- stunnel-users - stunnel.org

Problem with roundrobbin failover mode?
by Matt Wise 01 May '13

01 May '13

I've got dozens of clients connecting with Stunnel to a group of 5 servers. Each system has a config that looks like this: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > delay = yes > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > session = 86400 > debug = 5 > [zookeeper] > accept = 127.0.0.1:2182 > failover = rr > connect = prod-zookeeper:2182 > connect = prod-zookeeper-1:2182 > connect = prod-zookeeper-2:2182 > connect = prod-zookeeper-3:2182 > connect = prod-zookeeper-4:2182 > connect = prod-zookeeper-5:2182 Essentially the first host is a load balancer, and the next 5 are the actual zookeeper hosts so that we can bypass the ELB if its giving us fits. Now what we're seeing is that almost every connection ends up on prod-zookeeper-5. Over and over and over again, our hosts pick the same system each time. We're running Stunnel 4.52: > Clients allowed=8000 > stunnel 4.52 on i486-pc-linux-gnu platform > Compiled/running with OpenSSL 0.9.8k 25 Mar 2009 > Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 Any ideas what might be wrong here? Obviously we want the connections to be *roughly* random across the list of hosts... and if one of the hosts goes down, and the connection fails, we want the stunnel service to try again, and randomly pick a new host. It doesn't really seem to be doing that though. --Matt

3 8

help on Linux stunnel setup
by Valerio.FABRIZIO＠sungard.com 26 Apr '13

26 Apr '13

Hello all! I'm in charge of activating stunnel to connect a service to a remote service. Since I'm totally new on this product, I'd be grateful if someone could help me in configuring. This is where I stand: Stunnel version: stunnel 4.29 on x86_64-unknown-linux-gnu with OpenSSL 1.0.0-fips 29 Mar 2010 OS: Linux 2.6.32-220.23.1.el6.x86_64 #1 SMP Mon Jun 18 18:58:52 BST 2012 x86_64 x86_64 x86_64 GNU/Linux I'd need to have it started by non-root user, and I have loaded under a specific path (owned by the same user): Stunnel.conf: ; Sample stunnel configuration file ;cert = FXMS1.pem client = yes output = /export/home/bg_mtsbv/slev5fix/log pid = /export/home/bg_mtsbv/slev5fix/conf/stunnel.pid [ssl01] accept = 127.0.0.1:18889 connect = 193.203.229.143:443 Stunnel.pid (empty) xxx.pem (certificate has been provided by the owner of the target server) my first two questions: which is the correct command line to be launched? Is it correct to have all the files under the user's directory? Many thanks in advance for your help! Regards, Valerio

1 0

Inconsistent performance across stunnel and/or OpenSSL versions
by PPingPongBaker PPingPongBaker 23 Apr '13

23 Apr '13

Hi All, I am experimenting with stunnel inside a VM on Xenserver 6.02. So this may not be a "common" use case, nonetheless, I would like to point out the issue. It is a basic setup as follows with 3 VMs running "ab" for webclient, stunnel+haproxy combo as the https/http bridge and nginx as the webserver. client VM (ab) <-> stunnel + haproxy VM <-> webserver VM (nginx) Specs on the stunnel VM are 2GB RAM, single-core dedicated 2.5 GHz Xeon E5-2640 vCPU, running Debian Squeeze 2.6.32-5-amd64 (64 bit) kernel. All things unchanged such as stunnel/haproxy/nginx config and taking care of common gotchas such as file descriptor limit, TIMEOUTclose, disabling libwrap, etc. stunnel is built with pthreads. Also stunnel is configured to use a 2K RSA self-signed certificate, and the client is being forced to do TLS1. "ab" is invoked with "-c 4" so as to peg the stunnel VM CPU (any value beyond 4 doesn't seem to matter). nginx serves a tiny 32 byte static html file. With stunnel 4.29 and OpenSSL 0.9.8o, I get 300 requests per second as max throughput. With stunnel 4.56 and OpenSSL 1.0.1e, I get only 40 requests per second as max throughput. tcpdump tells me that the Server Hello sent to the client takes a longer time in the latter case. Tinkering with TCP_NODELAY doesn't change anything. Anyone else seeing this maybe even on physical hardware? Has anything changed in OpenSSL across those versions? Suggestions? Thanks.

4 10

Windows Failover Clustering Support
by Cynthia Haselton 22 Apr '13

22 Apr '13

All, A (hopefully) quick question: Is stunnel supported on Windows Failover Clusters...specifically as a clustered service or to encrypt connections to/from a clustered IP? Thanks in advance, CJH

2 4

Customizing encryption
by John 19 Apr '13

19 Apr '13

HI guys, I need to take off SSL and use another encryption, need some hints since i'm new to stunnel. Thanks in advance,John

1 0

limited number of ports
by Terren Suydam 09 Apr '13

09 Apr '13

Hi, There appears to be a limit to the number of services you can define. Services beyond the 64th service appear to get set up without any log warnings or errors, yet don't pass traffic. The code uses select() & FD_SET to accept() an incoming connection & in Windows (using Windows Server 2008) the default is 64 sockets for that so wondering if I can just recompile, setting FD_SETSIZE to something larger. I'll try it either way, just wanted to put it out there to see if anyone else has ever run into this. Thanks, Terren

4 10

Trying to Upgrade stunnel, but compile isn't working?
by Michael D. Setzer II 03 Apr '13

03 Apr '13

I have been using stunnel for a long time, but was just trying to compile the latest version from source, and it compiles, but doesn't work like the older version, so I must have some option wrong. With the current version on my Fedora 14 machine using the latest version it loads the stunnel ports and works, but the newer version does seem to load or give an error message. I've tested the stunnel from Fedora 16 and Fedora 17, and they work fine with the stunnel.conf to load the settings. Current version info from Fedora 14 system. stunnel 4.34 on x86_64-redhat-linux-gnu with OpenSSL 1.0.0e-fips 6 Sep 2011 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 curve = sect163r2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none The new build does this. stunnel 4.56 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0e-fips 6 Sep 2011 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Have also tried it with --disable-fips With the new version I have to provide the /etc/stunnel/stunnel.conf, but it doesn't load any of the options. Sure it is just a simple configure setting I am missing. Thanks. +----------------------------------------------------------+ Michael D. Setzer II - Computer Science Instructor Guam Community College Computer Center mailto:[email protected] mailto:[email protected] http://www.guam.net/home/mikes Guam - Where America's Day Begins G4L Disk Imaging Project maintainer http://sourceforge.net/projects/g4l/ +----------------------------------------------------------+ http://setiathome.berkeley.edu (Original) Number of Seti Units Returned: 19,471 Processing time: 32 years, 290 days, 12 hours, 58 minutes (Total Hours: 287,489) BOINC@HOME CREDITS SETI 14305761.074364 | EINSTEIN 10610832.119852 ROSETTA 6726167.419674 | ABC 15903532.519753

2 2

Log Rotation on Windows
by Brian Wilkins 03 Apr '13

03 Apr '13

I know that log rotation on Windows is on the TO-DO list. Is there a way to rotate the log at startup using some other means or during use? I suppose I could start stunnel with a batch file and do the log rotation before starting. Is there any other way? Brian

1 0

32/64 bit interposition on Solaris
by Norm Jacobs 29 Mar '13

29 Mar '13

I was recently working with stunnel on Solaris and ran across the following code in client.c: putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); This appears to have been put in place to interpose a stunnel version of getpeername() on the downstream application. This works great when libstunnel.so has the same bittedness as the downstream application, but Solaris allows users to install and run both 32 and 64 bit applications on the same system. If the stunnel exectuable is a 32 bit application and the downstream application is a 64 bit application, the runtime linker falls over because of the mismatch with the interposed library. To avoid this problem, stunnel should use LD_PRELOAD_32 and LD_PRELOAD_64 on Solaris. I have put together a patch to client.c that sets both LD_PRELOAD_* environment variables to something that seems to make sense on Solaris, but have used a fairly hacky way of enabling it when I build. The client.c changes that I put together are: # On Solaris, fix stunnel so that the linker know where both the 32 and 64 bit # interposer libraries are. If you use LD_PRELOAD with the wrong bittedness # of interposer, the runtime linker hits a fatal error in trying to load # mismatched ELF objects. # diff -r -u stunnel-4.55.orig/src/client.c stunnel-4.55/src/client.c --- stunnel-4.55.orig/src/client.c 2013-02-28 00:17:58.000000000 -0800 +++ stunnel-4.55/src/client.c 2013-03-21 22:55:21.098479331 -0700 @@ -1096,9 +1096,14 @@ /* just don't set these variables if getnameinfo() fails */ putenv(str_printf("REMOTE_HOST=%s", host)); if(c->opt->option.transparent_src) { - putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); - /* for Tru64 _RLD_LIST is used instead */ +#ifdef MACH64 + putenv("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); + putenv("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); +#elif __osf /* for Tru64 _RLD_LIST is used instead */ putenv("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); +#else + putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); +#endif } } This adds more appropriate environment variables into the calling environment on Solaris. It still needs some work to integrate better with the build. Anyway, I thought that I would raise the issue and at least offer a direction to work from. I am happy to work with someone on a better resolution to this. -Norm

1 0

use of CRYPTO_NUM_LOCKS
by Norm Jacobs 29 Mar '13

29 Mar '13

A while ago, the Solaris security group noticed that stunnel uses CRYPTO_NUM_LOCKS to size a lock table in the code at compile time. They noted that there is function CRYPTO_num_locks() that can do the same thing at runtime and have requested that the function be used so that FIPS/non-FIPS support can be switched on by users simply using interposition. As a result of this, I put together this patch that switches to code to use the function instead of macro. -Norm # stunnel should use CRYPTO_num_locks() function instead of CRYPTO_NUM_LOCKS # macro. The function interogates libcrypto at run-time for sizing and the # macro at compile time. If you interpose a a version at runtime to switch # between FIPS/non-FIPS support, the lock table may not be sized correctly. # diff -r -u stunnel-4.55.orig/src/sthreads.c stunnel-4.55/src/sthreads.c --- stunnel-4.55.orig/src/sthreads.c 2012-08-09 14:44:18.000000000 -0700 +++ stunnel-4.55/src/sthreads.c 2013-03-21 23:29:34.912001586 -0700 @@ -212,7 +212,7 @@ #ifdef USE_PTHREAD static pthread_mutex_t stunnel_cs[CRIT_SECTIONS]; -static pthread_mutex_t lock_cs[CRYPTO_NUM_LOCKS]; +static pthread_mutex_t *lock_cs; void enter_critical_section(SECTION_CODE i) { pthread_mutex_lock(stunnel_cs+i); @@ -275,13 +275,15 @@ int sthreads_init(void) { int i; + int num_locks = CRYPTO_num_locks(); /* initialize stunnel critical sections */ for(i=0; i<CRIT_SECTIONS; i++) pthread_mutex_init(stunnel_cs+i, NULL); /* initialize OpenSSL locking callback */ - for(i=0; i<CRYPTO_NUM_LOCKS; i++) + lock_cs = calloc(num_locks, sizeof (*lock_cs)); + for(i=0; i<num_locks; i++) pthread_mutex_init(lock_cs+i, NULL); CRYPTO_set_id_callback(stunnel_thread_id); CRYPTO_set_locking_callback(locking_callback);

1 0