- stunnel-users - stunnel.org

Error I am receiving in stunnel logfile (more info)
by Eric S. Eberhard 18 Jan '07

18 Jan '07

Hello Everyone, I tried it on 4.3.3 as well with my re-compiled version ... below are all 5 lines in the log file. stunnel 4.16 on powerpc-ibm-aix4.3.3.0 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 stunnel connected from 127.0.0.1:37690 remote socket: Addr family not supported by protocol (66) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I have been using this for a while but I had to transfer to a new machine (AIX 4.3 to 5.3) and had to recompile my software and get a newer stunnel. My version is stunnel-3.8p4: I thought it might be related to ipv4 versus ipv6 ... according to AIX documentation I had it set up for ipv4. I tried ipv6 for ducks, no difference. My inetd.conf line is: visanet stream tcp nowait root /visanet/ssl/stunnel stunnel /visanet/ssl/visanet.conf My .conf file is: output = /tmp/stunnel.log debug = 5 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 cert = /visanet/ssl/stunnel.pem EGD = /etc/egd-pool My guess is that this is something really stupid I am doing, but it is not obvious. Any help would be appreciated. Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Error I am receiving in stunnel logfile
by Eric S. Eberhard 18 Jan '07

18 Jan '07

Hello Everyone, remote socket: Addr family not supported by protocol (66) I have been using this for a while but I had to transfer to a new machine (AIX 4.3 to 5.3) and had to recompile my software and get a newer stunnel. My version is stunnel-3.8p4: My .conf file is: output = /tmp/stunnel.log debug = 5 RNDfile = /visanet/ssl/stunnel.rnd RNDoverwrite = yes client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 cert = /visanet/ssl/stunnel.pem EGD = /etc/egd-pool My guess is that this is something really stupid I am doing, but it is not obvious. Any help would be appreciated. Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

RE: [stunnel-users] Does editing *.conf file require restart of stunnel ?
by Stunnel 15 Jan '07

15 Jan '07

Hi, As far as I know the service needs to be restarted to load the new configuration. Regards Craig -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Ben Stover Sent: 15 January 2007 01:16 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Does editing *.conf file require restart of stunnel ? Hello, sorry for this newbie question. I did not found the answer in the FAQ. Assume I edit the *.conf file. Is it required to restrat stunnel (service) to enable the changes ? Or is the *.conf file read at ever new stunnel call? If explicit restart is required: would it be possible to add a context menu entry to the Windows systray-Stunnel-icon "restart". This would make handling much more comfortable than always opening a command line window and entering all the commands manually. Thank you Ben ___________________________________________________________ Try the all-new Yahoo! Mail. "The New Version is radically easier to use" - The Wall Street Journal http://uk.docs.yahoo.com/nowyoucan.html _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

re: Problem with certificates using smtp/pop
by Klaas 12 Jan '07

12 Jan '07

> cert = /path/to/certnew.cer > key = /path/to/stunnel.pem > Or concatenate them into one file and use cert = ... only > (no key = ...). > Also take care that the CN is the server FQDN to which the client > connects. Thanks, it works now perfect!

1 0

Re: [stunnel-users] re: Problem with certificates using smtp/pop
by Hans Werner Strube 11 Jan '07

11 Jan '07

"Klaas" wrote: > I have a part I sent to CA created whit openssl req -new -days > 365 -nodes -config stunnel.cnf -out certreq.pem -keyout stunnel.pem > > I have get return a file certnew.cer and I have the file stunnel.pem. And > now I don't know what I have to do next to get this certificate. I have > tried several options but no one works. cert = /path/to/certnew.cer key = /path/to/stunnel.pem Or concatenate them into one file and use cert = ... only (no key = ...). Also take care that the CN is the server FQDN to which the client connects.

1 0

re: Problem with certificates using smtp/pop
by Klaas 11 Jan '07

11 Jan '07

Sorry David that I have misted you e-mail. I'm using stunnel on a Windows server and I have working it all. I use outlook express as mail client and when I pres OK on the message of the certificate it works. But I want to install a real certificate. Only I don't exactly where I have place which part of the certificate and what I place into the stunnel.conf I have a part I sent to CA created whit openssl req -new -days 365 -nodes -config stunnel.cnf -out certreq.pem -keyout stunnel.pem I have get return a file certnew.cer and I have the file stunnel.pem. And now I don't know what I have to do next to get this certificate. I have tried several options but no one works.

1 0

Problems with Powerposter?
by Roger Stevens 10 Jan '07

10 Jan '07

I'm curious if anyone else has tried Stunnel with Powerposter on the Giganews Usenet network. I (and many other users) have reported problems whereby the post does not complete and just hangs. Per Giganews, this is a software problem and not their servers. Non-SSL posting in Powerposter works fine. but hangs when Stunnel is used usually after a couple of files are successfully uploaded. Any else run into this? TIA! Roger

1 0

re: Problem with certificates using smtp/pop
by David Chase 10 Jan '07

10 Jan '07

I tried sending directly to you, I must have looked like a spammer. I am ever so slightly pleased to see that I have some company in my frustration with this software. I'll try to help, since the experts seem to be too busy. I've only used it twice, and it was painful both times. Have you gotten it to work at all? That is, what do you see? Do you get a running stunnel process? Do you have (with permissions) ls -l /usr/local/etc/stunnel/mail.pem -rw------- 1 root staff 2233 Jan 5 17:25 /usr/local/etc/stunnel/ mail.pem I created it by running this command in that directory: sudo openssl req -new -out mail.pem -keyout mail.pem -nodes -x509 - days 365 I created a stupid certificate, because at some point it looked like it was asking me for my name (David Chase) when what they wanted was my fully qualified domain name (dr2chase.org), so that part of the certificate is wrong. The certificate creation in the makefile asked for this in a slightly more sensible way, using the abbreviation "FQDN", though you have to wonder how busy the authors of some of this security software are, that they cannot take the time to type in "Fully qualified domain name", and instead expect us to figure it out. It can be whiny about permissions, in a non-specific way (as if the software ran a one-way-hash on the permissions, didn't get a match, and expected you to just guess till it worked.) sudo chmod 600 /usr/local/etc/stunnel/mail.pem sudo chmod 755 /usr/local/etc/stunnel/ sudo chown root /usr/local/etc/stunnel/stunnel.conf You'll need to copy the sample stunnel.conf file into the real one: sudo cp /usr/local/etc/stunnel/stunnel.conf-sample /usr/local/etc/ stunnel/stunnel.conf You might want to look it over, though I don't recall changing much in mine. You might want to turn on debug logging there; mine seemed to spew in the invoking terminal, instead of any file that I could find, but that was good enough for a start: debug = 7 output = stunnel.log Some part of stunnel created its chroot directory with incorrect (for MacOS, at least) permissions: % ls -ld /usr/local/var/lib/stunnel/ 948 drwxrwx--T 2 root wheel 68 Jan 5 16:55 /usr/local/var/lib/ stunnel/ That's the one that didn't work, and clearly someone thought carefully about giving it the wrong permissions -- that "T" didn't get there accidentally. This caused silent failure for me. What worked, but might not be secure, is drwxrwxrwx 2 root wheel 68 Jan 6 00:16 /usr/local/var/lib/stunnel/ My guess is that it would be better if it were owned by nobody/nogroup, but this is clearly something that trained experts should GET RIGHT, instead of leaving it busted for novices to tinker with. What mail reader are you using? For example, Apple Mail's "connection doctor" will treat an unofficial certificate as a connection failure; only when you actually try to receive or send mail, will you get a chance to trust the certificate. Perhaps my sarcastic remarks will cause someone to actually fix something. Who knows. yours, David Chase

1 0

STunnel not creating connections.
by Paul Morrison 09 Jan '07

09 Jan '07

I have a problem perhaps someone can help me with. I have setup Stunnel and OpenSSL on a Windows 2003 server. It is configured to accept data on TCP port 2000, decrypt it, then pass it on to TCP port 8014. I have placed the certificates provided for this in a directory and I have told STunnel where these certificates are. The problem I am having is I can see the connection from port 2000 coming in to the system, but STunnel then does nothing before finally dropping the connection. The version of STunnel and OpenSSL are (stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005) I have the same setup at a different site on a different server and it works fine. In the debug.log the following is output: 2007.01.09 13:41:02 LOG7[684:352]: MATSU_GPRS started 2007.01.09 13:41:02 LOG7[684:352]: FD 196 in non-blocking mode 2007.01.09 13:41:02 LOG5[684:352]: MATSU_GPRS connected from 212.183.136.192:57511 2007.01.09 13:41:02 LOG7[684:352]: SSL state (accept): before/accept initialization 2007.01.09 13:41:22 LOG3[684:352]: SSL_accept: Peer suddenly disconnected 2007.01.09 13:41:22 LOG5[684:352]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.01.09 13:41:22 LOG7[684:352]: MATSU_GPRS finished (0 left) I would normally expect to see details of the SSL connection and the certificates being checked after the line 2007.01.09 13:41:02 LOG7[684:352]: SSL state (accept): before/accept initialization, but as you can see it does nothing before dropping the connection after 20 seconds. Does anyone know why this installation of STunnel does not seem to be attempting to use the certificates provided? I would be very grateful for any advice. P.S. Do I need to have a Certifcate Authority server setup at the site in order for STunnel to work? Paul Morrison IT Support Specialist TS3 Services Ltd Castle Court, Carnegie Campus Dunfermline KY11 8PB TEL: 01383 629900 Mob: 07918078864 EMAIL: Paul.Morrison(a)ts3services.co.uk <BLOCKED::mailto:[email protected]>

1 0

Problem with certificates using smtp /pop
by Klaas 09 Jan '07

09 Jan '07

Isn't there no one who knows how do deal with certificate? > Is there no one who can tell me exactly which part of the > certificate I have to place where and how I must configure > stunnel.conf for the certificate >> I have installed stunnel 4.20 on Windows2003 server and have >> created my private key as follow: >> openssl req -new -days 365 -nodes -config stunnel.cnf -out >> certreq.pem -keyout stunnel.pem >> >> After that I have send certreq.pem to my own CA and have >> received a certnew.cer file. But what I have to do next because >> I still receive the message that the CN-name of the certificate >> is not the same with the given name. >> >> I append this certificate (certnew.cer) to my stunnel.pem file like: >> -----BEGIN RSA PRIVATE KEY----- >> data here >> -----END RSA PRIVATE KEY----- >> -----BEGIN CERTIFICATE----- >> data here >> -----END CERTIFICATE----- >> >> But this doesn't work. Still receive the message that I also read >> on the stunnel.conf must I config something here? >> cert = stunnel.pem >> key = stunnel.pem >> >> ; Authentication stuff >> ;verify = 2 >> ; Don't forget to c_rehash CApath >> ;CApath = certs >> ; It's often easier to use CAfile >> ;CAfile = certs.pem >> ; Don't forget to c_rehash CRLpath >> ;CRLpath = crls >> ; Alternatively you can use CRLfile >> ;CRLfile = crls.pem >> >> Can anyone tell me please what certificate I place where and how config >> the stunnel.conf so I get this working?

1 0

RE: [stunnel-users] URL changes in browser to http from https
by Casey Rayman 08 Jan '07

08 Jan '07

I figured it out. The webserver was redirecting me to the index.html page so that is where the protocol was getting changed. So now the question changes. Is there a function in stunnel for URL rewriting? In otherwords the webserver sends back "redirect yourself to http:// but stunnel intercepts that before it gets back to your browser to keep the connection secure? Thanks, Casey -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Casey Rayman Sent: Monday, January 08, 2007 10:10 AM To: stunnel-users(a)mirt.net Subject: [stunnel-users] URL changes in browser to http from https I am just starting to experiment with stunnel on Debian Linux, using the standard debian packages. I've got it working so far accepting requests on the local port 443 and connecting on 80, but when the page loads the URL changes back to a non-secure address. To illustrate: https://192.168.1.10 loads a simple static web page and you get the normal warning for the certificate, but after the page loads the URL changes to http://192/168.1.10 . I thought this might just be IE or something but Firefox does it too. Could I be missing a setting in stunnel? Any ideas? Thank you, Casey _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

URL changes in browser to http from https
by Casey Rayman 08 Jan '07

08 Jan '07

I am just starting to experiment with stunnel on Debian Linux, using the standard debian packages. I've got it working so far accepting requests on the local port 443 and connecting on 80, but when the page loads the URL changes back to a non-secure address. To illustrate: https://192.168.1.10 loads a simple static web page and you get the normal warning for the certificate, but after the page loads the URL changes to http://192/168.1.10 . I thought this might just be IE or something but Firefox does it too. Could I be missing a setting in stunnel? Any ideas? Thank you, Casey

1 0

Problem with certificates using smtp /pop
by Klaas 08 Jan '07

08 Jan '07

Is there no one who can tell me exactly which part of the certificate I have to place where and how I must configure stunnel.conf for the certificate

1 0

patch: round robin load balancing
by Luke Deller 08 Jan '07

08 Jan '07

Hi, I noticed that stunnel already does round-robin load balancing of connections when the DNS name specified by the "connect" option resolves to multiple IP addresses. Here is a simple patch which allows the "connect" option to accept a comma separated list of names instead of just a single name. This can be used to load balance tunnelled connections across several servers. For example, to load balance HTTPS connections across 3 HTTP servers (localhost:80, anotherhost:8080 and anotherhost:8081), we could specify: [https] accept = 443 connect = 80,anotherhost:8080,anotherhost:8081 Regards, Luke. ********************************************************************************************** Important Note This email (including any attachments) contains information which is confidential and may be subject to legal privilege. If you are not the intended recipient you must not use, distribute or copy this email. If you have received this email in error please notify the sender immediately and delete this email. Any views expressed in this email are not necessarily the views of XPlan Technology. It is the duty of the recipient to virus scan and otherwise test the information provided before loading onto any computer system. Xplan Technology does not warrant that the information is free of a virus or any other defect or error. **********************************************************************************************

1 0

re: I am clearly doing something wrong
by David Chase 06 Jan '07

06 Jan '07

Foolishly, I trusted it to create /usr/local/var/lib/stunnel/ with the correct permissions. The directory that appeared had these permissions: ls -ld /usr/local/var/lib/stunnel/ drwxrwx--T 2 root wheel 68 Jan 5 16:55 /usr/local/var/lib/stunnel/ When I replaced it with this directory ls -ld /usr/local/var/lib/stunnel/ drwxrwxrwx 3 root wheel 102 Jan 5 20:43 /usr/local/var/lib/stunnel/ Suddenly, when I ran stunnel, it continued to run. I'd call this a bug. Still not doing quite what I want, (not connecting to elsewhere.com like I expect) but I'm closer. David Chase

1 0

I am clearly doing something wrong
by David Chase 05 Jan '07

05 Jan '07

But I think the documentation has some serious gaps in it, too. I compiled stunnel, installed it, created certificates, and even turned on debugging in the configuration file. Now, all I want to do is forward port 443 locally to port 80 elsewhere. Says my config file: cert = /usr/local/etc/stunnel/mail.pem ;key = /usr/local/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode ; client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [https] accept = 443 connect = elsewhere.com:80 TIMEOUTclose = 0 and when I run it, it says: sudo /usr/local/sbin/stunnel Password: 2007.01.05 18:51:01 LOG7[13470:2684415368]: Snagged 64 random bytes from /Users/chase/.rnd 2007.01.05 18:51:01 LOG7[13470:2684415368]: Wrote 1024 new random bytes to /Users/chase/.rnd 2007.01.05 18:51:01 LOG7[13470:2684415368]: RAND_status claims sufficient entropy for the PRNG 2007.01.05 18:51:01 LOG7[13470:2684415368]: PRNG seeded successfully 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service pop3s 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service imaps 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service ssmtp 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate: /usr/local/ etc/stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Certificate loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: Key file: /usr/local/etc/ stunnel/mail.pem 2007.01.05 18:51:01 LOG7[13470:2684415368]: Private key loaded 2007.01.05 18:51:01 LOG7[13470:2684415368]: SSL context initialized for service https I see nothing that looks like a complaint, but when I go looking for a stunnel process, there is not one, nor is anyone listening on port 443 at localhost. I cannot be the first person who wanted to do this, but I found both the FAQ and the documentation to be uninformative. How do I keep stunnel running and listening for connections on 443? I tried client=yes, that didn't seem to help. I am running Stunnel 4.20 on MacOS 10.4.8 David Chase

1 0

STunnel transparent + Solaris
by Corey Johnston 05 Jan '07

05 Jan '07

The documentation mentions that Solaris should support transparent mode for stunnel, yet I receive bind errors when I try to do this. "bind transparent: Cannot assign requested adddress (126)" Seems to suggest that either its actually not possible, or I've got to include something beyond "transparent = yes" in the conf file, or during compilation. Does anybody know if there's anything else special to make this work? Thanks in advance, Corey

2 1

Red Hat 7.0, Stunnel 4.20, and my Transparent Proxy Woes
by Richard Anderson 03 Jan '07

03 Jan '07

All, I'm attempting to setup Stunnel 4.20 on a RH7.0 box in transparent mode to essentially act as an SSL accelerator. I've gotten the SSL accelerator part to work (which means RH and Stunnel are working fine). But it's when I enable the transparent feature of stunnel I start having problems. The error it returns is : bind transparent: Cannot assign requested address (99) What I know is this: For transparent option to work with stunnel you must be using linux kernel 2.2. (check...red hat 7.0) Transparent proxy option must be enabled in kernel. (check, enabled, recompiled, and booted off that image) IP_FORWARD must be enabled. (check, set this in the sysctl.conf to do it on bootup) But it still won't work. Does anybody have any other ideas as to what I'm missing? thanks, rich _________________________________________________________________ Get FREE Web site and company branded e-mail from Microsoft Office Live http://clk.atdmt.com/MRT/go/mcrssaub0050001411mrt/direct/01/

1 0

Problem with certificates using smtp /pop
by Klaas 29 Dec '06

29 Dec '06

Hello, I have installed stunnel 4.20 on Windows2003 server and have created my private key as follow: openssl req -new -days 365 -nodes -config stunnel.cnf -out certreq.pem -keyout stunnel.pem After that I have send certreq.pem to my own CA and have received a certnew.cer file. But what I have to do next because I still receive the message that the CN-name of the certificate is not the same with the given name. I append this certificate (certnew.cer) to my stunnel.pem file like: -----BEGIN RSA PRIVATE KEY----- data here -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- data here -----END CERTIFICATE----- But this doesn't work. Still receive the message that I also read on the stunnel.conf must I config something here? cert = stunnel.pem key = stunnel.pem ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem Can anyone tell me what certificate I place where and how config the stunnel.conf so I get this working?

1 0

Avira Anti-Vir Detects stunnel as virus
by Daniel Tschinder 26 Dec '06

26 Dec '06

I'm using Avira AntiVir (www.free-av.de) and it detects stunnel 4.20 as virus APPL/Stunnel.A . I do not know what to do against it... as you can see in this list, stunnel was added to the signatures Database of AntiVir: http://www.avira.de/en/threats/section/vdfhistory/vdf_no/6.37.00.53/6.37.00… Maybe one of the devs can check back with avira.... best regards, daniel

2 1

Benchmarks
by Michal Trojnara 17 Dec '06

17 Dec '06

Dear Users, I have updated stunnel performance benchmarks: http://stunnel.mirt.net/perf.html I hope you'll find them useful. The funny thing I currently have 2 hardware accelerator cards, but none of them works: - one of them is too obsolete and its proprietary drivers are no longer available; - the other one is too modern and its PCI-X slot does not work with my ASUS P5WDG2 WS Professional motherboard. I'm pretty sure most users won't even be able to utilize the performance provided by software implementation. The bottleneck will most likely be network connection or the destination server performance. Best regards, Mike

1 0

service reconfiguration by SIGHUP
by Matthew Eaton 15 Dec '06

15 Dec '06

Hi, I've created a patch to Stunnel that reloads all accepting connections from the config file. This will not work for privileged ports in the current implementation. Test at your own risk :) Feedback welcome. Best regards, Matthew diff -urb stunnel-orig/stunnel-4.20/src/stunnel.c stunnel-4.20/src/stunnel.c --- stunnel-orig/stunnel-4.20/src/stunnel.c 2006-11-30 15:47:45.000000000 -0500 +++ stunnel-4.20/src/stunnel.c 2006-12-12 03:34:36.000000000 -0500 @@ -53,12 +53,12 @@ #endif int volatile num_clients=0; /* Current number of clients */ +int volatile conf_updated=0; /* Conf updated ? */ /* Functions */ #ifndef USE_WIN32 int main(int argc, char* argv[]) { /* execution begins here 8-) */ - main_initialize(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL); signal(SIGPIPE, SIG_IGN); /* avoid 'broken pipe' signal */ @@ -78,12 +78,17 @@ } #endif +char *cfg_arg1 = NULL; +char *cfg_arg2 = NULL; + void main_initialize(char *arg1, char *arg2) { ssl_init(); /* initialize SSL library */ sthreads_init(); /* initialize critical sections & SSL callbacks */ parse_config(arg1, arg2); log_open(); stunnel_info(0); + cfg_arg1 = arg1; + cfg_arg2 = arg2; } void main_execute(void) { @@ -105,6 +110,7 @@ SOCKADDR_UNION addr; s_poll_set fds; LOCAL_OPTIONS *opt; + int i; get_limits(); s_poll_zero(&fds); #if !defined(USE_WIN32) && !defined(USE_OS2) @@ -173,6 +179,42 @@ accept_connection(opt); } + if(conf_updated) { + for(i=0; i<fds.nfds; i++) + close(fds.ufds[i].fd); + + /* re-bind local ports */ + for(opt=local_options.next; opt; opt=opt->next) { + if(!opt->option.accept) /* no need to bind this service */ + continue; + memcpy(&addr, &opt->local_addr.addr[0], sizeof(SOCKADDR_UNION)); + if((opt->fd=socket(addr.sa.sa_family, SOCK_STREAM, 0))<0) { + sockerror("local socket"); + exit(1); + } + if(alloc_fd(opt->fd)) + exit(1); + if(set_socket_options(opt->fd, 0)<0) + exit(1); + s_ntop(opt->local_address, &addr); + if(bind(opt->fd, &addr.sa, addr_len(addr))) { + s_log(LOG_ERR, "Error binding %s to %s", + opt->servname, opt->local_address); + sockerror("bind"); + exit(1); + } + s_log(LOG_DEBUG, "%s bound to %s", opt->servname, opt->local_address); + if(listen(opt->fd, 5)) { + sockerror("listen"); + exit(1); + } +#ifdef FD_CLOEXEC + fcntl(opt->fd, F_SETFD, FD_CLOEXEC); /* close socket in child execvp */ +#endif + s_poll_add(&fds, opt->fd, 1, 0); + } + conf_updated = 0; + } } s_log(LOG_ERR, "INTERNAL ERROR: End of infinite loop 8-)"); } @@ -413,9 +455,16 @@ } static void signal_handler(int sig) { /* signal handler */ + if((sig==SIGHUP) && local_options.next) { /* only in service mode */ + s_log(LOG_NOTICE, "Re-reading configuration"); + parse_config(cfg_arg1, cfg_arg2); + conf_updated = 1; + } + else { s_log(sig==SIGTERM ? LOG_NOTICE : LOG_ERR, "Received signal %d; terminating", sig); exit(3); + } } #endif /* !defined USE_WIN32 */

1 2

stunnel patch to support URL lookups for parameters (take 2)
by Dan Jakubiec 13 Dec '06

13 Dec '06

Attached is a patch which extends the "connect=" and "CApath=" options to allow these parameters to be obtained dynamically at connect-time via a URL lookup, rather than statically from the stunnel configuration file. It is a generalization of an earlier patch to 4.04 submitted by Jan Piet-Mens which does something similar using LDAP lookups. Feedback is appreciated! Here is a summary of the functionality, along with some notes: 1. The patch was written to allow stunnel to dynamically route and authenticate incoming connections based on parameters found in the client's certificate. 2. Routing and authentication information is obtained by issuing a URL lookup, so the information can be obtained from a variety of local or remote sources. 3. It is particularly useful in high-volume, load-balancing scenarios where many copies of stunnel are running on multiple front-end servers. It allows the destination socket and client certificate verification info to be obtained on-the-fly from a centralized database. 4. Although primarily intended for use with HTTP, this patch uses the libcurl URL library and should work with all of its supported protocols: HTTP, HTTPS, FTP, FTPS, TFTP, DICT, TELNET, LDAP or FILE. As a brief example, an end-user might configure their stunnel as follows: cert = id.pem verify = 2 CApath = ca_dir CAlookup = http://database.stunnel.org/map_client.php?hash=%h [dynamic] accept = 50000 connect = @http://database.stunnel.org/map_client.php?common_name=%n In this scenario, an incoming stunnel connection would obtain it's connect info from database.stunnel.org by sending an HTTP request and passing the common name found in the client certificate. Similarly, the client's certificate would be verified using CA certificates obtained via HTTP lookup to the same host. Comments are appreciated. Thanks, Dan Jakubiec

1 0

stunnel patch to support URL lookups for parameters
by Dan Jakubiec 13 Dec '06

13 Dec '06

Attached is a patch which extends the "connect=" and "CApath=" options to allow these parameters to be obtained dynamically at connect-time via a URL lookup, rather than statically from the stunnel configuration file. It is a generalization of an earlier patch to 4.04 submitted by Jan Piet-Mens which does something similar using LDAP lookups. Feedback is appreciated! Here is a summary of the functionality, along with some notes: 1. The patch was written to allow stunnel to dynamically route and authenticate incoming connections based on parameters found in the client's certificate. 2. Routing and authentication information is obtained by issuing a URL lookup, so the information can be obtained from a variety of local or remote sources. 3. It is particularly useful in high-volume, load-balancing scenarios where many copies of stunnel are running on multiple front-end servers. It allows the destination socket and client certificate verification info to be obtained on-the-fly from a centralized database. 4. Although primarily intended for use with HTTP, this patch uses the libcurl URL library and should work with all of its supported protocols: HTTP, HTTPS, FTP, FTPS, TFTP, DICT, TELNET, LDAP or FILE. As a brief example, an end-user might configure their stunnel as follows: cert = id.pem verify = 2 CApath = ca_dir CAlookup = http://database.stunnel.org/map_client.php?hash=%h <http://database.stunnel.org/map_client.php?hash=%25h> [dynamic] accept = 50000 connect = @http://database.stunnel.org/map_client.php?common_name=%n<http://database.stunnel.org/map_client.php?common_name=%25n> In this scenario, an incoming stunnel connection would obtain it's connect info from database.stunnel.org by sending an HTTP request and passing the common name found in the client certificate. Similarly, the client's certificate would be verified using CA certificates obtained via HTTP lookup to the same host. Comments are appreciated. Thanks, Dan Jakubiec

1 0

Re: [stunnel-users] service reconfiguration by SIGHUP
by Hans Werner Strube 13 Dec '06

13 Dec '06

Matthew Eaton wrote: > I've created a patch to Stunnel that reloads all accepting connections > from the config file. This will not work for privileged ports in the > current implementation. Please explain why it will not work for privileged ports. Does this hold even if the master stunnel process runs as root? And what happens to active connections on SIGHUP? Are they simply broken?

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users