- stunnel-users - stunnel.org

Latest x-forwarded-for patch for Stunnel 5.31
by Nelson 20 Mar '16

20 Mar '16

Hi, Has anyone knows a compatible patch for the latest version 5.31? Can anyone provide the link? The patch that I have only works on 5.02 but not on 5.31

1 0

Minor bug in resolver.c
by Jose Alf. 16 Mar '16

16 Mar '16

Hello Michal, I found a small bug on resolver.c. In function addrlist_resolve, in source line 318 for version 5.31, there is the instruction: num+=name2addrlist(addr_list, host->name) I think It should be: num = name2addrlist(addr_list, host->name) I found this because I created a service with three connect lines, like this: [ldaps] client=yes accept=127.0.0.1:7000 connect=10.1.1.1:636 connect=10.2.2.2:636 connect=10.3.2.3:636 And I found this line in the log: 2016.03.15 22:23:34 LOG6[0]: failover: round-robin, starting at entry #6 #6? It should be <= #2 ! I checked the source code, added some s_log instructions and found that the problem. For 3 addresses num variable was set to 6 (1 + 2 + 3) and that was returned by addrlist_resolve. Hope this helps. And thanks again for your hard work on stunnel. Best Regards Jose A. Diaz

1 0

Possible signal handling bug in fork mode
by Philippe Anctil 15 Mar '16

15 Mar '16

Hi, In fork mode, sending a sigterm signal to a child is caught by the parent. I suspect it has something to do with signal_pipe being shared by the child and parent after the fork. Here I sent a signal to the parent while a child process was also running. The parent shut down as expected. After sending sigterm, the child remains. Processes before sigterm: UID PID PPID C STIME TTY STAT TIME CMD user 1423 1 0 10:32 ? Ss 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf user 1921 1423 0 10:37 ? S 0:00 \_ /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf selected pid 1423 Processes after: UID PID PPID C STIME TTY STAT TIME CMD user 1921 1 0 10:37 ? S 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf Here I sent the signal to the child. The parent shut down and the child completed normally. Processes before: UID PID PPID C STIME TTY STAT TIME CMD user 1276 1 0 10:31 ? Ss 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf user 1309 1276 0 10:31 ? S 0:00 \_ /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf selected pid 1309 Processes after: UID PID PPID C STIME TTY STAT TIME CMD user 1309 1 0 10:31 ? S 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf I know I should be trying threads. I will eventually. I can only switch once I validate it can sustain our level of traffic. Fork has done that flawlessly for many years now. Best regards, -- Philippe Anctil

2 5

windows certificate store
by Jim Howland 11 Mar '16

11 Mar '16

Hi I am running a windows instance of stunnel as a client and A Linux version as the server When I set this on the Windows side : engine = capi and this in my section: engineId = capi I get an error message that CApath or CAFile still needs to be set. My understanding is that these setting should make stunnel use the Windows certificate store to find a root and intermediate certificate to authenticate my (Symantec generated) certificate and should not require a CAfile. Here is my windows config : ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option engine = capi [FIX] client = yes accept = 9021 connect = fixuat.au.abnamroclearing.com:9443<http://fixuat.au.abnamroclearing.com:9443> cert = C:\certs\jim.howland.cer key = C:\certs\jim.howland.key verify = 3 ; CAfile = C:\certs\veriSign_root_certificates\symantec-class3-G5.cer engineId = capi and here is the error [ ] Cron thread initialized [ ] No limit detected for the number of clients [.] stunnel 5.31 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [ ] Enabling support for engine "capi" [ ] Initializing engine #1 (capi) [ ] Engine #1 (capi) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 0 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [FIX] [!] Service [FIX]: Either "CAfile" or "CApath" has to be configured [!] Server is down Any ideas? Kind Regards, Jim Howland | Linux Engineer ABN AMRO | ABN AMRO Clearing Sydney Pty Ltd Level 8, 50 Bridge Street | Sydney NSW 2000 | Australia Tel: +61 (0)2 9151 3124 | Mobile: +61 (0)417 885818 | Internet abnamroclearing.com ******** This message (including any attachments ) is confidential and is intended solely for the use of the individual or entity to whom it is addressed. If you have received this message by mistake please notify the sender by return email and delete this message from your system. Any unauthorised use or dissemination of this message in whole or in part is strictly prohibited. ********

1 0

Error 1408F10B talking to Active Directory on port 636
by Matthew Slowe 07 Mar '16

07 Mar '16

Hi all! We’ve been using stunnel as part of a vendor supplied product for some time to connect a large application running in an application server on Windows to Active Directory for authentication via LDAPS (for some reason, it only natively supports LDAP!). Anyway, it’s been working fine until a couple of weeks ago when we started getting intermittent failures against all of our configured Domain Controllers (the upstream LDAPS servers). With no change in STunnel or DC config, some connections would abort with the following log: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number … while others worked fine. The error is not limited to any one of the upstream DCs nor does it occur for every request. We’ve updated STunnel to the latest version (5.31) and the problem remains running on Windows 2008 R2 SP1. Below are two transactions from the same instance of STunnel connecting to the same DC one which works and one which doesn’t (IP addresses obfuscated). Config in use: {{{ client = yes debug = 7 output = e:\prog\stunnel\stunnel.log options = NO_SSLv2 [ldaps] accept = localhost:389 connect = domain.local:636 }}} Any thoughts gratefully received! Thanks, Matthew Fails ==== 2016.03.04 15:20:25 LOG7[14]: Service [ldaps] started 2016.03.04 15:20:25 LOG5[14]: Service [ldaps] accepted connection from 127.0.0.1:63130 2016.03.04 15:20:25 LOG6[14]: failover: round-robin, starting at entry #2 2016.03.04 15:20:25 LOG6[14]: s_connect: connecting 10.10.1.254:636 2016.03.04 15:20:25 LOG7[14]: s_connect: s_poll_wait 10.10.1.254:636: waiting 10 seconds 2016.03.04 15:20:25 LOG5[14]: s_connect: connected 10.10.1.254:636 2016.03.04 15:20:25 LOG5[14]: Service [ldaps] connected remote server from 10.10.1.225:63131 2016.03.04 15:20:25 LOG7[14]: Remote socket (FD=448) initialized 2016.03.04 15:20:25 LOG6[14]: SNI: sending servername: ad.kent.ac.uk 2016.03.04 15:20:25 LOG7[14]: SSL state (connect): before/connect initialization 2016.03.04 15:20:25 LOG7[14]: SSL state (connect): SSLv3 write client hello A 2016.03.04 15:20:25 LOG7[14]: SSL alert (write): fatal: protocol version 2016.03.04 15:20:25 LOG3[14]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2016.03.04 15:20:25 LOG5[14]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.03.04 15:20:25 LOG7[14]: Remote socket (FD=448) closed 2016.03.04 15:20:25 LOG7[14]: Local socket (FD=492) closed 2016.03.04 15:20:25 LOG7[14]: Service [ldaps] finished (0 left) Works ====== 2016.03.02 18:18:01 LOG7[204]: Service [ldaps] started 2016.03.02 18:18:01 LOG5[204]: Service [ldaps] accepted connection from 127.0.0.1:52873 2016.03.02 18:18:01 LOG6[204]: failover: round-robin, starting at entry #0 2016.03.02 18:18:01 LOG6[204]: s_connect: connecting 10.10.1.254:636 2016.03.02 18:18:01 LOG7[204]: s_connect: s_poll_wait 10.10.1.254:636: waiting 10 seconds 2016.03.02 18:18:01 LOG5[204]: s_connect: connected 10.10.1.254:636 2016.03.02 18:18:01 LOG5[204]: Service [ldaps] connected remote server from 10.10.1.223:52874 2016.03.02 18:18:01 LOG7[204]: Remote socket (FD=492) initialized 2016.03.02 18:18:01 LOG6[204]: SNI: sending servername: ad.kent.ac.uk 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): before/connect initialization 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client hello A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server hello A 2016.03.02 18:18:01 LOG6[204]: Certificate verification disabled 2016.03.02 18:18:01 LOG6[204]: Certificate verification disabled 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server certificate A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server key exchange A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server certificate request A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server done A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client certificate A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client key exchange A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write finished A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 flush data 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read finished A 2016.03.02 18:18:01 LOG7[204]: 205 client connect(s) requested 2016.03.02 18:18:01 LOG7[204]: 205 client connect(s) succeeded 2016.03.02 18:18:01 LOG7[204]: 0 client renegotiation(s) requested 2016.03.02 18:18:01 LOG7[204]: 0 session reuse(s) 2016.03.02 18:18:01 LOG6[204]: SSL connected: new session negotiated 2016.03.02 18:18:01 LOG7[204]: Deallocating application specific data for addr index 2016.03.02 18:18:01 LOG6[204]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES256-SHA (256-bit encryption) 2016.03.02 18:18:01 LOG7[204]: Compression: null, expansion: null 2016.03.02 18:18:01 LOG6[204]: Read socket closed (readsocket) 2016.03.02 18:18:01 LOG7[204]: Sending close_notify alert 2016.03.02 18:18:01 LOG7[204]: SSL alert (write): warning: close notify 2016.03.02 18:18:01 LOG6[204]: SSL_shutdown successfully sent close_notify alert 2016.03.02 18:18:01 LOG3[204]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2016.03.02 18:18:01 LOG5[204]: Connection reset: 276 byte(s) sent to SSL, 44 byte(s) sent to socket 2016.03.02 18:18:01 LOG7[204]: Remote socket (FD=492) closed 2016.03.02 18:18:01 LOG7[204]: Local socket (FD=456) closed 2016.03.02 18:18:01 LOG7[204]: Service [ldaps] finished (0 left) -- Matthew Slowe | Server Infrastructure Officer IT Infrastructure, Information Services, University of Kent Room S21, Cornwallis South Canterbury, Kent, CT2 7NZ, UK Tel: +44 (0)1227 824265 www.kent.ac.uk/is | @UnikentUnseenIT | @UKCLibraryIt PGP: https://keybase.io/fooflington

1 0

CRL checking
by Fritz Gschwendner 03 Mar '16

03 Mar '16

Hello, I noticed a change in functionality of CRL checking in server mode somewhere between stunnel version 5.2.00 and 5.31.00. We have multiple services listening for incoming connections and a global option CRLfile = crls.pem, with crls.pem containing a few CRLs but not one for every possible client certificate, and client certificates not all having a CRL distribution point configured. This worked with the old version in the sense that all clients could connect. I don't know If CRL checking really worked, they are all empty and I can't test. With the new version client certificates with no CRL and no CRL distribution point configured got rejected with errors "CERT: Pre-verification error: unable to get certificate CRL" and "SSL_accept: 14089086: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed" If I remove the global entry for CRLfile with the new version, all clients can connect again. I guess I could enter the CRLfile option on service level, but it could be that some client certificates connecting to a specific service have a CRL and some don't. My questions: Is this intended behaviour? I find it logical to check the CRL of a client certificate, if there is one in the CRLfile, if there isn't, to not check. Does a CRL distribution point configured in a client certificate play any role?

2 1

Problem with Stunnel 5.31 and Openssl 1.0.2g
by Carter Browne 02 Mar '16

02 Mar '16

I have a confusing problem I cannot figure out: I have two systems: one Redhat 5.10 x86, the other CentOs 5.10 x86 I compiled openssl version 1.0.2g on both systems I compiled stunnel 5.31 on both systems In both cases, this was updating older working verions of openssl and stunnel. On the Redhat system I used gcc44 On the CentOS system i used gcc4.1 The CentOS system works as before. On the Redhat system all self signed certificates are rejected. As I only use self-signed certificates to identify a set of known hosts, this is a problem for me. I tried various verify optios (2 3 4) both nothing changed. Any idea on how to fix this problem. What information can I provide you with to help? Thanks, Carter Carter Browne cbrowne(a)cbcs-usa.com

2 1

Slow sending email through stunnel to Office365
by ajreynolds＠san.rr.com 01 Mar '16

01 Mar '16

After a bit of experimentation, I've succeeded in getting stunnel 5.31 running on my Windows 2008 r2 server and sending email through SMTP through Office365. My problem now is that it's quite slow. I can see a point in the log file where it stops for 5 seconds or more for each email message. Are there any parameter for stunnel that might help, or do I have to just accept that Office365 is slow? Here is my stunnel.conf file: debug = 7 output = stunnel.log [ms-smtp] protocol = smtp client = yes accept = 587 connect = smtp.office365.com:587 And here is the log file for an email transmission. Notice the 5 second pause at 12:31:04. Is there a way to eliminate this pause? 2016.03.01 12:30:21 LOG7[cron]: Cron thread initialized 2016.03.01 12:30:21 LOG7[main]: No limit detected for the number of clients 2016.03.01 12:30:21 LOG5[main]: stunnel 5.31 on x86-pc-msvc-1500 platform 2016.03.01 12:30:21 LOG5[main]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.03.01 12:30:21 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.03.01 12:30:21 LOG7[main]: errno: (*_errno()) 2016.03.01 12:30:21 LOG7[service]: GUI message loop initialized 2016.03.01 12:30:21 LOG5[main]: Reading configuration from file stunnel.conf 2016.03.01 12:30:21 LOG5[main]: UTF-8 byte order mark detected 2016.03.01 12:30:21 LOG5[main]: FIPS mode disabled 2016.03.01 12:30:21 LOG7[main]: Compression disabled 2016.03.01 12:30:21 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2016.03.01 12:30:21 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2016.03.01 12:30:21 LOG7[main]: PRNG seeded successfully 2016.03.01 12:30:21 LOG6[main]: Initializing service [ms-smtp] 2016.03.01 12:30:21 LOG7[main]: No certificate or private key specified 2016.03.01 12:30:21 LOG4[main]: Service [ms-smtp] needs authentication to prevent MITM attacks 2016.03.01 12:30:21 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.03.01 12:30:21 LOG5[main]: Configuration successful 2016.03.01 12:30:21 LOG7[main]: Listening file descriptor created (FD=424) 2016.03.01 12:30:21 LOG7[main]: Service [ms-smtp] (FD=424) bound to 0.0.0.0:587 2016.03.01 12:30:58 LOG7[main]: Found 1 ready file descriptor(s) 2016.03.01 12:30:58 LOG7[main]: FD=388 ifds=r-x ofds=--- 2016.03.01 12:30:58 LOG7[main]: Service [ms-smtp] accepted (FD=440) from 192.168.8.58:55266 2016.03.01 12:30:58 LOG7[main]: Creating a new thread 2016.03.01 12:30:58 LOG7[main]: New thread created 2016.03.01 12:30:58 LOG7[0]: Service [ms-smtp] started 2016.03.01 12:30:58 LOG5[0]: Service [ms-smtp] accepted connection from 192.168.8.58:55266 2016.03.01 12:30:58 LOG6[0]: failover: round-robin, starting at entry #3 2016.03.01 12:30:58 LOG6[0]: s_connect: connecting 132.245.34.194:587 2016.03.01 12:30:58 LOG7[0]: s_connect: s_poll_wait 132.245.34.194:587: waiting 10 seconds 2016.03.01 12:30:58 LOG5[0]: s_connect: connected 132.245.34.194:587 2016.03.01 12:30:58 LOG5[0]: Service [ms-smtp] connected remote server from 192.168.8.14:55477 2016.03.01 12:30:58 LOG7[0]: Remote descriptor (FD=460) initialized 2016.03.01 12:30:59 LOG7[0]: <- 220 CY1PR21CA0008.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 1 Mar 2016 20:30:58 +0000 2016.03.01 12:30:59 LOG7[0]: -> 220 CY1PR21CA0008.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 1 Mar 2016 20:30:58 +0000 2016.03.01 12:30:59 LOG7[0]: -> EHLO localhost 2016.03.01 12:30:59 LOG7[0]: <- 250-CY1PR21CA0008.outlook.office365.com Hello [#.#.#.#] 2016.03.01 12:30:59 LOG7[0]: <- 250-SIZE 157286400 2016.03.01 12:30:59 LOG7[0]: <- 250-PIPELINING 2016.03.01 12:30:59 LOG7[0]: <- 250-DSN 2016.03.01 12:30:59 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2016.03.01 12:30:59 LOG7[0]: <- 250-STARTTLS 2016.03.01 12:30:59 LOG7[0]: <- 250-8BITMIME 2016.03.01 12:30:59 LOG7[0]: <- 250-BINARYMIME 2016.03.01 12:30:59 LOG7[0]: <- 250 CHUNKING 2016.03.01 12:30:59 LOG7[0]: -> STARTTLS 2016.03.01 12:30:59 LOG7[0]: <- 220 2.0.0 SMTP server ready 2016.03.01 12:30:59 LOG6[0]: SNI: sending servername: smtp.office365.com 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): before/connect initialization 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2016.03.01 12:30:59 LOG6[0]: Certificate verification disabled 2016.03.01 12:30:59 LOG6[0]: Certificate verification disabled 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2016.03.01 12:30:59 LOG6[0]: Empty client CA list 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server certificate request A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server done A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write client certificate A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write finished A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 flush data 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read finished A 2016.03.01 12:30:59 LOG7[0]: 1 client connect(s) requested 2016.03.01 12:30:59 LOG7[0]: 1 client connect(s) succeeded 2016.03.01 12:30:59 LOG7[0]: 0 client renegotiation(s) requested 2016.03.01 12:30:59 LOG7[0]: 0 session reuse(s) 2016.03.01 12:30:59 LOG6[0]: SSL connected: new session negotiated 2016.03.01 12:30:59 LOG7[0]: Peer certificate was cached (4882 bytes) 2016.03.01 12:30:59 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2016.03.01 12:30:59 LOG7[0]: Compression: null, expansion: null 2016.03.01 12:31:04 LOG6[0]: Read socket closed (readsocket) 2016.03.01 12:31:04 LOG7[0]: Sending close_notify alert 2016.03.01 12:31:04 LOG7[0]: SSL alert (write): warning: close notify 2016.03.01 12:31:04 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.03.01 12:31:04 LOG6[0]: SSL socket closed (SSL_read) 2016.03.01 12:31:04 LOG7[0]: Sent socket write shutdown 2016.03.01 12:31:04 LOG5[0]: Connection closed: 413 byte(s) sent to SSL, 635 byte(s) sent to socket 2016.03.01 12:31:04 LOG7[0]: Remote descriptor (FD=460) closed 2016.03.01 12:31:04 LOG7[0]: Local descriptor (FD=440) closed 2016.03.01 12:31:04 LOG7[0]: Service [ms-smtp] finished (0 left) Thanks very much, Andy

1 0

stunnel 5.31 released
by Michal Trojnara 01 Mar '16

01 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.31 of stunnel. The ChangeLog entry: Version 5.31, 2016.03.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2g. https://www.openssl.org/news/secadv_20160301.txt * New features - Added logging the list of client CAs requested by the server. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Only reset the watchdog if some data was actually transferred. - A workaround implemented for the unexpected exceptfds set by select() on WinCE 6.0 (thx to Richard Kraemer). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: a746b71ab3dc6c23eacb0daf7342467870e43ac933430905eb1b1d050bbae0b7 stunnel-5.31.tar.gz c662fc1254f22ce5ac3f6e09bf643b3a0a99a884b6414f55cc8ab22d7c680fd5 stunnel-5.31-installer.exe f14d7c9cf23a25bdcef8480f9d35c66233bb9e64f82098f1867edf4b038b41c4 stunnel-5.31-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW1cIFAAoJEC78f/DUFuAU998P/1LpUY+B/Q4E7XWCctK1XspG zcFi8U5UhaMek9eTPlY0mJWUGihX4qQOeQi+9MV9LqvzLLfWbgMzWSv/rAiWxCzx NbHw7yASK5+xfnGBGoSenvdbvmL6s4RPxM0Qf3lrVj9kpha75JS9aHPnDhq90aLG YXle0uTj/dvDC3aG2UY0TYFQMvvubrx87JyoiTbf9i2f6q85iM76DaeP15mMZSXZ eq+9bP37OVG6RDFrlFSoSSHxOWHA5ebftwvf4MjedrziXld6pzYSzwIJ7eJhZO7Y ob+hRO3D86chiGfynYj1WWws51Q+TE4hg2NQ7vWPEi7HuN+/62CMZg3q1h/LAIT+ 2qzjVFIoVwwl8B3RZ94aJ8AzsFnhWOp5AZJ7nOBFbF69cRAuIT6DQL+GwcJoB+RJ +sxlJAyhu+3/RuAPbZYXzSzr7Lsp4/fhWIxVRW5rBqHSJCBZU+QqSOTu9GP06F9i 7FaUq9p7RxajVjtqn+QmzDpVTgBymkYvc3F1+ATSUZZNLU8KPWG+aYTtSYKKEDQS VBtQJ3BRR0Ne/TqBXStdK3PdG8t8r7hoYhPSAE1IX59F0/4MaKHcAoyDEAH5aKQx rK1Iowb5DUNF/Rcota3CXzLFBfp/ePmZFbjpQd9YcGtMXnMGFk9/Lnc+8If+vHGk p66Kx7ZYLNzkIPf0y8wn =WkNw -----END PGP SIGNATURE-----

1 0

How to build Stunnel on x64 Windows by VC with right alignment memory allocation functions
by zuz666＠gmail.com 28 Feb '16

28 Feb '16

Hello! I need to compile stunnel using VC for Windows x64 platform. I know that I can use MinGW/gcc and it will work, but VC used to build all other libraries and I want to simplify assembly process. I am try build stunnel by VC for Windows x64 platform and it builds fine but after start, stunnel crashed in VC runtime after calling setjmp function in client.c : /* try to process the request */ err=setjmp(c->err); I did some researches of the reason of a problem and found the following comment in prototypes.h: jmp_buf err; /* exception handler needs to be 16-byte aligned on Itanium */ The memory for CLI struct allocated by str_alloc_detached function (jmp_buf uded in definition CLI struct), but jmp_buf for AMD64/x64 must be 16-byte aligned to save state of SSE registers. Function calloc used for memory allocation in str_alloc_detached function and sometimes it return pointers not aligned to 16-byte boundary what causes a problem. I create dummy patch to workaround the problem but am think the best solution in that case is to use malloc instead calloc function (as described in some articles it’s always 16-byte aligned on AMD64 VC builds). Can you suggest some solutions to this problem? prototypes.h @@ -404,6 +404,10 @@ typedef struct { uint64_t sock_bytes, ssl_bytes; /* bytes written to socket and SSL */ s_poll_set *fds; /* file descriptors */ uintptr_t redirect; /* redirect to another destination after failed auth */ + /* New member added by Zuz to work around setjmp alignment issues */ +#if defined(_MSC_VER) && defined(_WIN64) + void *cli_struct_free_ptr; /* Ptr to unaligned address for this struct */ +#endif } CLI; client.c @@ -76,8 +76,14 @@ NOEXPORT void reset(SOCKET, char *); CLI *alloc_client_session(SERVICE_OPTIONS *opt, SOCKET rfd, SOCKET wfd) { static unsigned long long seq=0; CLI *c; - +#if defined(_MSC_VER) && defined(_WIN64) + #define CLI_STRUCT_ALIGNMENT 15 + void *cli_ptr_unaligned = str_alloc_detached(sizeof(CLI) + CLI_STRUCT_ALIGNMENT); + c = (CLI *)(((uintptr_t)cli_ptr_unaligned+CLI_STRUCT_ALIGNMENT) & ~ (uintptr_t)0x0F); + c->cli_struct_free_ptr = cli_ptr_unaligned; +#else c=str_alloc_detached(sizeof(CLI)); +#endif c->opt=opt; c->local_rfd.fd=rfd; c->local_wfd.fd=wfd; @@ -117,7 +123,13 @@ void client_main(CLI *c) { * -> spawn a local program instead of stdio */ for(;;) { SERVICE_OPTIONS *opt=c->opt; +#if defined(_MSC_VER) && defined(_WIN64) + void *cli_ptr_unaligned = c->cli_struct_free_ptr; +#endif memset(c, 0, sizeof(CLI)); /* connect_local needs clean c */ +#if defined(_MSC_VER) && defined(_WIN64) + c->cli_struct_free_ptr = cli_ptr_unaligned; +#endif c->opt=opt; if(!setjmp(c->err)) c->local_rfd.fd=c->local_wfd.fd=connect_local(c); @@ -136,7 +148,11 @@ void client_main(CLI *c) { } } else client_run(c); - str_free(c); +#if defined(_MSC_VER) && defined(_WIN64) + str_free(c->cli_struct_free_ptr); +#else + str_free(c); +#endif } #ifdef __GNUC__ -- Yuris W. Auzins

1 0