- stunnel-users - stunnel.org

SSL Labs: Session resumption IDs assigned but not accepted
by Brandon Jackson 17 May '16

17 May '16

Trying to find out why SSL Labs is giving this message Session resumption (caching): No (IDs assigned but not accepted) I have this in the config. sessionCacheSize = 1000 sessionCacheTimeout = 86400 ---------------------------------- Brandon Jackson bojack1437(a)gmail.com

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:50:04 +0000, David Faizulaev wrote: > Hello, > > I've tried changing the value of 'verify' to 0 & 1, in both cases I get the following: > > 2016.05.17 16:40:25 LOG3[285]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed > 2016.05.17 16:40:25 LOG5[285]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket > 2016.05.17 16:40:25 LOG4[285]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 11859 allocations > 2016.05.17 16:40:25 LOG4[285]: Possible memory leak at .\crypto\asn1\asn1_lib.c:408: 11241 allocations Strange. I never used verify = 0, but I had the understanding, stunnel should accept a connection even if the peer's certificate can't be verified. Anyhow, what happens if you add the self-signed certificate presented by the peer to the CA file? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:33:31 +0000, David Faizulaev wrote: > Between each certificate block I have the following block: > > Bag Attributes > friendlyName: trustcenterclass2caii > 2.16.840.1.113894.746875.1.1: <Unsupported tag 6> > subject=/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II > issuer=/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II > > possible cause? No, this should be ignored as a comment. But you instructed stunnel to check the peer's certificate against the trusted ones (verify = 2), and the certificate chain the peer presents ends with a certificate not found in the CA file. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:24:38 +0000, David Faizulaev wrote: > Logs messages are generated upon connection attempt. Then the server presents a certificate that can't be validated against the trusted certificates stored to the file you specified with CAfile=... Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:08:33 +0000, David Faizulaev wrote: > Latest update: > After further investigation, it became evident that Stunnel should run as client. > Therefore, I've converted my existing certs file (from my application) into a PEM file. > The file includes -----BEGIN CERTIFICATE----- & -----END CERTIFICATE-----. > > But I still get an error: > > 2016.05.17 15:57:24 LOG4[281]: CERT: Pre-verification error: self signed certificate in certificate chain > 2016.05.17 15:57:24 LOG4[281]: Rejected by CERT at depth=1: CN=NextnineCA > 2016.05.17 15:57:24 LOG3[281]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed > > Here is the current configuration: > > [custom] > client = yes > accept = 127.0.0.1:8449 > connect = 192.168.220.62:443 > verify = 2 > CAfile = myapp.pem David, CAfile should point to a list of trusted certificates. The file(s) for your pair of certificate and key should be specified with cert=... (and key=..., if certificate and key are stored to separate files). Are the log messages generated at stunnel startup or at connection establishment? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 11:13:26 +0000, David Faizulaev wrote: > I see, I have a keystore file for the server, can it be set as KEY ? can I convert keystore to PEM? I don't know. Some key/certificate repositories don't allow to export private keys. Maybe there is a PKCS11 plug-in for OpenSSL to access the keystore. If this is the case, you don't have to export your private key. But again, I don't know. > Additionally, I've thought about configuring Stunnel in client mode. > Here is the configuration: > [..] Running stunnel in client or server mode makes no difference w.r.t. certificate and key files. As long as stunnel is not able to access your private key, the client mode won't work either. HTH, Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 08:29:17 +0000, David Faizulaev wrote: > Hello Ludolf, > > I've printed the content of certificate file and the lines: "-----BEGIN CERTIFICATE-----" "-----END CERTIFICATE-----" exist. > In addition, I've compared the default certificate provided by Stunnel with the one I wish to use, they're structure is identical. Hello David, Please reply to the list, so others are able to comment too. I don't know the 'default certificate provided by Stunnel'. I expect it to be depending on the distribution. However, if there are "BEGIN/END CERTIFICATE" lines in your file, but no "BEGIN/END RSA PRIVATE KEY", then the file is in PEM format, but the key is missing. Maybe you have separate files for private key and certificate. If this is the case, you may either concatenate key and certificate to a single file or specify both files in the stunnel configuration: >> key = my-private-key.pem >> cert = my-certificate.pem Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring Stunnel to work between client and server - possible certificate issue
by David Faizulaev 17 May '16

17 May '16

Hello, I've found Stunnel as a potential answer to securely moving traffic between two machines. But I'm having some difficulties configuring the software. I've installed it on to the client machine and configured the client to connect to 127.0.0.1:8449 while the Server to which the client needs to connect is 192.168.220.72:8447 In the stunnel.conf I've set the following: [custom] accept = 127.0.0.1:8449 connect = 192.168.220.72:8447 cert = 220.72.cer TIMEOUTclose = 0 Upon initializing Stunnel I get the following error: 2016.05.16 19:14:04 LOG3[main]: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib 2016.05.16 19:14:04 LOG3[main]: SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line 2016.05.16 19:14:04 LOG3[main]: Service [custom]: Failed to initialize SSL context 2016.05.16 19:14:04 LOG3[main]: Failed to reload the configuration file What can be the cause? Thanks in advance. Best Regards, David. [logo_tagline_Sig] David Faizulaev | PL/SQL Developer | T +972 (3) 767 3026<tel:%2B97237673012> | M +972 (54) 7314<tel:%2B972528466746>687 Centralized OT Security Management for Distributed SCADA/ICS Networks P Please consider the environment before printing this e-mail

2 1

TIMEOUTBusy exceeded
by James Brown 17 May '16

17 May '16

Running OpenSSL 1.0.2h, and stunnel 5.32 I often get: ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2016.05.17 16:51:46 LOG5[21]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.05.17 16:51:46 LOG7[21]: Local descriptor (FD=15) closed 2016.05.17 16:51:46 LOG7[21]: Service [ssmtp2] finished (3 left) 2016.05.17 16:51:46 LOG6[22]: ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2016.05.17 16:51:46 LOG5[22]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.05.17 16:51:46 LOG7[22]: Local descriptor (FD=16) closed 2016.05.17 16:51:46 LOG7[22]: Service [ssmtp2] finished (2 left) when a user is sending an email. The email actually makes it to our mail server and gets sent, but the sender’s mail app says that it could not be sent. Upgraded to 5.33b2, no change. It is not all the time - I suspect it is with emails with large attachments. Any suggestions? Mac OS X 10.7.5. Thanks, James.

1 0

stunnel v5.32 (and older) strange session cache behavior on memory (de)allocation
by Adrian Irimescu 16 May '16

16 May '16

I am using stunnel v5.32 compiled on a RHEL 6.7 with openssl-1.0.1e-42.el6.x86_64. The stunnel.conf cache settings are (for testing cache behaviour): *sessionCacheSize = 3sessionCacheTimeout = 60* What I expect is that after sessioncache size is reached, the memory (RSS) allocated to stunnel process does not grow with new sessions which are not in cache. Instead of this the stunnel allocates about 28K for any new session which does not have a stored session in cache and does not free this anymore. For new connections, but with session stored in cache, the memory does not grow. This lead me to a problem in memory deallocation for expired session in internal session cache.( I know that openssl frees expired session cache entries at every 255 sessions). See example below: --> stunnel start (see RSS) USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND stunnel 20655 0.0 0.0 117760 1440 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 --> after 3 sessions with no cache hits stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: New session callback 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s) requested 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s) succeeded 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 server renegotiation(s) requested 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 session reuse(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 3 internal session cache item(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session cache fill-up(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session cache miss(es) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 external session cache hit(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 expired session(s) retrieved 2016.05.11 15:50:57 LOG6[kngHAM6DLUpVRXEqHcUMIt]: SSL accepted: new session negotiated 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: Remove session callback ----------------------------------------------------- --> after another 1 request with cache hit: as you can see no RSS memory was added stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: SSL state (accept): SSLv3 read finished A 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s) requested 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s) succeeded 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 server renegotiation(s) requested 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 session reuse(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 3 internal session cache item(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 internal session cache fill-up(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 internal session cache miss(es) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 external session cache hit(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 expired session(s) retrieved 2016.05.11 15:51:57 LOG6[Slq6WdqS97Ox4G8eOKfGg0]: SSL accepted: previous session reused ---------------------------------------------------- --> after another 1 request with no cache hit (now we have the first cache fill-up) stunnel 20655 0.0 0.0 117828 3000 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: New session callback 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s) requested 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s) succeeded 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 server renegotiation(s) requested 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 session reuse(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 3 internal session cache item(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 internal session cache fill-up(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 internal session cache miss(es) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 external session cache hit(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 expired session(s) retrieved 2016.05.11 15:53:31 LOG6[P8n33mFxzHVAZEeRwnFccK]: SSL accepted: new session negotiated 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: Remove session callback ---------------------------------------------------- --> after another 300 new session with no cache hits and after waiting 1 minute for entries in session cache to expire (as said in documentation openssl must free expired entries every 255 sessions) stunnel 20655 0.0 0.2 117828 11632 ? Ss 15:49 0:03 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: New session callback 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s) requested 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s) succeeded 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 server renegotiation(s) requested 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 1 session reuse(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 3 internal session cache item(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 301 internal session cache fill-up(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 internal session cache miss(es) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 external session cache hit(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 expired session(s) retrieved 2016.05.11 16:13:26 LOG6[vWvoFT1DXuJ9x0eEfFnQBf]: SSL accepted: new session negotiated 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: Remove session callback ---------------------------------------------------- What I can see is tat memory grows with ~28K for every new session after session cache was filled and never deallocates this memory. In my production env. this really creates problems because after 2 weeks stunnel fils all 32GB of server RAM. *Anyone has encountered a similar problem? * Of course the stunnel service restart clears the memory but I loose all cache entries and is not acceptable. After some code analysis between different versions of stunnel I can see that between v5.26 ans v5.27 the ctx callbacks functions was changed. In my tests with versions prior to 5.27 I can see that this memory problems does not appear. See logs below: ---- stunnel v5.26 -------- 2016.05.12 13:08:14 LOG5[ui]: stunnel 5.26 on x86_64-unknown-linux-gnu platform 2016.05.12 13:08:14 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 stunnel 27402 0.0 0.0 117604 1316 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2756 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2804 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2828 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 cache fill-up 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 0 session reuse(s) 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 3 internal session cache item(s) 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 1 internal session cache fill-up(s) stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 after 100 fill-ups 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: SSL state (accept): SSLv3 flush data 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s) requested 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s) succeeded 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 server renegotiation(s) requested 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 1 session reuse(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 3 internal session cache item(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 102 internal session cache fill-up(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 internal session cache miss(es) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 external session cache hit(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 expired session(s) retrieved 2016.05.12 13:13:55 LOG6[TWO1OFFPYvsW4qdjyJ0IZK]: SSL accepted: new session negotiated stunnel 27402 0.1 0.0 117672 2872 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 after another 100 fill-ups 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: SSL state (accept): SSLv3 flush data 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s) requested 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s) succeeded 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 server renegotiation(s) requested 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 1 session reuse(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 3 internal session cache item(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 202 internal session cache fill-up(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 internal session cache miss(es) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 external session cache hit(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 expired session(s) retrieved 2016.05.12 13:19:03 LOG6[InwkBBOxJrfptxYx6wXTxU]: SSL accepted: new session negotiated stunnel 27402 0.0 0.0 117672 2872 ? Ss 13:08 0:01 /usr/local/bin/stunnel5 Code: --->>> callbacks in v5.26 L605 *NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { unsigned char *val, *val_tmp; ssize_t val_len; const unsigned char *session_id; unsigned int session_id_length; val_len=i2d_SSL_SESSION(sess, NULL); val_tmp=val=str_alloc((size_t)val_len); i2d_SSL_SESSION(sess, &val_tmp);#if OPENSSL_VERSION_NUMBER>=0x0090800fL session_id=SSL_SESSION_get_id(sess, &session_id_length);#else session_id=(const unsigned char *)sess->session_id; session_id_length=sess->session_id_length;#endif cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_NEW, SSL_SESSION_get_timeout(sess), session_id, session_id_length, val, (size_t)val_len, NULL, NULL); str_free(val); return 1; /* leave the session in local cache for reuse */}NOEXPORT SSL_SESSION *sess_get_cb(SSL *ssl, unsigned char *key, int key_len, int *do_copy) { unsigned char *val, *val_tmp=NULL; ssize_t val_len=0; SSL_SESSION *sess; *do_copy = 0; /* allow the session to be freed autmatically */ cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_GET, 0, key, (size_t)key_len, NULL, 0, &val, (size_t *)&val_len); if(!val) return NULL; val_tmp=val; sess=d2i_SSL_SESSION(NULL,#if OPENSSL_VERSION_NUMBER>=0x0090800fL (const unsigned char **)#endif /* OpenSSL version >= 0.8.0 */ &val_tmp, val_len); str_free(val);* --->>> callbacks in v5.32 /**************************************** session callbacks */ *NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { CLI *c; s_log(LOG_DEBUG, "New session callback"); c=SSL_get_ex_data(ssl, index_cli); if(c->opt->option.sessiond) cache_new(ssl, sess); return 1; /* leave the session in local cache for reuse */}NOEXPORT SSL_SESSION *sess_get_cb(SSL *ssl,#if OPENSSL_VERSION_NUMBER>=0x10100000L const#endif unsigned char *key, int key_len, int *do_copy) { CLI *c; s_log(LOG_DEBUG, "Get session callback"); *do_copy=0; /* allow the session to be freed automatically */ c=SSL_get_ex_data(ssl, index_cli); if(c->opt->option.sessiond) return cache_get(ssl, key, key_len); return NULL; /* no session to resume */}NOEXPORT void sess_remove_cb(SSL_CTX *ctx, SSL_SESSION *sess) { SERVICE_OPTIONS *opt; s_log(LOG_DEBUG, "Remove session callback"); opt=SSL_CTX_get_ex_data(ctx, index_opt); if(opt->option.sessiond) cache_remove(ctx, sess);}* In production env. I have downgraded today at stunnel v5.26 and memory seems to be OK (untill now). Regards, Adrian Irimescu

1 0