- stunnel-users - stunnel.org

Trying to load stunnel sources
by Nadav, Erez 09 May '06

09 May '06

Hi all, I am a programmer and I want to compile the stunnel for windows application in order to try to fix some non working TLS issues. I having problem when accessing http://www.stunnel.org/download/source.html address. I have the following questions: 1. Where and How can I load all stunnel sources ? 2. How should I compile it on windows machine ? 3. How should I use the mentioned PGP key Thanks Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Stunnel configuration
by Nadav, Erez 08 May '06

08 May '06

Hi all, How can I configure my stunnel client application (windows) with the following parameter : TLSv1only = yes Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:erez.nadav@erez.nadav@verint.com> Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

client certificate authentication
by Srilalitha Muralidhara(HCL Capital Market Services) 08 May '06

08 May '06

Hi, I am new to stunnel. My application listens on 6 socket ports. External applications either dump data on these socket ports or send requests on these socket ports to receive data. Thus, my application is a server and external applications are clients. We got to authenticate these external applications before accepting the requests/data. So I am planning to use client certificate authentication of stunnel. In this case, should the server have a certificate as well? Will the server be authenticated? Is it necessary for all the external applications to be using the same certificate? Thanks, Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0

Performance Problems.
by Don Werve 05 May '06

05 May '06

After a fair bit of poking, prodding, and googling, I have yet to find the solution to my problem. So, here goes: stunnel looks to be running slowly. Very slowly. We're starting to analyze it with gprof to see where it spends all of its time when we're trying to do content negotiation, and I've whipped up a quick-and-dirty Ruby script that grabs data from the server and then spits out the performace results; I'm sitting on my own T1, so our connectivity is pretty good. The results with this script are similar with 'delay=yes', 'session=600', and 'compression=zlib'. So, here's what happens when I nab data from our stunnel-ed server with said script (I can supply the script if anyone is interested): #File Size time thrpht time thrprt multiple ---------------------------------------------------------------------- index.html 7k http 0.1548 ( 46k/s) https 0.7449 ( 9k/s) * 4.8131 test1.jpg 1k http 0.0928 ( 12k/s) https 0.6379 ( 1k/s) * 6.8726 test2.jpg 10k http 0.1812 ( 59k/s) https 0.6743 ( 16k/s) * 3.7208 test3.jpg 19k http 0.2236 ( 85k/s) https 0.7677 ( 24k/s) * 3.4338 test4.jpg 53k http 0.5668 ( 94k/s) https 1.1543 ( 46k/s) * 2.0365 test5.jpg 97k http 0.7861 (123k/s) https 2.1974 ( 44k/s) * 2.7954 test6.jpg 214k http 1.4061 (152k/s) https 2.3735 ( 90k/s) * 1.6880 test7.jpg 140k http 0.9434 (149k/s) https 1.9331 ( 72k/s) * 2.0491 test8.jpg 470k http 2.8590 (164k/s) https 3.7696 (124k/s) * 1.3185 ('multiple' is the number of times 'slower' https is versus http). And, here's my stunnel config: *** cert = /etc/certs/combined.pem setuid = nobody setgid = nobody pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 0 output = /var/log/stunnel [https] local = 64.40.110.16 accept = 443 connect = 64.40.110.16:80 TIMEOUTclose = 0 *** So, any ideas why stunnel is working so slowly? I mean, I know there's the overhead of the SSL negotiation, and I've heard some things about a stunnel session cache, but nothing about enabling/using it (unless 'session = something bigger than zero' does so?). Any suggestions to improve performance, especially for large batches of small transfers? Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

Using stunnel to add https support to ONE virtual host
by Gonzalo Diethelm 05 May '06

05 May '06

Hello, I have Apache serving plain http pages for several domains running as virtual hosts on one machine (debian). I know SSL will not work with this setup, and I understand the reasons why (at least I think I do). Let's say the virtual hosts are www.server1.com www.server2.com www.server3.com I would like to use stunnel to add https capabilities to ONE of the virtual hosts (say, www.server3.com). In other words, I would like to configure stunnel in server mode with a certificate file, listening on www.server3.com:443, so that if I use a browser to visit https://www.server3.com/ then stunnel will accept the connection and forward all traffic to www.server3.com:80, letting Apache handle it; in particular, this would have to allow Apache to recognize which of the virtual hosts is being visited; I wouldn't like to have www.server1.com respond to my requests instead of www.server3.com. Is this possible? Any caveats, hints, recommendations? Thanks in advance, and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

Using stunnel to add https support to ONE virtual host
by Gonzalo Diethelm 04 May '06

04 May '06

Hello, I have Apache serving plain http pages for several domains running as virtual hosts on one machine (debian). I know SSL will not work with this setup, and I understand the reasons why (at least I think I do). Let's say the virtual hosts are www.server1.com www.server2.com www.server3.com I would like to use stunnel to add https capabilities to ONE of the virtual hosts (say, www.server3.com). In other words, I would like to configure stunnel in server mode with a certificate file, listening on www.server3.com:443, so that if I use a browser to visit https://www.server3.com/ then stunnel will accept the connection and forward all traffic to www.server3.com:80, letting Apache handle it; in particular, this would have to allow Apache to recognize which of the virtual hosts is being visited; I wouldn't like to have www.server1.com respond to my requests instead of www.server3.com. Is this possible? Any caveats, hints, recommendations? Thanks in advance, and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

1 0

Re: stunnel 4.15 crashes with vnc server 4.1.1
by Harry Boeck 04 May '06

04 May '06

Hallo stunnel-users, @Michal Trojnara: Thanks for your help, Mike! The solution came overnight when i remembered my own message: > and the screen on the server side should remove the background image > and visual effects). Well: I disabled the desktop modifications in vnc and it runs. Something is incompatible in the stunnel GUI with the removal of global windows GUI behaviour (despite the fact, that i have not a single one of them in use - to the best of my knowledge), what has nothing to do with the dedication of stunnel. Maybe there's a simple GUI message not handled correctly? As this seems to be something common to all windows versions, could this possibly happen in windows xp, too? (I don't use one, so somone would have to investigate this.) It's another motivation to start compiling in cygnus. But unfortunally at this very moment i'm occupied with other tasks. May be some other guy has the fancy to look at this matter... Mit freundlichem Gruß Harry Boeck

1 0

stunnel install issues with mknod command
by Trishul Shah 04 May '06

04 May '06

Hi, I was wondering if you could help me, I am trying to install stunnel on a machine running solaris 10, but the catch is that I am trying to install it within a zone in solaris 10, unfortunately during the installation process after the source is compiled I see the following error: Making install in src test -z "/usr/local/lib" || /bin/bash ../auto/mkinstalldirs "/usr/local/lib" /bin/bash ../libtool --mode=install ../auto/install-sh -c 'libstunnel.la' '/usr/local/lib/libstunnel.la' ../auto/install-sh -c .libs/libstunnel.so /usr/local/lib/libstunnel.so chmod +x /usr/local/lib/libstunnel.so ../auto/install-sh -c .libs/libstunnel.lai /usr/local/lib/libstunnel.la ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- test -z "/usr/local/sbin" || /bin/bash ../auto/mkinstalldirs "/usr/local/sbin" /bin/bash ../libtool --mode=install ../auto/install-sh -c 'stunnel' '/usr/local/sbin/stunnel' ../auto/install-sh -c stunnel /usr/local/sbin/stunnel test -z "/usr/local/sbin" || /bin/bash ../auto/mkinstalldirs "/usr/local/sbin" ../auto/install-sh -c 'stunnel3' '/usr/local/sbin/stunnel3' Making install in doc test -z "/usr/local/share/doc/stunnel" || /bin/bash ../auto/mkinstalldirs "/usr/local/share/doc/stunnel" ../auto/install-sh -c -m 644 'stunnel.html' '/usr/local/share/doc/stunnel/stunnel.html' ../auto/install-sh -c -m 644 'stunnel.pl.html' '/usr/local/share/doc/stunnel/stunnel.pl.html' ../auto/install-sh -c -m 644 'stunnel.fr.html' '/usr/local/share/doc/stunnel/stunnel.fr.html' test -z "/usr/local/man/man8" || /bin/bash ../auto/mkinstalldirs "/usr/local/man/man8" ../auto/install-sh -c -m 644 './stunnel.8' '/usr/local/man/man8/stunnel.8' ../auto/install-sh -c -m 644 './stunnel.pl.8' '/usr/local/man/man8/stunnel.pl.8' ../auto/install-sh -c -m 644 './stunnel.fr.8' '/usr/local/man/man8/stunnel.fr.8' Making install in tools test -z "/usr/local/etc/stunnel" || /bin/bash ../auto/mkinstalldirs "/usr/local/etc/stunnel" ../auto/install-sh -c -m 644 'stunnel.conf-sample' '/usr/local/etc/stunnel/stunnel.conf-sample' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr/local/bin/openssl req -new -x509 -days 365 -nodes $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ test -eq 0 || /usr/local/bin/openssl gendh $RND 512 >> stunnel.pem; \ /usr/local/bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ../auto/install-sh -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi mkdir -p /usr/local/var/stunnel chmod a=rwx,+t /usr/local/var/stunnel if uname | grep SunOS; then \ mkdir -p /usr/local/var/stunnel/dev; \ chmod u=rwx,go=rx /usr/local/var/stunnel/dev; \ mknod /usr/local/var/stunnel/dev/zero c 13 12; \ chmod a=rw /usr/local/var/stunnel/dev/zero; \ fi SunOS mknod: Not owner *** Error code 2 make: Fatal error: Command failed for target `install-data-local' Current working directory /export/home/playtech/stunnel-4.14/tools *** Error code 1 The following command caused the error: make install-exec-am install-data-am make: Fatal error: Command failed for target `install-am' Current working directory /export/home/playtech/stunnel-4.14/tools *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' After much digging around I have discovered that the mknod command cannot be used within a solaris 10 zone, I have gotten round this previously by installing stunnel from the global zone but that intertwines the parent zone with the child zone and ideally we would like to keep these as independent of each other as possible as we use these zones for 3rs party applications and hence we have a lot of other user traffic on these zones. Thanks in advance for your help. Kind Regards, Trishul Shah Blue Square Tel: 020 7288 7920 Mob: 07789 982 688 Fax: 020 7288 7955

1 0

stunnel 4.15 crashes with vnc server 4.1.1
by Harry Boeck 04 May '06

04 May '06

Hallo stunnel users, i'm learning to use ssl and ssh tools to get secured access to my home server from work and other places. I already have a working ssh installation but stumbled over stunnel ba accident. I would like to use it, because i still have computers in use with win98 (both for myself and among my clients) and this little program is exactly all what i would need to use vnc over a secured connection. SSH to the contrary needs a little bit more setup (over a cygwin that serves the only purpose of aquiring such tools like SSH), needs its own crypto library compilation and so on. Now, there is the problem that stunnel 4.15 crashes at the moment, when the vnc server 4.1.1 tries to deliver its first screen to the client. Stunnel was downloaded from http://www.stunnel.org/download/binaries.html, vnc was downloaded from http://www.realvnc.com (already some times ago). Both where downloaded as binaries, for the typical help hints on forums for the question "i have a compile problem on windows" being "how dare you"... Both machines i'm using for testing use win98 as operating system. The crash happens both when testing a configuration on one machine with stunnel running both as server and as client, as well as when using it to connect two machines with stunnel running as server on the machine with vnc server and as client on the machine with vnc client. VNC runs correct for itself as well as via an ssh secured connection. Stunnel is startet with only the server versus the client configuration file as command line parameter. The configuration files are: http://harryboeck.dyndns.org/Sicherheit/stunnel-server.ini http://harryboeck.dyndns.org/Sicherheit/stunnel-client.ini Stunnel delivers correctly the data between vnc server and client (including connection establishment and authentication) until the point of first screen transfer (when the screen on the client side turns black and the screen on the server side should remove the background image and visual effects). The output of stunnel server and client is: http://harryboeck.dyndns.org/Sicherheit/stunnel-server.log http://harryboeck.dyndns.org/Sicherheit/stunnel-client.log The output of "stunnel -version" is: http://harryboeck.dyndns.org/Sicherheit/stunnel-version.txt I have no clue what '6. Output of "uname -a"' should mean, if that is somehow important for hints, please let me know. openssl version is: OpenSSL 0.9.8a 11 Oct 2005 I would appreciate any suggestions or hints on the interaction of vnc and stunnel. with best regards Harry Boeck

2 1

certificate unknown
by Ludovic DUFLOT 03 May '06

03 May '06

Hi, I tried to use stunnel to connect in SSL to a LDAP server. But I can't and I've got this error message: certificate unknown I use stunnel for establishing connexion with IMAPS server and all is right but not for LDAP connexion. The certificate is self-signate. I searched on the list's archives and with google but I can't find any solution... Help !!! Ludo ps: these are the stunnel.conf and the log: *************************** cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ldaps] accept = 389 connect = 10.0.0.1:636 verify = 0 [imaps] accept = 143 connect = 10.0.0.2:993 *************************** 2006.05.03 07:52:40 LOG7[4436:2436]: RAND_status claims sufficient entropy for the PRNG 2006.05.03 07:52:40 LOG6[4436:2436]: PRNG seeded successfully 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service ldaps 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service imaps 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service https 2006.05.03 07:52:40 LOG5[4436:2436]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7f 22 Mar 2005 2006.05.03 07:52:40 LOG5[4436:2436]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.05.03 07:52:40 LOG5[4436:4612]: No limit detected for the number of clients 2006.05.03 07:52:40 LOG7[4436:4612]: FD 192 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: ldaps bound to 0.0.0.0:389 2006.05.03 07:52:40 LOG7[4436:4612]: FD 196 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: imaps bound to 0.0.0.0:143 2006.05.03 07:52:40 LOG7[4436:4612]: FD 212 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: https bound to 0.0.0.0:443 2006.05.03 07:52:50 LOG7[4436:4612]: ldaps accepted FD=220 from 127.0.0.1:2893 2006.05.03 07:52:50 LOG7[4436:4612]: Creating a new thread 2006.05.03 07:52:50 LOG7[4436:4612]: New thread created 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps started 2006.05.03 07:52:50 LOG7[4436:5780]: FD 220 in non-blocking mode 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on local socket 2006.05.03 07:52:50 LOG5[4436:5780]: ldaps connected from 127.0.0.1:2893 2006.05.03 07:52:50 LOG7[4436:5780]: FD 244 in non-blocking mode 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps connecting 10.0.0.1:636 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: waiting 10 seconds 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: connected 2006.05.03 07:52:50 LOG7[4436:5780]: Remote FD=244 initialized 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on remote socket 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): before/connect initialization 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client hello A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server hello A 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=0, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=ldap-bourget.univ-savoie.fr 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate request A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server done A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client key exchange A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write certificate verify A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write change cipher spec A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write finished A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 flush data 2006.05.03 07:52:50 LOG7[4436:5780]: SSL alert (read): fatal: certificate unknown 2006.05.03 07:52:50 LOG3[4436:5780]: SSL_connect: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2006.05.03 07:52:50 LOG5[4436:5780]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps finished (0 left)

1 0

Wrapping interclient connections outbound to many servers
by Matthew Case 02 May '06

02 May '06

Hello all, I have searched high and low for a solution to this problem, but I haven't found anything so I am coming here in hopes someone will be able to help me. I have to wrap the interclient protocol (>1024 to 3060) in some manner of encryption to appease one of my clients. I have already wrapped the ajp13 protocol between the apache server and the tomcat server, but now the tomcat server (which acts as an stunnel server in the ajp13 setup) must also act as a client and wrap all outbound and return traffic to 10 servers to and from port 3060. Making large modifications to the source code is not going to be feasible given my current time crunch (it must be implemented in two weeks). Has anyone run into anything like this and does anyone have any tips? Thanks in advance! - Matt

1 0

Stunnel + Snort + MySQL
by Steven 02 May '06

02 May '06

I have a problem that I have been unsuccessful in solve thus far with Stunnel, Snort, and MySQL. Stunnel (client & server): 4.04 Snort: 2.4.4 on the client MySQL Ver 11.18 Distrib 3.23.58, for redhat-linux-gnu (i386) [not the latest and greatest by any means] I setup stunnel so that traffic destined for localhost 3306 (mysql) on the client goes to port 3307 on the server. Stunnel on the server is setup to take traffic from 3307 and send it to 3306 locally. This connection works fine. I can fire up Snort and have events properly log to my snort database on the server from the client. However, if stunnel is stopped/restarted on either the client or the server Snort is not able to keep writing to the database unless it is restarted. I just get this error: May 2 12:44:03 box snort[44126]: database: Problem inserting a new signature 'Test Snort Signature' May 2 12:44:03 box1 snort[44126]: database: mysql_error: MySQL server has gone away SQL=INSERT INTO event (sid,cid,signature,timestamp) VALUES ('4', '22', '0', '2006-05-02 16:44:03.322') May 2 12:44:03 box snort[44126]: database: mysql_error: MySQL server has gone away SQL=ROLLBACK Whenever I close stunnel it sends traffic to the other end. I can restart it and open up new connections just fine. However, Snort will not even try and connect to port 3306. Once stunnel has been stopped (or even restarted) it just immediately fails to even try and connect to the port. It seems there's some kind of signal sent that kills the connection (and all future connections?). I cannot figure oout why this happens. Any ideas? Thanks Steven

1 0

stunnel broken?
by Smith, Brian C1 (N-ASGARD AVIONICS) 28 Apr '06

28 Apr '06

does anyone know what this error message means and how to fix it? SSL_read (SSL_ERROR_SYSCALL): Operation would block (246) Brian Smith brian.c1.smith(a)lmco.com

1 0

SSL_read (SSL_ERROR_SYSCALL): Operation would block (246)
by Smith, Brian C1 (N-ASGARD AVIONICS) 26 Apr '06

26 Apr '06

Hello all, I am having a problem using stunnel to connect web application in java to a UniData Database server. The setup is working fine, traffic passes over the tunnel from webserver to database without a problem except when a large query is sent over the tunnel. Normal queries get responses no problem. I am running HP-UX 11.00. Stunnel is running in daemon mode on both servers. Any ideas why this might happen? Is there a buffer limit or something for stunnel? Thanks in advance! Here's the stunnel.conf files for them: database side: ------------------------------------------------------ RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd pid = /opt/hpws/apache/logs/stunnel.pid debug = 7 output = /opt/hpws/apache/logs/stunnel.log client = no foreground = no [unidata] accept = 5555 connect = 127.0.0.1:31438 ------------------------------------------------------ webserver side: ------------------------------------------------------ RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd pid = /opt/hpws/apache/logs/stunnel.pid debug = 7 output = /opt/hpws/apache/logs/stunnel.log client = yes foreground = no [unidata] accept = 127.0.0.1:5555 connect = dbserver:5555 ------------------------------------------------------ Here is my stunnel -version output: ------------------------------------------------------ stunnel 4.04 on hppa2.0w-hp-hpux11.00 PTHREAD with OpenSSL 0.9.7g 11 Apr 2005 Global options cert = /opt/hpws/apache/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /opt/hpws/apache/stunnel/etc/stunnel/stunnel.pem pid = /opt/hpws/apache/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds ------------------------------------------------------ Here is the error from the client: ------------------------------------------------------ 2006.04.26 10:47:11 LOG7[1862:1]: unidata accepted FD=0 from 127.0.0.1:49644 2006.04.26 10:47:11 LOG7[1862:1]: FD 0 in non-blocking mode 2006.04.26 10:47:11 LOG7[1862:8]: unidata started 2006.04.26 10:47:11 LOG5[1862:8]: unidata connected from 127.0.0.1:49644 2006.04.26 10:47:11 LOG7[1862:8]: FD 1 in non-blocking mode 2006.04.26 10:47:11 LOG7[1862:8]: unidata connecting 141.240.76.34:5555 2006.04.26 10:47:11 LOG7[1862:8]: remote connect #1: EINPROGRESS: retrying 2006.04.26 10:47:11 LOG7[1862:8]: waitforsocket: FD=1, DIR=write 2006.04.26 10:47:11 LOG7[1862:8]: waitforsocket: ok 2006.04.26 10:47:11 LOG7[1862:8]: Remote FD=1 initialized 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): before/connect initialization 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write client hello A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read server hello A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read server certificate A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read server done A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write client key exchange A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write change cipher spec A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write finished A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 flush data 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read finished A 2006.04.26 10:47:11 LOG7[1862:8]: 3 items in the session cache 2006.04.26 10:47:11 LOG7[1862:8]: 7 client connects (SSL_connect()) 2006.04.26 10:47:11 LOG7[1862:8]: 7 client connects that finished 2006.04.26 10:47:11 LOG7[1862:8]: 0 client renegotiatations requested 2006.04.26 10:47:11 LOG7[1862:8]: 0 server connects (SSL_accept()) 2006.04.26 10:47:11 LOG7[1862:8]: 0 server connects that finished 2006.04.26 10:47:11 LOG7[1862:8]: 0 server renegotiatiations requested 2006.04.26 10:47:11 LOG7[1862:8]: 4 session cache hits 2006.04.26 10:47:11 LOG7[1862:8]: 0 session cache misses 2006.04.26 10:47:11 LOG7[1862:8]: 0 session cache timeouts 2006.04.26 10:47:11 LOG6[1862:8]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.04.26 10:47:12 LOG3[1862:8]: SSL_read (SSL_ERROR_SYSCALL): Operation would block (246) 2006.04.26 10:47:12 LOG5[1862:8]: Connection reset: 744 bytes sent to SSL, 539 bytes sent to socket 2006.04.26 10:47:12 LOG7[1862:8]: unidata finished (0 left) --------------------------------------------------------- Here is the error from the server: --------------------------------------------------------- 2006.04.26 10:48:24 LOG7[18850:1]: unidata accepted FD=0 from 141.240.76.29:49645 2006.04.26 10:48:24 LOG7[18850:1]: FD 0 in non-blocking mode 2006.04.26 10:48:24 LOG7[18850:6]: unidata started 2006.04.26 10:48:24 LOG5[18850:6]: unidata connected from 141.240.76.29:49645 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): before/accept initialization 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 read client hello A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write server hello A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write certificate A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write server done A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 flush data 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 read client key exchange A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 read finished A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write change cipher spec A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write finished A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 flush data 2006.04.26 10:48:24 LOG7[18850:6]: 1 items in the session cache 2006.04.26 10:48:24 LOG7[18850:6]: 0 client connects (SSL_connect()) 2006.04.26 10:48:24 LOG7[18850:6]: 0 client connects that finished 2006.04.26 10:48:24 LOG7[18850:6]: 0 client renegotiatations requested 2006.04.26 10:48:24 LOG7[18850:6]: 5 server connects (SSL_accept()) 2006.04.26 10:48:24 LOG7[18850:6]: 5 server connects that finished 2006.04.26 10:48:24 LOG7[18850:6]: 0 server renegotiatiations requested 2006.04.26 10:48:24 LOG7[18850:6]: 3 session cache hits 2006.04.26 10:48:24 LOG7[18850:6]: 1 session cache misses 2006.04.26 10:48:24 LOG7[18850:6]: 1 session cache timeouts 2006.04.26 10:48:24 LOG6[18850:6]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.04.26 10:48:24 LOG7[18850:6]: FD 1 in non-blocking mode 2006.04.26 10:48:24 LOG7[18850:6]: unidata connecting 127.0.0.1:31438 2006.04.26 10:48:24 LOG7[18850:6]: Remote FD=1 initialized 2006.04.26 10:48:25 LOG3[18850:6]: SSL_read (SSL_ERROR_SYSCALL): Connection reset by peer (232) 2006.04.26 10:48:25 LOG5[18850:6]: Connection reset: 9477 bytes sent to SSL, 744 bytes sent to socket 2006.04.26 10:48:25 LOG7[18850:6]: unidata finished (0 left) ---------------------------------------------------------- Brian Smith brian.c1.smith(a)lmco.com

1 0

NSIS Installer Script
by Ryan O'Horo 25 Apr '06

25 Apr '06

I'm looking to distribute stunnel for Windows in such a manner that stunnel installs with a client certificate already configured. Is the original NSIS installer script available for use? Ryan O'Horo

2 1

New behaviour under 4.15?
by Scott Tuc Ellentuch＠T-B-O-H 24 Apr '06

24 Apr '06

Hi, I just did a portupgrade in FreeBSD from 4.14 to 4.15, and now it seems to be looping the command that I asked it, instead of just doing it once. Has there been an option added I need to tell it to just do once? Thanks, Tuc

3 2

too many file descriptors
by Sligar, Benjamin 22 Apr '06

22 Apr '06

I'm working on upgrading from stunnel 4.04 to the 4.15 to utilize the per port specification of a certificate. On my initial testing, I ran with only a few ports, specified the different certs, and, everything seems to work fine. I'm ran into a problem, though, when trying to use the same config file in regards to the number of configured ports. I have 104 inbound ports setup, and, when it hits the 69th configured port, I get the following message for this, and every port that follows: s_poll_add failed for FD=69: too many file descriptors I checked the code, and, this is what I found: #define MAX_FD 64 I didn't find a relation to any configurable options, so I made a change to this parameter in the code, recompiled, and, I was able to start up all of my listens without error. I just wanted to pass this along, and, if it does tie into a configurable parameter, my apologies for not finding it....if someone knows it, please pass that on. Thanks! **************************************** Benjamin Sligar Senior Development Support Specialist Transaction Network Services, Inc P: 703.453.8324 F: 703.453.8391 AIM: dagdromer88 **************************************** This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

Stunnel with TPM engine !!!
by dinesh.kallath＠bt.com 19 Apr '06

19 Apr '06

Hello I am new to Stunnel and would like to know how to integrate the engine with Stunnel 4.15. I am trying to integrate a Trusted Platform Module (TPM) engine which is compatible with OpenSSL to use with Stunnel so that the private key for SSL connection can be retrieved and stored in the hardware. I was able to configure the Stunnel config file to use the engine and it is loading the engine fine. The problem I am facing now is the key which stunnel tries to load can be loaded only by the engine, I mean it has to be loaded into the TPM to use it and stunnel tried to load it in the normal way. Please find the debug output bellow, # ./stunnel stunnel-engine.conf 2006.04.19 13:39:22 LOG7[1261:3086812864]: Enabling support for engine 'tpm' DEBUG e_tpm_err.c:295 ERR_load_TPM_strings DEBUG e_tpm_err.c:298 TPM_lib_error_code is 136 2006.04.19 13:39:22 LOG7[1261:3086812864]: Initializing engine DEBUG e_tpm.c:336 tpm_engine_init LOG_DEBUG TSPI ../tcsd_api/clntside.c:58 Sending TSP packet to host localhost. LOG_DEBUG TSPI ../tcsd_api/clntside.c:74 Connecting to 127.0.0.1 LOG_DEBUG TSPI ../tcsd_api/tcstp.c:390 TCS_OpenContext_RPC_TP: Received TCS Context: 0xa0ef791d 2006.04.19 13:39:22 LOG7[1261:3086812864]: Engine initialized 2006.04.19 13:39:22 LOG7[1261:3086812864]: Engine closed 2006.04.19 13:39:22 LOG7[1261:3086812864]: Snagged 64 random bytes from /root/.rnd DEBUG e_tpm.c:1151 tpm_rand_bytes getting 1024 bytes LOG_DEBUG TSPI ../tcsd_api/tcstp.c:2488 TCSP_GetRandom_TP: TCS Context: 0xa0ef791d 2006.04.19 13:39:23 LOG7[1261:3086812864]: Wrote 1024 new random bytes to /root/.rnd DEBUG e_tpm.c:1171 tpm_rand_status 2006.04.19 13:39:23 LOG7[1261:3086812864]: RAND_status claims sufficient entropy for the PRNG 2006.04.19 13:39:23 LOG6[1261:3086812864]: PRNG seeded successfully DEBUG e_tpm.c:736 tpm_rsa_init 2006.04.19 13:39:23 LOG7[1261:3086812864]: Certificate: /root/dk/CVS/070406/applications/openssl_tpm_engine/TpmKey.crt 2006.04.19 13:39:23 LOG7[1261:3086812864]: Key file: /root/dk/CVS/070406/applications/openssl_tpm_engine/TpmKey.key 2006.04.19 13:39:23 LOG3[1261:3086812864]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2006.04.19 13:39:23 LOG3[1261:3086812864]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line It is obvious from the debug that the Stunnel expect a private key file in PEM format but the whole issue is that the private key I have (created using TPM) is not in a PEM format, it is an encrypted file with root key used to encrypt stays inside the TPM hardware. I suppose we need to provide a key load function which loads the key into the TPM rather than using Stunnel. It will be a great help if someone could provide me with some pointers on how to solve this, or please let me know if I am missing out something. Also do ask me if you need any further clarifications. Many thanks, Dinesh Kallath, CISSP Research Professional, Security Research Centre BT Group Chief Technology Office ___________________________ Tel : +44 (0) 1473 643476 Fax : +44 (0) 1473 646886 Mob: +44 (0) 7952144553 Email: dinesh.kallath(a)bt.com Post : PP:2A, B28, Adastral Park, Ipswich IP5 3RE. British Telecommunications plc Registered office: 81 Newgate Street London EC1A 7AJ Registered in England no. 1800000 This electronic message contains information from British Telecommunications plc which may be privileged or confidential. The information is intended to be for the use of the individual(s) or entity named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by telephone or email (to the numbers or address above) immediately. Activity and use of the British Telecommunications plc email system is monitored to secure its effective operation and for other lawful business purposes. Communications using this system will also be monitored and may be recorded to secure effective operation and for other lawful business purposes.

1 0

stunnel-4.15 doesn't work on Mac OS X 10.4.6
by SUENAGA Hiroki 18 Apr '06

18 Apr '06

Dear all, I found a problem that the stunnel-4.15 doesn't work on the Mac OS X 10.4.6. I think this is a BUG. My environment is: - OS: Mac OS X 10.4.6/Intel - Compiler: gcc 4.0.1 (from XCode 2.2) - OpenSSL: 0.9.7i (Mac OS X original version) - Usage: connect to the submission port. The detail of BUG is the following: In protocol.c::smtp_client() line 138, fdputline() called with argument line = "EHLO localhost." This is a string literal. 130 static void smtp_client(CLI *c) { ... 138 fdputline(c, c->remote_fd.fd, "EHLO localhost"); ... In network.c::fdputline() line 565, the literal is passed to 1st argument of safeconcat(). 556 void fdputline(CLI *c, int fd, char *line) { .... 565 safeconcat(line, crlf); ... In common.h line 311, safeconcat() is #define'ed as: 311 #define safeconcat(dst, src) \ 312 (dst[STRLEN-1]='\0', strncat((dst), (src), \ STRLEN-strlen(dst)-1)) This means the macro safeconcat() write to string literal. This is the BUG. In Mac OS X envoronment, string literal is NOT writable. So protection fault occurs at this code. On the other environment, this breaks somewhere in the heap or in the stack. This may also cause a crash. In stunnel-4.14, fdprintf() is used instead of fdputline(). fdprint() have own writable buffers on stack, and the string literal is copied to the stack. This works fine. The work around is using own writable buffers in fdputline() like fdprint() in stunnel-4.14. But it seems to be a performance tuning why fdputline() is used. So I don't know what is the correct way to fix this BUG.... I hope this BUG is fixed in the future release. If this was already reported, please ignore this mail. Thank you. Rgards, ---------- Internet Initiative Japan Inc. Research & Development Section, Product Development Division, SEIL Business Unit SUENAGA Hiroki <hsuenaga(a)iij.ad.jp>

2 2

STunnel and the MAC
by Bryan Bearden 15 Apr '06

15 Apr '06

I am working on setting up a mac server and having trouble getting the stunnel to work on the mac. I installed Darwin Ports and am running it under there. It appears to be running and my stunnel.conf file appears to be correct, but I cannot get it to use stunnel. Any ideas? I'm trying to connect to MySQL 4. thanks... Bryan

1 0

Choosing local 'source' IP? (again)
by Don Werve 14 Apr '06

14 Apr '06

This is a repost, but the response I got last time said, 'use the "local" option'...which does not appear to work. Ok, so here's the problem: I've got stunnel handling SSL for a web-based service that is otherwise too stupid to be able to talk https. On the same piece of hardware that runs this service (Virtuozzo if you must know), I've set up stunnel to listen to ETH0_IP:443 and wrapper them to ETH0_IP:80, which is where VZ listens. This works wonderfully. Unfortunately, I need to set up a redirection rule inside this service that bounces people back to the https:// page if they try to come in over http. Since said service isn't managing its own SSL, I have no solid way of determining which connections are wrappered by stunnel and which connections come in over the wire, save for by the IP address of the connection. Now, each piece of iron has two ethernet adapters, so I got the bright idea to try and get stunnel to 'appear' to be connecting from the IP address of the second adapter. So, I set 'local = ETH1_IP' in stunnel.conf, and...nada. Still shows as connecting from ETH0_IP. I've screwed with socket options, read the source code for Stunnel, and so on. Having read the source code and refreshed my knowledge of socket() and connect(), is it really even possible to do what I want if stunnel is running on the same system? Oh, a ptrace of stunnel also yields the following: socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 8 fcntl64(8, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(8, F_SETFL, O_RDWR|O_NONBLOCK) = 0 bind(8, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("[ETH1_IP]")}, 16) = 0 connect(8, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("[ETH0_IP]")}, 16) = -1 EINPROGRESS (Operation now in progress) ...and the connection inside of $CRAP_SYSTEM shows the connection as coming from ETH0_IP. So, I'm kind of at my wits' end here. Any possible way to make this work? Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

stunnel4 stealing my ports (listening on ports it shouldn't be)
by Eric Brown 12 Apr '06

12 Apr '06

I have two stunnel processes. One listing on 443 -> localhost:80. The other listening on 8000 -> localhost:7001. (See configs below.) However, when I stop the process listening on port 7001, both stunnel processes start listening on 7001 (and a few other ports). I'm completely confused as to why this would happen. This is what I see normally: mta4-tiny-support (epgate)[6]$ sudo lsof -p 25253 -p 25255 -a -i4 Password: COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME stunnel4 25253 root 6u IPv4 3439450 TCP *:8000 (LISTEN) stunnel4 25255 root 6u IPv4 3439456 TCP *:https (LISTEN) This is what I see when stunnel appears to go bizerk: (after stopping the process that was listening on ports *:7000, localhost:7001 & localhost:7005) COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME stunnel4 22788 root 5u IPv4 1269640 TCP 127.0.0.1:4341- >127.0.0.1:19996 (CLOSE_WAIT) stunnel4 22788 root 6u IPv4 1273504 TCP 127.0.0.1:7001 (LISTEN) stunnel4 22788 root 7u IPv4 1273476 TCP 127.0.0.1:4606- >127.0.0.1:19995 (ESTABLISHED) stunnel4 22788 root 9u IPv4 1273477 TCP 127.0.0.1:19995- >127.0.0.1:4606 (ESTABLISHED) stunnel4 22788 root 11u IPv4 1273507 TCP *:7000 (LISTEN) stunnel4 22788 root 17u IPv4 1273515 TCP 127.0.0.1:7005 (LISTEN) stunnel4 22788 root 19u IPv4 1274895 TCP 127.0.0.1:7001- >127.0.0.1:1793 (CLOSE_WAIT) stunnel4 22788 root 24u IPv4 1275089 TCP *:8000 (LISTEN) stunnel4 22790 root 5u IPv4 1269640 TCP 127.0.0.1:4341- >127.0.0.1:19996 (CLOSE_WAIT) stunnel4 22790 root 6u IPv4 1273504 TCP 127.0.0.1:7001 (LISTEN) stunnel4 22790 root 7u IPv4 1273476 TCP 127.0.0.1:4606- >127.0.0.1:19995 (ESTABLISHED) stunnel4 22790 root 9u IPv4 1273477 TCP 127.0.0.1:19995- >127.0.0.1:4606 (ESTABLISHED) stunnel4 22790 root 11u IPv4 1273507 TCP *:7000 (LISTEN) stunnel4 22790 root 17u IPv4 1273515 TCP 127.0.0.1:7005 (LISTEN) stunnel4 22790 root 19u IPv4 1274895 TCP 127.0.0.1:7001- >127.0.0.1:1793 (CLOSE_WAIT) stunnel4 22790 root 24u IPv4 1275094 TCP *:443 (LISTEN) Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 127.0.0.1:7008 0.0.0.0:* LISTEN 0 1281907 24848/python tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 0 1275089 22788/stunnel4 tcp 0 0 0.0.0.0:1025 0.0.0.0:* LISTEN 0 1681 - tcp 0 0 0.0.0.0:963 0.0.0.0:* LISTEN 0 1556 1205/rpc.statd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 0 1238 986/portmap tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 0 1281911 24848/python tcp 0 0 127.0.0.1:7025 0.0.0.0:* LISTEN 0 1281130 24605/master tcp 0 0 127.0.0.1:7026 0.0.0.0:* LISTEN 0 1281542 24677/python tcp 0 0 0.0.0.0:818 0.0.0.0:* LISTEN 0 1356 1061/ypbind tcp 0 0 127.0.0.1:7027 0.0.0.0:* LISTEN 0 1281731 24777/python tcp 0 0 127.0.0.1:7028 0.0.0.0:* LISTEN 0 1281910 24848/python tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 1486 1195/sshd tcp 0 0 0.0.0.0:7000 0.0.0.0:* LISTEN 0 1273507 22788/stunnel4 tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 400 1269115 20559/postmaster tcp 0 0 172.16.80.213:25 0.0.0.0:* LISTEN 0 1281126 24605/master tcp 0 0 172.16.80.212:25 0.0.0.0:* LISTEN 0 1280994 24584/master tcp 0 0 127.0.0.1:7001 0.0.0.0:* LISTEN 0 1273504 22788/stunnel4 tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 0 1275094 22790/stunnel4 tcp 0 0 127.0.0.1:955 0.0.0.0:* LISTEN 0 1518 1201/famd tcp 0 0 127.0.0.1:7005 0.0.0.0:* LISTEN 0 1273515 22788/stunnel4 tcp 0 0 127.0.0.1:7006 0.0.0.0:* LISTEN 0 1281540 24677/python tcp 0 0 127.0.0.1:7007 0.0.0.0:* LISTEN 0 1281724 24777/python I'm running stunnel 4.09 on Debian 3.1/Linux 2.6 Kernel. My configurations are: pid=/var/run/epgate_admin_stunnel4.pid cert=/epgate/etc/ssl/admin.stunnel [Admin] accept=8000 connect=7001 and: pid=/var/run/epgate_quarantine_stunnel4.pid cert=/epgate/etc/ssl/quar.stunnel [Quarantine] accept=443 connect=80

1 0

Deamon signal on close connection
by Ondra Medek 05 Apr '06

05 Apr '06

Hi, I'm using stunnel4 in daemon mode. It runs a bash script "service" for each connection. I want to stop the script, when the client closes the connection. Does the stunnel4 send any signal to child process when the connection is closed? My script receives no signal. Or is it a problem of bash? The only way how can the script find, that connection is broken is by reading the standart input, but I don't want to read any standart input. Thanks P.S. a snip of stunnel4 config: [aswconsole] accept = 1002 exec = /home/ondrejm/SeptimOS/ServerConsole/aswc-new/opt/asw/console/service

1 0

Having problems with an special configuration
by Michael Spiegle 04 Apr '06

04 Apr '06

Hi all, I've got a strange thing (at least I think so) that i'm trying to do with stunnel and it doesn't work. Here's the layout... Feel free to skip the next 3 paragraphs to get to the root of the problem: I'm using stunnel to provide SSL for a set of webservers behind a pair of LVS loadbalancers using keepalived. lets say I have a public IP of 10.0.0.1. I have an iptables rule which marks all 443 traffic to this IP with a fwmark, then keepalived dumps the traffic to the stunnel after seeing this fwmark. I have configured LVS to use direct-routing so that the stunnel server can see the original public IP which was requested (so it can serve up the right cert). Now, here is where things break. Internally, lets say stun is setup with an IP 192.168.0.10, and the LVS server has an interface on this VLAN with the IP 192.168.0.5. In my keepalived configuration for the correct fwmark, I dump the traffic to stun on 192.168.0.10. When I test this by creating a connection to the public IP address (10.0.0.1), LVS dumps the traffic to stunnel as planned and stunnel sees something like the following in TCPDUMP: Websurfer's_IP:123131 ----> 10.0.0.1:443 Stunnel refuses to do anything with the traffic. I assumed this was becuase the IP 10.0.0.1 wasn't configured anywhere on the stunnel box itself. I assigned this IP to the loopback interface as an alias, and it still doesn't work. I've straced/debug-logged stunnel and it doesn't do anything - almost like it doesn't think it should service the traffic. If I run netstat - plan, stunnel is listening to 0.0.0.0:443. So, why doesn't stunnel want to do anything with this traffic? uname -a: Linux ssl-server.domain.com 2.4.29-1.2smp #1 SMP Fri Mar 18 15:45:07 EST 2005 i686 unknown Running redhat 7.3. Glibc: glibc-2.2.5-44 glibc-common-2.2.5-44 openssl version: 0.9.6b configuration: cert = /nfs/ssl/pem/default chroot = /nfs certdir = /ssl/pem hashdir = yes pid = /run/stunnel.pid setuid = nobody setgid = nogroup output = /var/log/stunnel.log [https] accept = 443 connect = *:80 httpprotocol = yes TIMEOUTclose = 1 IP on loopback: bash-2.05a# ip addr list 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo inet 10.0.0.1/32 brd 10.0.0.255 scope global lo:0 ... ... ... Michael Spiegle mike(a)nauticaltech.com 310.686.4570

1 0

(stunnel-4.14) poor performance with openssl engine
by Zhuang Yuyao 03 Apr '06

03 Apr '06

Hi, I've just added openssl engine support for Cavium Nitrox lite PCI card. Here are the speed test output: [engine] stands for speed test output with engine [soft] stands for speed test output without engine (openssl internal software implementation used) ~ # openssl speed -evp [rc4|aes256|sha1] [-engine /root/libcavium.so] ...... The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes rc4[engine] 6339.20k 25376.00k 100966.40k 3757056.00k 919961.60k rc4[soft] 6056.66k 7017.34k 7228.37k 7339.13k 7356.14k aes-256-cbc[engine] 3178.40k 25465.60k 50636.80k 194201.60k 2088140.80k aes-256-cbc[soft] 2430.36k 2572.93k 2597.45k 2617.27k 2609.82k sha1[engine] 774.20k 3115.20k 16486.40k 27033.60k 285593.60k sha1[soft] 915.74k 2622.71k 5678.93k 7942.23k 9041.75k ~ # openssl speed rsa [-engine /root/libcavium.so] sign verify sign/s verify/s rsa[soft] 512 bits 0.013810s 0.001349s 72.4 741.2 rsa[soft] 1024 bits 0.079200s 0.004342s 12.6 230.3 sign verify sign/s verify/s rsa[engine] 512 bits 0.000037s 0.000022s 26725.8 45181.5 rsa[engine] 1024 bits 0.000046s 0.000043s 21866.7 23489.1 The speed test shows than using engine is much much faster than software implementations. but while testing with stunnel, the result is really poor. I am still using apache benchmark 2 as the test tool. #ab2 -c 50 -n 100 https://192.168.10.5/test_1k.html (a html file whose size is 1Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_4k.html (a html file whose size is 4Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_50k.html (a html file whose size is 50Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_100k.html (a html file whose size is 100Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_200k.html (a html file whose size is 200Kbytes) Here is the result: Algorithm engine 1K 4K 50K 100K 200K AES-256-CBC+SHA1 no 14.12 13.21 7.92 4.48 2.17 (Requests per second) AES-256-CBC+SHA1 yes 51.10 23.34 7.30 3.12 1.91 (Requests per second) the data says everything. while using engine with stunnel, we got some performance increasement for processing small files, but processing bigger files is even slower than software implementation (it's quite strange, because proccessing large data blocks with hardware engine is assumed to be much faster than proccessing small data blocks). I did the same test for several times, but the result is the same. something I can be sure: 1) while doing stunnel engine test, all of the algorithms are processed by the engine. I can see it by debugging information printed on console screen. 2) the client running ab2 is a AMD64 with 1G RAM, and the web server (apache) used in the test above is an XEON with 2G RAM. so the bottleneck should be neither ab2 nor apache. So here are my questions: Has anyone tried stunnel with a hardware acceleartor? How about the performance? BTW, attached to this mail is a little patch for stunnel-4.14 which allows the engine directive in stunnel.conf to be set to either a engine id or a shared object path refer to the engine (ie. engine = /root/libcavium.so) Best regards, Zhuang Yuyao --- stunnel-4.14/src/ssl.c Thu Oct 27 09:42:54 2005 UTC +++ stunnel/src/ssl.c Tue Mar 28 08:48:03 2006 UTC @@ -122,6 +143,21 @@ } #if (SSLEAY_VERSION_NUMBER >= 0x00907000L) && defined(HAVE_OSSL_ENGINE_H) +static ENGINE *load_dynamic_engine(const char *engine) +{ + ENGINE *e = ENGINE_by_id("dynamic"); + if (e) + { + if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0) + || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) + { + ENGINE_free(e); + e = NULL; + } + } + return e; +} + static void init_engine(void) { ENGINE *e; @@ -133,9 +169,12 @@ } e=ENGINE_by_id(options.engine); if(!e) { + e = load_dynamic_engine(options.engine); + if (!e) { s_log(LOG_ERR, "Engine not found"); exit(1); } + } if(!ENGINE_init(e)) { s_log(LOG_ERR, "Engine can't be initialized"); ENGINE_free(e);

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users