stunnel4 reset by peer on hardy

[trmentry]

Binary package hint: stunnel4

have an odd issue and I can't figure it out.

I have stunnel4 installed and setup as a client. When my Hardy laptop
boots up Stunnel4 is running.

However connections to localhost:143 and localhost:119 get reset by
peer. If I restart Stunnel4 everything works fine. But I have to
restart it every time after it's already running from the bootup.

I don't have this issue with Stunnel4 on my Gutsy server. I did the
same thing to setup on my laptop that I did with my server. So
something has changed but I can't find it.

Any ideas?

Thanks

chris@kessel:~$ ps -eaf | grep stunnel4
root 6372 1 0 07:47 ? 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
root 6373 1 0 07:47 ? 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
root 6374 1 0 07:47 ? 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
root 6375 1 0 07:47 ? 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
root 6376 1 0 07:47 ? 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
stunnel4 6377 1 0 07:47 ? 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
chris 7963 7943 0 08:12 pts/0 00:00:00 grep stunnel4
chris@kessel:~$
chris@kessel:~$
chris@kessel:~$ telnet localhost 143
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection reset by peer
chris@kessel:~$
chris@kessel:~$ telnet localhost 119
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.
chris@kessel:~$
chris@kessel:~$
chris@kessel:~$ sudo /etc/init.d/stunnel4 restart
[sudo] password for chris:
Restarting SSL tunnels: [stopped: /etc/stunnel/stunnel.conf] [Started:
/etc/stunnel/stunnel.conf] stunnel.
chris@kessel:~$
chris@kessel:~$
chris@kessel:~$ ps -eaf | grep stunnel4
root 8028 1 0 08:13 pts/0 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
root 8029 1 0 08:13 pts/0 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
root 8030 1 0 08:13 pts/0 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
root 8031 1 0 08:13 pts/0 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
root 8032 1 0 08:13 pts/0 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
stunnel4 8033 1 0 08:13 ? 00:00:00 /usr/bin/stunnel4
/etc/stunnel/stunnel.conf
chris 8035 7943 0 08:13 pts/0 00:00:00 grep stunnel4
chris@kessel:~$
chris@kessel:~$
chris@kessel:~$ telnet localhost 143
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
* OK Gimap ready for requests from 70.228.53.2 f60if1628793pyh.0 ^]
telnet> quit
Connection closed.

[Andreas Hasenack (ahasenack)]

I have a slightly different behaviour. Every second connection to stunnel breaks with "SSL_connect: 1408F06B: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression":

andreas@nsn2:~$ telnet localhost 81
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.

andreas@nsn2:~$ telnet localhost 81
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
HEAD / HTTP/1.0

HTTP/1.1 403 Forbidden
Date: Wed, 12 Nov 2008 16:29:03 GMT
(... rest of response ...)

The third connection works, and the 4th one breaks again, and so on.

The logs show:
Nov 12 14:28:52 nsn2 stunnel: LOG5[1895:3082509200]: testconn accepted connection from 127.0.0.1:57277
Nov 12 14:28:52 nsn2 stunnel: LOG5[1895:3082509200]: testconn connected remote server from 192.168.1.5:56783
Nov 12 14:28:53 nsn2 stunnel: LOG3[1895:3082509200]: SSL_connect: 1408F06B: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression
Nov 12 14:28:53 nsn2 stunnel: LOG5[1895:3082509200]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
Nov 12 14:28:56 nsn2 stunnel: LOG5[1895:3082509200]: testconn accepted connection from 127.0.0.1:57279
Nov 12 14:28:57 nsn2 stunnel: LOG5[1895:3082509200]: testconn connected remote server from 192.168.1.5:56785
Nov 12 14:29:04 nsn2 stunnel: LOG5[1895:3082509200]: Connection closed: 19 bytes sent to SSL, 240 bytes sent to socket

[Andreas Hasenack (ahasenack)]

I "fixed" my problem by changing the sslVersion line. I replaced SSLv3 with TLSv1 and now it's working fine in that test case I pasted above:

sslVersion = TLSv1

[Thomas Hotz (thotz-deactivatedaccount)]

I'm not able to confirm this bug on Ubuntu 13.04. Is this still an issue for you? Thank you for telling us!

[Launchpad Janitor (janitor)]

[Expired for stunnel4 (Ubuntu) because there has been no activity for 60 days.]