Hello,
I've upgraded to stunnel 4.10 yesterday and since this time I can't
managed to get stunnel working with xinetd. I try to access a CVS server
with ssl encryption. If stunnel is started as stand-alone, it works as
before, but when it's started by xinetd all I get is:
cvs [update aborted]: reading from server: Connection reset by peer
I've attached the connection logs with 4.09 and 4.10 as well as my
configuration file (which used to work for more than a year). My xinetd
is version 2.3.13 (and I haven't changed it for several months).
Please, let me know if I'm overlooking at something or if I can try
anything to debug more in depth...
Thanks in advance,
Eric
PS: actually the CVS is accesible from outside, so you might want to try
yourself!
# Sample stunnel configuration file
# Copyright by Michal Trojnara 2002
setuid = root
setgid = root
# Authentication stuff
verify = 2
CAfile = /etc/ssl/stunnel/lifl-cvs.pem
# Use it for client mode
client = yes
#debug = 7
#output = /home/eric/busy/stunnel.log
connect = cvs.lifl.fr:2405
4
5
I wanted to follow up on this. Flyspray did not let me add a comment
since the bug is closed, so I'm posting to the mailing list.
1. I tried using CRLpath (and setting up the symbolic link properly to
the hashed value), but that had the same behavior as CRLfile. It only
reads the actual CRL once. If I update the file on disk, it never
re-reads the file. So I don't see how this is a workaround. Am I missing
something?
2. As I mentioned in my initial report, it is a significant disruption
for existing stunnel processes to be killed. If it were possible just to
kill the main daemon without also killing the child processes (i.e. like
sshd), that could be a workaround. But currently, killing the main
stunnel process also kills all child stunnel processes.
I guess I don't understand what else one could do in this situation,
apart from having the application properly reread the CRL on a regular
basis. (OCSP is not yet available). When you say that "that's how
openssl works", are you saying that the API does not allow you to
reread/reload the CRL file? That seems rather odd. It seems like there
should be some kind of way to refresh the OpenSSL data structures that
store the CRL.
Any thoughts/suggestions would be appreciated.
Thanks,
-Kartik
Michal.Trojnara(a)mirt.net wrote:
> Notice from stunnel
>
> Michal Trojnara (mtrojnar) has closed the following task. You are
> receiving this because you are on the notification list.
>
> Task #7: CRLfile is never refreshed
> The reason for closing is: Not a bug
> That's how OpenSSL work. There are two workarounds:
> 1. Use CRLpath instead of CRLfile (I recommend it).
> 2. Restart stunnel after the CRL file modification.
>
> You can get more information about this task at the following URL:
> http://stunnel.mirt.net/flyspray/index.php?do=details&id=7
>
>
1
0
[stunnel patch] updated transparent proxy on linux 2.6 using cttproxy patch
by MAtteo HCE Valsasna 26 Aug '05
by MAtteo HCE Valsasna 26 Aug '05
26 Aug '05
hello folks,
here comes an improved version of the transparent proxy patch, basically
solving the previous TODO issues.
please try it if you are interested in transparent stunnel.
any feedback il welcome.
the code is heavly based on the examples distributed along with the
cttproxy patch, many thanks to Balzs Scheidler for its great work and to
Lennert Buytenhek for the skaidrus example program.
this code is (re)distributed under the GPL version 2
MAtteo
---README---
cttproxy patch to stunnel
MAtteo HCE Valsasna (matteo dot valsasna at uninsubria dot it)
based on example code in cttproxy patch
ports stunnel transparent proxy to cttproxy kernel patch
allow stunnel server to connect to the application server faking the
stunnel client's IP source address. the server sees connections coming
from the stunnel client's IP address instead of that of the stunnel
server, and thus can apply admission control, bandwidth control,
logging policies as if the client connected directly.
should work 2.4 and 2.6 kernels and 2.0.x cttproxy patch
tested with kernel 2.6.12.5 and cttproxy-2.6.12-2.0.2 patch
setup:
* application server(s):
here run the application(s) you want to access trough stunnel
must route all traffic, or at least all traffic for
transproxyed connections, trough the stunnel server
* stunnel server:
must not be the same host as the application server
grab recent kernel source
patch your kernel source with the appropriate cttproxy patch
(from http://www.balabit.com/products/oss/tproxy/)
configure kernel with:
CONFIG_IP_NF_TPROXY=m
CONFIG_IP_NF_MATCH_TPROXY=m
CONFIG_IP_NF_TARGET_TPROXY=m
make and install kernel
reboot and choose patched kernel
load tproxy kernel modules
# modprobe iptable_tproxy
# modprobe ipt_tproxy
enable ip forwarding (this must act as a router)
# echo 1 > /proc/sys/net/ipv4/ip_forward
grab stunnel source and extract it
$ tar xzf stunnel-4.11.tar.gz
patch it
$ patch -p0 < cttproxy.patch
configure selecting tproxy support
$ ./configure --enable-tproxy
make and install
$ make
# make install
run stunnel in server mode with
transparent = yes
remote = <application server>:<port>
in conf file
* stunnel client
run plain stunnel,
client = yes
remote = stunnel server
* application client
may or may not be the same host as the stunnel client
connect to stunnel client to talk securely to application
server
---PATCH---diff -crb /tmp/stunnel-4.11/configure stunnel-4.11/configure
*** /tmp/stunnel-4.11/configure 2005-07-09 23:00:44.000000000 +0200
--- stunnel-4.11/configure 2005-08-25 16:59:57.000000000 +0200
***************
*** 463,469 ****
# include <unistd.h>
#endif"
! ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA CYGPATH_W PACKAGE VERSION ACLOCAL AUTOCONF AUTOMAKE AUTOHEADER MAKEINFO install_sh STRIP ac_ct_STRIP INSTALL_STRIP_PROGRAM mkdir_p AWK SET_MAKE am__leading_dot AMTAR am__tar am__untar build build_cpu build_vendor build_os host host_cpu host_vendor host_os CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT DEPDIR am__include am__quote AMDEP_TRUE AMDEP_FALSE AMDEPBACKSLASH CCDEPMODE am__fastdepCC_TRUE am__fastdepCC_FALSE EGREP LN_S ECHO AR ac_ct_AR RANLIB ac_ct_RANLIB CPP CXX CXXFLAGS ac_ct_CXX CXXDEPMODE am__fastdepCXX_TRUE am__fastdepCXX_FALSE CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL ssldir RANDOM_FILE USE_DH USE_IPv6 LIBOBJS LTLIBOBJS'
ac_subst_files=''
# Initialize some variables set by options.
--- 463,469 ----
# include <unistd.h>
#endif"
! ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA CYGPATH_W PACKAGE VERSION ACLOCAL AUTOCONF AUTOMAKE AUTOHEADER MAKEINFO install_sh STRIP ac_ct_STRIP INSTALL_STRIP_PROGRAM mkdir_p AWK SET_MAKE am__leading_dot AMTAR am__tar am__untar build build_cpu build_vendor build_os host host_cpu host_vendor host_os CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT DEPDIR am__include am__quote AMDEP_TRUE AMDEP_FALSE AMDEPBACKSLASH CCDEPMODE am__fastdepCC_TRUE am__fastdepCC_FALSE CPP LN_S RANLIB ac_ct_RANLIB EGREP ECHO AR ac_ct_AR CXX CXXFLAGS ac_ct_CXX CXXDEPMODE am__fastdepCXX_TRUE am__fastdepCXX_FALSE CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL ssldir RANDOM_FILE USE_DH USE_IPv6 USE_TPROXY LIBOBJS LTLIBOBJS'
ac_subst_files=''
# Initialize some variables set by options.
***************
*** 1037,1042 ****
--- 1037,1043 ----
--disable-rsa Disable RSA support
--enable-dh Enable DH support
--enable-ipv6 Enable IPv6 support
+ --enable-tproxy Enable linux 2.6 tproxy patch support
--disable-libwrap Disable TCP wrappers library support
Optional Packages:
***************
*** 23166,23171 ****
--- 23344,23367 ----
fi;
+ # use linux 2.[46] tproxy patch
+ echo "$as_me:$LINENO: checking whether to enable transparent proxyng using linux 2.46 tproxy patch" >&5
+ echo $ECHO_N "checking whether to enable transparent proxyng using linux 2.46 tproxy patch... $ECHO_C" >&6
+ # Check whether --enable-tproxy or --disable-tproxy was given.
+ if test "${enable_tproxy+set}" = set; then
+ enableval="$enable_tproxy"
+ echo "$as_me:$LINENO: result: yes" >&5
+ echo "${ECHO_T}yes" >&6; cat >>confdefs.h <<\_ACEOF
+ #define USE_TPROXY 1
+ _ACEOF
+
+ else
+ echo "$as_me:$LINENO: result: no" >&5
+ echo "${ECHO_T}no" >&6
+
+ fi;
+
+
# Disable use of libwrap (TCP wrappers)
# it should be the last check!
echo "$as_me:$LINENO: checking whether to disable TCP wrappers library support" >&5
***************
*** 23987,23992 ****
--- 24184,24190 ----
s,@RANDOM_FILE@,$RANDOM_FILE,;t t
s,@USE_DH@,$USE_DH,;t t
s,@USE_IPv6@,$USE_IPv6,;t t
+ s,@USE_TPROXY@,$USE_TPROXY,;t t
s,@LIBOBJS@,$LIBOBJS,;t t
s,@LTLIBOBJS@,$LTLIBOBJS,;t t
CEOF
diff -crb /tmp/stunnel-4.11/configure.ac stunnel-4.11/configure.ac
*** /tmp/stunnel-4.11/configure.ac 2005-07-09 22:58:05.000000000 +0200
--- stunnel-4.11/configure.ac 2005-08-25 16:56:33.000000000 +0200
***************
*** 14,21 ****
--- 14,24 ----
if test "$GCC" = "yes"
then CFLAGS="$CFLAGS -Wall -Wshadow -Wcast-align -Wpointer-arith"
fi
+ AC_PROG_CPP
AC_PROG_INSTALL
+ AC_PROG_LN_S
AC_PROG_MAKE_SET
+ AC_PROG_RANLIB
# Checks for typedefs, structures, and compiler characteristics
# AC_C_CONST
***************
*** 254,259 ****
--- 257,271 ----
)
AC_SUBST(USE_IPv6)
+ # use linux 2.[46] tproxy patch
+ AC_MSG_CHECKING([whether to enable transparent proxyng using linux 2.[46] tproxy patch])
+ AC_ARG_ENABLE(tproxy,
+ [ --enable-tproxy Enable linux 2.6 tproxy patch support],
+ [AC_MSG_RESULT([yes]); AC_DEFINE(USE_TPROXY)],
+ [AC_MSG_RESULT([no])]
+ )
+ AC_SUBST(USE_TPROXY)
+
# Disable use of libwrap (TCP wrappers)
# it should be the last check!
AC_MSG_CHECKING([whether to disable TCP wrappers library support])
diff -crb /tmp/stunnel-4.11/src/client.c stunnel-4.11/src/client.c
*** /tmp/stunnel-4.11/src/client.c 2005-07-02 08:55:58.000000000 +0200
--- stunnel-4.11/src/client.c 2005-08-26 16:01:34.000000000 +0200
***************
*** 44,49 ****
--- 44,65 ----
#define SHUT_RDWR 2
#endif
+ #ifdef USE_TPROXY
+ #define LINUX_NETFILTER
+ #define LINUX_TPROXY
+ #define TPROXY_MAJOR_VERSION(x) ((x >> 24) & 0xff)
+ #define TPROXY_MINOR_VERSION(x) ((x >> 16) & 0xff)
+ #define TPROXY_PATCH_VERSION(x) (x & 0xffff)
+ #endif
+
+ /* transparent proxy */
+ #ifdef LINUX_NETFILTER
+ #include <linux/netfilter_ipv4.h>
+ #endif
+ #ifdef LINUX_TPROXY
+ #include <linux/netfilter_ipv4/ip_tproxy.h>
+ #endif
+
/* TCP wrapper */
#ifdef USE_LIBWRAP
#include <tcpd.h>
***************
*** 77,82 ****
--- 93,103 ----
static int connect_wait(CLI *, int, int);
static void reset(int, char *);
+ #ifdef USE_TPROXY
+ static int determine_source_address(struct sockaddr_in *destination,
+ struct sockaddr_in *source);
+ #endif
+
int max_clients;
#ifndef USE_WIN32
int max_fds;
***************
*** 921,926 ****
--- 942,954 ----
int s; /* destination socket */
u16 i;
+ // struct in_addr *local=NULL;
+ #ifdef USE_TPROXY
+ int f;
+ struct in_tproxy itp;
+ struct sockaddr_in tproxy_sin;
+ #endif
+
/* setup address_list */
if(c->opt->option.delayed_lookup) {
resolved_list.num=0;
***************
*** 945,959 ****
if(alloc_fd(s))
return -1;
! if(c->bind_addr.num) { /* explicit local bind or transparent proxy */
memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION));
if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) {
sockerror("bind transparent");
closesocket(s);
return -1;
}
}
/* try to connect for the 1st time */
s_ntop(c->connecting_address, &addr);
s_log(LOG_DEBUG, "%s connecting %s",
--- 973,1066 ----
if(alloc_fd(s))
return -1;
! if(c->bind_addr.num
! #ifdef USE_TPROXY
! /* if we're using the tproxy patch, transparent proxy is
! handled below */
! && !c->opt->option.transparent
! #endif
! ) {
! /* explicit local bind, not tproxy transparent mode */
!
memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION));
if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) {
sockerror("bind transparent");
closesocket(s);
return -1;
}
+ sockerror("local bind succeeded");
}
+ #ifdef USE_TPROXY
+ if (c->opt->option.transparent){
+ /* transparent proxy support on 2.[46] linux kernels */
+ /* added by MAtteo HCE Valsasna (matteo.valsasna(a)uninsubria.it), 20050826 */
+ /* requires tproxy kernel patch (http://www.balabit.com/products/oss/tproxy */
+ /* based on examples in cttproxy patch */
+ /* this patch is released under the GNU General Public Licence, Version 2 */
+
+ memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION));
+
+ /* check tproxy version */
+ itp.op = TPROXY_VERSION;
+ itp.v.version = 0x00000000;
+
+ getsockopt(s, SOL_IP, IP_TPROXY, &itp, &f);
+ s_log(LOG_NOTICE, "TPROXY_VERSION: %d.%d.%d",
+ TPROXY_MAJOR_VERSION(itp.v.version),
+ TPROXY_MINOR_VERSION(itp.v.version),
+ TPROXY_PATCH_VERSION(itp.v.version));
+
+ /* conservative: accepting only tproxy version 2.0.x */
+ if (TPROXY_MAJOR_VERSION(itp.v.version) != 2 ||
+ TPROXY_MINOR_VERSION(itp.v.version) != 0)
+ {
+ s_log(LOG_ERR, "unsupported tproxy version: %x (2.0.x required)", itp.v.version);
+ return -1;
+ }
+
+ tproxy_sin.sin_family = AF_INET;
+ if (determine_source_address(&addr.in, &tproxy_sin) < 0){
+ sockerror("determine_source_address");
+ return -1;
+ }
+
+ /* do not request a specific source port */
+ tproxy_sin.sin_port = htons(0);
+
+ /* bind to local source address */
+ /* needed for tproxy magic */
+ if (bind(s, (struct sockaddr *) &tproxy_sin, sizeof(tproxy_sin)) == -1)
+ {
+ sockerror("bind");
+ return -1;
+ }
+ s_log(LOG_NOTICE, "bound to local: %s", inet_ntoa(tproxy_sin.sin_addr));
+
+ /* assign foreign address */
+ itp.op = TPROXY_ASSIGN;
+ itp.v.addr.faddr = bind_addr.in.sin_addr;
+ itp.v.addr.fport = 0;
+
+ if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1)
+ {
+ s_log(LOG_NOTICE, "error assigning foreign address: %s", inet_ntoa(bind_addr.in.sin_addr));
+ sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)");
+ return -1;
+ }
+ s_log(LOG_NOTICE, "assigned foreign address: %s", inet_ntoa(bind_addr.in.sin_addr));
+
+ /* set connect flag on socket */
+ itp.op = TPROXY_FLAGS;
+ itp.v.flags = ITP_CONNECT|ITP_ONCE;
+ if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1)
+ {
+ sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)");
+ return -1;
+ }
+ }
+ #endif
+
/* try to connect for the 1st time */
s_ntop(c->connecting_address, &addr);
s_log(LOG_DEBUG, "%s connecting %s",
***************
*** 1020,1023 ****
--- 1127,1175 ----
log_error(LOG_DEBUG, get_last_socket_error(), txt);
}
+
+ #ifdef USE_TPROXY
+
+ /* from skaidrus */
+ static int determine_source_address(struct sockaddr_in *destination,
+ struct sockaddr_in *source)
+ {
+ struct sockaddr_in addr;
+ socklen_t addrlen;
+ char textaddr[32];
+ int sock;
+
+ sock = socket(AF_INET, SOCK_DGRAM, 0);
+ if (sock < 0) {
+ syslog(LOG_CRIT, "determine_source_address: error "
+ "%d while creating socket", errno);
+ abort();
+ }
+
+ addr = *destination;
+ addr.sin_port = htons(80);
+ if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
+ syslog(LOG_ALERT, "determine_source_address: error %d "
+ "while looking up route for %d", errno,
+ inet_aton(textaddr, &(addr.sin_addr)));
+ close(sock);
+ return -1;
+ }
+
+ addrlen = sizeof(*source);
+ if (getsockname(sock, (struct sockaddr *)source, &addrlen) < 0) {
+ syslog(LOG_CRIT, "determine_source_address: error %d "
+ "while retrieving source address", errno);
+ abort();
+ }
+ source->sin_port = 0;
+
+ close(sock);
+
+ return 0;
+ }
+
+ #endif
+
+
/* End of client.c */
1
0
Hello Michal,
Just one thought:
- if the stunnel on LAN1 joins a group to receive a multicasted
stream does it really depend on DTLS's [in]ability to handle the
multicasting?
I see it this way - on LAN1 a machine running the (first instance of)
stunnel joins a group, i.e. stunnel is told to open a socket with all
the relevant socket options. Then, another machine on LAN2 (behind
NAT + firewall + internet + firewall + NAT) connects to the first
stunnel and tells it's own instance of stunnel to open a socket with
all the relevant socket options to emit the (apparently) multicasted
stream.
Please comment.
--
Best regards,
Tony
2
2
[stunnel patch] transparent proxy on linux 2.6 using cttproxy patch
by MAtteo HCE Valsasna 22 Aug '05
by MAtteo HCE Valsasna 22 Aug '05
22 Aug '05
hi folks:
as suggested in http://www.stunnel.org/faq/transparent.html#ToC3, I
modified the stunnel code to use the transparent proxy funcionality on
2.6 (and possibly 2.4) linux kernels with the cttproxy patch
(http://www.balabit.com/products/oss/tproxy/, I
used )cttproxy-2.6.12-2.0.2. on a clean 2.6.12.5 kernel)
the patch is higly incomplete, but it works (see TODO).
please try it if you are interested in transparent stunnel.
any feedback il welcome.
MAtteo
the code is heavly based on the examples distributed along with the
cttproxy patch, many thanks to Balázs Scheidler for its great work and
for making it GPL.
with this patch, I was able to run a stunnel in server mode with the
transparent option, and the application server I connected to saw the IP
address of the stunnel client.
of course, this code il also redistributed under the GPL.
conditions for running stunnel in transparent mode:
if you want to try this patch, you MUST modify the hardcoded IP address
in client.c to the IP address of the stunnel server (look for DOIT! in
the source code). any improvements wellcome.
the stunnel server must run a linux kernel patched with the cttproxy
patch
the stunnel server and the application server cannot be the same host
the application server must believe that it has to route all packets of
transparently tunneled connections via the stunnel server. thus the two
server should be on the same subnet.
I was also able to use linux policy routing to avoid modifying the
general routing on the application server: transparently tunneled
connections are directed to a different IP on the application server,
where a policy rule applies a specific routing table to packets with
that source address (see at the end of this message).
TODO:
stunnel must explicitly bind to an *existing* local address (not
loopback) before calling setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)").
now the address is hardcoded in the patch, it should
automatically find a local address to bind to (or get it from the config
file)
now the code will only run with tproxy patch version 2.0.2
it should be less strict about tproxy version (make it a configurable
option in stunnel?).
which tproxy version will it run with?
auto detect or configure kernel version (2.2 vs 2.4 or 2.6 with
cttproxy), or better add it in .configure
----begin patch-----
*** /tmp/stunnel-4.11/src/client.c 2005-07-02 08:55:58.000000000 +0200
--- stunnel-4.11/src/client.c 2005-08-22 12:19:57.000000000 +0200
***************
*** 44,49 ****
--- 44,60 ----
#define SHUT_RDWR 2
#endif
+ #define LINUX_NETFILTER
+ #define LINUX_TPROXY
+
+ /* transparent proxy */
+ #ifdef LINUX_NETFILTER
+ #include <linux/netfilter_ipv4.h>
+ #endif
+ #ifdef LINUX_TPROXY
+ #include <linux/netfilter_ipv4/ip_tproxy.h>
+ #endif
+
/* TCP wrapper */
#ifdef USE_LIBWRAP
#include <tcpd.h>
***************
*** 921,926 ****
--- 932,944 ----
int s; /* destination socket */
u16 i;
+ // struct in_addr *local=NULL;
+ #ifdef LINUX_TPROXY
+ int f;
+ struct in_tproxy itp;
+ struct sockaddr_in tproxy_sin;
+ #endif
+
/* setup address_list */
if(c->opt->option.delayed_lookup) {
resolved_list.num=0;
***************
*** 945,960 ****
if(alloc_fd(s))
return -1;
! if(c->bind_addr.num) { /* explicit local bind or transparent proxy */
! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION));
! if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) {
! sockerror("bind transparent");
! closesocket(s);
! return -1;
! }
! }
!
! /* try to connect for the 1st time */
s_ntop(c->connecting_address, &addr);
s_log(LOG_DEBUG, "%s connecting %s",
c->opt->servname, c->connecting_address);
--- 963,1053 ----
if(alloc_fd(s))
return -1;
! if(c->bind_addr.num && !c->opt->option.transparent) {
! /* explicit local bind, not transparent mode */
!
! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION));
! if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) {
! sockerror("bind transparent");
! closesocket(s);
! return -1;
! }
! sockerror("local bind succeeded");
! }
!
! if (c->opt->option.transparent){
!
! /* transparent proxy support on 2.[46] linux kernels */
! /* added by MAtteo HCE Valsasna (matteo.valsasna(a)uninsubria.it), 20050822 */
! /* requires tproxy kernel patch (http://www.balabit.com/products/oss/tproxy */
! /* based on examples in cttproxy patch */
!
! /* FIXME: should detect 2.2 kernel or 2.[46] + cttproxy patch and use appropriate code */
!
! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION));
!
! /* check tproxy version */
! itp.op = TPROXY_VERSION;
! itp.v.version = 0x00000000;
!
! getsockopt(s, SOL_IP, IP_TPROXY, &itp, &f);
! s_log(LOG_NOTICE, "pre getsockopt(s, SOL_IP, IP_TPROXY): %x", itp.v.version);
!
! /* FIXME: should accept a range of tproxy versions - which? */
!
! if (itp.v.version != 0x02000002) {
! itp.v.version = 0x02000002;
! if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1)
! {
! sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)");
! getsockopt(s, SOL_IP, IP_TPROXY, &itp, &f);
! s_log(LOG_NOTICE, "err getsockopt(s, SOL_IP, IP_TPROXY): %x", itp.v.version);
! return -1;
! }
! }
! else{
! s_log(LOG_NOTICE, "getsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION) returned right version");
! }
!
! /* bind to local address */
! /* FIXME: must become dynamic */
! tproxy_sin.sin_family = AF_INET;
! /* DOIT! add a local IP address here */
! inet_aton("192.168.179.71", &tproxy_sin.sin_addr);
! /* do not request a specific source port */
! tproxy_sin.sin_port = htons(0);
!
! if (bind(s, (struct sockaddr *) &tproxy_sin, sizeof(tproxy_sin)) == -1)
! {
! sockerror("bind");
! return -1;
! }
! s_log(LOG_NOTICE, "bound to local: %s", inet_ntoa(tproxy_sin.sin_addr));
!
! /* assign foreign address */
! itp.op = TPROXY_ASSIGN;
! itp.v.addr.faddr = bind_addr.in.sin_addr;
! itp.v.addr.fport = 0;
!
! if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1)
! {
! s_log(LOG_NOTICE, "error assigning foreign address: %s", inet_ntoa(bind_addr.in.sin_addr));
! sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)");
! return -1;
! }
! s_log(LOG_NOTICE, "assigned foreign address: %s", inet_ntoa(bind_addr.in.sin_addr));
!
! /* set connect flag on socket */
! itp.op = TPROXY_FLAGS;
! itp.v.flags = ITP_CONNECT|ITP_ONCE;
! if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1)
! {
! sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)");
! return -1;
! }
! }
!
! /* try to connect for the 1st time */
s_ntop(c->connecting_address, &addr);
s_log(LOG_DEBUG, "%s connecting %s",
c->opt->servname, c->connecting_address);
----end patch-----
EXTRAS
source routing on the application server
intended usage: the application server is a squid proxy with pubblic
adresses. its default gw is an HW-based router (not the transparent
stunnel server).
we want normal traffic (i.e. not handled by transparent stunnel) to
continue to use normal routing. only traffic handled by stunnel should
be routed back to the stunnel server.
a new IP address (10.0.0.1) is added on the application server
specifically for this purpose. stunnel server will forward connections
to this address, normal clients will use another address. then, only
traffic originating from this address needs to be routed back to the
stunnel server.
the stunnel server has IP 10.0.0.254 (but it can have more, of course)
in /etc/iproute2/rt_tables add a line defining a new routing table:
10 inr.tproxy
# add a rule to the new routing table
ip r a table inr.tproxy default via 10.0.0.254
# create ip policy routing rule: packets with source address =
# 10.0.0.1 should be routed according to the inr.tproxy table
ip rule add type unicast from 10.0.0.1 table inr.tproxy priority 220
# apply policy routing changes
ip route flush cache
1
0
Hello Michal,
OK. Securing a plain UDP will suffice at first!
Are there any plans to use DTLS?
Thank you in advance.
--
Best regards,
Tony
1
0
Hello stunnel-users,
OpenSSL from v0.9.8 onwards (I'm told) supports a thing called DTLS.
On the OpenSSL's list I was told that it's the tool one needs to use
for UDP tunneling.
Are there any plans to use this OpenSSL's functionality in the
stunnel?
I need to securely tunnel the UDP traffic, namely multicasted
datagramms.
--
Best regards,
Tony.
2
1
Folks,
I'm in need of some help in setting up stunnel on windows, I get
either
Error reading certificate file: {path}/stunnel.pem
{path}/stunnel.pem: No such process (3)
So I am assuming the second error {path}/stunnel.pem: No such process
(3) the path statement is correct and therefore something else is not
correct but I have no idea where and what
Regards
Paul
1
0
Hello,
We are having a problem with our application using STUNNEL and are
stuck. I have detailed the issue below with more detailed info about
our setup. I am not very familiar with the SSL protocol so I am having
trouble identifying the differences between the log samples I posted to
determine what the issue may be. Any help would be greatly appreciated.
Thanks,
Salar Madadi
- Latest Developments Inc.
Problem Description ************************************
We are using Stunnel to provide an HTTPS client for use with the UPS
ShipXML service. Our application is an xBase++ 1.82 service using the
XB2.NET library, running on a windows 2003 server. The application
opens a connection to stunnel, which then connects to the UPS https
server to send and retrieve an xml response with shipping data. UPS
made a change to their service last week related to load balancing and
our application has not worked since then. When we send an XML document
to UPS we receive the exact same XML document back as if it has been
bounced instead of the proper response. Our setup was working until
they made the change and they have no idea what is going on.
Stunnel Version *****************************************
The problem initially happened with stunnel v. 4.05 and openSSL v.
0.9.7c. I have also tried it with stunnel v. 4.11 and openSSL v. 0.9.7f
and the same result occurs.
Stunnel.conf settings ***********************************
#Stunnel server configuration file
key=stunnel.pem
#up this number to 7 to get full log details
#leave it at 3 to just get critical error messages
debug=7
output=test.log
client=yes
verify=0
[psuedo-https]
accept = 8080
connect = www.ups.com:443
TIMEOUTclose = 0
Stunnel log samples **************************************
Here are some log samples. The first is a log sample of when it was
working. The second is one when it stopped working and the third is
from when it was still not working using the latest version of
stunnel/openssl.
LOG 1 - Working
2005.05.24 23:37:39 LOG7[184:2796]: psuedo-https accepted FD=216 from
127.0.0.1:3349
2005.05.24 23:37:39 LOG7[184:2796]: FD 216 in non-blocking mode
2005.05.24 23:37:39 LOG7[184:2796]: Creating a new thread
2005.05.24 23:37:39 LOG7[184:2796]: New thread created
2005.05.24 23:37:39 LOG7[184:1840]: psuedo-https started
2005.05.24 23:37:39 LOG5[184:1840]: psuedo-https connected from
127.0.0.1:3349
2005.05.24 23:37:39 LOG7[184:1840]: FD 208 in non-blocking mode
2005.05.24 23:37:39 LOG7[184:1840]: psuedo-https connecting
153.2.228.50:443
2005.05.24 23:37:39 LOG7[184:1840]: remote connect #1: EWOULDBLOCK:
retrying
2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: FD=208, DIR=write
2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: ok
2005.05.24 23:37:39 LOG7[184:1840]: Remote FD=208 initialized
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): before/connect
initialization
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write
client hello A
2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: FD=208, DIR=read
2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: ok
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read
server hello A
2005.05.24 23:37:39 LOG5[184:1840]: VERIFY IGNORE: depth=1, /C=US/O=RSA
Data Security, Inc./OU=Secure Server Certification Authority
2005.05.24 23:37:39 LOG5[184:1840]: VERIFY IGNORE: depth=1, /C=US/O=RSA
Data Security, Inc./OU=Secure Server Certification Authority
2005.05.24 23:37:39 LOG5[184:1840]: VERIFY IGNORE: depth=0, /C=US/ST=New
Jersey/L=Mahwah/O=United Parcel Service/OU=Internet
Systems/CN=www.ups.com
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read
server certificate A
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read
server done A
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write
client key exchange A
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write
change cipher spec A
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write
finished A
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 flush
data
2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: FD=208, DIR=read
2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: ok
2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read
finished A
2005.05.24 23:37:39 LOG7[184:1840]: 3 items in the session cache
2005.05.24 23:37:39 LOG7[184:1840]: 3 client connects (SSL_connect())
2005.05.24 23:37:39 LOG7[184:1840]: 3 client connects that finished
2005.05.24 23:37:39 LOG7[184:1840]: 0 client renegotiatations
requested
2005.05.24 23:37:39 LOG7[184:1840]: 0 server connects (SSL_accept())
2005.05.24 23:37:39 LOG7[184:1840]: 0 server connects that finished
2005.05.24 23:37:39 LOG7[184:1840]: 0 server renegotiatiations
requested
2005.05.24 23:37:39 LOG7[184:1840]: 0 session cache hits
2005.05.24 23:37:39 LOG7[184:1840]: 0 session cache misses
2005.05.24 23:37:39 LOG7[184:1840]: 0 session cache timeouts
2005.05.24 23:37:39 LOG6[184:1840]: Negotiated ciphers: RC4-SHA
SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
2005.05.24 23:37:40 LOG7[184:1840]: SSL alert (read): warning: close
notify
2005.05.24 23:37:40 LOG7[184:1840]: SSL closed on SSL_read
2005.05.24 23:37:40 LOG7[184:1840]: SSL write shutdown (output buffer
empty)
2005.05.24 23:37:40 LOG7[184:1840]: Socket write shutdown (output buffer
empty)
2005.05.24 23:37:40 LOG7[184:1840]: SSL alert (write): warning: close
notify
2005.05.24 23:37:40 LOG6[184:1840]: SSL_shutdown successfully sent
close_notify
2005.05.24 23:37:40 LOG7[184:1840]: Socket closed on read
2005.05.24 23:37:40 LOG5[184:1840]: Connection closed: 726 bytes sent to
SSL, 648 bytes sent to socket
2005.05.24 23:37:40 LOG7[184:1840]: psuedo-https finished (0 left)
LOG 2 - NOT WORKING
2005.08.15 15:46:07 LOG7[2636:3432]: psuedo-https accepted FD=180 from
127.0.0.1:3141
2005.08.15 15:46:07 LOG7[2636:3432]: FD 180 in non-blocking mode
2005.08.15 15:46:07 LOG7[2636:3432]: Creating a new thread
2005.08.15 15:46:07 LOG7[2636:3432]: New thread created
2005.08.15 15:46:07 LOG7[2636:1316]: psuedo-https started
2005.08.15 15:46:07 LOG5[2636:1316]: psuedo-https connected from
127.0.0.1:3141
2005.08.15 15:46:07 LOG7[2636:1316]: FD 172 in non-blocking mode
2005.08.15 15:46:07 LOG7[2636:1316]: psuedo-https connecting
65.171.127.243:443
2005.08.15 15:46:07 LOG7[2636:1316]: remote connect #1: EWOULDBLOCK:
retrying
2005.08.15 15:46:07 LOG7[2636:1316]: waitforsocket: FD=172, DIR=write
2005.08.15 15:46:07 LOG7[2636:1316]: waitforsocket: ok
2005.08.15 15:46:07 LOG7[2636:1316]: remote connect #2: EINVAL: ok
2005.08.15 15:46:07 LOG7[2636:1316]: Remote FD=172 initialized
2005.08.15 15:46:07 LOG7[2636:1316]: SSL state (connect): before/connect
initialization
2005.08.15 15:46:07 LOG7[2636:1316]: SSL state (connect): SSLv3 write
client hello A
2005.08.15 15:46:07 LOG7[2636:1316]: waitforsocket: FD=172, DIR=read
2005.08.15 15:46:12 LOG7[2636:1316]: waitforsocket: ok
2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 read
server hello A
2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 read
finished A
2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 write
change cipher spec A
2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 write
finished A
2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 flush
data
2005.08.15 15:46:12 LOG7[2636:1316]: 17 items in the session cache
2005.08.15 15:46:12 LOG7[2636:1316]: 230 client connects
(SSL_connect())
2005.08.15 15:46:12 LOG7[2636:1316]: 230 client connects that finished
2005.08.15 15:46:12 LOG7[2636:1316]: 0 client renegotiatations
requested
2005.08.15 15:46:12 LOG7[2636:1316]: 0 server connects (SSL_accept())
2005.08.15 15:46:12 LOG7[2636:1316]: 0 server connects that finished
2005.08.15 15:46:12 LOG7[2636:1316]: 0 server renegotiatiations
requested
2005.08.15 15:46:12 LOG7[2636:1316]: 213 session cache hits
2005.08.15 15:46:12 LOG7[2636:1316]: 0 session cache misses
2005.08.15 15:46:12 LOG7[2636:1316]: 0 session cache timeouts
2005.08.15 15:46:12 LOG6[2636:1316]: Negotiated ciphers: AES256-SHA
SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2005.08.15 15:46:14 LOG7[2636:1316]: SSL_read returned WANT_: retrying
2005.08.15 15:46:14 LOG7[2636:1316]: SSL_read returned WANT_: retrying
2005.08.15 15:46:14 LOG7[2636:1316]: SSL alert (read): warning: close
notify
2005.08.15 15:46:14 LOG7[2636:1316]: SSL closed on SSL_read
2005.08.15 15:46:14 LOG7[2636:1316]: SSL write shutdown (output buffer
empty)
2005.08.15 15:46:14 LOG7[2636:1316]: Socket write shutdown (output
buffer empty)
2005.08.15 15:46:14 LOG7[2636:1316]: SSL alert (write): warning: close
notify
2005.08.15 15:46:14 LOG6[2636:1316]: SSL_shutdown successfully sent
close_notify
2005.08.15 15:46:14 LOG5[2636:1316]: Connection closed: 738 bytes sent
to SSL, 5754 bytes sent to socket
2005.08.15 15:46:14 LOG7[2636:1316]: psuedo-https finished (0 left)
LOG 3 - NOT WORKING WITH LATEST VERSION OF STUNNEL/OPENSSL
2005.08.18 20:45:13 LOG7[2212:3324]: psuedo-https accepted FD=164 from
127.0.0.1:1076
2005.08.18 20:45:13 LOG7[2212:3324]: Creating a new thread
2005.08.18 20:45:13 LOG7[2212:3324]: New thread created
2005.08.18 20:45:13 LOG7[2212:3388]: psuedo-https started
2005.08.18 20:45:13 LOG7[2212:3388]: FD 164 in non-blocking mode
2005.08.18 20:45:13 LOG5[2212:3388]: psuedo-https connected from
127.0.0.1:1076
2005.08.18 20:45:13 LOG7[2212:3388]: FD 188 in non-blocking mode
2005.08.18 20:45:13 LOG7[2212:3388]: psuedo-https connecting
153.2.228.50:443
2005.08.18 20:45:13 LOG7[2212:3388]: connect_wait: waiting 10 seconds
2005.08.18 20:45:13 LOG7[2212:3388]: connect_wait: connected
2005.08.18 20:45:13 LOG7[2212:3388]: Remote FD=188 initialized
2005.08.18 20:45:16 LOG5[2212:3388]: VERIFY IGNORE: depth=1, /C=US/O=RSA
Data Security, Inc./OU=Secure Server Certification Authority
2005.08.18 20:45:16 LOG5[2212:3388]: VERIFY IGNORE: depth=1, /C=US/O=RSA
Data Security, Inc./OU=Secure Server Certification Authority
2005.08.18 20:45:16 LOG5[2212:3388]: VERIFY IGNORE: depth=0,
/C=US/ST=New Jersey/L=Mahwah/O=United Parcel Service/OU=Internet
System/OU=Terms of use at www.verisign.com/rpa (c)05/CN=www.ups.com
2005.08.18 20:45:17 LOG6[2212:3388]: SSL connected: new session
negotiated
2005.08.18 20:45:17 LOG6[2212:3388]: Negotiated ciphers: RC4-SHA
SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
2005.08.18 20:45:20 LOG7[2212:3388]: SSL_read returned WANT_READ:
retrying
2005.08.18 20:45:20 LOG7[2212:3388]: SSL_read returned WANT_READ:
retrying
2005.08.18 20:45:20 LOG7[2212:3388]: SSL closed on SSL_read
2005.08.18 20:45:20 LOG7[2212:3388]: Socket write shutdown
2005.08.18 20:45:20 LOG7[2212:3388]: SSL write shutdown
2005.08.18 20:45:20 LOG6[2212:3388]: SSL_shutdown successfully sent
close_notify
2005.08.18 20:45:20 LOG5[2212:3388]: Connection closed: 738 bytes sent
to SSL, 8248 bytes sent to socket
2005.08.18 20:45:20 LOG7[2212:3388]: psuedo-https finished (0 left)
Output of stunnel.exe -version *************************************
stunnel 4.11 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7f 22 Mar
2005
Global options
cert = stunnel.pem
ciphers = ALL:!ADH:+RC4:@STRENGTH
debug = 5
key = stunnel.pem
RNDbytes = 64
RNDoverwrite = yes
service = stunnel
session = 300 seconds
taskbar = yes
verify = none
Service-level options
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTconnect = 10 seconds
TIMEOUTidle = 43200 seconds
2005.08.18 21:06:04 LOG3[2508:3100]: Server is down
2
1
18 Aug '05
Hi,
There is a trivial to exploit Local Privilege Escalation when stunnel
is installed as a system service on windows.
Who should I inform of this so a fix can be made?
Thanks
Ian
--
5
4