- stunnel-users - stunnel.org

Pass IP Attn: Alexander Lazic
by tbrown2376＠adelphia.net 08 Apr '05

08 Apr '05

ATTN: Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-)

1 0

Compilation error on windows, cannot find "-lssl"
by Billinger Olle 07 Apr '05

07 Apr '05

Hi I'm trying to compile stunnel 4.08 on windows using mingw, with openssl-0.9.7f. I have edited the Makefile.w32 and it compiles ok until it cannot find the "-lssl". Any suggestions are welcome. //Olle ************************************** $ make -f Makefile.w32 stunnel.exe gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o stunnel.o stunnel.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o ssl.o ssl.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o client.o client.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o protocol.o protocol.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o sthreads.o sthreads.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o log.o log.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o options.o options.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o network.o network.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o resolver.o resolver.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o gui.o gui.c gcc -s -o stunnel.exe stunnel.o ssl.o client.o protocol.o sthreads.o log.o options.o network.o resolver.o gui.o resources.o -L/c/openssl/bin -lwsock32 -lgdi32 -lssl -mwindows c:\mingw\bin\..\lib\gcc-lib\mingw32\3.2.3\..\..\..\..\mingw32\bin\ld.exe: cannot find -lssl make: *** [stunnel.exe] Error 1 My Makefile.w32 ******************* SSLDIR=/c/openssl DEFINES=-DUSE_WIN32 -DHAVE_OPENSSL CFLAGS=-g -O2 -Wall $(DEFINES) -I$(SSLDIR)/include LDFLAGS=-s # LIBS=-L$(SSLDIR)/out -lssl -lcrypto -lwsock32 -lgdi32 LIBS=-L$(SSLDIR)/bin -lwsock32 -lgdi32 -lssl OBJS=stunnel.o ssl.o client.o protocol.o sthreads.o log.o options.o network.o resolver.o gui.o resources.o stunnel.exe: $(OBJS) $(CC) $(LDFLAGS) -o stunnel.exe $(OBJS) $(LIBS) -mwindows clean: rm *.o rm stunnel.exe #resources.o: resources.rc resources.h # windres resource.rc resources.o $(OBJS): *.h Makefile.w32 *********************

1 0

Stunnel.conf reload
by CIM Massy 05 Apr '05

05 Apr '05

Hi, is there a way, under win32, to have stunnel reload its .conf file and certificates without restarting the service ? (A kind of SIGHUP) Thanks, Phil

1 0

Stunnel and CRLs
by CIM Massy 05 Apr '05

05 Apr '05

Hi, is there a way to automagically mutually verify certificates (verify=3) and to check the certificates against a .crl file hosted on a web server ? I want my "VNC over Stunnel" host check if the incoming connexions are authorized or if the certificates have expired / been revoked. Thanks, Phil

1 0

stunnel 4.09 problem: Connection rejected: too many clients
by Steven Van Acker 04 Apr '05

04 Apr '05

Hi, after upgrading to stunnel 4.09, we are having 2 problems with it that did not exist in a previous version (our case: stunnel 4.05 without pthreads) ---[ My testsetup is as follows: * stunnel listening on port 4321, connects to localhost port 13 (daytime) * daytime is enabled in inetd * stunnel was compiled without pthreads * ulimit -u = 8192 ---[ problem 1 At first, it works fine. For every incoming connection, the process forks and data is transferred. However, when the connection is closed, the forked process remains hanging for a while (about 1 minute) and then exits. This in itself is not a real problem, except that it generates a lot of processes. (and maybe causes problem 2 ?) ---[ data and logs concerning problem 1 (process hangs for 1 minute): I run the following command: openssl s_client -connect 192.168.2.119:4321 the output follows immediately The logfile (debug = debug) looks like this: 2005.03.31 14:05:05 LOG7[4552:0]: daytime accepted FD=8 from 192.168.2.103:47200 2005.03.31 14:05:05 LOG7[4552:0]: FD 8 in non-blocking mode 2005.03.31 14:05:05 LOG7[4553:0]: daytime started 2005.03.31 14:05:05 LOG5[4553:0]: daytime connected from 192.168.2.103:47200 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): before/accept initialization 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read client hello A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write server hello A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write certificate A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write server done A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 flush data 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read client key exchange A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read finished A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write change cipher spec A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write finished A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 flush data 2005.03.31 14:05:05 LOG7[4553:0]: 1 items in the session cache 2005.03.31 14:05:05 LOG7[4553:0]: 0 client connects (SSL_connect()) 2005.03.31 14:05:05 LOG7[4553:0]: 0 client connects that finished 2005.03.31 14:05:05 LOG7[4553:0]: 0 client renegotiatations requested 2005.03.31 14:05:05 LOG7[4553:0]: 1 server connects (SSL_accept()) 2005.03.31 14:05:05 LOG7[4553:0]: 1 server connects that finished 2005.03.31 14:05:05 LOG7[4553:0]: 0 server renegotiatiations requested 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache hits 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache misses 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache timeouts 2005.03.31 14:05:05 LOG6[4553:0]: SSL accepted: new session negotiated 2005.03.31 14:05:05 LOG6[4553:0]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2005.03.31 14:05:05 LOG7[4553:0]: FD 7 in non-blocking mode 2005.03.31 14:05:05 LOG7[4553:0]: daytime connecting 127.0.0.1:13 2005.03.31 14:05:05 LOG7[4553:0]: connect_wait: waiting 10 seconds 2005.03.31 14:05:05 LOG7[4553:0]: connect_wait: connected 2005.03.31 14:05:05 LOG7[4553:0]: Remote FD=7 initialized 2005.03.31 14:05:05 LOG7[4553:0]: Socket closed on read 2005.03.31 14:05:05 LOG7[4553:0]: SSL write shutdown 2005.03.31 14:05:05 LOG7[4553:0]: SSL alert (write): warning: close notify 2005.03.31 14:05:05 LOG7[4553:0]: SSL_shutdown retrying 2005.03.31 14:05:06 LOG7[4553:0]: SSL alert (read): warning: close notify 2005.03.31 14:05:06 LOG7[4553:0]: SSL closed on SSL_read 2005.03.31 14:05:06 LOG7[4553:0]: Socket write shutdown When I check netstat, the connection from the client to stunnel is in the CLOSE_WAIT state and the connection from stunnel to the daytime server is in TIME_WAIT state then 1 minute later, this follows: 2005.03.31 14:06:06 LOG6[4553:0]: s_poll_wait timeout: connection close 2005.03.31 14:06:06 LOG5[4553:0]: Connection closed: 26 bytes sent to SSL, 0 bytes sent to socket 2005.03.31 14:06:06 LOG7[4553:0]: removing pid file /stunnel.pid 2005.03.31 14:06:06 LOG7[4552:0]: Steven: going into client_status with num_clients = 1 2005.03.31 14:06:06 LOG7[4552:0]: Process 4553 finished with code 0 (0 left) Now, netstat no longer shows the connections in any state. ---[ problem 2 Another problem that was found is that after bombarding stunnel with lots of connections, it stops accepting new connections. This would be normal if all connections remained open, but they are all closed. This is the error: Mar 31 13:53:40 hostname stunnel[13044]: Connection rejected: too many clients (>=4000) netstat only shows +- 500 connections, of which none are aimed at the stunnel process in question (port 4321 in my test setup) there is only 1 stunnel process active aswell. I dug into the problem a bit and it probably has to do with num_clients not being decreased after a process is closed (although I can not find any specifics :/) greets, -- Steven

3 4

Terminal services and stunnel 4.09
by Mattias Olsson 01 Apr '05

01 Apr '05

Hi! Im tying to access an internal Win2003 terminal server from my Linux box (internet). As i understand it stunnel should do the work. I have read some documents but im not sure... This is my setup. Linuxbox ----> Linuxbox ssh server | Firewall | Terminal server i wish to access. Can this be done or do i have to open a port in the fw to access the TS directly? Should stunnel.conf look like this on my linuxbox (client) cert = /usr/local/etc/stunnel/mail.pem client = yes On the TS? [TS] accept = 3000 connect = 3389 Should it have cert = ? Or could i on my linux ssh server have a config looking like this: [TS-remote] accept = 3000 connect = <internal-ip>:3389 Should it have cert = ? A novice man sends his best regards and thanks! /Kaz -- Mvh / Regards Mattias Olsson - aka - KaZaMaNIaC

1 0

Does stunnel work on Windows 2000 & SIMP(Secure Instant Messaging) ??
by DK 01 Apr '05

01 Apr '05

Hi Group, I have a windows 2000 box & want to communicate securely with someone else via SIMP(Secure Instant Messaging Protocol - http://www.winfosec.com/simp.php) I know that SIMP Instant Messaging is a "Direct Connection" & does NOT go through an intermediary server & that its encrypted, but being the security nut I am, I want to know if "stunnel" handles the SIMP protocols ? ... as I can't find anywhere what the SIMP protocols are ... because as I have read in the stunnel FAQ, stunnel does not handle UDP. Regards, David __________________________________ Do you Yahoo!? Yahoo! Personals - Better first dates. More second dates. http://personals.yahoo.com

1 0

Pass IP
by Tim Brown 31 Mar '05

31 Mar '05

I am running Stunnel version 4.07 on a Windows 2000 server. Is there any way to pass the originating IP through Stunnel to my server application? As it is now Stunnel is passing the server IP for all requests. Thanks. Confidentiality Notice: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately delete this message and attachments (including all copies) and notify the sender by return e-mail or by phone at 904.723.6300.

2 1

help
by Maddalena.Pulcini＠seleniacomms.com 31 Mar '05

31 Mar '05

Hi Mike, Thank you for your precious help. I am using stunnel as SSL client. The SSL server runs in a router. As you suggested me, I have done these changes: at first I have modified the stunnel.conf with options = SSL_OP_TLS_BLOCK_PADDING_BUG stunnel.conf ============================== client = yes debug=7 options = SSL_OP_TLS_BLOCK_PADDING_BUG [telnet] accept = 23 connect = 10.36.3.144:4433 ============================= but I have got this error ======================================= file stunnel.conf line 5: Illegal SSL option 2005.03.31 13:26:48 LOG3[3396:3716]: Server is down ======================================= After I have changed the stunnel.conf in this way: stunnel.conf ============================== client = yes debug=7 ciphers = RC4-MD5 [telnet] accept = 23 connect = 10.36.3.144:4433 ============================== The problem I had is now solved. But my question is: how can I know more about this protocol incompatibility? Is there an accurate documentation about that and also about stunnel configuration? Sorry but sometimes it's difficult for me to find (in the FAQ or other sessions) the informations that I need. Thanks&Regards Maddalena

2 1

Terminal services and stunnel 4.09
by Mattias Olsson 31 Mar '05

31 Mar '05

Hi! Im tying to access an internal Win2003 terminal server from my Linux box (internet). As i understand it stunnel should do the work. I have read some documents but im not sure... This is my setup. Linuxbox ----> Linuxbox ssh server | Firewall | Terminal server i wish to access. Can this be done or do i have to open a port in the fw to access the TS directly? Should stunnel.conf look like this on my linuxbox (client) cert = /usr/local/etc/stunnel/mail.pem client = yes On the TS? [TS] accept = 3000 connect = 3389 Should it have cert = ? Or could i on my linux ssh server have a config looking like this: [TS-remote] accept = 3000 connect = <internal-ip>:3389 Should it have cert = ? A novice man sends his best regards and thanks! /Kaz

1 0