Hi, I'm running Hybrid-7.2 on two PCs, one of which has a dynamic IP, as Hybrid wants a static IP and not hostname in its connect section, we are trying to use stunnel to encrypt server<->server communication. Server 1 specs (To which I'm connecting) running FreeBSD 6.3: *********************************************** #stunnel -version stunnel 4.05 on amd64-unknown-freebsd5.3 PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /var/tmp/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes #gcc -v Using built-in specs. Configured with: FreeBSD/amd64 system compiler Thread model: posix gcc version 3.4.6 [FreeBSD] 20060305 #uname FreeBSD 6.3-STABLE FreeBSD 6.3-STABLE #6: Tue Jan 22 13:23:51 GMT 2008 root@:/usr/obj/usr/src/sys/SVR1 amd64 Server 2 specs (From which I'm connecting via stunnel as a client) running OpenBSD 4.2: ****************************************************************** #stunnel -version stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/arandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/lib/gcc-lib/i386-unknown-openbsd4.2/3.3.5/specs Configured with: Thread model: single gcc version 3.3.5 (propolice) # cat stunnel.conf: cert = /etc/ssl/private/stunnel.pem key = /etc/ssl/private/rsa.key setuid = _stunnel setgid = _stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 foreground = yes [irc] client = yes accept = localhost:994 connect = xxx.xxx.xxx.xxx:994 Here's the debug logged to stderr: # stunnel 2008.02.08 19:34:54 LOG7[11904:2237644800]: Snagged 64 random bytes from /dev/arandom 2008.02.08 19:34:54 LOG7[11904:2237644800]: RAND_status claims sufficient entropy for the PRNG 2008.02.08 19:34:54 LOG7[11904:2237644800]: PRNG seeded successfully 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate: /etc/ssl/private/stunnel.pem 2008.02.08 19:34:54 LOG7[11904:2237644800]: Certificate loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: Key file: /etc/ssl/private/rsa.key 2008.02.08 19:34:54 LOG7[11904:2237644800]: Private key loaded 2008.02.08 19:34:54 LOG7[11904:2237644800]: SSL context initialized for service irc 2008.02.08 19:34:54 LOG5[11904:2237644800]: stunnel 4.20 on i386-unknown-openbsd4.2 with OpenSSL 0.9.7j 04 May 2006 2008.02.08 19:34:54 LOG5[11904:2237644800]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.02.08 19:34:54 LOG6[11904:2237644800]: file ulimit = 128 (can be changed with 'ulimit -n') 2008.02.08 19:34:54 LOG6[11904:2237644800]: poll() used - no FD_SETSIZE limit for file descriptors 2008.02.08 19:34:54 LOG5[11904:2237644800]: 61 clients allowed 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 6 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 7 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: FD 8 in non-blocking mode 2008.02.08 19:34:54 LOG7[11904:2237644800]: SO_REUSEADDR option set on accept socket 2008.02.08 19:34:54 LOG7[11904:2237644800]: irc bound to 127.0.0.1:994 2008.02.08 19:34:54 LOG7[11904:2237644800]: Created pid file /var/run/stunnel.pid 2008.02.08 19:35:15 LOG7[11904:2237644800]: irc accepted FD=9 from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc started 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 9 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on local socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 11 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: Connection from 127.0.0.1:8579 permitted by libwrap 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc accepted connection from 127.0.0.1:8579 2008.02.08 19:35:15 LOG7[11904:2336256000]: FD 10 in non-blocking mode 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc connecting 69.50.175.50:994 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: waiting 10 seconds 2008.02.08 19:35:15 LOG7[11904:2237644800]: Cleaning up the signal pipe 2008.02.08 19:35:15 LOG6[11904:2237644800]: Child process 26562 finished with code 0 2008.02.08 19:35:15 LOG7[11904:2336256000]: connect_wait: connected 2008.02.08 19:35:15 LOG5[11904:2336256000]: irc connected remote server from 192.168.1.101:42954 2008.02.08 19:35:15 LOG7[11904:2336256000]: Remote FD=10 initialized 2008.02.08 19:35:15 LOG7[11904:2336256000]: TCP_NODELAY option set on remote socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): before/connect initialization 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server hello A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server certificate A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read server done A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write client key exchange A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write change cipher spec A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 write finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 flush data 2008.02.08 19:35:15 LOG7[11904:2336256000]: SSL state (connect): SSLv3 read finished A 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 items in the session cache 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects (SSL_connect()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 1 client connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 client renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects (SSL_accept()) 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server connects that finished 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 server renegotiations requested 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache hits 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache misses 2008.02.08 19:35:15 LOG7[11904:2336256000]: 0 session cache timeouts 2008.02.08 19:35:15 LOG6[11904:2336256000]: SSL connected: new session negotiated 2008.02.08 19:35:15 LOG6[11904:2336256000]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2008.02.08 19:35:15 LOG3[11904:2336256000]: SSL_read: Connection reset by peer (54) 2008.02.08 19:35:15 LOG5[11904:2336256000]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2008.02.08 19:35:15 LOG7[11904:2336256000]: irc finished (0 left) What is going on here with "SSL_read: Connection reset by peer (54)"? This process keeps repeating itself without the ircd's linking. - S
participants (1)
-
Strykar