cURL / Mailing Lists / curl-users / Single Mail

curl-users

Curl 7.16.2; Tests Using Stunnel

From: jayjwa <jayjwa_at_atr2.ath.cx>
Date: Fri, 13 Apr 2007 02:28:32 -0400

It took me awhile to figure this out so I thought I'd share it. When I was
testing this curl, tests such as 301 (the ones using Stunnel) would fail,
like so:

HTTPS server: /usr/sbin/stunnel /usr/local/src/curl-7.16.2/tests/stunnel.conf
stunnel exited with 1!
RUN: failed to start the HTTPS server
test 301 SKIPPED: failed starting HTTPS server (stunnel)
TESTFAIL: No tests were performed
TESTDONE: 1 tests were considered during 6 seconds.
TESTINFO: 1 tests were skipped due to these restraints:
TESTINFO: "failed starting HTTPS server (stunnel)" 1 times (301)

It's hard to see the stunnel.conf file, because it seems to get deleted after
the test. According to the log it's
/usr/local/src/curl-7.16.2/tests/stunnel.conf in my case. If you make a
hardlink to what its name will be (ln stunnel.conf another.conf) you can use
this new name to see the file. Changing the debug and output lines...

         CApath=/usr/local/src/curl-7.16.2/tests
         cert = ./stunnel.pem
         pid = /usr/local/src/curl-7.16.2/tests/.https.pid
         debug = daemon.info
         output = /dev/stdout
         foreground = yes

         [curltest]
         accept = 8991
         connect = 8990

Let's see the error from stunnel:

2007.04.13 01:14:01 LOG5[1479:3083049280]: Could not load DH parameters from
./stunnel.pem
2007.04.13 01:14:01 LOG4[1479:3083049280]: Diffie-Hellman initialization
failed
2007.04.13 01:14:01 LOG3[1479:3083049280]: Error reading certificate file:
./stunnel.pem
2007.04.13 01:14:01 LOG3[1479:3083049280]: SSL_CTX_use_certificate_chain_file:
906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line

I wondered why this was, and found my stunnel didn't seem to run the way I
figured it should. This was version stunnel-4.20. As it turns out, both my
stunnel's PEM file and the stunnel PEM cert/key file used in the tests:
seems to omit DH parameters.

fgrep 'DH PARA' /usr/local/src/curl-7.16.2/tests/stunnel.pem

Adding these allows the tests to complete. Here's the stunnel.pem again
(without the long English text output ) with some DH parameters on the end:

Now that's fixed, re-run the test:

********* System characteristics ********
* curl 7.16.2 (i686-pc-linux-gnu)
* libcurl/7.16.2 OpenSSL/0.9.8d zlib/1.2.3 c-ares/1.3.1 libidn/0.6.5
libssh2/0.14
* Features: AsynchDNS IDN Largefile NTLM SSL libz
* Host: atr2
* System: Linux atr2 2.6.20.4 #2 Sat Apr 7 08:32:29 EDT 2007 i686 GNU/Linux
* Server SSL: ON
* libcurl SSL: ON
* libcurl debug: OFF
* valgrind: OFF
* HTTP IPv6 OFF
* FTP IPv6 OFF
* HTTP port: 8990
* FTP port: 8992
* FTP port 2: 8995
* FTPS port: 8993
* HTTPS port: 8991
* TFTP port: 8997
* SCP/SFTP port: 8999
* SSL library: OpenSSL
* Libtool lib: ON
*****************************************
HTTPS server: /usr/sbin/stunnel /usr/local/src/curl-7.16.2/tests/stunnel.conf
test 301...[HTTPS GET with user and password]
-d-p-e-- OK (1 out of 1 , remaining: 00:00)
TESTDONE: 1 tests out of 1 reported OK: 100%
TESTDONE: 1 tests were considered during 9 seconds.

Openssl can make DH parm's, and actually this is what stunnel does during its
install during 'make install' if you watch closely.

OpenSSL> gendh

Generating DH parameters, 512 bit long safe prime, generator 2
This is going to take a long time
...........................................................................+......................................................................................+...................................+.............+....................+.........+.......+....+.......................................................................................................................+.......+..........+....................+..............+....+..........+........++*++*++*++*++*++*
-----BEGIN DH PARAMETERS-----
MEYCQQDc8dnzSJodFOJStolXylDlhwrIDScZ+tutASEWvUqhAp4HqX/Zcy69ix/d
4aTzuTpOf8Yboz1gal3yXGdzWEsDAgEC
-----END DH PARAMETERS-----

OpenSSL>
Received on 2007-04-13

This message: [ Message body ]
Next message: peter mcdonald: "winldap.h problem compilling"
Previous message: Song Ma: "Re: Maybe cURL manual shall state something about the invalid range user input for FTP?"
Next in thread: Daniel Stenberg: "Re: Curl 7.16.2; Tests Using Stunnel"
Reply: Daniel Stenberg: "Re: Curl 7.16.2; Tests Using Stunnel"

Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]