- stunnel-users - stunnel.org

Still having issues compiling Stunnel on aix 5.3. SOL_TCP not defined? Please help
by Geoff 02 Dec '09

02 Dec '09

I installed gcc and the latest version of openssl on my aix 5.3 server. I did the ./configure and all went well. When I did the make I recieved the following error. if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.28\" -DPACKAGE_STRING=\"stunnel\ 4.28\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.28\" -DHOST=\"powerpc-ibm-aix5.3.0.0\" -DCPU_POWERPC=1 -DVENDOR_IBM=1 -DOS_AIX5_3_0_0=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTS_AND_PTC=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/include -MT options.o -MD -MP -MF ".deps/options. Tpo" -c -o options.o options.c; then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c:1773: error: 'SOL_TCP' undeclared here (not in a function) make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. The SOL_TCP option is not defined on AIX. I am hoping this can be applied to SOL_SOCKET which is defined. So... I changed the following lines in the options.c program #ifdef TCP_KEEPCNT /* {"TCP_KEEPCNT", SOL_TCP, TCP_KEEPCNT, TYPE_INT, DEF_VALS}, */ {"TCP_KEEPCNT", SOL_SOCKET, TCP_KEEPCNT, TYPE_INT, DEF_VALS}, #endif #ifdef TCP_KEEPIDLE /* {"TCP_KEEPIDLE", SOL_TCP, TCP_KEEPIDLE, TYPE_INT, DEF_VALS}, */ {"TCP_KEEPIDLE", SOL_SOCKET, TCP_KEEPIDLE, TYPE_INT, DEF_VALS}, #endif #ifdef TCP_KEEPINTVL /* {"TCP_KEEPINTVL", SOL_TCP, TCP_KEEPINTVL, TYPE_INT, DEF_VALS},*/ {"TCP_KEEPINTVL", SOL_SOCKET, TCP_KEEPINTVL, TYPE_INT, DEF_VALS}, I can compile the code without error at this point. So... my question is has anyone else made a similar change to get the code to compile on AIX 5.3? If not, can you please tell me what configuration options you used to make stunnel work. Thanks for any help you can provide. I am at my wits end here and pretty much my capability in compiling code. Thanks in advance, Geoff

1 0

Upgrade From 4.27 to 4.28? Or Wait for Next Version?
by Jeff Salisbury 01 Dec '09

01 Dec '09

Greetings, I've noticed some problems with v4.28 (posted in this group). Is there any compelling reason to upgrade from 4.27 to 4.28? Or, should we wait for the problems in 4.28 to be fixed in a new version and then upgrade? Regards, Jeff

1 0

build problem with 4.28 on SLES9 (SSL again)
by Andreas Vetter 27 Nov '09

27 Nov '09

Hi, there is a build problem with 4.28 on a SLES 9. May be similar to the no_ticket problem. Here is the interesting part of build log: options.c: In function `parse_ssl_option': options.c:1714: error: `SSL_OP_NO_QUERY_MTU' undeclared (first use in this function) options.c:1714: error: (Each undeclared identifier is reported only once options.c:1714: error: for each function it appears in.) options.c:1715: error: `SSL_OP_COOKIE_EXCHANGE' undeclared (first use in this function) options.c:1724: error: `SSL_OP_SINGLE_ECDH_USE' undeclared (first use in this function) make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/usr/src/packages/BUILD/stunnel-4.28/src' any hints? -- Mit freundlichen Gruessen, Andreas Vetter Informations- und Kommunikationstechnik Fakultaet fuer Physik und Astronomie Universitaet Wuerzburg

2 2

Help in making stunnel please.
by Geoff 26 Nov '09

26 Nov '09

Compiling on aix 5.3 ./configure runs fine when I run make I get this error... I am using the latest version of ssl. # make Making all in src source='env.c' object='env.lo' libtool=yes DEPDIR=.deps depmode=aix /bin/sh ../auto/depcomp /bin/sh ../libtool --tag=CC --mode=compile cc -qlanglvl=ansi -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.28\" -DPACKAGE_STRING=\"stunnel\ 4.28\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.28\" -DHOST=\"powerpc-ibm-aix5.3.0.0\" -DCPU_POWERPC=1 -DVENDOR_IBM=1 -DOS_AIX5_3_0_0=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTS_AND_PTC=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -I/usr/include -c -o env.lo env.c cc -qlanglvl=ansi -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.28\" "-DPACKAGE_STRING=\"stunnel 4.28\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.28\" -DHOST=\"powerpc-ibm-aix5.3.0.0\" -DCPU_POWERPC=1 -DVENDOR_IBM=1 -DOS_AIX5_3_0_0=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTS_AND_PTC=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR=\"/usr/local/lib/stunnel\" -DCONFDIR=\"/usr/local/etc/stunnel\" -DPIDFILE=\"/usr/local/var/run/stunnel/stunnel.pid\" -g -I/usr/include -c -M env.c -DPIC -o .libs/env.o "/usr/include/sys/socket.h", line 141.9: 1506-213 (S) Macro name getpeername cannot be redefined. "/usr/include/sys/socket.h", line 141.9: 1506-358 (I) "getpeername" is defined on line 39 of env.c. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Here is the configure # ./configure configure: **************************************** initialization checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking build system type... powerpc-ibm-aix5.3.0.0 checking host system type... powerpc-ibm-aix5.3.0.0 checking for gcc... no checking for cc... cc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether cc accepts -g... yes checking for cc option to accept ISO C89... -qlanglvl=ansi checking for style of include used by make... GNU checking dependency style of cc -qlanglvl=ansi... aix checking for a BSD-compatible install... auto/install-sh -c checking whether make sets $(MAKE)... (cached) yes configure: **************************************** libtool checking for a sed that does not truncate output... /usr/bin/sed checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for non-GNU ld... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... no checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognize dependent libraries... pass_all checking how to run the C preprocessor... cc -qlanglvl=ansi -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for g++... no checking for c++... no checking for gpp... no checking for aCC... no checking for CC... no checking for cxx... no checking for cc++... no checking for cl.exe... no checking for FCC... no checking for KCC... no checking for RCC... no checking for xlC_r... no checking for xlC... no checking whether we are using the GNU C++ compiler... no checking whether g++ accepts -g... no checking dependency style of g++... none checking for g77... no checking for xlf... no checking for f77... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for xlf90... no checking for f90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for xlf95... no checking for f95... no checking for fort... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 18432 checking command to parse /usr/bin/nm -B output from cc -qlanglvl=ansi object... ok checking for objdir... .libs checking for ar... ar checking for ranlib... ranlib checking for strip... strip checking for cc -qlanglvl=ansi option to produce PIC... checking if cc -qlanglvl=ansi static flag -bnso -bI:/lib/syscalls.exp works... no checking if cc -qlanglvl=ansi supports -c -o file.o... yes checking whether the cc -qlanglvl=ansi linker (/usr/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... aix5.3.0.0 ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... no checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no configure: creating libtool appending configuration tag "CXX" to libtool appending configuration tag "F77" to libtool configure: **************************************** types checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 checking for socklen_t... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... no checking for "/dev/ptc"... yes configure: **************************************** entropy checking for "/dev/urandom"... yes configure: **************************************** default group checking for default group... nobody configure: **************************************** header files checking ucontext.h usability... yes checking ucontext.h presence... yes checking for ucontext.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking for struct msghdr.msg_control... yes configure: **************************************** libraries checking for library containing gethostbyname... none required checking for library containing yp_get_default_domain... none required checking for socket in -lsocket... no checking for openpty in -lutil... no checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for inflateEnd in -lz... yes configure: **************************************** thread model checking for pthread_create in -lc_r... no checking for pthread_create in -lpthread... yes configure: PTHREAD thread model detected configure: **************************************** library functions checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for setsid... yes checking for setgroups... yes checking for chroot... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for localtime_r... yes checking for getcontext... yes checking for __makecontext_v2... no checking for poll... yes checking for endhostent... yes checking for getnameinfo... yes checking for getaddrinfo... yes checking for broken poll() implementation... no configure: **************************************** SSL checking for SSL directory... /usr checking for obsolete RSAref library... no checking /usr/include/openssl/engine.h usability... yes checking /usr/include/openssl/engine.h presence... yes checking for /usr/include/openssl/engine.h... yes configure: **************************************** optional features checking whether to disable RSA support... no checking whether to enable DH support... no checking whether to enable IPv6 support... yes checking whether to disable TCP wrappers library support... autodetecting checking for hosts_access in -lwrap... no checking whether to enable FIPS mode support... autodetecting checking for FIPS_mode_set... no configure: **************************************** write the results configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/stunnel3 config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init config.status: executing depfiles commands configure: **************************************** success

2 1

problem with -fd option on Linux
by Sorkin, David 21 Nov '09

21 Nov '09

I'd like to report an interesting problem I found that occurs on Linux but not Solaris when using the -fd 0 option to read the stunnel configuration in from stdin. I am using stunnel to establish client tunnels on the fly for one time use by programs such as rsync. The client config file is generated automatically with some dynamic parameters. After the client tunnel is established a client program connects to the specified port on localhost. This works fine on Solaris but on Linux I found that the client program has to be invoked *twice* before it works. My work around is to write the config to a temp file and starting stunnel with the location of the file as its argument instead of writing to its standard input. I am using tcp wrappers to protect the stunnel servers and to limit the connects to the client to localhost. This isn't an issue for me anymore but it took a bit of troubleshooting to figure out. On Solaris I am running the same version of stunnel, openssl, etc... all compiled very similarly. One difference could be iconv but I don't know enough about it to say. Regards, David Sorkin Debug log from the first client invocation: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Nov 10 15:37:02 test03 stunnel: LOG5[32303:182894071744]: stunnel 4.27 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 Nov 10 15:37:02 test03 stunnel: LOG5[32303:182894071744]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Nov 10 15:37:02 test03 stunnel: LOG6[32303:182894071744]: file ulimit = 1024 (can be changed with 'ulimit -n') Nov 10 15:37:02 test03 stunnel: LOG6[32303:182894071744]: poll() used - no FD_SETSIZE limit for file descriptors Nov 10 15:37:02 test03 stunnel: LOG5[32303:182894071744]: 500 clients allowed Nov 10 15:37:03 test03 stunnel: LOG3[32309:1073809760]: Unexpected socket close (read_blocking) Nov 10 15:37:03 test03 stunnel: LOG5[32309:1073809760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Nov 10 15:37:03 test03 stunnel: LOG5[32309:182894071744]: Received signal 15; terminating My client config is similar to the following: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ debug = local4.info foreground = no sslVersion = TLSv1 RNDfile = /dev/random RNDoverwrite = no pid = %s [stunnel] client = yes key = /path/to/private_key.pem cert = /path/to/public_key_cert.pem verify = 0 accept = 127.0.0.1:12345 # ephemeral port connect = remote_host:123 # well known port ciphers = AES256-SHA Server Config: ^^^^^^^^^^^^^^ debug = local4.info foreground = no pid = /var/run/stunnel.pid sslVersion = TLSv1 RNDfile = /dev/random RNDoverwrite = no [rsync] client = no key = /path/to/private_key.pem cert = /path/to/public_key_cert.pem CAfile = /path/to/authority_certs.pem verify = 3 accept = 123 exec = /usr/bin/rsync execargs = rsync --daemon --no-detach ciphers = AES256-SHA hosts.allow ^^^^^^^^^^^^ stunnel: 127.0.0.1 rsync: <ip of authorized server> > /usr/local/bin/stunnel -version stunnel 4.27 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none > /usr/local/bin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 > uname -a Linux test1 2.6.9-89.0.11.ELsmp #1 SMP Mon Aug 31 11:00:34 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux -- David Sorkin <david.sorkin(a)citi.com> CATE - Network Engineering (908) 563-0017

2 1

Examples are for V3?
by James Bowery 18 Nov '09

18 Nov '09

The examples at: http://www.stunnel.org/examples/ appear to be for version 3. This wasted a lot of my time.

2 1

Stunnel with a enterprise proxy server
by Vandooren, Pascal 16 Nov '09

16 Nov '09

Hello, I have a problem ... on my network i have more than one proxy server, and y use Stunnel for a remote RDP. if my computer is directly connected to internet there is no problem. If i connect my computer on my domain with my proxies servers i'm not able to connect me on RDP to my remote RDP server. Is it possible to indicate my proxy server to user ? Kind regards PascalV --------------------------------------------------------------------------- This e-mail is confidential. If you are not the addressee or an authorized recipient of this message, any distribution, copying, publication or use of this information for any purpose is prohibited. Please notify the sender immediately by e-mail and then delete this message. Ce message est confidentiel. Si vous n'etes pas le destinataire designe de ce message ou une personne autorisee a l'utiliser, toute distribution, copie, publication ou usage a quelques fins que ce soit des informations contenues dans ce message sont interdits. Merci d'informer immediatement l'expediteur par messagerie electronique et d'ensuite detruire ce message. ---------------------------------------------------------------------------

1 0

Error installing Stunnel-4.28
by th＠ftlabs.com 13 Nov '09

13 Nov '09

I could not get Stunnel-4.27 to work as described in a previous post on Mon Nov 9 17:12:38 CET 2009 to which nobody responded. So I tried installing the latest version, Stunnel-4.28, and received the following error when running the 'make' command... options.c: In function ‘service_options’: options.c:1139: error: ‘SSL_OP_NO_TICKET’ undeclared (first use in this function) options.c:1139: error: (Each undeclared identifier is reported only once options.c:1139: error: for each function it appears in.) options.c: In function ‘parse_ssl_option’: options.c:1709: error: ‘SSL_OP_NO_TICKET’ undeclared (first use in this function) make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.28/src' make: *** [all-recursive] Error 1 The output for 'openssl version' is: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Can anyone help me with either problems please?

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 64, Issue 8
by Michael Wilson 12 Nov '09

12 Nov '09

Thanks Ludholf, Re Q2 - Solved. Re Q1 - Thanks, but I should have been clearer, I wanted an automated solution. My nightly Blat e-mails come from a command line .cmd file. I have recently added a javascript to check if stunnel is active and, if not, start it before my e-mails. Now I would like to create a similar script that, if stunnel is running, stops it after my e-mail. I may just have to use Windows Script Host's Terminate. Mike On Thu, Nov 12, 2009 at 6:00 AM, <stunnel-users-request(a)mirt.net> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Vista questions (Michael Wilson) > 2. Re: Vista questions (Ludolf Holzheid) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 11 Nov 2009 13:22:53 -0500 > From: Michael Wilson <michael.r.wilson(a)gmail.com> > Subject: [stunnel-users] Vista questions > To: stunnel-users(a)mirt.net > Message-ID: > <6d39888c0911111022r39c898c5je24d6808075bc0ba(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > I am running 4.27 on Vista and can successfully start it and use Blat > to e-mail via my gmail account using stunnel. > > However, I have two questions: > > Q1: I would like to close down stunnel after sending my e-mails. How > can I do that on Vista? > > Q2: Why do I get the following when I enter "stunnel -help" at the command line > > A window with the heading "Stunnel 4.27 on Win32 (not configured)" that says: > Stunnel server is down due to an error. > You will need to exit and correct the problem > Click OK to see the error log window > > The error log is: > > Global options > compression = zlib|rle compression type > debug = [facility].level (e.g. daemon.info) > EGD = path to Entropy Gathering Daemon socket > engine = auto|engine_id > engineCtrl = cmd[:arg] > output = file to append log messages > RNDbytes = bytes to read from random seed files > RNDfile = path to file with random seed data > RNDoverwrite = yes|no overwrite seed datafiles with new random data > service = service name > socket = a|l|r:option=value[:value] > set an option on accept/local/remote socket > taskbar = yes|no enable the taskbar icon > > Service-level options > accept = [host:]port accept connections on specified host:port > CApath = CA certificate directory for 'verify' option > CAfile = CA certificate file for 'verify' option > cert = certificate chain > ciphers = list of permitted SSL ciphers > client = yes|no client mode (remote service uses SSL) > connect = [host:]port connect remote host:port > CRLpath = CRL directory > CRLfile = CRL file > delay = yes|no delay DNS lookup for 'connect' option > engineNum = number of engine to read the key from > failover = rr|prio chose failover strategy > ident = username for IDENT (RFC 1413) checking > key = certificate private key > local = IP address to be used as source for remote connections > ocsp = OCSP server URL > OCSPflag = OCSP server flags > options = SSL option > set an SSL option > protocol = protocol to negotiate before SSL initialization > currently supported: cifs, connect, nntp, pop3, smtp > protocolAuthentication = authentication type for protocol negotiations > protocolHost = host:port for protocol negotiations > protocolPassword = password for protocol negotiations > protocolUsername = username for protocol negotiations > session = session cache timeout (in seconds) > stack = thread stack size (in bytes) > sslVersion = all|SSLv2|SSLv3|TLSv1 SSL method > TIMEOUTbusy = seconds to wait for expected data > TIMEOUTclose = seconds to wait for close_notify (set to 0 for buggy MSIE) > TIMEOUTconnect = seconds to connect remote host > TIMEOUTidle = seconds to keep an idle connection > verify = level of peer certificate verification > level 1 - verify peer certificate if present > level 2 - require valid peer certificate always > level 3 - verify peer with locally installed certificate > > 2009.11.11 13:03:36 LOG3[5440:5128]: Server is down > > > ------------------------------ > > Message: 2 > Date: Wed, 11 Nov 2009 20:06:20 +0100 > From: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> > Subject: Re: [stunnel-users] Vista questions > To: stunnel-users(a)mirt.net > Message-ID: <20091111190620.GD29581(a)svr5.bihl-wiedemann.de> > Content-Type: text/plain; charset=iso-8859-1 > > On Wed, 2009-11-11 13:22:53 -0500, Michael Wilson wrote: >> I am running 4.27 on Vista and can successfully start it and use Blat >> to e-mail via my gmail account using stunnel. >> >> However, I have two questions: >> >> Q1: I would like to close down stunnel after sending my e-mails. How >> can I do that on Vista? > > Michael, > > did you try to right-click on the stunnel icon in the systray and select "Exit"? > >> Q2: Why do I get the following when I enter "stunnel -help" at the command line > > This is stunnel's way to output the help message (or other messages) > on windows. > > If stunnel used stdio for messages, you would have seen the help > message in the command prompt window you entered "stunnel -help" > in. However, there isn't necessarily a command prompt window stunnel > is attached to. Imagine to invoke "stunnel -help" via [start]->[run]. > > Ludolf > > -- > > --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 > Bihl+Wiedemann GmbH Fax: +49 621 3392239 > Flo?w?rthstra?e 41 e-mail: lholzheid(a)bihl-wiedemann.de > D-68199 Mannheim, Germany > --------------------------------------------------------------- > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 64, Issue 8 > ******************************************** >

2 1

Vista questions
by Michael Wilson 11 Nov '09

11 Nov '09

I am running 4.27 on Vista and can successfully start it and use Blat to e-mail via my gmail account using stunnel. However, I have two questions: Q1: I would like to close down stunnel after sending my e-mails. How can I do that on Vista? Q2: Why do I get the following when I enter "stunnel -help" at the command line A window with the heading "Stunnel 4.27 on Win32 (not configured)" that says: Stunnel server is down due to an error. You will need to exit and correct the problem Click OK to see the error log window The error log is: Global options compression = zlib|rle compression type debug = [facility].level (e.g. daemon.info) EGD = path to Entropy Gathering Daemon socket engine = auto|engine_id engineCtrl = cmd[:arg] output = file to append log messages RNDbytes = bytes to read from random seed files RNDfile = path to file with random seed data RNDoverwrite = yes|no overwrite seed datafiles with new random data service = service name socket = a|l|r:option=value[:value] set an option on accept/local/remote socket taskbar = yes|no enable the taskbar icon Service-level options accept = [host:]port accept connections on specified host:port CApath = CA certificate directory for 'verify' option CAfile = CA certificate file for 'verify' option cert = certificate chain ciphers = list of permitted SSL ciphers client = yes|no client mode (remote service uses SSL) connect = [host:]port connect remote host:port CRLpath = CRL directory CRLfile = CRL file delay = yes|no delay DNS lookup for 'connect' option engineNum = number of engine to read the key from failover = rr|prio chose failover strategy ident = username for IDENT (RFC 1413) checking key = certificate private key local = IP address to be used as source for remote connections ocsp = OCSP server URL OCSPflag = OCSP server flags options = SSL option set an SSL option protocol = protocol to negotiate before SSL initialization currently supported: cifs, connect, nntp, pop3, smtp protocolAuthentication = authentication type for protocol negotiations protocolHost = host:port for protocol negotiations protocolPassword = password for protocol negotiations protocolUsername = username for protocol negotiations session = session cache timeout (in seconds) stack = thread stack size (in bytes) sslVersion = all|SSLv2|SSLv3|TLSv1 SSL method TIMEOUTbusy = seconds to wait for expected data TIMEOUTclose = seconds to wait for close_notify (set to 0 for buggy MSIE) TIMEOUTconnect = seconds to connect remote host TIMEOUTidle = seconds to keep an idle connection verify = level of peer certificate verification level 1 - verify peer certificate if present level 2 - require valid peer certificate always level 3 - verify peer with locally installed certificate 2009.11.11 13:03:36 LOG3[5440:5128]: Server is down

2 1

FIPS_mode_set error
by th＠ftlabs.com 09 Nov '09

09 Nov '09

I just installed Stunnel-4.27 on a Linux box and cannot get it to start with a test config that works on another box running same version of Stunnel. I get the following output... [root@dvl stunnel]# stunnel stunnel.conf-test 2009.11.07 11:07:43 LOG7[31671:46968864029472]: Snagged 64 random bytes from stunnel-test.rnd 2009.11.07 11:07:43 LOG7[31671:46968864029472]: Wrote 1024 new random bytes to stunnel-test.rnd 2009.11.07 11:07:43 LOG7[31671:46968864029472]: RAND_status claims sufficient entropy for the PRNG 2009.11.07 11:07:43 LOG7[31671:46968864029472]: PRNG seeded successfully 2009.11.07 11:07:43 LOG7[31671:46968864029472]: SSL context initialized for service Test 2009.11.07 11:07:43 LOG3[31671:46968864029472]: FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match Does anybody have a clue what may be causing this and how to fix it? Please pardon my ignorance regarding OpenSSL.

1 0

Stunnel 4.28 released
by Michal Trojnara 08 Nov '09

08 Nov '09

The ChangeLog entry: Version 4.28, 2009.11.08, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8l. - Transparent proxy support on Linux kernels >=2.6.28. See the manual for details. - New socket options to control TCP keepalive on Linux: TCP_KEEPCNT, TCP_KEEPIDLE, TCP_KEEPINTVL. - SSL options updated for the recent version of OpenSSL library. * Bugfixes - A serious bug in asynchronous shutdown code fixed. - Data alignment updated in libwrap.c. - Polish manual encoding fixed. - Notes on compression implementation in OpenSSL added to the manual. SHA-1 value for stunnel-4.28.tar.gz: 868cba9ec56ed6a02c8ecfa2a87614b4d433611b Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

Update docs to remove RLE as compression choice
by Joe Kemp 06 Nov '09

06 Nov '09

I just confirmed that RLE compression is not truly implemented in OpenSSL. It would be helpful to remove it from the stunnel docs so people don't think it's an option to compress data. ZLIB is it. And yes I spent a good bit of time last year with Wireshark to determine RLE vs ZLIB compression ratios in stunnel. Shockingly ZLIB was always better... One other note that may be important for some people is that 0.9.7 openssl is not compatible with 0.9.8 with respect to zlib compression. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. _________________________________________________________________ Windows Live: Gör det enklare för dina vänner att se vad du håller på med på Facebook. http://www.microsoft.com/sverige/windows/windowslive/see-it-in-action/socia…

1 0

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. Another question is that if there is no support for PSK, how much work is it to download the source and add support for it given that I know C++/C. _________________________________________________________________ Hitta hetaste singlarna på MSN Dejting! http://dejting.se.msn.com/channel/index.aspx?trackingid=1002952

1 0

Tunneling udp over stunnel
by D-503 03 Nov '09

03 Nov '09

Hi, I'm trying to setup some kind of DNS-encryption with the usage of stunnel: https://www.privacyfoundation.de/wiki/HTTPS-DNS/TLS-DNS . This setup is working but pretty pretty slow. One DNS-request takes really long, about 5-6 seconds! I'm wondering why this happens. On the server is running stunnel 4.22 and on the client stunnel 4.25. The config is as described in the link above. What happens in the logs when I do one dns-request, you can see in the attachments of this mail. Something interesting is, if I do a: dig @localhost google.com it takes 5-6 seconds to finish. But if I execute it, abort it directly and execute it again, I get immediatly an answer! This works reproducably. Have you any idea? Could the error be with open/closed connections or some timeouts in stunnel? greetings D-503

1 0

Help with basic stunnel configuration
by Craig Watkinson 30 Oct '09

30 Oct '09

Hello, I have been trying to enable stunnel on a HPUX server, and whilst I thought it was going to be simple, I have not been able to make it work so far. We have a webserver and due to some pages being hardcoded to port 8080 it can't support SSL without a lot of code changes. As a short term workaround I am trying to use stunnel in server mode to provide a HTTPS interface. I expected this to be a very simple matter of accepting connections on port 443 and connecting to port 8080, but it's not working. We're using an old version of stunnel (4.04) however this is the version bundled with the HPUX OS we have. When stunnel is started there are no errors (log file output below) and netstat shows that a process is listening on port 443, however a browser (tried IE6 and Firefox) doesn't display anything. Connecting to port 8080 shows the application as expected. I have run a wireshark trace at the client end, and it seems that the stunnel server is not responding to the initial "Client Hello" message. Only 3 packets are seen: C->S SYN S->C SYN,ACK C->S SSL Client Hello My guess is that the ssl server is not starting up correctly, however everything looks ok in the logfile, although it might not be completing. Nothing is displayed in the log when I try to connect to port 443. Any help would be much appreciated as I am stuck! Thanks Craig Server eSM_CoE# uname -a HP-UX eSM_CoE B.11.23 U ia64 1107767544 unlimited-user license Stunnel Version eSM_CoE# ./sbin/stunnel -version stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006 Global options cert = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem pid = /opt/hpws/apache32/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Conf file eSM_CoE# cat stunnel.conf # Sample stunnel configuration file RNDfile=/opt/hpws/apache32/stunnel/.stunnel.rnd # Chroot #chroot = /var/chroot/stunnel/ # PID is created inside chroot jail pid = /opt/hpws/apache32/logs/stunnel.pid # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Client Authentication #verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /opt/hpws/apache32/conf/certs.pem # Some debugging stuff debug = 7 output = /opt/hpws/apache32/logs/stunnel.log # Use in client mode client = no # Run in the background foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 delay=yes # Service-level configuration [https] accept = 172.20.167.74:443 connect = localhost:8080 TIMEOUTclose = 10 Log file output 2009.10.30 14:32:41 LOG5[4172:1]: stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006 2009.10.30 14:32:41 LOG7[4172:1]: Snagged 64 random bytes from /opt/hpws/apache32/stunnel/.stunnel.rnd 2009.10.30 14:32:41 LOG7[4172:1]: Wrote 1024 new random bytes to /opt/hpws/apache32/stunnel/.stunnel.rnd 2009.10.30 14:32:41 LOG7[4172:1]: RAND_status claims sufficient entropy for the PRNG 2009.10.30 14:32:41 LOG6[4172:1]: PRNG seeded successfully 2009.10.30 14:32:41 LOG7[4172:1]: Certificate: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem 2009.10.30 14:32:41 LOG7[4172:1]: Key file: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem 2009.10.30 14:32:41 LOG5[4172:1]: FD_SETSIZE=60000, file ulimit=4096 -> 2000 clients allowed 2009.10.30 14:32:41 LOG7[4172:1]: FD 5 in non-blocking mode 2009.10.30 14:32:41 LOG7[4172:1]: SO_REUSEADDR option set on accept socket 2009.10.30 14:32:41 LOG7[4172:1]: https bound to 172.20.167.74:443 _________________________________________________________________ New Windows 7: Find the right PC for you. Learn more. http://www.microsoft.com/uk/windows/buy/

1 0

stunnel compatibility problems between Windows & Linux ?
by Ewald 30 Oct '09

30 Oct '09

I am running an stunnel in chroot setup on a Red Hat Enterprise Linux Server (v3) : stunnel 4.27 on x86_64-unknown-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 And i want to connect from a Windows 2003 system (als version 4.27) When i try to do a basic connect from the Windows stunnel to the Linux stunnel, the connection gets reset each time, ssldump shows: New TCP connection #1: hans13(1363) <-> nada(25000) 1 1 0.0000 (0.0000) C>S Handshake ClientHello Version 3.0 cipher suites Unknown value 0x39 Unknown value 0x38 Unknown value 0x35 SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA Unknown value 0x33 Unknown value 0x32 Unknown value 0x2f SSL_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 SSL_RSA_EXPORT_WITH_RC4_40_MD5 compression methods unknown value NULL 1 2 0.0000 (0.0000) S>C Alert level fatal value handshake_failure 1 0.0000 (0.0000) S>C TCP RST Stunnel logging shows: 2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx started 2009.10.26 10:37:25 LOG7[29959:1073879408]: FD 7 in non-blocking mode 2009.10.26 10:37:25 LOG5[29959:1073879408]: tfe accepted connection from 10.10.10.10:1250 2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL state (accept): before/accept initialization 2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL alert (write): fatal: handshake failure 2009.10.26 10:37:25 LOG3[29959:1073879408]: SSL_accept: 1408A09F: error:1408A09F:SSL routines:SSL3_GET_CLIENT_HELLO:length mismatch 2009.10.26 10:37:25 LOG5[29959:1073879408]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx finished (-1 left) When i explicitly configure the Windows stunnel to use: sslVersion = SSLv2 or sslVersion = TLSv1 (see ssldump logging below) everything works fine. Is this a known bug or an undocumented feature? Ewald... New TCP connection #3: hans13.amc.nl(1367) <-> nada.amc.nl(25000) 3 1 0.0000 (0.0000) C>S Handshake ClientHello Version 3.1 resume [32]= b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64 cipher suites Unknown value 0x39 Unknown value 0x38 Unknown value 0x35 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA Unknown value 0x33 Unknown value 0x32 Unknown value 0x2f TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_RC4_128_MD5 TLS_DHE_RSA_WITH_DES_CBC_SHA TLS_DHE_DSS_WITH_DES_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS_RSA_EXPORT_WITH_RC4_40_MD5 compression methods unknown value NULL 3 2 0.0000 (0.0000) S>C Handshake ServerHello Version 3.1 session_id[32]= b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64 cipherSuite Unknown value 0x35 compressionMethod NULL etc...

2 1

Connections begin resetted
by Roman Medina-Heigl Hernandez 26 Oct '09

26 Oct '09

Hello, Till some recent time, I was using "socat" (http://www.dest-unreach.org/socat/) to create a SSL-wrapper (in a way similar to what "stunnel" does). I was using: === socat -ly -d -d openssl-listen:443,bind=X.X.X.X,fork,reuseaddr,cipher=HIGH:3DES:MD5,cert=server-cert.pem,key=server-key.pem,verify=0 tcp4:Y.Y.Y.Y:P === It was working pretty well, without interruptions, although it got some estability problems when passing 1-2 months (server apparently get stuck). So I decided to give a try to "stunnel". I switched to "stunnel" and problems arise... I'm experimenting *very* frequent connection cuts. If I examine daemon.log (I'm using Debian 5), I have: Oct 20 12:06:36 hetzner stunnel: LOG3[3677:3083029392]: SSL_read: 140EC071: error:140EC071:SSL routines:SSL2_READ_INTERNAL:bad mac decode Oct 20 12:06:36 hetzner stunnel: LOG5[3677:3083029392]: Connection reset: 315484 bytes sent to SSL, 50471 bytes sent to socket So it seems stunnel is closing the connection due to a "bad mac decode" error. My environment (client and server) have not changed, I only switched "the transport" (socat -> stunnel). Any idea why is it failing now? Moreover, if I switch back to socat, cuts disappear. Is stunnel buggy? Am I missing some config/tunning at the SSL/socket level? My current config is: roman@hetzner:~$ stunnel4 -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 root@hetzner:~# stunnel4 -version stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none My stunnel.conf is very simple. Apart from cert setup, the tunnel is something like: === [tunelserv] accept = X.X.X:X:443 connect = X.X.X.X:P === Any idea? Thank you in advance. Cheers, -Roman

2 2

Re: [stunnel-users] multiple domain certificates
by Ludolf Holzheid 23 Oct '09

23 Oct '09

On Fri, 2009-10-23 15:04:14 -0400, Al Gonzalez wrote: > I apologize for a potentially silly question, but is there any way to > determine if my question made it to the user's group. I sent in a > question (I think last Friday), and other than a auto-reply to myself, I > don't know if anyone really received it. I'm in a bit of a pickle, and > could sure use some help. Thanks. If you are worried about your message may not make it to a mailing list, check the list archive at the URL given in the "List-Archive:" header included in the mails sent from the list server. In case of stunnel-users this is http://stunnel.mirt.net/pipermail/stunnel-users. And yes, your mail from October 20th can be found there. Regarding your problem, I'm afraid I can't help as I use stunnel for 'secure tunnels' only, i.e. I have stunnel on both ends of the connection and I don't have to care about the protocols tunneled through. Sorry, Ludolf. -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

multiple domain certificates
by Andrew Farmer 23 Oct '09

23 Oct '09

Does stunnel support multiple domain certificates? I am trying to get stunnel to work with multiple domains on a machine that can have only one IP address. (It is an amazon EC2 instance - they do not support multiple IPs per instance) It seems to me that the only way to get this to work is with a multiple domain certificate, which I believe is called a "Unified Communications Certificate". Does stunnel support these? Thank you so much, Andrew -- View this message in context: http://www.nabble.com/multiple-domain-certificates-tp25897355p25897355.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 2

https problems over TLSv1
by Al Gonzalez 20 Oct '09

20 Oct '09

Thank you in advance for any assistance you can provide... I am trying to talk to a UHF radio (from a PC) over a secure channel, but having some difficulties. Please let me provide just a little background so you know why I’m doing what I’m doing. In the existing system, Internet Explorer (IE) is the client that talks to this radio. When the radio boots up, it sends a webpage over Ethernet to IE and (after the user login), a secure link is established, and the radio can be controlled from IE – the various webpages change as the user maneuvers through the various dropdowns, etc. We’ve been asked to automate this interface now for a production environment. The client is going to be replaced with a PC connected to a great deal of test equipment, and the server will now send XML instead of html to the client. The client is being developed in LabVIEW (from National Instruments) – this has made this task even more challenging. As all of this secure stuff is new to me, I spent many hours just trying to understand the problem(s) and the lingo. As LabVIEW has some limitations in this area, I found that Stunnel was my best option. Using TCP/IP and sending http to the radio (shown below), I’ve been able (in a non-secure mode, without Stunnel) to communicate and get the opening screen (html) to be returned to me (the XML server output is currently being developed) and displayed in a LabVIEW window. GET / HTTP/1.1 Host: 10.4.32.1 Connection: Keep-Alive Authorization: Basic YWRtaW46UgEkJHdvtmQx Credentials: admin:Password I downloaded the binary version of Stunnel.exe (version 4.27 with OpenSSL 0.9.8k dated Mar 2009), then modified the LabVIEW code to call (using a command line approach) Stunnel. In this way, I can’t provide any (dash) options, so it’s completely dependent on the stunnel.conf file. After a number of attempts, I was able to get the client to bind to the server (I think), but I see nothing being returned to me (no html). I must use TLSv1, and ciphers = DES-CBC3-SHA. I’ve seen examples on stunnel.org that show a great deal more handshaking information than I’m seeing, so I’m wondering if I’m missing some detail in my conf file. For example, my log file ends like this 2009.10.16 13:18:49 LOG7[4812:4776]: FD 208 in non-blocking mode 2009.10.16 13:18:49 LOG7[4812:4776]: SO_REUSEADDR option set on accept socket 2009.10.16 13:18:49 LOG7[4812:4776]: https bound to 10.4.1.8:443 But the example I mentioned goes on after the “https bound” and adds things like … 2009.08.04 12:15:55 LOG7[16648:22996]: proxy accepted FD=320 from 127.0.0.1:48086 2009.08.04 12:15:55 LOG7[16648:22996]: Creating a new thread 2009.08.04 12:15:55 LOG7[16648:22996]: New thread created 2009.08.04 12:15:55 LOG7[16648:8540]: proxy started 2009.08.04 12:15:55 LOG7[16648:8540]: FD 320 in non-blocking mode 2009.08.04 12:15:55 LOG7[16648:8540]: TCP_NODELAY option set on local socket 2009.08.04 12:15:55 LOG5[16648:8540]: proxy accepted connection from 127.0.0.1:48086 2009.08.04 12:15:55 LOG7[16648:8540]: FD 340 in non-blocking mode 2009.08.04 12:15:55 LOG7[16648:8540]: proxy connecting 89.149.253.125:8080 2009.08.04 12:15:55 LOG7[16648:8540]: connect_wait: waiting 10 seconds 2009.08.04 12:15:56 LOG7[16648:8540]: connect_wait: connected 2009.08.04 12:15:56 LOG5[16648:8540]: proxy connected remote server from 192.168.2.3:48088 2009.08.04 12:15:56 LOG7[16648:8540]: Remote FD=340 initialized 2009.08.04 12:15:56 LOG7[16648:8540]: TCP_NODELAY option set on remote socket 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): before/connect initialization 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 write client hello A 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 read server hello A . . . 2009.08.04 12:15:57 LOG6[16648:8540]: SSL connected: new session negotiated 2009.08.04 12:15:57 LOG6[16648:8540]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 That make’s me think that I’m not quite there yet. I’ve attached my stunnel.conf, my log file, and the http request I’m making (above). I’m hoping you can find some flaws in my conf file that will get me closer. Other than receiving html, I’m not sure how to know that I truly have a secure connection. I’m thinking I should see a little more in my log file, but I’m not sure. The other thing I’m not sure about (as I’ve heard differing thoughts) is whether I have to Encrypt my http commands, or does stunnel take care of that somehow? If I have to encypt, how would I go about doing this? Also, (and I’m getting ahead of myself) do I have to open and close a session every time I want to talk, or do I somehow leave the channel open? I’ve read about Session Resumption, but I’m not sure if that is something I need to setup in the conf file, or if that can even be controlled by Stunnel. Al Gonzalez Principal Software Engineer Compass Call Programs Offensive Information Warfare Raytheon Company 260.429.4354 260.429.5829 fax Al_Gonzalez(a)raytheon.com

1 0

MySQL replication with stunnel, connection closed after some time
by Marcel Kirsch 16 Oct '09

16 Oct '09

Hello, I have a problem regarding stunnel and MySQL replication. I use replication to keep our database synchronous with a second database, which stands in our building. The secure connection via stunnel works and "SHOW SLAVE STATUS;" shows, that the replication is working. Because the master database is rarely used at the moment, sometimes there are no changes (insert, update or delete) made for an hour. Unfortunately it seems that stunnel disconnects the connection between the databases after some time. The client database still thinks that it is connected to the master server, because it still is connected to port 3307 (which is stunnel of course). So now the changes made in the master database are no longer replicated. Is there any way to configure stunnel to keep the connection between the to servers alive even after an hour of zero traffic? I thought that TIMEOUTidle would be the answer to my problem, but it had no effect. I really hope you can help me and thanks for your suggestions in advance. Greetings, Marcel Kirsch This is my current configuration: Client: ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle retry = yes TIMEOUTidle = 86400 ; Some debugging stuff useful for troubleshooting debug = 3 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes [mysqls] accept = 3307 connect = 78.46.106.68:3307 Server: client = no pid = /var/run/stunnel.pid # # debugging # debug = 7 output = /etc/stunnel/stunnel.log # # Some performance tunings # # disable Nagle algorithm (a.k.a. tinygram prevention, see man 7 tcp) socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem retry = yes TIMEOUTidle = 86400 [mysqls] accept = 3307 connect = 127.0.0.1:mysql Log of client while connecting: 2009.10.09 09:28:58 LOG7[3729:3082963856]: connect_wait: connected 2009.10.09 09:28:58 LOG5[3729:3082963856]: mysqls connected remote server from 192.168.1.87:33206 2009.10.09 09:28:58 LOG7[3729:3082963856]: Remote FD=17 initialized 2009.10.09 09:28:58 LOG7[3729:3082963856]: TCP_NODELAY option set on remote socket 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): before/connect initialization 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write client hello A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read server hello A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read server certificate A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read server done A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write client key exchange A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write change cipher spec A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write finished A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 flush data 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read finished A 2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 items in the session cache 2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 client connects (SSL_connect()) 2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 client connects that finished 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 client renegotiations requested 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server connects (SSL_accept()) 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server connects that finished 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server renegotiations requested 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache hits 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache misses 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache timeouts 2009.10.09 09:28:58 LOG6[3729:3082963856]: SSL connected: new session negotiated 2009.10.09 09:28:58 LOG6[3729:3082963856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 Log of server while connecting: 2009.10.09 09:28:52 LOG7[31073:139652979042032]: mysqls accepted FD=14 from 212.95.118.250:60651 2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls started 2009.10.09 09:28:52 LOG7[31073:1091389776]: FD 14 in non-blocking mode 2009.10.09 09:28:52 LOG7[31073:1091389776]: TCP_NODELAY option set on local socket 2009.10.09 09:28:52 LOG7[31073:1091389776]: Waiting for a libwrap process 2009.10.09 09:28:52 LOG7[31073:1091389776]: Acquired libwrap process #0 2009.10.09 09:28:52 LOG7[31073:1091389776]: Releasing libwrap process #0 2009.10.09 09:28:52 LOG7[31073:1091389776]: Released libwrap process #0 2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls permitted by libwrap from 212.95.118.250:60651 2009.10.09 09:28:52 LOG5[31073:1091389776]: mysqls accepted connection from 212.95.118.250:60651 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): before/accept initialization 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 read client hello A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write server hello A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write certificate A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write server done A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 flush data 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 read client key exchange A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 read finished A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write change cipher spec A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write finished A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 flush data 2009.10.09 09:28:52 LOG7[31073:1091389776]: 3 items in the session cache 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client connects (SSL_connect()) 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client connects that finished 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client renegotiations requested 2009.10.09 09:28:52 LOG7[31073:1091389776]: 17 server connects (SSL_accept()) 2009.10.09 09:28:52 LOG7[31073:1091389776]: 17 server connects that finished 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 server renegotiations requested 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 session cache hits 2009.10.09 09:28:52 LOG7[31073:1091389776]: 1 session cache misses 2009.10.09 09:28:52 LOG7[31073:1091389776]: 14 session cache timeouts 2009.10.09 09:28:52 LOG6[31073:1091389776]: SSL accepted: new session negotiated 2009.10.09 09:28:52 LOG6[31073:1091389776]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.10.09 09:28:52 LOG7[31073:1091389776]: FD 15 in non-blocking mode 2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls connecting 127.0.0.1:3306 2009.10.09 09:28:52 LOG7[31073:1091389776]: connect_wait: waiting 10 seconds 2009.10.09 09:28:52 LOG7[31073:1091389776]: connect_wait: connected 2009.10.09 09:28:52 LOG5[31073:1091389776]: mysqls connected remote server from 127.0.0.1:59705 2009.10.09 09:28:52 LOG7[31073:1091389776]: Remote FD=15 initialized 2009.10.09 09:28:52 LOG7[31073:1091389776]: TCP_NODELAY option set on remote socket 2009.10.09 09:28:52 LOG7[31073:1098307920]: Socket closed on read 2009.10.09 09:28:52 LOG7[31073:1098307920]: SSL write shutdown 2009.10.09 09:28:52 LOG7[31073:1098307920]: SSL alert (write): warning: close notify 2009.10.09 09:28:52 LOG6[31073:1098307920]: SSL socket closed on SSL_shutdown 2009.10.09 09:28:52 LOG7[31073:1098307920]: Socket write shutdown 2009.10.09 09:28:52 LOG5[31073:1098307920]: Connection closed: 9600 bytes sent to SSL, 185 bytes sent to socket 2009.10.09 09:28:52 LOG7[31073:1098307920]: mysqls finished (1 left) Log of server while disconnecting: 2009.10.09 09:53:48 LOG3[31073:1091389776]: SSL_read: Connection reset by peer (104) 2009.10.09 09:53:48 LOG5[31073:1091389776]: Connection reset: 1047 bytes sent to SSL, 185 bytes sent to socket 2009.10.09 09:53:48 LOG7[31073:1091389776]: mysqls finished (0 left) (There is no log of client while disconnecting)

3 3

Re: [stunnel-users] MySQL replication with stunnel, connection closed after some time
by Michal Trojnara 16 Oct '09

16 Oct '09

Marcel Kirsch wrote: > it is correct that there is a router (with NAT) between the slave server > and the internet. I tried the solution of Mike (socket = > l:SO_KEEPALIVE=1...), but it didn't work. > I googled SO_KEEPALIVE and discovered that it only sends a keep alive > packet every 2 hours by default. Unfortunately the connection is closed > after a shorter time (about 30 minutes). Do you know how it is possible > to set the keep alive time to a shorter value? On Linux you can use: echo 300 > /proc/sys/net/ipv4/tcp_keepalive_time Best regards, Mike

1 0

Re: [stunnel-users] MySQL replication with stunnel, connection closed after some time
by Michal Trojnara 15 Oct '09

15 Oct '09

Marcel Kirsch wrote: > Is there any way to > configure stunnel to keep the connection between the to servers alive > even after an hour of zero traffic? I thought that TIMEOUTidle would be > the answer to my problem, but it had no effect. [cut] > 2009.10.09 09:53:48 LOG3[31073:1091389776]: SSL_read: Connection reset > by peer (104) I'm pretty sure there is a network device (some kind of statefull firewall or NAT) between these machines. I think the timeout is caused by the TCP state expired rater than by stunnel. I think enabling TCP keepalives could be an effective workaround: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 The trick is to generate some traffic on an idle connection to convince the network device that this TCP connection is not dead. An alternative solution would be to increase the TCP state timeout on the network device. Best regards, Mike

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users