- stunnel-users - stunnel.org

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 31 May '16

31 May '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Hi Michal, > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > why not just start stunnel with config parameter on command line? stunnel %USERPROFILE%/stunnel-config-file (windows) stunnel ${HOME}/stunnel-config-file (*nix)

2 1

Re: [stunnel-users] IPv4 and IPv6
by Konstantin Belousov 31 May '16

31 May '16

On Tue, May 31, 2016 at 08:04:24AM +0200, Micha?? Trojnara wrote: > On 31.05.2016 00:42, Konstantin Belousov wrote: > > I have a following configuration for the outgoing connection > > [XXX-1] > > client = yes > > accept = 127.0.0.1:1564 > > connect = some-server:9999 > > local = some-other-address > [cut] > > The socket was created with INET6 address family, but bind was done for > > INET AF. > > This is pretty much expected if "some-server:9999" is an IPv6 address > and "some-other-address" is an IPv4 address. The "local" option indeed > cannot handle a mix of IPv4 and IPv6 "connect" addresses. Usually some-server is the list of addresses, one of them is IPv4, and another is IPv6. This is the only reasonable way to name dual-stack host. > > What do you think might be a proper solution? I would expect that the code which binds the socket for connect(2), matched the address types before binding. A good implementation needs to iterate over the results of getaddrinfo(3) for remote host to try to connect to each returned address. In the same manner, when one outgoing address is attempted to connect to, the getaddrinfo(3) list for the local address would be iterated over, and first matched compatible address selected for binding. It seems that it is enough to match addrinfo pairs by ai_family/ai_socktype/ai_protocol, but you might also need to e.g. pay some attention to filter out IPv4 mapped to IPv6 entries. I am not sure how much additional plumbing is required to have local getaddrinfo(3) result in the local_bind().

1 0

IPv4 and IPv6
by Konstantin Belousov 30 May '16

30 May '16

Hi. I have a following configuration for the outgoing connection [XXX-1] client = yes accept = 127.0.0.1:1564 connect = some-server:9999 local = some-other-address Sometimes, or rather, quite regular, the connection to localhost port 1564 results in immediate connection close and logging the following: May 30 23:06:58 tom stunnel: LOG5[4]: Service [XXX-1] accepted connection from 127.0.0.1:12848 May 30 23:06:58 tom stunnel: LOG3[4]: local_bind (ephemeral port): Invalid argument (22) I traced the syscalls and see the following: 28196 stunnel CALL socket(PF_INET6,SOCK_STREAM,IPPROTO_IP) 28196 stunnel RET socket 10/0xa 28196 stunnel CALL fcntl(0xa,F_GETFL,0) 28196 stunnel RET fcntl 2 28196 stunnel CALL fcntl(0xa,F_SETFL,0x6<O_RDWR|O_NONBLOCK>) 28196 stunnel RET fcntl 0 28196 stunnel CALL fcntl(0xa,F_SETFD,FD_CLOEXEC) 28196 stunnel RET fcntl 0 28196 stunnel CALL bind(0xa,0x802808a6c,0x10) 28196 stunnel STRU struct sockaddr { AF_INET, 176.36.249.139:0 } 28196 stunnel RET bind -1 errno 22 Invalid argument The socket was created with INET6 address family, but bind was done for INET AF. Indeed, both some-server and some-other-address have both A and AAAA records, corresponding addresses are configured and functional. OS is FreeBSD, I was ensured that this combination (INET6 socket and INET bind) is not correct. It probably works sometime when first resolved addresses for names happen to come from the same address family, but when resolvers return different order, the situation above occurs. Disabling ipv6 support makes the connection work reliably, which confirms my observations. I am using stunnel 5.31. Would be nice to have this fixed. Thanks.

1 0

Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 28 May '16

28 May '16

the problem frequently occurs on the client side: admin need to configure stunnel for multiple users. every user has own key, certificate, own permissions on file system (for log-files, etc) this patch allow to write flexible config. some examples: cert = %USERPROFILE%\.config\my.pem (windows) cert = ${HOME}/.config/my.pem (other) output = %APPDATA%\stunnel.log (windows) output = ${HOME}/stunnel.log (other) CAfile = %ALLUSERSPROFILE%\ourCAbundle.crt (windows) CAfile = /etc/ssl/certs/ourCAbundle.crt (other, not using variables) "secure" :) random port example: ... [srv1] accept = 127.0.0.1:%SRV1_PORT% (windows) accept = 127.0.0.1:${SRV1_PORT} (other) ... start stunnel (batch-file or shell-script): set SRV1_PORT=%RANDOM% (windows) limitations: 1. don't support unicode on windows (localized usernames, files, etc) 2. only ${NAME} syntax supported on *nix (not $NAME).

2 1

Potential performance degradation moving from Stunnel 5.06 to 5.32
by Mark Brookes 24 May '16

24 May '16

There might be a throughput degradation in the more recent versions of stunnel. I have recently been testing the 5.32 version of stunnel and have noticed that the tps drop quite significantly when moving from 5.06 to 5.32. Im willing to admit it could be something to do with my config or testing. But if anyone could offer some suggestions it would be much appreciated. The config is setup as follows - Stunnel VIP -> Haproxy. (I have configured haproxy to return a simple page). I am using a self signed 1024 bit certificate and the cipher I am using is ECDHE-RSA-AES256-GCM-SHA384 (I also tested with aNull:eNULL:MD5:LOW:HIGH and noticed a similar drop in performance) My Stunnel config is - setuid = stunnel pid = /var/run/stunnel/stunnel.pid debug = local1.0 socket = a:IP_FREEBIND=yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [VIP_Name-1] cert = /root/server1024.pem ciphers = ECDHE-RSA-AES256-GCM-SHA384 accept = 192.168.80.131:443 connect = 127.0.0.1:80 connect = 127.0.0.2:80 delay = no options = CIPHER_SERVER_PREFERENCE options = DONT_INSERT_EMPTY_FRAGMENTS renegotiation = no TIMEOUTclose = 0 My HAProxy config is - global daemon stats socket /var/run/haproxy.stat mode 600 level admin pidfile /var/run/haproxy.pid maxconn 100000 tune.maxrewrite 1024 nbproc 3 defaults #mode http #balance roundrobin timeout connect 4000 timeout client 42000 timeout server 43000 peers loadbalancer_replication peer lbmaster localhost:7778 peer lbslave localhost:7778 listen VIP_Name bind 127.0.0.1:80 transparent #bind 192.168.80.121:80 transparent monitor-uri / mode http errorfile 200 /etc/haproxy/200.http listen VIP_Name_2 monitor-uri / mode http bind 127.0.0.2:80 transparent errorfile 200 /etc/haproxy/200.http All the versions of stunnel mentioned here have been built against Openssl1.0.1s I am using siege to generate the load and issuing the following command - siege https://192.168.80.131 -t1M -c 15 -b The test is stop stunnel service, replace stunnel binary with different version, restart service, run test. The results im seeing are as follows (All results are quoted in transactions per second as reported by siege). v5.06 - 2233 v5.07 - 2229 v5.25 - 2171 v5.30 - 2092 v5.32 - 302 In my results you can see roughly a 200 tps drop from version 5.06 to v5.30 then when we get to v5.32 it drops further. To reiterate the only thing I am changing in my configuration is the stunnel binary. Everything else is remaining the same. Does anyone have any ideas what could be happening? Thankyou Mark

1 0

stunnel on AIX 7
by Randall LeJeune 19 May '16

19 May '16

Does anyone here have any experience in installing and/or running stunnel on AIX? I have version 4.56 installed on my AIX v.7 box, but I checked when this was released and it was over three years ago. I found a version 5.17-2 binary available on Perzl.org but nothing more recent (this version is slightly over a year old). I did try a compile of the newest version but got some errors when I tried to run make (1254-004 error on collect2). Does anyone have any ideas on what would be the best way to proceed here? Thanks in advance.

2 1

PKCS12 support patch
by Dmitry Bakshaev 19 May '16

19 May '16

googling internet about using certificate and keys from PKCS12 file lead to convert it to PEM. it requires some additional utilities (openssl not default windows application) and manual steps to convert. this patch allow using PKCS12 directly from stunnel. example configuration: cert = /home/dab/.certs/my.p12 PKCS12-files detected by file extension (.p12 or .pfx, no case sensetive) and load specially. password prompted if needed, empty password also supported. code based on examples from: https://groups.google.com/forum/#!topic/mailing.openssl.users/iuBmSqwsIG4 http://openssl-users.openssl.narkive.com/J0bR3cMA/ssl-ctx-use-privatekey-fi… patch tested on stunnel working on linux (gentoo: from our overlay http://bbgentoo.ilb.ru/repos/bbgentoo/bbgentoo_overlay/branches/drafts/net-… ) and windows.

1 1

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 18 May '16

18 May '16

On Wed, 2016-05-18 07:24:52 +0000, David Faizulaev wrote: > Do you concatenate the self-signed certificate to the current CA? This self-signed certificate /is/ the current CA certificate, as it is the root of the peer's certificate chain and you trust it. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

SSL Labs: Session resumption IDs assigned but not accepted
by Brandon Jackson 17 May '16

17 May '16

Trying to find out why SSL Labs is giving this message Session resumption (caching): No (IDs assigned but not accepted) I have this in the config. sessionCacheSize = 1000 sessionCacheTimeout = 86400 ---------------------------------- Brandon Jackson bojack1437(a)gmail.com

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:50:04 +0000, David Faizulaev wrote: > Hello, > > I've tried changing the value of 'verify' to 0 & 1, in both cases I get the following: > > 2016.05.17 16:40:25 LOG3[285]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed > 2016.05.17 16:40:25 LOG5[285]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket > 2016.05.17 16:40:25 LOG4[285]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 11859 allocations > 2016.05.17 16:40:25 LOG4[285]: Possible memory leak at .\crypto\asn1\asn1_lib.c:408: 11241 allocations Strange. I never used verify = 0, but I had the understanding, stunnel should accept a connection even if the peer's certificate can't be verified. Anyhow, what happens if you add the self-signed certificate presented by the peer to the CA file? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0