December 2004 - stunnel-users

A couple of patches against 4.06
by Peter Pentchev 31 Dec '04

31 Dec '04

Hi, First of all, thanks for writing and maintaining this great piece of software :) When I ported 4.06 to FreeBSD on Monday, there were three changes that needed to be made. One is the passing of -1, not -1000, to poll(2), which has already been discussed on this list (and which, by the way, is mandated by POSIX and the Single Unix Specification, as you can see at http://www.opengroup.org/onlinepubs/007908799/xsh/poll.html ) The other two can be seen in the patch below. The first one is related to the fact that EAI_NODATA is not present on all systems - it was actually obsoleted by the KAME implementation of IPv6 about an year ago. On some systems it is defined and has its own value - then stunnel builds just fine. On other systems it is not defined at all, while on yet other systems it is aliased to EAI_NONAME, so 'case EAI_NONAME' and 'case EAI_NODATA' would produce an error message from the compiler. Thus, the #ifdef and #if in the first chunk of the patch. This could not be done portably with a single statement, something like '#if defined(EAI_NODATA) && EAI_NODATA != EAI_NONAME', since there are some compilers that would barf on the second part if EAI_NODATA was not actually defined. The second chunk of the patch fixes getnameinfo() error reporting - just like with getaddrinfo(), getnameinfo() errors should be displayed using s_gai_strerror() instead of sockerror(). Keep up the good work! G'luck, Peter --- src/network.c.orig Thu Oct 14 18:03:49 2004 +++ src/network.c Wed Dec 29 14:16:06 2004 @@ -416,8 +416,12 @@ return "Temporary failure in name resolution (EAI_AGAIN)"; case EAI_FAIL: return "Non-recoverable failure in name resolution (EAI_FAIL)"; +#ifdef EAI_NODATA +#if EAI_NODATA != EAI_NONAME case EAI_NODATA: return "No address associated with nodename (EAI_NODATA)"; +#endif +#endif case EAI_FAMILY: return "ai_family not supported (EAI_FAMILY)"; case EAI_SOCKTYPE: @@ -562,10 +566,13 @@ /* getnameinfo() version */ char *s_ntop(char *text, SOCKADDR_UNION *addr) { char host[20], port[6]; + int err; - if(getnameinfo(&addr->sa, addr_len(*addr), - host, 20, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { - sockerror("getnameinfo"); + err = getnameinfo(&addr->sa, addr_len(*addr), + host, 20, port, 6, NI_NUMERICHOST|NI_NUMERICSERV); + if (err) { + s_log(LOG_ERR, "Error resolving the specified address: %s", + s_gai_strerror(err)); strcpy(text, "unresolvable IP"); return text; } -- Peter Pentchev roam(a)ringlet.net roam(a)cnsys.bg roam(a)FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 .siht ekil ti gnidaer eb d'uoy ,werbeH ni erew ecnetnes siht fI

2 5

xforwardfor-patch
by Alexander Lazic 30 Dec '04

30 Dec '04

Hi, i have attached my xforwardfor-patch for stunnel-4.06 ;-) al ;-)

2 2

stunnel 4.0.6 stunnel uid/gid removal
by Noah 30 Dec '04

30 Dec '04

stunnel-4.0.6 FreeBSD-4.9 I just installed stunnel 4.0.6 and noticed during the portinstall that the defualt behavior was to remove the stunnel uid and gid. can somebody clue me in as to why this was the Process? I cant find any relevant information on the web. cheers, Noah

2 1

engine-patch
by Alexander Lazic 29 Dec '04

29 Dec '04

Hi, we have a the following openssl: --- OpenSSL 0.9.7d 17 Mar 2004 built on: Wed Nov 3 13:28:35 CET 2004 platform: solaris-sparcv9-gcc options: bn(64,32) md2(int) rc4(ptr,char) des(idx,cisc,16,long) idea(int) blowfish(ptr) compiler: gcc -DOPENSSL_SYSNAME_ULTRASPARC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_KRB5 -DOPENSSL_NO_ENGINE -m32 -mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DMD5_ASM --- We don't have the engine enabled therefore the current stunnel don't compile :-( I have attached the patch for the current (4.06) stunnel version. BTW: I need the 'X-Forwarded-For' header, in where is the right position to add it in the 4.06 version. I think in 'src/client.c => transfer()' but i'am not sure, where there ;-) Thanx for help ;-) al ;-)

2 2

enforcing minimum cipher set available
by auto403973＠hushmail.com 29 Dec '04

29 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 is there a way (perhaps using extended 'options' section?), to enforce a minimum cipher strength / type for the connecting client? a solution would be to use apache 2's sslproxy to stunnel (yikes), but stunnel rocks :) apache / mod_ssl - from httpd.conf # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:- SSLv2:+EXP:+eNULL -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkHSUs4ACgkQdgNHoxEs/oi+2ACfYPDjijulcO0luIPfV2oYZ4aLWdAA niumLVXQRaEEK12TO5EF12e9ay/b =aNe8 -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get secure FREE email: http://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger http://www.hushmail.com/services-messenger?l=434 Promote security and make money with the Hushmail Affiliate Program: http://www.hushmail.com/about-affiliate?l=427

2 1

using stunnel for smb networking
by David Bear 28 Dec '04

28 Dec '04

out of curiousity, has anyone been able to use stunnel as a cheap vpn for smb/cifs windows networks? We have a stupid firewall policy that blocks ALL port 139 traffic. Yes, thats good most of the time since microsoft rpc's are notoriously insecure. It does cause a problem when we have other units at other universities with different firewall policies however, so I was hoping to go around the different bureacracies and tunnel it myself. just curious. -- David Bear phone: 480-965-8257 fax: 480-965-9189 College of Public Programs/ASU Wilson Hall 232 Tempe, AZ 85287-0803 "Beware the IP portfolio, everyone will be suspect of trespassing"

1 0

Re: [stunnel-announce] Problem with stunnel 4.06 on FreeBSD andpossibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Jay W. Reffner wrote: > Could you explain the problem on FreeBSD? > Do you think the problems exists in OpenBSD as well? poll() call uses a negative parameter value to indicate an infinite timeout. On some systems (like Linux) any negative value is accepted, while some other systems (like FreeBSD or HP-UX) require -1 here. On affected systems stunnel starts an infinite loop and does not accept any connections. I'm not sure if OpenBSD is affected. Best regards, Mike

1 0

Re: [stunnel-announce] Problem with stunnel 4.06 on FreeBSD andpossibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Jay W. Reffner wrote: > Could you explain the problem on FreeBSD? > Do you think the problems exists in OpenBSD as well? poll() call uses a negative parameter value to indicate an infinite timeout. On some systems (like Linux) any negative value is accepted, while some other systems (like FreeBSD or HP-UX) require -1 here. On affected systems stunnel starts an infinite loop and does not accept any connections. I'm not sure if OpenBSD is affected. Best regards, Mike

1 0

Re: Gmail / Eudora / SpamPal and Stunnel
by Sebastien WILLEMIJNS 28 Dec '04

28 Dec '04

(i copy message i have send via google groups) > I am running Eudora 6.2.0.14, Stunnel-4.04, SpamPal 1,583 maybe try latest build ? > Gmail REQUIRES SSL > A connection to my university email will not SEND over IMAP as you, i cannot send to gmail servers he stops now at (i have used "protocol = smtp" in options) 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:05 LOG7[16629555:16525099]: <- 220 2.0.0 Ready to start TLS. 2004.12.23 23:24:05 LOG5[16629555:16525099]: Protocol negotiation succeded 2004.12.23 23:24:05 LOG7[16629555:16525099]: SSL state (connect): before/connect initialization 2004.12.23 23:24:05 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write client hello A 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server hello A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server certificate A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server done A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write client key exchange A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write change cipher spec A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write finished A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 flush data 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read finished A 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 items in the session cache 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 client connects (SSL_connect()) 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 client connects that finished 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 client renegotiatations requested 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server connects (SSL_accept()) 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server connects that finished 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server renegotiatiations requested 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache hits 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache misses 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache timeouts 2004.12.23 23:24:06 LOG6[16629555:16525099]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 else for mail.vfemail.net:465 /mail.gmx.net:465 without "protocol = smtp" it works well... > Yes I know Spampal and Gmail is "belt and braces" but I have a challenge > here!!!! > Justified "give up you can't" would be equally appreciated so i do... only for gmail...

1 0

ERROR: stunnel-4.06.exe file is linked to missing export ...
by Sebastien WILLEMIJNS 28 Dec '04

28 Dec '04

> When I try to start and test stunnel-4.06 on Windows ME, I get the > following error message: > The STUNNEL-4.06.EXE file is linked to missing export > WS2_32.DLL:freeaddinfo Same thing on Win98SE :X

1 0