven't described yes, I would like to encript > every program I want through PC2, used as a proxy, like you said. > But if it would work with the http it wouldn't be bad. > > Thank you for your reply. Hi, Ok, this has clarified things for me. Another question, do you have a copy of the proxy program (SocksCap ?) running on PC2? If not then this is the problem. I believe that stunnel does not itself act as a proxy. It simply acts as a tunnel. >From your description of your config I suspect that you should have a second copy of SocksCap listenening on PC2 which will forward data onto the internet. A quick example: PC1: SocksCap listening on port 8080 ( for example) forwards to 127.0.0.1:500 stunnel listening on port 500, forwarded any data to PC2 port 500 PC2: stunnel listening on port 500 forwards data to 127.0.0.1:8080 SocksCap listening on port 8080 forwards data out to the internet. This will encrypt data between PC1 & PC2 but after that it will be back in plain. In order to test this I would break it down into its individual components and test each stage. I recommend downloading netcat (http://netcat.sourceforge.net/ or google for it) and learn how to use it. Sorry I can't help you with this bit, its better if you learn it yourself - and once you have you will wonder how you ever managed without it ;) Regards Ian --

1 0

Stunnel for HTTP encription
by LoopBack Inc 18 Jul '06

18 Jul '06

Hello! I'm tring to encript HTTP. I use two PCs, PC1 and PC2. PC1 is a client PC2 is a server. IP of PC1:192.168.0.1 IP of PC2:192.168.0.2 I use SocksCap to forward the iexplore cnnections to another port, a port on which stunnel listens. On PC1, the client, stunnel is listening on port 500. So when I start iexplore.exe with SocksCap every connection goes to 127.0.0.1:500. PC1 connects to PC2, with connect = 192.168.0.2:123 On PC2, the server, stunnel listens on port 500. then is connects to the internet with connect = 127.0.0.1:80. Here is the problem, stunnel doesn't connect to the internet over 127.0.0.1:80. I don't know why, but it doesnt. LOGs from the SERVER: 2006.07.18 16:56:07 LOG7[2332:2720]: inet accepted FD=208 from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:2720]: Creating a new thread 2006.07.18 16:56:07 LOG7[2332:2720]: New thread created 2006.07.18 16:56:07 LOG7[2332:1880]: inet started 2006.07.18 16:56:07 LOG7[2332:1880]: FD 208 in non-blocking mode 2006.07.18 16:56:07 LOG5[2332:1880]: inet connected from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): before/accept initialization 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read client hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write server hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write change cipher spec A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write finished A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 flush data 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read finished A 2006.07.18 16:56:07 LOG7[2332:1880]: 1 items in the session cache 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects (SSL_connect()) 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects (SSL_accept()) 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 server renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 5 session cache hits 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache misses 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache timeouts 2006.07.18 16:56:07 LOG6[2332:1880]: SSL accepted: previous session reused 2006.07.18 16:56:07 LOG7[2332:1880]: FD 244 in non-blocking mode 2006.07.18 16:56:07 LOG7[2332:1880]: inet connecting 127.0.0.1:80 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: waiting 10 seconds 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: connected 2006.07.18 16:56:07 LOG7[2332:1880]: Remote FD=244 initialized After nothing happend for 52 seconds I aborted in the iexplore.exe to open the page. 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (read): warning: close notify 2006.07.18 16:56:59 LOG7[2332:1880]: SSL closed on SSL_read 2006.07.18 16:56:59 LOG7[2332:1880]: Socket write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (write): warning: close notify 2006.07.18 16:56:59 LOG6[2332:1880]: SSL_shutdown successfully sent close_notify 2006.07.18 16:56:59 LOG5[2332:1880]: Connection closed: 0 bytes sent to SSL, 3 bytes sent to socket 2006.07.18 16:56:59 LOG7[2332:1880]: inet finished (0 left) LOGs from the CLIENT: 2006.07.18 17:10:11 LOG7[1756:4756]: inet accepted FD=444 from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:4756]: Creating a new thread 2006.07.18 17:10:11 LOG7[1756:4756]: New thread created 2006.07.18 17:10:11 LOG7[1756:2840]: inet started 2006.07.18 17:10:11 LOG7[1756:2840]: FD 444 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on local socket 2006.07.18 17:10:11 LOG5[1756:2840]: inet connected from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:2840]: FD 348 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: inet connecting 192.168.0.2:123 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: waiting 10 seconds 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: connected 2006.07.18 17:10:11 LOG7[1756:2840]: Remote FD=348 initialized 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on remote socket 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): before/connect initialization 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write client hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read server hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write change cipher spec A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 flush data 2006.07.18 17:10:11 LOG7[1756:2840]: 17 items in the session cache 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects (SSL_connect()) 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 client renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects (SSL_accept()) 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 48 session cache hits 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache misses 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache timeouts 2006.07.18 17:10:11 LOG6[1756:2840]: SSL connected: previous session reused Nothing happendend, I aborted iexplore.exe 2006.07.18 17:10:25 LOG7[1756:2840]: Socket closed on read 2006.07.18 17:10:25 LOG7[1756:2840]: SSL write shutdown 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (write): warning: close notify 2006.07.18 17:10:25 LOG7[1756:2840]: SSL_shutdown retrying 2006.07.18 17:10:25 LOG7[1756:2840]: SSL doesn't need to read or write 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (read): warning: close notify 2006.07.18 17:10:26 LOG7[1756:2840]: SSL closed on SSL_read 2006.07.18 17:10:26 LOG7[1756:2840]: Socket write shutdown 2006.07.18 17:10:26 LOG5[1756:2840]: Connection closed: 3 bytes sent to SSL, 0 bytes sent to socket 2006.07.18 17:10:26 LOG7[1756:2840]: inet finished (0 left) So the problem is that stunnel doesn't connect to the internet on PC2. I think i have to use something different than connect = 127.0.0.1:80 on PC2, but not sure. I'm using Windwos. Thanks for helping. _________________________________________________________________ On the road to retirement? Check out MSN Life Events for advice on how to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement

1 0

exclusively TLS
by Richard Kotal 17 Jul '06

17 Jul '06

Hey, I had the same problem. I solved this problem. You must download my patch: http://www.aolserver.cz/, or http://www.aolserver.cz/download/stunnel-4.15_patch.tgz Richard Kotal info(a)waplikace.cz www.aolserver.cz prepis.waplikace.cz www.nvp.cz /> I need to talk to a server that is requiring pure TLS. It seems that > STUNNEL always starts with SSL. How do I get STUNNEL to start the client //> //side conversation with TLS? //> / /> // //> //John Moehrke //> //Enterprise Security Architect //> //GE Healthcare //> //T 262 293 1667 //> //W126 N7449 Flint Road, Suite 200, Menomonee Falls, WI 53051 //> / <http://stunnel.mirt.net/mailman/listinfo/stunnel-users>/John.Moehrke at med.ge.com <http://stunnel.mirt.net/mailman/listinfo/stunnel-users> <mailto:John.Moehrke at med.ge.com <http://stunnel.mirt.net/mailman/listinfo/stunnel-users>> //> //www.gehealthcare.com <http://www.gehealthcare.com/> //> //What I may see or hear in the course of the treatment or even outside of //> //the treatment in regard to the life of men, which on no account one must //> //spread abroad, I will keep to myself, holding such things shameful to be //> //spoken about. (One Portion of the Hippocratic Oath - Hippocrates, circa //> //400 B.C.) /

1 0

configure/compile issue on AIX
by Boxall, John 13 Jul '06

13 Jul '06

I'm trying to get stunnel working on AIX 5.3. I'm running the configure with "--prefix=/opt/freeware", however, when I start stunnel it is looking for the stunnel.conf file in /usr/local/etc/stunnel. Shouldn't it be looking for it in "/opt/freeware/etc/stunnel", which is where the "make install" put it? Regards, John Boxall

3 4

newbie: stunnel works but do not encrypt
by Gallas Róbert 13 Jul '06

13 Jul '06

Hello, I setup stunnel( v4.15 win32 port ) on both side, client and server. Connection is working but does not encrypt. Setup is done for ORACLE and WEB. Oracle`s listener is setup with "USE_SHARED_SOCKET = TRUE" variable and works fine with OpenSSH with PUTTY I use default configuration just with the needed basic customization: # ##Client cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log client = yes [web] accept = 3128 connect = 10.160.1.220:3128 [oracle] accept = 1521 connect = 10.160.1.220:4892 ### Server: cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [web] accept = 3128 connect = 10.160.0.4:3128 [oracle] accept = 4892 connect = 10.160.1.220:1521 Any good sugestions? Thanks for your answers Regards Robert

2 4

(no subject)
by Gallas Róbert 12 Jul '06

12 Jul '06

Hello, I setup stunnel( v4.15 win32 port ) on both side, client and server. Connection is working but does not encrypt. Setup is done for ORACLE and WEB. Oracle`s listener is setup with "USE_SHARED_SOCKET = TRUE" variable and works fine with OpenSSH with PUTTY I use default configuration just with the needed basic customization: # ##Client cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log client = yes [web] accept = 3128 connect = 10.160.1.220:3128 [oracle] accept = 1521 connect = 10.160.1.220:4892 ### Server: cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [web] accept = 3128 connect = 10.160.0.4:3128 [oracle] accept = 4892 connect = 10.160.1.220:1521 Any good sugestions? Thanks for your answers Regards Robert

1 0

Follow-up: Bad certificate? (was Expired certificate?)
by Boxall, John 11 Jul '06

11 Jul '06

Mike, et al, The problem I was having with stunnel on a Windows box connecting with stunnel on a Unix server (Solaris in this case) turned out to be a mis-configuration of the syslog-ng server on Unix. I took a sample syslog-ng.conf from somewhere else and didn't know the impact of "max-connections(1)". Though I assume it is intended as a limit on the number of connections to the localhost (127.0.0.1:514), it effectively limits the number of in-bound connections from remote logging clients to 1 (in this case using port 5140). Removing this parameter allowed all of my test clients to simultaneously log to the server. Mike, the OpenSSL-generated cert works fine. Thanks. Regards, John Boxall

1 0

libssl.so.0.9.8 error running stunnel
by Michael Tyrrell 10 Jul '06

10 Jul '06

I have a Solaris 10 SPARC server running stunnel 4.15 with openssl version "OpenSSL 0.9.8b 04 May 2006". When I try to run /usr/local/sbin/stunnel I get the following error. ld.so.1: stunnel: fatal: libssl.so.0.9.8: open failed: No such file or directory Killed In the stunnel.conf file I have debug set to 7 but it will not write to the stunnel.log file. I also get the same error if I run stunnel -version. Thanks for any help you could give.

2 1

stunnel and gmail (Windows)
by Al Oomens 08 Jul '06

08 Jul '06

I've gotten an older version of stunnel to work the way I want by starting it from a command prompt like: stunnel -c -d 110 -r pop.gmail.com:995 How do I specify this in the config file for the newest version of stunnel, in order to use it as a service on Windows? -- Al Oomens Wheaton, IL. aloomens(a)gmail.com

2 1

Wildcard outbound IP matching...
by Jeff Roberts 07 Jul '06

07 Jul '06

Is there a way to configure Stunnel to capture outbound packets for *any* IP, but for a specific port? My SMTP server can be configured to connect directly to the final SMTP server. I can configure the outbound port to some other port other than 25, so I'd like to say something like - [smtpclient] protocol=smtp accept = *:2210 connect = *:25 Suggestions? ->Jeff RAD Game Tools

2 1

Bad certificate? (was Expired certificate?)
by Boxall, John 30 Jun '06

30 Jun '06

Mike, I've created a self-signed certificate on my Windows test box using OpenSSL 0.9.7j (the version from Shining Light). I created the key file with the following command: "openssl genrsa 1024 > \host.key Here is the command I used to create the self-signed cert: "openssl req -new -x509 -nodes -sha1 -days 9999 -key \host.key > \host.cert" I then copied the key/cert to the appropriate file in the stunnel directory. I then copied the cert to the Solaris server and included it with all other client certs. Here is the Windows configuration file: ; ;CLIENT-ONLY stunnel configuration file ; client = yes cert = C:\Program Files\stunnel\stunnel.pem-client-certificate CAfile = C:\Program Files\stunnel\stunnel.pem-server-certificate ;chroot = /var/run/stunnel ;pid = /usr/local/var/run/stunnel/stunnel.pid ;setuid = stunnel ;setgid = stunnel verify = 3 ;foreground = yes debug = 7 output = C:\Program Files\stunnel\stunnel.log [5140] accept = 127.0.0.1:514 connect = 172.17.99.143:5140 Here is the Solaris configuration file: ; ;SERVER-ONLY stunnel configuration file ; cert = /usr/local/etc/stunnel/stunnel.pem-server-certificate CAfile = /usr/local/etc/stunnel/stunnel.pem-all-client-certificates ;chroot = /var/run/stunnel ;pid = /var/run/stunnel/run/stunnel.pid ;setuid = stunnel ;setgid = stunnel verify = 3 ;foreground = yes debug = 7 output=/stunnel.log [5140] accept = 172.17.99.143:5140 connect = 127.0.0.1:514 The following happens on the Windows box when I first launch stunnel: 2006.06.30 09:51:31 LOG5[516:360]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.06.30 09:51:31 LOG5[516:360]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.06.30 09:51:31 LOG5[516:392]: No limit detected for the number of clients 2006.06.30 09:51:31 LOG7[516:392]: FD 1904 in non-blocking mode 2006.06.30 09:51:31 LOG7[516:392]: SO_REUSEADDR option set on accept socket 2006.06.30 09:51:31 LOG7[516:392]: 5140 bound to 127.0.0.1:514 Nothing happens on the Solaris box. When I start EventReporter, the following happens, in a continuous loop (until I stop EventReporter): 2006.06.30 10:16:26 LOG7[296:700]: 5140 accepted FD=156 from 127.0.0.1:1154 2006.06.30 10:16:26 LOG7[296:700]: Creating a new thread 2006.06.30 10:16:26 LOG7[296:700]: New thread created 2006.06.30 10:16:27 LOG7[296:1204]: 5140 started 2006.06.30 10:16:27 LOG7[296:1204]: FD 156 in non-blocking mode 2006.06.30 10:16:27 LOG5[296:1204]: 5140 connected from 127.0.0.1:1154 2006.06.30 10:16:27 LOG7[296:1204]: FD 188 in non-blocking mode 2006.06.30 10:16:27 LOG7[296:1204]: 5140 connecting 172.17.99.143:5140 2006.06.30 10:16:27 LOG7[296:1204]: connect_wait: waiting 10 seconds 2006.06.30 10:16:27 LOG7[296:1204]: connect_wait: connected 2006.06.30 10:16:27 LOG7[296:1204]: Remote FD=188 initialized 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): before/connect initialization 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write client hello A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server hello A 2006.06.30 10:16:27 LOG5[296:1204]: VERIFY OK: depth=0, /C=CA/ST=ONTARIO/L=TORONTO/O=BANK OF MONTREAL/OU=LMG-DTS/CN=jdb2u10 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server certificate A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server certificate request A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 read server done A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write client certificate A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write client key exchange A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write certificate verify A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write change cipher spec A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 write finished A 2006.06.30 10:16:27 LOG7[296:1204]: SSL state (connect): SSLv3 flush data 2006.06.30 10:16:27 LOG3[296:1204]: SSL_connect: Peer suddenly disconnected 2006.06.30 10:16:27 LOG5[296:1204]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.30 10:16:27 LOG7[296:1204]: 5140 finished (0 left) On the Solaris box, here is the matching entry, also in a continuous loop: 2006.06.30 10:16:47 LOG7[1214:1]: 5140 accepted FD=2 from 172.17.99.150:1155 2006.06.30 10:16:47 LOG7[1214:800]: 5140 started 2006.06.30 10:16:47 LOG7[1214:800]: FD 2 in non-blocking mode 2006.06.30 10:16:47 LOG5[1214:800]: 5140 connected from 172.17.99.150:1155 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): before/accept initialization 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 read client hello A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write server hello A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write certificate A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 write certificate request A 2006.06.30 10:16:47 LOG7[1214:800]: SSL state (accept): SSLv3 flush data 2006.06.30 10:16:48 LOG4[1214:800]: VERIFY ERROR: depth=0, error=self signed certificate: /C=CA/ST=ONTARIO/L=TORONTO/O=BMO/OU=LMG-DTS/CN=jdb1winxp 2006.06.30 10:16:48 LOG7[1214:800]: SSL alert (write): fatal: bad certificate 2006.06.30 10:16:48 LOG3[1214:800]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2006.06.30 10:16:48 LOG5[1214:800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.06.30 10:16:48 LOG7[1214:800]: 5140 finished (1 left) It appears the server cert is ok, but "something" is wrong with the client (Windows box) cert. Any chance you could post the command used in the "make install" to kick off the creation of the self-signed cert on Unix? I grep'd for it, but couldn't find it. Regards, John Boxall

1 0

Stunnel 4.15 cannot handle PKCS8 format private keys
by David Gillingham 29 Jun '06

29 Jun '06

In modifying stunnel to work with the OpenSSL FIPS-certified module, I found out that private keys cannot be in the default OpenSSL format; they must be in PKCS8 format (due to the MD5 algorithm being disabled in FIPS mode). Talking to Dr. Henson of the OpenSSL group I was able to convert my private keys from the default format to PKCS8, but I found that stunnel was not able to handle these keys. I got the following error output (note that server.pem contains a PKCS8 private key and a PKCS7 public cert): 2006.06.08 17:49:38 LOG7[1120:616]: Certificate: server.pem 2006.06.08 17:49:38 LOG7[1120:616]: Key file: server.pem 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 2306A075 : error:2306A075:PKCS12 routines:PKCS12_DECRYPT_D2I:pkcs12 pbe crypt error 2006.06.08 17:49:42 LOG3[1120:616]: error stack: 23077073 : error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error 2006.06.08 17:49:42 LOG3[1120:616]: SSL_CTX_use_RSAPrivateKey_file: 6074079: error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithm 2006.06.08 17:49:42 LOG3[1120:616]: Server is down Continuing with Dr. Henson, he informed me that this ssl error output meant that "the PBE table has not been initialized in the application". I corrected this by adding a call to OpenSSL_add_all_algorithms() into ssl_init() in ssl.c. This fixed my error with the PEM files. I am posting this so that this bug may be fixed for the next stunnel release. Additionally, I'd like verification that my fix makes sense given the structure of the stunnel code. From doing some searches in the stunnel source, I could not find any existing code that initialized the PBE table so adding the call to ssl_init() made sense _to me_. Michal: do you agree?

2 1

Expired certificate?
by Boxall, John 29 Jun '06

29 Jun '06

Michal, et al, When attempting to connect from a Windows box to a Solaris box (as the server), the Solaris stunnel log (debug = 7) shows that the certificate on the Windows box (included with the download) has expired. I can connect from a Solaris 9 client box with no problems. The Solaris box is running as an NTP client to an internal NTP server. The Windows box isn't logged into a domain, but the time is within 5 minutes of the Solaris box. Solaris server: Solaris 9 (2004/09, no patches) OpenSSL 0.9.8a Stunnel 4.15 Application: Syslog-ng 1.6.11 (working fine on a client Solaris 9 box) Windows client: Windows XP Stunnel 4.15 Application: EventReporter 8.0.268/8.0.219 stunnel.conf: (borrowed and modified from a Solaris client box) ; ;CLIENT-ONLY stunnel configuration file ; client = yes cert = C:\Program Files\stunnel\stunnel.pem-client-certificate CAfile = C:\Program Files\stunnel\stunnel.pem-server-certificate ;chroot = /var/run/stunnel ;pid = /usr/local/var/run/stunnel/stunnel.pid ;setuid = stunnel ;setgid = stunnel verify = 3 ;foreground = yes debug = 7 output = C:\Program Files\stunnel\stunnel.log [5140] accept = 127.0.0.1:514 connect = 192.168.0.143:5140 If the certificate has truly expired, could you post a new one? If not, any suggestions? Regards, John Boxall

2 1

Re: [stunnel-users] patch to build stunnel 4.15 with VS2005
by David Gillingham 29 Jun '06

29 Jun '06

Surely. Here are the contents of the patch file for vs.mak. >cat 4.15-MSVC2005.patch diff -cr stunnel-4.15-orig/src/vc.mak stunnel-4.15/src/vc.mak *** stunnel-4.15-orig/src/vc.mak Sat Jan 21 10:17:32 2006 --- stunnel-4.15/src/vc.mak Thu Jun 29 17:31:43 2006 *************** *** 1,2 **** ! # makefile for VC is not ready... --- 1,42 ---- ! # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2006 ! # ! # Modified by David Gillingham (dgillingham(a)gmail.com) for Visual ! # Studio + # Modify this to point to your actual openssl compile directory + # (You did already compile openssl, didn't you???) + SSLDIR=..\openssl-0.9.7j + + OBJS=stunnel.obj ssl.obj ctx.obj file.obj client.obj protocol.obj \ + sthreads.obj log.obj options.obj network.obj resolver.obj \ + gui.obj + + CC=cl + CFLAGS=-MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo \ + -I"$(SSLDIR)\inc32" $(DEFINES) + DEFINES=-DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE \ + -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO \ + -DHAVE_GETNAMEINFO -D_MBCS + + LINK=link + LDFLAGS=-INCREMENTAL:NO -NOLOGO -SUBSYSTEM:WINDOWS -OPT:REF \ + -OPT:ICF -LTCG -MACHINE:X86 -ERRORREPORT:PROMPT + LIBS=-LIBPATH:"$(SSLDIR)\out32dll" wsock32.lib ssleay32.lib \ + libeay32.lib user32.lib gdi32.lib shell32.lib comdlg32.lib \ + advapi32.lib + + all: stunnel.exe + + clean: + del $(OBJS) resources.res + del *.manifest + del stunnel.exe + + stunnel.exe: $(OBJS) resources.res + $(LINK) $(LDFLAGS) $(LIBS) -OUT:$@ $** + IF EXIST $@.manifest mt -nologo -manifest $@.manifest -outputresource:$@;1 + + resources.res: resources.rc resources.h stunnel.ico + rc -fo $@ resources.rc + + $(OBJS): *.h vc.mak On 6/29/06, Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote: > > That's possible. Could you prepare a patch with a minimal set of > changes (not including anything needed to build those Unix-specific files?).

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users