- stunnel-users - stunnel.org

Stunnel and DistCache Patch
by Kling, Kent M. 10 Jan '05

10 Jan '05

we have a RedHat 7.2 system and we are trying to apply the distcache_geoff.patch to enable distcache 1.4.5 with stunnel-4.04. We have run into a snag after the configure script is run and we attempt the "make", it complains that configure.in is missing. In step 2 is our "configure" line wrong? # make output: cd . && aclocal cd . && automake --gnu --include-deps Makefile cd . \ && CONFIG_FILES=Makefile CONFIG_HEADERS= /bin/sh ./config.status config.status: creating Makefile cd . && autoconf autoconf: configure.in: No such file or directory make: *** [configure] Error 1 Our work around is to change directory into the /usr/src/stunnel-4.04/src and run "make" from that directory to create our stunnel binary. Any idea why it won't work from the top directory. our stunnel source resides in /usr/src/stunnel-4.04, distcache_geoff.patch is in /usr/src and distcache-1.4.5 is in /usr/local/distcache-1.4.5. Our installation steps are below: step 1. # patch -p0 < distcache_geoff.patch output: patching file stunnel-4.04/configure.ac patching file stunnel-4.04/src/common.h patching file stunnel-4.04/src/options.c patching file stunnel-4.04/src/prototypes.h patching file stunnel-4.04/src/ssl.c step 2. # cd stunnel-4.04 # export CFLAGS="-DHAVE_DISTCACHE_DC_CLIENT_H -I/usr/local/distcache-1.4.5/include"; export LDFLAGS="-L/usr/local/distcache-1.4.5/lib -ldistcache -lnal"; ./configure --prefix=/usr/local/stunnel-4.04 --with-ssl=/usr/local/openssl-0.9.7e --with-tcp-wrappers --disable-shared output: checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking build system type... i686-pc-linux-gnu checking host system type... i686-pc-linux-gnu checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether make sets ${MAKE}... (cached) yes checking for ld used by GCC... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognise dependant libraries... pass_all checking command to parse /usr/bin/nm -B output... ok checking how to run the C preprocessor... gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... GNU/Linux ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... no checking whether to build static libraries... yes creating libtool checking for SSL directory... /usr/local/openssl-0.9.7e checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... no checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... yes checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... yes checking pty.h presence... yes checking for pty.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... yes checking for _getpty... no checking for daemon... yes checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init Thanks, Kent Kling This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services.Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

3 2

Error:1408F10B, Wrong Version Number
by Emily Mattes 09 Jan '05

09 Jan '05

I'm trying to set up STunnel 4.07 client-side for Qm (http://pyric.org/qm/) on Windows XP Pro, but when I try to send a message Qm times out and I get this error in the STunnel log: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Here's my config file: client = yes delay = yes [pop3] accept = 110 connect = pop.gmail.com:995 [smtp] accept = 25 connect = smtp.gmail.com:587 This is my first time trying to configure SSL for anything, so I really don't know what's going wrong. Any help would be greatly appreciated. Thank you very much! -- Emily -- schroedinger(a)gmail.com

1 0

Newbie trying to connect over a Microsoft Proxy
by Michael Blake 05 Jan '05

05 Jan '05

Hi All I'm a relative newbie to Stunnel, and am trying to set up a tunnel so I can Remote Desktop from work to my PC/server at home. I'm using versions 4.05 & 4.06 of the Windows binaries. A Microsoft Proxy Server v2.0 is used at work, and it proxies HTTP, Secure (is that SSL/port 443??), FTP and Gopher over port 800. I'm not sure if it proxies Socks, as there's no entry for it in Internet Explorer. I've tested the configuration and it works on my LAN, and it works from home when I enter my domain home (so my firewall is set up correctly). My config is as follows: #Client CAfile = stunnel.pem cert = stunnel.pem client = yes verify = 3 [rdp-80] accept = localhost:3390 connect = xxx.xxx.xxx.xxx:80 #Server CAfile = stunnel.pem cert = stunnel.pem client = yes verify = 3 [rdp-80] accept = 192.168.10.221:80 connect = 127.0.0.1:3389 Is there something I need to do to traverse this proxy? Any help would be greatly appreciated! Tks, Michael Blake IT Consultant | Headbyte Limited Tel: + 44 7909 844273 http://www.headbyte.co.uk

2 2

stunnel-4.07 on non-IPv6 systems
by Hans Werner Strube 04 Jan '05

04 Jan '05

On systems which do not yet support IPv6 and do not have getnameinfo (for instance, Solaris 7), also NI_NUMERICHOST and NI_NUMERICSERV are usually undefined. In stunnel-4.07, this causes compilation of src/network.c to fail. Patch: *** src/network.c.ORI Mon Jan 3 00:20:27 2005 --- src/network.c Tue Jan 4 14:46:10 2005 *************** *** 73,78 **** --- 73,84 ---- static const char *s_gai_strerror(int); #ifndef HAVE_GETNAMEINFO + #ifndef NI_NUMERICHOST + #define NI_NUMERICHOST 2 + #endif + #ifndef NI_NUMERICSERV + #define NI_NUMERICSERV 8 + #endif static int getnameinfo(const struct sockaddr *, socklen_t, char *, int , char *, int , int ); #endif

1 0

bugfix for the makefile of stunnel 4.07
by deepstar＠ulyssis.org 04 Jan '05

04 Jan '05

Hi, there appears to be a bug in the makefile (tools/Makefile) that installed files/directories in the wrong place when installing to another root directory (DESTDIR env var) The attached patch should fix it. greets, -- Steven Van Acker

1 0

Port forwarding based on application type
by Konda Ankireddyapalli 03 Jan '05

03 Jan '05

Hello all, Can stunnel forward the traffic to different ports based on an application type as opposed to by port? If yes, how can it be configured? My need is that on the client side we have many applications that share a single outgoing port. On the server side I want to demultiplex the stunnel traffic coming in on a single port to multiple applications after decryption. Thanks in advance, Konda

1 0

Stunnel 4.07 released
by Michal Trojnara 02 Jan '05

02 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 New release fixes several bugs introduced in version 4.06. ChangeLog entry: Version 4.07, 2005.01.03, urgency: MEDIUM: * Bugfixes - Problem with infinite poll() timeout negative, but not equal to -1 fixed. - Problem with a file descriptor ready to be read just after a non-blocking connect call fixed. - Compile error with EAI_NODATA not defined or equal to EAI_NONAME fixed. - IP address and TCP port textual representation length (IPLEN) increased to 128 bytes. - OpenSSL engine support is only used if engine.h header file exists. - Broken NT Service mode on WIN32 platform fixed. - Support for IPv4-only WIN32 machines restored. Homepage: http://stunnel.mirt.net/ Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFB2IcR/NU+nXTHMtERAn/hAJ42XjEtUrkyixamOeMV0rRGCvqwDACg21LB sYFF8L4teETWdrkLjfkdX2E= =qOfD -----END PGP SIGNATURE-----

1 0

A couple of patches against 4.06
by Peter Pentchev 31 Dec '04

31 Dec '04

Hi, First of all, thanks for writing and maintaining this great piece of software :) When I ported 4.06 to FreeBSD on Monday, there were three changes that needed to be made. One is the passing of -1, not -1000, to poll(2), which has already been discussed on this list (and which, by the way, is mandated by POSIX and the Single Unix Specification, as you can see at http://www.opengroup.org/onlinepubs/007908799/xsh/poll.html ) The other two can be seen in the patch below. The first one is related to the fact that EAI_NODATA is not present on all systems - it was actually obsoleted by the KAME implementation of IPv6 about an year ago. On some systems it is defined and has its own value - then stunnel builds just fine. On other systems it is not defined at all, while on yet other systems it is aliased to EAI_NONAME, so 'case EAI_NONAME' and 'case EAI_NODATA' would produce an error message from the compiler. Thus, the #ifdef and #if in the first chunk of the patch. This could not be done portably with a single statement, something like '#if defined(EAI_NODATA) && EAI_NODATA != EAI_NONAME', since there are some compilers that would barf on the second part if EAI_NODATA was not actually defined. The second chunk of the patch fixes getnameinfo() error reporting - just like with getaddrinfo(), getnameinfo() errors should be displayed using s_gai_strerror() instead of sockerror(). Keep up the good work! G'luck, Peter --- src/network.c.orig Thu Oct 14 18:03:49 2004 +++ src/network.c Wed Dec 29 14:16:06 2004 @@ -416,8 +416,12 @@ return "Temporary failure in name resolution (EAI_AGAIN)"; case EAI_FAIL: return "Non-recoverable failure in name resolution (EAI_FAIL)"; +#ifdef EAI_NODATA +#if EAI_NODATA != EAI_NONAME case EAI_NODATA: return "No address associated with nodename (EAI_NODATA)"; +#endif +#endif case EAI_FAMILY: return "ai_family not supported (EAI_FAMILY)"; case EAI_SOCKTYPE: @@ -562,10 +566,13 @@ /* getnameinfo() version */ char *s_ntop(char *text, SOCKADDR_UNION *addr) { char host[20], port[6]; + int err; - if(getnameinfo(&addr->sa, addr_len(*addr), - host, 20, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { - sockerror("getnameinfo"); + err = getnameinfo(&addr->sa, addr_len(*addr), + host, 20, port, 6, NI_NUMERICHOST|NI_NUMERICSERV); + if (err) { + s_log(LOG_ERR, "Error resolving the specified address: %s", + s_gai_strerror(err)); strcpy(text, "unresolvable IP"); return text; } -- Peter Pentchev roam(a)ringlet.net roam(a)cnsys.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 .siht ekil ti gnidaer eb d'uoy ,werbeH ni erew ecnetnes siht fI

2 5

xforwardfor-patch
by Alexander Lazic 30 Dec '04

30 Dec '04

Hi, i have attached my xforwardfor-patch for stunnel-4.06 ;-) al ;-)

2 2

stunnel 4.0.6 stunnel uid/gid removal
by Noah 30 Dec '04

30 Dec '04

stunnel-4.0.6 FreeBSD-4.9 I just installed stunnel 4.0.6 and noticed during the portinstall that the defualt behavior was to remove the stunnel uid and gid. can somebody clue me in as to why this was the Process? I cant find any relevant information on the web. cheers, Noah

2 1

engine-patch
by Alexander Lazic 29 Dec '04

29 Dec '04

Hi, we have a the following openssl: --- OpenSSL 0.9.7d 17 Mar 2004 built on: Wed Nov 3 13:28:35 CET 2004 platform: solaris-sparcv9-gcc options: bn(64,32) md2(int) rc4(ptr,char) des(idx,cisc,16,long) idea(int) blowfish(ptr) compiler: gcc -DOPENSSL_SYSNAME_ULTRASPARC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_KRB5 -DOPENSSL_NO_ENGINE -m32 -mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DMD5_ASM --- We don't have the engine enabled therefore the current stunnel don't compile :-( I have attached the patch for the current (4.06) stunnel version. BTW: I need the 'X-Forwarded-For' header, in where is the right position to add it in the 4.06 version. I think in 'src/client.c => transfer()' but i'am not sure, where there ;-) Thanx for help ;-) al ;-)

2 2

enforcing minimum cipher set available
by auto403973＠hushmail.com 29 Dec '04

29 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 is there a way (perhaps using extended 'options' section?), to enforce a minimum cipher strength / type for the connecting client? a solution would be to use apache 2's sslproxy to stunnel (yikes), but stunnel rocks :) apache / mod_ssl - from httpd.conf # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:- SSLv2:+EXP:+eNULL -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkHSUs4ACgkQdgNHoxEs/oi+2ACfYPDjijulcO0luIPfV2oYZ4aLWdAA niumLVXQRaEEK12TO5EF12e9ay/b =aNe8 -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get secure FREE email: http://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger http://www.hushmail.com/services-messenger?l=434 Promote security and make money with the Hushmail Affiliate Program: http://www.hushmail.com/about-affiliate?l=427

2 1

using stunnel for smb networking
by David Bear 28 Dec '04

28 Dec '04

out of curiousity, has anyone been able to use stunnel as a cheap vpn for smb/cifs windows networks? We have a stupid firewall policy that blocks ALL port 139 traffic. Yes, thats good most of the time since microsoft rpc's are notoriously insecure. It does cause a problem when we have other units at other universities with different firewall policies however, so I was hoping to go around the different bureacracies and tunnel it myself. just curious. -- David Bear phone: 480-965-8257 fax: 480-965-9189 College of Public Programs/ASU Wilson Hall 232 Tempe, AZ 85287-0803 "Beware the IP portfolio, everyone will be suspect of trespassing"

1 0

Re: [stunnel-announce] Problem with stunnel 4.06 on FreeBSD andpossibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Jay W. Reffner wrote: > Could you explain the problem on FreeBSD? > Do you think the problems exists in OpenBSD as well? poll() call uses a negative parameter value to indicate an infinite timeout. On some systems (like Linux) any negative value is accepted, while some other systems (like FreeBSD or HP-UX) require -1 here. On affected systems stunnel starts an infinite loop and does not accept any connections. I'm not sure if OpenBSD is affected. Best regards, Mike

1 0

Re: [stunnel-announce] Problem with stunnel 4.06 on FreeBSD andpossibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Jay W. Reffner wrote: > Could you explain the problem on FreeBSD? > Do you think the problems exists in OpenBSD as well? poll() call uses a negative parameter value to indicate an infinite timeout. On some systems (like Linux) any negative value is accepted, while some other systems (like FreeBSD or HP-UX) require -1 here. On affected systems stunnel starts an infinite loop and does not accept any connections. I'm not sure if OpenBSD is affected. Best regards, Mike

1 0

Re: Gmail / Eudora / SpamPal and Stunnel
by Sebastien WILLEMIJNS 28 Dec '04

28 Dec '04

(i copy message i have send via google groups) > I am running Eudora 6.2.0.14, Stunnel-4.04, SpamPal 1,583 maybe try latest build ? > Gmail REQUIRES SSL > A connection to my university email will not SEND over IMAP as you, i cannot send to gmail servers he stops now at (i have used "protocol = smtp" in options) 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:05 LOG7[16629555:16525099]: <- 220 2.0.0 Ready to start TLS. 2004.12.23 23:24:05 LOG5[16629555:16525099]: Protocol negotiation succeded 2004.12.23 23:24:05 LOG7[16629555:16525099]: SSL state (connect): before/connect initialization 2004.12.23 23:24:05 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write client hello A 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server hello A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server certificate A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server done A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write client key exchange A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write change cipher spec A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write finished A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 flush data 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read finished A 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 items in the session cache 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 client connects (SSL_connect()) 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 client connects that finished 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 client renegotiatations requested 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server connects (SSL_accept()) 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server connects that finished 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server renegotiatiations requested 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache hits 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache misses 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache timeouts 2004.12.23 23:24:06 LOG6[16629555:16525099]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 else for mail.vfemail.net:465 /mail.gmx.net:465 without "protocol = smtp" it works well... > Yes I know Spampal and Gmail is "belt and braces" but I have a challenge > here!!!! > Justified "give up you can't" would be equally appreciated so i do... only for gmail...

1 0

ERROR: stunnel-4.06.exe file is linked to missing export ...
by Sebastien WILLEMIJNS 28 Dec '04

28 Dec '04

> When I try to start and test stunnel-4.06 on Windows ME, I get the > following error message: > The STUNNEL-4.06.EXE file is linked to missing export > WS2_32.DLL:freeaddinfo Same thing on Win98SE :X

1 0

stunnel 4.06 problems with service on XP
by Mat Leinmueller 28 Dec '04

28 Dec '04

Hi, I tried to upgrade an existing 4.04 stunnel service to 4.06 (uninstalled service, reinstalled with new version). The service gets registered correctly, when I try to start it, however, it seems not to find the stunnel.conf file. After downgrading to 4.04 everything works again. Any suggestions? Mat

2 1

Error when executing stunnel 4.06 Windows binaries as service
by Liron Newman 28 Dec '04

28 Dec '04

Hello, I'm trying to run the offical stunnel 4.06 Win32 binaries from stunnel.org as a service, but I get the following error: "The procedure entry point freeaddrinfo could not be located in the dynamic link library WS2_32.DLL" I looked it up a bit and it seems to have something to do with IPv6, but I don't use it.. stunnel 4.05 works fine as a service, and worked without a problem for months now. I'm using Win2k SP4 fully patched. Help? :)

2 1

Problem with stunnel 4.06 on FreeBSD and possibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Dear Users, Frank de Bot has found a bug in stunnel 4.06. I've attached the patch stunnel needs to work on FreeBSD (and possibly other) systems. It's not needed on Linux and WIN32 platforms. Best regards, Mike

2 1

ERROR: stunnel-4.06.exe file is linked to missing export ...
by Mike_Stunnel 26 Dec '04

26 Dec '04

When I try to start and test stunnel-4.06 on Windows ME, I get the following error message: The STUNNEL-4.06.EXE file is linked to missing export WS2_32.DLL:freeaddinfo Stunnel-4.05 runs fine and I have OpenSSL 0.9.7e How do I resolve this? Thanks, mz

1 0

Stunnel 4.06 released
by Michal Trojnara 25 Dec '04

25 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Here is the ChangeLog entry: Version 4.06, 2004.12.26, urgency: LOW: * New feature sponsored by SURFnet http://www.surfnet.nl/ - IPv6 support (to be enabled with ./configure --enable-ipv6). * New features - poll() support - no more FD_SETSIZE limit! - Multiple connect=host:port options are allowed in a single service section. Remote hosts are connected using round-robin algorithm. This feature is not compatible with delayed resolver. - New 'compression' option to enable compression. To use zlib algorithm you have to enable it when building OpenSSL library. - New 'engine' option to select a hardware engine. - New 'TIMEOUTconnect' option with 10 seconds default added. - stunnel3 perl script to emulate version 3.x command line options. - French manual updated by Bernard Choppy <choppy AT free POINT fr>. - A watchdog to detect transfer() infinite loops added. - Configuration file comment character changed from '#' to ';'. '#' will still be recognized to keep compatibility. - MT-safe getaddrinfo() and getnameinfo() are used where available to get better performance on resolver calls. - Automake upgraded from 1.4-p4 to 1.7.9. * Bugfixes - log() changed to s_log() to avoid conflicts on some systems. - Common CRIT_INET critical section introduced instead of separate CRIT_NTOA and CRIT_RESOLVER to avoid potential problems with libwrap (TCP Wrappers) library. - CreateThread() finally replaced with _beginthread() on Win32. - make install creates $(localstatedir)/stunnel. $(localstatedir)/stunnel/dev/zero is also created on Solaris. - Race condition with client session cache fixed. - Other minor bugfixes. * Release notes - Win32 port requires Winsock2 to work. Some Win95 systems may need a free update from Microsoft. http://www.microsoft.com/windows95/downloads/ - Default is *not* to use IPv6 '::' for accept and '::1' for connect. For example to accept pop3s on IPv6 you could use: 'accept = :::995'. I hope the new syntax is clear enough. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBzf1b/NU+nXTHMtERAtUVAKD+41kLTFS/qrOleskfH1MZEkYr2ACfcJPZ 4QQk085XimnyplqENZaT7nk= =zIM2 -----END PGP SIGNATURE-----

1 0

Faulting application stunnel-4.05.exe
by Paulo Cesar Soares da Silva 25 Dec '04

25 Dec '04

stunnel-4.05.exe executed as a service presents the following problems: Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8. Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libeay32.dll, version 0.0.0.0, fault address 0x000564ec. The application, C:\Program Files\Crivo\tn3270\stunnel-4.05.exe, generated an application error The error occurred on 11/10/2004 @ 15:37:13.875 The exception generated was c0000005 at address 6B086CD8 (libssl32!SSL_set_session) Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x000086f7. Environment: Hardware IBM 86496BX Dual processor 3 GHz Software OS Name Microsoft(R) Windows(R) Server 2003, Standard Edition , Version 5.2.3790 Build 3790 The following files are in same folder (..\Program Files\Teste\Stunnel) stunnel-4.05.exe, 4.05 libeay32.dll, openssl-0.9.7d-zlib libssl32.dll, openssl-0.9.7d-zlib Comntents of stunnel.conf: client = yes verify = 0 service = stunnel 4.05 options = DONT_INSERT_EMPTY_FRAGMENTS [data] accept = localhost:3500 connect = www.teste.com.br:443 delay = yes I would appreciate if anyone can help me on this? many thanks in advance! Paulo Cesar Soares da Silva (11) 3231-5396 pcesar(a)crivo.com.br --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.794 / Virus Database: 538 - Release Date: 10/11/2004 --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.794 / Virus Database: 538 - Release Date: 10/11/2004 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.799 / Virus Database: 543 - Release Date: 19/11/2004

2 1

Gmail / Eudora / SpamPal and Stunnel
by John Bullas 22 Dec '04

22 Dec '04

Good Morning I hope there is someone on this group who can assist? I am running Eudora 6.2.0.14, Stunnel-4.04, SpamPal 1,583 win 2k on D drive / Stunnel on e (partitions not physical) startup line E:\stunnel\stunnel-4.04.exe Stunnel log after running it (systray icon appears to suggest it is started and Services app allowed me to start it) 2004.12.22 08:15:32 LOG5[3216:208]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7c 30 Sep 2003 2004.12.22 08:15:32 LOG7[3216:1504]: Snagged 64 random bytes from C:/.rnd 2004.12.22 08:15:32 LOG7[3216:1504]: Wrote 1024 new random bytes to C:/.rnd 2004.12.22 08:15:32 LOG7[3216:1504]: RAND_status claims sufficient entropy for the PRNG 2004.12.22 08:15:32 LOG6[3216:1504]: PRNG seeded successfully 2004.12.22 08:15:32 LOG5[3216:1504]: WIN32 platform: 30000 clients allowed 2004.12.22 08:15:32 LOG7[3216:1504]: FD 324 in non-blocking mode 2004.12.22 08:15:32 LOG7[3216:1504]: SO_REUSEADDR option set on accept socket 2004.12.22 08:15:32 LOG7[3216:1504]: pop bound to 127.0.0.1:1109 2004.12.22 08:15:32 LOG7[3216:1504]: FD 332 in non-blocking mode 2004.12.22 08:15:32 LOG7[3216:1504]: SO_REUSEADDR option set on accept socket 2004.12.22 08:15:32 LOG7[3216:1504]: imap bound to 127.0.0.1:1439 2004.12.22 08:15:32 LOG7[3216:1504]: FD 340 in non-blocking mode 2004.12.22 08:15:32 LOG7[3216:1504]: SO_REUSEADDR option set on accept socket 2004.12.22 08:15:32 LOG7[3216:1504]: smtp bound to 127.0.0.1:259 Eudora settings: username: myloginname@gmail.com@127.0.0.1:1109 smtp server:127.0.0.1 incoming server as POP and local ohst or 127.0.0.1 see below I can RECEIVE Gmail ok but SENDING prompts a "Could not connect to "127.0.0.1" Cause: connection refused (10061) ditto if "localhost" is used as the pop server in steadof 127.0.0.1 I have Hotmail Popper on 127.0.0.2 for hotmail and Spampal/Eudora is fine with that Hotmail Popper? A method to send/receive Hotmail via POP http://www.boolean.ca/hotpop/ Spampal? http://www.spampal.org a free spam tagging proxy(?) I am now in the realms of "playing about" to try and fix this outgoing mail issue HOWEVER I am sure someone in this forum has Gmail happily sending and receiving!!!! Gmail REQUIRES SSL A connection to my university email will not SEND over IMAP and needs to go out via SMTP as it requires a verified internal IP address to work (relay denied) I am uncertain of how the SSL settings in Eudora need to be set to allow Gmail to both send/receive using Required Alternate Post as given in the online help for Gmail via spampal and Stunnel http://gmail.google.com/support/bin/answer.py?answer=13279&query=eudora&top… ( aka: http://tinyurl.com/5vp6u ) Your learned wisdom would be welcome!!!! Regards John "Fatbloke" Bullas Southampton UK Yes I know Spampal and Gmail is "belt and braces" but I have a challenge here!!!! Justified "give up you can't" would be equally appreciated ** Eudora Mail 6.2 / McAfee Virus Scan 4.5.1 / Sp*mPal **

1 0

Fwd: [stunnel-users] stunnel 'options' section of config file
by Justin Miller 21 Dec '04

21 Dec '04

I understand the security concerns... I was just trying different protocols because I was receiving weird error messages with some https proxies (using the mathias wald patch) about wrong version numbers, etc. Googling it seemed to indicate that enabling/disabling ssl2/ssl3/tls1 could do the trick. However, I can't even get 'openssl s_client...' to yield a successful connection with some of these proxies. Can stunnel handle incoming http or socks proxy requests/connections? If not, will you ever support that? For instance I want stunnel listening on a local port 8080 and connect to a remote https proxy, and I set the HTTP proxy server in gaim to localhost:8080. -Justin On Tue, 21 Dec 2004 15:20:19 +0100, Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote: > Justin Miller wrote: > > So all looks well ang good... But then when it sends the client hello > > message, one would expect an ssl2 message, but we get the following > > Stunnel is not supposed to act as SSLv2 client. It uses > SSLv3_client_method() in src/ssl.c file. If you really need SSLv2 - change > it to SSLv2_client_method() and recompile stunnel. It's not recommended for > security, anyway. > > See SSL_CTX_new(3) manual for details. > > Best regards, > Mike > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users