- stunnel-users - stunnel.org

Trouble with smtp client connection and TLS in Windows
by David Schomaker 13 Sep '12

13 Sep '12

I need to configure stunnel to connect to smtp via TLS and am not able to get it to work either running 4.53 or 4.54beta. Perhaps I have the conf file created incorrectly. The stunnel.conf is as follows: +++++++++++++++++++++++++++++++++++++++ ; Debugging stuff (may useful for troubleshooting) debug = 7 output = c:\temp\stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMARSH-pop3] client = yes accept = 127.0.0.1:110 connect = pop.smarshmail.com:995 [SMARSH-smtp] client = yes SSLversion=TLSv1 accept = 127.0.0.1:25 connect = smtp.smarshmail.com:587 +++++++++++++++++++++++++ Pop works great. The log on an smtp session is as follows: +++++++++++++++++++++++++ 2012.09.10 12:48:31 LOG7[1984:300]: Service [SMARSH-smtp] accepted (FD=508) from 127.0.0.1:49517 2012.09.10 12:48:31 LOG7[1984:300]: Creating a new thread 2012.09.10 12:48:31 LOG7[1984:300]: New thread created 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] started 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] accepted connection from 127.0.0.1:49517 2012.09.10 12:48:31 LOG6[1984:2796]: connect_blocking: connecting 199.47.168.58:587 2012.09.10 12:48:31 LOG7[1984:2796]: connect_blocking: s_poll_wait 199.47.168.58:587: waiting 10 seconds 2012.09.10 12:48:31 LOG5[1984:2796]: connect_blocking: connected 199.47.168.58:587 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] connected remote server from 192.168.108.158:49518 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) initialized 2012.09.10 12:48:31 LOG7[1984:2796]: SNI: host name: smtp.smarshmail.com 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): before/connect initialization 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): SSLv3 write client hello A 2012.09.10 12:48:31 LOG7[1984:2796]: SSL alert (write): fatal: protocol version 2012.09.10 12:48:31 LOG3[1984:2796]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.09.10 12:48:31 LOG5[1984:2796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Local socket (FD=508) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] finished (0 left) 2012.09.10 12:48:40 LOG7[1984:300]: Dispatching signals from the signal pipe 2012.09.10 12:48:43 LOG7[1984:300]: Processing SIGNAL_TERMINATE 2012.09.10 12:48:43 LOG5[1984:300]: Terminated ++++++++++++++++++++++++++ Is sTunnel using SSLv3 rather than TLSv1? If so how do I force TLS? Thanks...

2 1

Stunnel message
by Philip Wong 13 Sep '12

13 Sep '12

Hi all, I'm still learning stunnel for my company support. l feel difficult to understand what's the meaning of some stunnel log message. Is there any doc listed the log messages with some explanation? Thanks, Philip

1 0

stunnel conf alternatives
by John A. Wallace 11 Sep '12

11 Sep '12

I have stunnel 4.53 on x86-pc-mingw32-gnu platform on Win7 OS. I use it minimally at this point but I would like to see whether I can expand my use of it if possible. When I installed it, I simply saved all the program's files into one folder without actually using the Windows installer program, and then I made some entries in the "stunnel.conf" to make it serve my purpose. Right now to start the program I can go to a Windows command prompt in the stunnel folder and type "stunnel stunnel.conf". Then a little icon appears in the notification area of Windows Taskbar. What would happen, I mean how would it differ, if I just typed "stunnel" instead of having to specify the "stunnel.conf" file too? And how would I be able to make use of it in that case? Thanks.

2 1

Binding to non-local sockets
by Janusz Dziemidowicz 09 Sep '12

09 Sep '12

Hi, attached is very simple patch that allows to set IP_FREEBIND under Linux (IP_BINDANY/IPV6_BINDANY under FreeBSD) on an accept socket. I've stumbled upon this need due to the following situation (which I believe might be quite common): - I've already had stunnel instance happily serving one website on port 443, single domain - a need occurred to set up another domain - SNI cannot be used, because Windows XP doesn't support it (and it is still a very large user base) - no problem, I thought, I have a few public IPs available, just set stunnel up on another IP - and here comes the problem, I have two frontend servers with VRRP configured to migrate public IP between them, only one server has the public IP at a time - under normal circumstances it is impossible to bind to an address that does not exist on the server (in case of one domain I've simply bound stunnel to 0.0.0.0) - starting stunnel manually when the address migrates is not an option (VRRP daemon probably can start it, but I was not happy with that solution, I want all services working constantly on both servers so there are no surprises in case of a failover) - setting IP_FREEBIND on accept socket solves the problem, stunnel is working on both machines and I can migrate the public IPs however I want As stunnel already exposes low level socket options, adding support for IP_FREEBIND is very simple. I've also added similar FreeBSD options (tested on FreeBSD 9.0). Oh, and the patch is public domain;) -- Janusz Dziemidowicz

1 0

SSL3_GET_RECORD:wrong version number
by Bob Tentinger 06 Sep '12

06 Sep '12

I have a POS application (SWIFTLINK) that uses Stunnel to send email on Windows XP. This is the error**************** SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number ***************** I have searched the Internet and none of the resolutions help.

2 1

Race condition in libwrap_auth can hang threads waiting on libwrap process
by Andrew Skalski 05 Sep '12

05 Sep '12

I ran into an issue with stunnel (verified with the latest version) where under certain conditions, client connections will hang in the "Waiting for a libwrap process" state. The problem is a race condition in src/libwrap.c: 170 --num_busy; /* the child process has been released */ 171 if(num_busy==num_processes-1) { /* need to wake up a thread */ 172 retval=pthread_cond_signal(&cond); /* signal waiting threads */ 173 if(retval) { 174 errno=retval; 175 ioerror("pthread_cond_signal"); 176 longjmp(c->err, 1); 177 } 178 } Removing the statement "if (num_busy==num_processes-1)" is one way to fix the problem. The conditions under which the race condition occur are: - All libwrap processes are busy, and multiple threads are waiting [num_busy == num_processes] - One thread releases its libwrap process (this signals one of the waiting threads) - Another thread releases its libwrap process before the signaled thread has a chance to acquire and increment num_busy. Once that happens, all queued threads are stuck waiting on the condition variable, until stunnel is hit with enough concurrent connections to max out num_busy again. (Depending on traffic patterns, this may not happen for a long time.) Andy Skalski

2 1

transpartent=destination setting fails with runtime error
by Stefan Lauterbach 03 Sep '12

03 Sep '12

*In the latest versions of stunnel including stunnel-4.54b8, activating the option for transparent destination with transparent=destination fails. The following error is found in the log with this configuration (tested on CentOS 6.2 and 6.3): INTERNAL ERROR: No target for remote socket This bug seems to be introduced with version 4.51 by rewriting the code and introducing additional sanity checks for the configuration. The following patch seems to resolve the problem: --- src/client.c.~1~ 2012-03-05 12:11:06.000000000 +0100 +++ src/client.c 2012-08-27 00:29:36.000000000 +0200 @@ -303,7 +303,7 @@ c->bind_addr=NULL; /* don't bind */ /* setup c->remote_fd, now */ - if(c->opt->option.remote) { /* try remote first for exec+connect targets */ + if(c->opt->option.remote || c->opt->option.transparent_dst) { /* try remote first for exec+connect targets */ c->remote_fd.fd=connect_remote(c); } else if(c->opt->option.program) { /* exec+connect uses local fd */ c->remote_fd.fd=connect_local(c); *

1 0

MySQL replication + SSL/stunnel
by Gareth Evans 27 Aug '12

27 Aug '12

Hello, I'm failing miserably to implement replication over any kind of SSL (that is, MySQL's native (alleged) SSL support) or stunnel. I'd be grateful for any tips or advice. I have tried using OpenSSL and MySQL in various flavours: CentOS 6.2, OpenSSL v1.0.0, MySQL v5.1.63 Ubuntu 12.04, OpenSSL v1.0.1, MySQL v 5.5.24 and stunnel4 on both - certs created with OpenSSL in each case. I get an eror 1045 access denied from the MySQL native SSL approach, and mysql -u ejbkslave -pejbkslavepw -h127.0.0.1 -P3307 ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 from stunnel (connecting two Ubuntu 12.04 VM's on my PC, with the latest updates) - if you know what causes this error and/or could point me towards some good documentation, I'd be grateful. I've copied and amended stunnel.conf-sample and just added debug and accept/connect info in each case. I've seen various reports around the web that OpenSSL+MySQL don't work together at the moment, but it seems some people can repicate the problem while others can't - I've tried the previous version of OpenSSL (1.0.0e on Ubuntu) still without success. Most frustrating!! Thanks Gareth

2 1

Stunnel performance about multiple session
by Yuqiong Sun 27 Aug '12

27 Aug '12

Hi, I am using stunnel as an encrypted channel between one server and multiple clients. Each client will transfer a very small piece of data every 20 seconds. Therefore I want to compare the tradeoff between maintaining multiple sessions with tearing down and re-establish connection every time. I read the performance table in stunnel doc and got a brief idea, but I hope to evaluate the performance for my specific hardware and software setup to make a better decision. I guess my question is how to measure the Max. concurrent sessions? Should I start multiple stunnel instances on client side? Also, how can I tear down a connection automatically after each time data transfer? Thanks Yuqiong

2 1

Behavior
by Javier 17 Aug '12

17 Aug '12

Hi, I want to report 2 different behaviors, one, related to logs and, the other, to close delay. - About the logs, there is a funny thing. If you reload stunnel.conf the log style and amount of information differs from the starting one. I'm under Windows 2000 and these are the general options in stunnel.conf: debug = debug delay = yes output = stunnel.log fips = no The differences can be seen in the attached text file. First part is how is being seen if you don't reload the conf file. The second, after you reload. I, by myself, prefer the second log style. - About the close delay, I don't know when it started to happen (maybe in the version you removed the multiple instance of stunnel or maybe later), but what happens is that stunnel delays about 1-2 seconds to close. It didn't happen before. It was immediately. And has nothing to do with how many services you have, it delays with one service or ten services or… whatever. My system specs, the same as above. But it happens in Windows XP as well, and with the latest 4.54 beta too (the one that has removed the annoying app error (thank you so much for this :-) )). Have a look to them ;-) and confirm if possible :-) Thanks.

1 0