- stunnel-users - stunnel.org

stunnel.exe stops connecting
by Mike Brazil 27 Sep '11

27 Sep '11

I'm running stunnel 4.44 for both POP3 and SMTP with my email client, Outlook Express, and my Spam filter, Cactus Spam. The OS is Win XP SP3. I have added the following to stunnel.conf: client = yes debug = debug [pop3s] accept = 127.0.0.1:11010 connect = camel.arvixe.com:995 [ssmtp] accept = 25 connect = camel.arvixe.com:465 Other than adding those lines, I've not changed anything in the rest of stunnel.conf as it comes with the program. When I boot the computer, Outlook Express, Cactus Spam, and stunnel all start and function correctly. However, after a period of time (a few hours -- I haven't yet pinned down whether there is a specific length to the time period), something goes wrong with stunnel, in that it stops communicating with Outlook Express, and it's CPU usage goes up to 25% (quad-core Intel CPU) and stays at that level indefinitely until I terminate the process. It is only the stunnel.exe process that is affected -- the service continues to run without error. I then restart stunnel.exe, and it works normally once again for a few hours. I usually become aware that stunnel has stopped connecting with Outlook Express when I come back to the computer after a few hours away from it, so I have so far been unable to see whether anything observable occurs when it gets into trouble or whether the length of time it ran properly varies or is constant. -- Mike Brazil mike(a)milibra.net

1 0

stunnel 4.44 - tools/Makefile $(ssldir) vs $(SSLDIR)
by Sebastian Kayser 27 Sep '11

27 Sep '11

Hi, I am building a recent stunnel version for Solaris via opencsw.org and with 4.44 it seems as if --with-ssl is used to AC_SUBST([SSLDIR]), yet tools/Makefile uses lowercase $(ssldir). Lead to an empty expansion and failed calls to openssl in my case. $ grep -i ssldir Makefile tools/Makefile Makefile:SSLDIR = /opt/csw tools/Makefile:SSLDIR = /opt/csw tools/Makefile:openssl = $(ssldir)/bin/openssl Sebastian

1 0

Certificates
by Cary Corse 17 Sep '11

17 Sep '11

I'm trying to use stunnel to connect to a secure server for syslogging. I have a certificate from the central logging server. How do I load this into stunnel so that I can connect? Cheers and thanks Cary

4 4

stunnel 4.44 released
by Michal Trojnara 17 Sep '11

17 Sep '11

Dear Users, I have released version 4.44 of stunnel. The ChangeLog entry: Version 4.44, 2011.09.17, urgency: MEDIUM: * New features - Major automake/autoconf cleanup. - Heap buffer overflow protection with canaries. - Stack buffer overflow protection with -fstack-protector. * Bugfixes - Fixed garbled error messages on errors with setuid/setgid options. - SNI fixes (thx to Alexey Drozdov). - Use after free in fdprintf() (thx to Alexey Drozdov). This issue might cause GPF with "protocol" or "ident" options. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.44.tar.gz: fa0dfc33f323abfbc94aa993d90d37481cd2f652ee93ec2f8c333ac7a496c7b9 Best regards, Mike

1 0

Goldmine 6.7 behind a Server
by Blake Miller 16 Sep '11

16 Sep '11

We are planning to transition our email service to Google Apps with our Goldmine 6.7 Corporate Edition so need to use Stunnel. We have Goldmine setup and run from a central Server and a shared/networked drive F: Each client machine runs Goldmine, BUT via the server path noted earlier. When logged in locally to the server and running Goldmine locally, everything works great. Stunnel is connected, we're able to send/receive email, etc. However from a remote machine, it doesn't work. Have tried installing stunnel on the local machine. Have tried accessing the said ports via the Server's IP address from within the network. And have hacked around different config setups without luck. Being a NOOB with Stunnel, we're at a loss with further configuration without literally 'hacking around' in the dark any further. Our config file is just below Thanks in advance. Blake ; **************************************************************************** * ; * Global Options * ; **************************************************************************** * ; Debugging stuff (may useful for troubleshooting) debug = 7 output = stunnel.log ; **************************************************************************** * ; * Service Defaults (may also be specified in individual service sections) * ; **************************************************************************** * ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; The following options provide additional security at some performance penalty ; Default ECDH/DH parameters are strong/conservative, so it is quite safe to ; comment out these lines in order to get a performance boost options = SINGLE_ECDH_USE options = SINGLE_DH_USE ; **************************************************************************** * ; * Service Definitions (at least one service has to be defined) * ; **************************************************************************** * ; Example SSL server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ; Example SSL client mode services [gmail-pop3] client = yes accept = 127.0.0.1:9995 connect = pop.gmail.com:995 [gmail-smtp] client = yes accept = 127.0.0.1:4465 connect = smtp.gmail.com:465 ;[gmail-imap] ;client = yes ;accept = 127.0.0.1:143 ;connect = imap.gmail.com:993 ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem

3 4

stunnel claims it needs certificate
by JOSE 14 Sep '11

14 Sep '11

Hi I am trying to get stunnel stunnel 4.36 on ia64-hp-hpux11.23 with OpenSSL 0.9.8o 01 Jun 2010 working on this server and so far I have generated a new pem file as per the instructions, but it is the time to make to run, it keeps looking for a certificate for one of the services: bash-3.2# /opt/iexpress/stunnel/bin/stunnel /opt/iexpress/stunnel/etc/stunnel/stunnel.conf Reading configuration from file /opt/iexpress/stunnel/etc/stunnel/stunnel.conf Snagged 64 random bytes from /opt/iexpress/stunnel/etc/stunnel/stunnel.rnd Wrote 1024 new random bytes to /opt/iexpress/stunnel/etc/stunnel/stunnel.rnd PRNG seeded successfully Line 37: End of section revnet_preprod_sunquest: SSL server needs a certificate my conf file is as follows: bash-3.2# more /opt/iexpress/stunnel/etc/stunnel/stunnel.conf # Sample stunnel configuration file #RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd RNDfile=/opt/iexpress/stunnel/etc/stunnel/stunnel.rnd # Chroot #chroot = /var/chroot/stunnel/ # PID is created inside chroot jail #pid = /opt/hpws/apache/logs/stunnel.pid pid = /opt/iexpress/stunnel/etc/stunnel/stunnel.pid # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Client Authentication #verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /opt/hpws/apache/conf/certs.pem # Some debugging stuff debug = 7 output = /opt/hpws/apache/logs/stunnel.log # Use in client mode client = no # Run in the background foreground = no # Service-level configuration [revnet_preprod_sunquest] accept = 10.99.10.37:8011 connect = 127.0.0.1:18011 #connect = 18011 [revnet_preprod_funsun] accept = 10.99.10.37:8017 connect = 127.0.0.1:18017 #connect = 18017 any help or tips would be welcome Thanks Jose

2 2

netword.c & fdprintf access access violation fix
by Alexey Drozdov 12 Sep '11

12 Sep '11

Hi, all One more bug was found out at work stunnel through a proxy. There is a reference to already released memory in fdprintf function. Here a small fix of this situation: *** network.c 2011-09-07 20:46:19.000000000 +0400 --- network.c_patch 2011-09-12 23:52:46.015618574 +0400 *************** *** 766,771 **** --- 766,772 ---- int fdprintf(CLI *c, int fd, const char *format, ...) { va_list ap; char *line; + int outsize; va_start(ap, format); line=str_vprintf(format, ap); *************** *** 775,782 **** longjmp(c->err, 1); } fdputline(c, fd, line); str_free(line); ! return strlen(line)+2; } #define INET_SOCKET_PAIR --- 776,784 ---- longjmp(c->err, 1); } fdputline(c, fd, line); + outsize = strlen(line)+2; str_free(line); ! return outsize; } #define INET_SOCKET_PAIR / Alexey Drozdov

1 0

SNI and some troubles solving
by Alexey Drozdov 10 Sep '11

10 Sep '11

Hi All, At first I would like to thank Marzena Trojnara for the useful program! Occurrence of support SNI has especially interest. I have decided to use the given possibility, but have detect pair of bugs which has independently successfully solved. To begin with I dump part of my config: [virtual_server] accept = 443 connect = localhost:1081 cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key ; need peer verification for default access verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt ; use restricted access form some target services [socks5] sni = virtual_server:localhost sni = virtual_server:89.250.5.185 sni = virtual_server:127.0.0.1 sni = virtual_server:server cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt connect = localhost:1081 ; public service [dreamhub_ru] sni = virtual_server:dreamhub.ru sni = virtual_server:pad.dreamhub.ru cert = /usr/local/etc/stunnel/dreamhub.cer key = /usr/local/etc/stunnel/dreamhub.pem connect = localhost:80 I want to use stunnel on 443rd port for ssl-socks5 service with peer certificates verification and use public https web-service (https://dreamhub.ru) And so it has appeared that value for "verify" are always used from global section (in my case [virtual_server]), and values of "verify" parameters from virtual services sections aren't used. Problem it has appeared that in the SNI check callback static int servername_cb(SSL *ssl, int *ad, void *arg) ... for(list=section->servername_list_head; list; list=list->next) if(!strcasecmp(servername, list->servername)) { c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); SSL_set_SSL_CTX(ssl, c->opt->ctx); does not copy ctx->verify_mode (SSL*)s->verify_mode=ctx->verify_mode; It has been solved by explicit calling SSL_set_verify *** ctx.c 2011-09-07 14:43:50.000000000 +0400 --- ctx.c_patched 2011-09-10 01:12:48.000000000 +0400 *************** *** 156,161 **** --- 156,162 ---- c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); + SSL_set_verify(ssl, SSL_CTX_get_verify_mode(c->opt->ctx), +NULL); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); #ifdef USE_LIBWRAP The second moment concerns uses stunnel as client through HTTPS a proxy (protocol=connect). All works perfectly, only it has appeared that value for SNI used from "connect" parameter instead of value of "protocolHost". On a code all is quite obvious: if(c->opt->host_name) { s_log(LOG_DEBUG, "SNI: host name: %s", c->opt->host_name); if(!SSL_set_tlsext_host_name(c->ssl, c->opt->host_name)) { sslerror("SSL_set_tlsext_host_name"); longjmp(c->err, 1); } } I solved it such: *** options.c 2011-09-07 20:38:56.000000000 +0400 --- options.c_patch 2011-09-10 16:34:56.882619049 +0400 *************** *** 695,700 **** --- 695,705 ---- s_log(LOG_INFO, "Cannot resolve '%s' - delaying DNS lookup", arg); section->option.delayed_lookup=1; } + + /* check - is host_name already filled */ + if (section->host_name != NULL) + return NULL; /* OK */ + tmpstr=strrchr(arg, ':'); if(tmpstr) { *tmpstr='\0'; *************** *** 1077,1082 **** --- 1082,1095 ---- if(strcasecmp(opt, "protocolHost")) break; section->protocol_host=str_dup_err(arg); + + /* Overwrite section->host_nam because of + protocolHost should be used for client SNI */ + tmpstr=strrchr(arg, ':'); + if(tmpstr) { + *tmpstr='\0'; + section->host_name=str_dup_err(arg); + } return NULL; /* OK */ case CMD_DEFAULT: break; I think that the given changes can be useful for other :) / Alexey Drozdov

2 1

SNI and some troubles solving
by Alexey Drozdov 10 Sep '11

10 Sep '11

Hi All, At first I would like to thank Marzena Trojnara for the useful program! Occurrence of support SNI has especially interest. I have decided to use the given possibility, but have detect pair of bugs which has independently successfully solved. To begin with I dump part of my config: [virtual_server] accept = 443 connect = localhost:1081 cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key ; need peer verification for default access verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt ; use restricted access form some target services [socks5] sni = virtual_server:localhost sni = virtual_server:89.250.5.185 sni = virtual_server:127.0.0.1 sni = virtual_server:server cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt connect = localhost:1081 ; public service [dreamhub_ru] sni = virtual_server:dreamhub.ru sni = virtual_server:pad.dreamhub.ru cert = /usr/local/etc/stunnel/dreamhub.cer key = /usr/local/etc/stunnel/dreamhub.pem connect = localhost:80 I want to use stunnel on 443rd port for ssl-socks5 service with peer certificates verification and use public https web-service (https://dreamhub.ru) And so it has appeared that value for "verify" are always used from global section (in my case [virtual_server]), and values of "verify" parameters from virtual services sections aren't used. Problem it has appeared that in the SNI check callback static int servername_cb(SSL *ssl, int *ad, void *arg) ... for(list=section->servername_list_head; list; list=list->next) if(!strcasecmp(servername, list->servername)) { c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); SSL_set_SSL_CTX(ssl, c->opt->ctx); does not copy ctx->verify_mode (SSL*)s->verify_mode=ctx->verify_mode; It has been solved by explicit calling SSL_set_verify *** ctx.c 2011-09-07 14:43:50.000000000 +0400 --- ctx.c_patched 2011-09-10 01:12:48.000000000 +0400 *************** *** 156,161 **** --- 156,162 ---- c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); + SSL_set_verify(ssl, SSL_CTX_get_verify_mode(c->opt->ctx), +NULL); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); #ifdef USE_LIBWRAP The second moment concerns uses stunnel as client through HTTPS a proxy (protocol=connect). All works perfectly, only it has appeared that value for SNI used from "connect" parameter instead of value of "protocolHost". On a code all is quite obvious: if(c->opt->host_name) { s_log(LOG_DEBUG, "SNI: host name: %s", c->opt->host_name); if(!SSL_set_tlsext_host_name(c->ssl, c->opt->host_name)) { sslerror("SSL_set_tlsext_host_name"); longjmp(c->err, 1); } } I solved it such: *** options.c 2011-09-07 20:38:56.000000000 +0400 --- options.c_patch 2011-09-10 16:34:56.882619049 +0400 *************** *** 695,700 **** --- 695,705 ---- s_log(LOG_INFO, "Cannot resolve '%s' - delaying DNS lookup", arg); section->option.delayed_lookup=1; } + + /* check - is host_name already filled */ + if (section->host_name != NULL) + return NULL; /* OK */ + tmpstr=strrchr(arg, ':'); if(tmpstr) { *tmpstr='\0'; *************** *** 1077,1082 **** --- 1082,1095 ---- if(strcasecmp(opt, "protocolHost")) break; section->protocol_host=str_dup_err(arg); + + /* Overwrite section->host_nam because of + protocolHost should be used for client SNI */ + tmpstr=strrchr(arg, ':'); + if(tmpstr) { + *tmpstr='\0'; + section->host_name=str_dup_err(arg); + } return NULL; /* OK */ case CMD_DEFAULT: break; I think that the given changes can be useful for other :) / Alexey Drozdov

1 0

stunnel 4.43 released
by Michal Trojnara 08 Sep '11

08 Sep '11

Dear Users, I have released version 4.43 of stunnel. The ChangeLog entry: Version 4.43, 2011.09.07, urgency: MEDIUM: * New features - Updated Win32 DLLs for OpenSSL 1.0.0e. - Major optimization of the logging subsystem. Benchmarks indicate up to 15% performance improvement. * Bugfixes - Fixed WIN32 configuration file reload. - Fixed FORK and UCONTEXT threading models. - Corrected INSTALL.W32 file. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.43.tar.gz: 93a002d9e1652d7684756af75b44b00f99aa93574e8a5a2e69f88656221d5ce2 Best regards, Mike

2 1