- stunnel-users - stunnel.org

stunnel claims it needs certificate
by JOSE 14 Sep '11

14 Sep '11

Hi I am trying to get stunnel stunnel 4.36 on ia64-hp-hpux11.23 with OpenSSL 0.9.8o 01 Jun 2010 working on this server and so far I have generated a new pem file as per the instructions, but it is the time to make to run, it keeps looking for a certificate for one of the services: bash-3.2# /opt/iexpress/stunnel/bin/stunnel /opt/iexpress/stunnel/etc/stunnel/stunnel.conf Reading configuration from file /opt/iexpress/stunnel/etc/stunnel/stunnel.conf Snagged 64 random bytes from /opt/iexpress/stunnel/etc/stunnel/stunnel.rnd Wrote 1024 new random bytes to /opt/iexpress/stunnel/etc/stunnel/stunnel.rnd PRNG seeded successfully Line 37: End of section revnet_preprod_sunquest: SSL server needs a certificate my conf file is as follows: bash-3.2# more /opt/iexpress/stunnel/etc/stunnel/stunnel.conf # Sample stunnel configuration file #RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd RNDfile=/opt/iexpress/stunnel/etc/stunnel/stunnel.rnd # Chroot #chroot = /var/chroot/stunnel/ # PID is created inside chroot jail #pid = /opt/hpws/apache/logs/stunnel.pid pid = /opt/iexpress/stunnel/etc/stunnel/stunnel.pid # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Client Authentication #verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /opt/hpws/apache/conf/certs.pem # Some debugging stuff debug = 7 output = /opt/hpws/apache/logs/stunnel.log # Use in client mode client = no # Run in the background foreground = no # Service-level configuration [revnet_preprod_sunquest] accept = 10.99.10.37:8011 connect = 127.0.0.1:18011 #connect = 18011 [revnet_preprod_funsun] accept = 10.99.10.37:8017 connect = 127.0.0.1:18017 #connect = 18017 any help or tips would be welcome Thanks Jose

2 2

netword.c & fdprintf access access violation fix
by Alexey Drozdov 12 Sep '11

12 Sep '11

Hi, all One more bug was found out at work stunnel through a proxy. There is a reference to already released memory in fdprintf function. Here a small fix of this situation: *** network.c 2011-09-07 20:46:19.000000000 +0400 --- network.c_patch 2011-09-12 23:52:46.015618574 +0400 *************** *** 766,771 **** --- 766,772 ---- int fdprintf(CLI *c, int fd, const char *format, ...) { va_list ap; char *line; + int outsize; va_start(ap, format); line=str_vprintf(format, ap); *************** *** 775,782 **** longjmp(c->err, 1); } fdputline(c, fd, line); str_free(line); ! return strlen(line)+2; } #define INET_SOCKET_PAIR --- 776,784 ---- longjmp(c->err, 1); } fdputline(c, fd, line); + outsize = strlen(line)+2; str_free(line); ! return outsize; } #define INET_SOCKET_PAIR / Alexey Drozdov

1 0

SNI and some troubles solving
by Alexey Drozdov 10 Sep '11

10 Sep '11

Hi All, At first I would like to thank Marzena Trojnara for the useful program! Occurrence of support SNI has especially interest. I have decided to use the given possibility, but have detect pair of bugs which has independently successfully solved. To begin with I dump part of my config: [virtual_server] accept = 443 connect = localhost:1081 cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key ; need peer verification for default access verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt ; use restricted access form some target services [socks5] sni = virtual_server:localhost sni = virtual_server:89.250.5.185 sni = virtual_server:127.0.0.1 sni = virtual_server:server cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt connect = localhost:1081 ; public service [dreamhub_ru] sni = virtual_server:dreamhub.ru sni = virtual_server:pad.dreamhub.ru cert = /usr/local/etc/stunnel/dreamhub.cer key = /usr/local/etc/stunnel/dreamhub.pem connect = localhost:80 I want to use stunnel on 443rd port for ssl-socks5 service with peer certificates verification and use public https web-service (https://dreamhub.ru). And so it has appeared that value for "verify" are always used from global section (in my case [virtual_server]), and values of "verify" parameters from virtual services sections aren't used. Problem it has appeared that in the SNI check callback static int servername_cb(SSL *ssl, int *ad, void *arg) ... for(list=section->servername_list_head; list; list=list->next) if(!strcasecmp(servername, list->servername)) { c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); SSL_set_SSL_CTX(ssl, c->opt->ctx); does not copy ctx->verify_mode (SSL*)s->verify_mode=ctx->verify_mode; It has been solved by explicit calling SSL_set_verify *** ctx.c 2011-09-07 14:43:50.000000000 +0400 --- ctx.c_patched 2011-09-10 01:12:48.000000000 +0400 *************** *** 156,161 **** --- 156,162 ---- c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); + SSL_set_verify(ssl, SSL_CTX_get_verify_mode(c->opt->ctx), +NULL); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); #ifdef USE_LIBWRAP The second moment concerns uses stunnel as client through HTTPS a proxy (protocol=connect). All works perfectly, only it has appeared that value for SNI used from "connect" parameter instead of value of "protocolHost". On a code all is quite obvious: if(c->opt->host_name) { s_log(LOG_DEBUG, "SNI: host name: %s", c->opt->host_name); if(!SSL_set_tlsext_host_name(c->ssl, c->opt->host_name)) { sslerror("SSL_set_tlsext_host_name"); longjmp(c->err, 1); } } I solved it such: *** options.c 2011-09-07 20:38:56.000000000 +0400 --- options.c_patch 2011-09-10 16:34:56.882619049 +0400 *************** *** 695,700 **** --- 695,705 ---- s_log(LOG_INFO, "Cannot resolve '%s' - delaying DNS lookup", arg); section->option.delayed_lookup=1; } + + /* check - is host_name already filled */ + if (section->host_name != NULL) + return NULL; /* OK */ + tmpstr=strrchr(arg, ':'); if(tmpstr) { *tmpstr='\0'; *************** *** 1077,1082 **** --- 1082,1095 ---- if(strcasecmp(opt, "protocolHost")) break; section->protocol_host=str_dup_err(arg); + + /* Overwrite section->host_nam because of + protocolHost should be used for client SNI */ + tmpstr=strrchr(arg, ':'); + if(tmpstr) { + *tmpstr='\0'; + section->host_name=str_dup_err(arg); + } return NULL; /* OK */ case CMD_DEFAULT: break; I think that the given changes can be useful for other :) / Alexey Drozdov

2 1

SNI and some troubles solving
by Alexey Drozdov 10 Sep '11

10 Sep '11

Hi All, At first I would like to thank Marzena Trojnara for the useful program! Occurrence of support SNI has especially interest. I have decided to use the given possibility, but have detect pair of bugs which has independently successfully solved. To begin with I dump part of my config: [virtual_server] accept = 443 connect = localhost:1081 cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key ; need peer verification for default access verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt ; use restricted access form some target services [socks5] sni = virtual_server:localhost sni = virtual_server:89.250.5.185 sni = virtual_server:127.0.0.1 sni = virtual_server:server cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt connect = localhost:1081 ; public service [dreamhub_ru] sni = virtual_server:dreamhub.ru sni = virtual_server:pad.dreamhub.ru cert = /usr/local/etc/stunnel/dreamhub.cer key = /usr/local/etc/stunnel/dreamhub.pem connect = localhost:80 I want to use stunnel on 443rd port for ssl-socks5 service with peer certificates verification and use public https web-service (https://dreamhub.ru). And so it has appeared that value for "verify" are always used from global section (in my case [virtual_server]), and values of "verify" parameters from virtual services sections aren't used. Problem it has appeared that in the SNI check callback static int servername_cb(SSL *ssl, int *ad, void *arg) ... for(list=section->servername_list_head; list; list=list->next) if(!strcasecmp(servername, list->servername)) { c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); SSL_set_SSL_CTX(ssl, c->opt->ctx); does not copy ctx->verify_mode (SSL*)s->verify_mode=ctx->verify_mode; It has been solved by explicit calling SSL_set_verify *** ctx.c 2011-09-07 14:43:50.000000000 +0400 --- ctx.c_patched 2011-09-10 01:12:48.000000000 +0400 *************** *** 156,161 **** --- 156,162 ---- c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); + SSL_set_verify(ssl, SSL_CTX_get_verify_mode(c->opt->ctx), +NULL); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); #ifdef USE_LIBWRAP The second moment concerns uses stunnel as client through HTTPS a proxy (protocol=connect). All works perfectly, only it has appeared that value for SNI used from "connect" parameter instead of value of "protocolHost". On a code all is quite obvious: if(c->opt->host_name) { s_log(LOG_DEBUG, "SNI: host name: %s", c->opt->host_name); if(!SSL_set_tlsext_host_name(c->ssl, c->opt->host_name)) { sslerror("SSL_set_tlsext_host_name"); longjmp(c->err, 1); } } I solved it such: *** options.c 2011-09-07 20:38:56.000000000 +0400 --- options.c_patch 2011-09-10 16:34:56.882619049 +0400 *************** *** 695,700 **** --- 695,705 ---- s_log(LOG_INFO, "Cannot resolve '%s' - delaying DNS lookup", arg); section->option.delayed_lookup=1; } + + /* check - is host_name already filled */ + if (section->host_name != NULL) + return NULL; /* OK */ + tmpstr=strrchr(arg, ':'); if(tmpstr) { *tmpstr='\0'; *************** *** 1077,1082 **** --- 1082,1095 ---- if(strcasecmp(opt, "protocolHost")) break; section->protocol_host=str_dup_err(arg); + + /* Overwrite section->host_nam because of + protocolHost should be used for client SNI */ + tmpstr=strrchr(arg, ':'); + if(tmpstr) { + *tmpstr='\0'; + section->host_name=str_dup_err(arg); + } return NULL; /* OK */ case CMD_DEFAULT: break; I think that the given changes can be useful for other :) / Alexey Drozdov

1 0

stunnel 4.43 released
by Michal Trojnara 07 Sep '11

07 Sep '11

Dear Users, I have released version 4.43 of stunnel. The ChangeLog entry: Version 4.43, 2011.09.07, urgency: MEDIUM: * New features - Updated Win32 DLLs for OpenSSL 1.0.0e. - Major optimization of the logging subsystem. Benchmarks indicate up to 15% performance improvement. * Bugfixes - Fixed WIN32 configuration file reload. - Fixed FORK and UCONTEXT threading models. - Corrected INSTALL.W32 file. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.43.tar.gz: 93a002d9e1652d7684756af75b44b00f99aa93574e8a5a2e69f88656221d5ce2 Best regards, Mike

2 1

SSL3_READ_BYTES:tlsv1 alert internal error
by Andrew Heuneman 07 Sep '11

07 Sep '11

Hello, We recently implemented Stunnel on Centos 5.6 for ssl offloading for our java application. The application has applets to communicate java objects over https to a tomcat server on the server side. We have it setup in front of our Alteon/Radware load balancer. This hardware load balancer is capable of ssl load balancing, but has produced a very specific packet reset that only presents itself in ssl processing. We decided to implement Stunnel in front of this load balancer to fix this problem. Ssl offloading was working great with Stunnel until we ran into Java 7. if I run any version of our applets on java 6 they work. If i run java 7 they do not work. I have tried googling and looking for this error but I have only found some references to SNI... is this correct? Is there anything I can do. Please forgive me if i have omitted any details I will be more than happy to include a packet capture or other details if needed. I compiled stunnel with the following options ./configure --disable-libwrap --bindir=/usr/sbin --sbindir=/usr/sbin --sysconfdir=/etc --with-ssl=/usr/local/ssl also i compiled OpenSSL 1.0.0d with the following ./Configure threads shared linux-generic64 stunnel -version No limit detected for the number of clients signal_pipe: FD=3 allocated (non-blocking mode) signal_pipe: FD=4 allocated (non-blocking mode) stunnel 4.42 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv6 stunnel 4.42 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv6 Global option defaults debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level option defaults ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none str_stats: 112 block(s), 4046 byte(s) stunnel.conf cert=/etc/stunnel/stunnel.pem debug=7 output=/var/log/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=0.0.0.0:443 connect=172.16.18.100:80 session = 300 TIMEOUTbusy = 300 TIMEOUTconnect = 10 TIMEOUTidle = 43200 client = no stunnel.log 2011.08.22 16:58:49 LOG7[438154:47689394220768]: Service https accepted FD=2 from 10.0.11.27:46830 2011.08.22 16:58:49 LOG7[438154:1104877888]: Service https started 2011.08.22 16:58:49 LOG7[438154:1104877888]: Option TCP_NODELAY set on local socket 2011.08.22 16:58:49 LOG5[438154:1104877888]: Service https accepted connection from 10.0.11.27:46830 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): before/accept initialization 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 read client hello A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write server hello A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write certificate A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write key exchange A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write certificate request A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 flush data 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL alert (read): fatal: internal error 2011.08.22 16:58:49 LOG3[438154:1104877888]: SSL_accept: 14094438: error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error 2011.08.22 16:58:49 LOG5[438154:1104877888]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.08.22 16:58:49 LOG7[438154:1104877888]: Service https finished (1 left) 2011.08.22 16:58:49 LOG7[438154:1104877888]: str_stats: 0 block(s), 0 byte(s) 2011.08.22 16:59:01 LOG7[438154:1104947520]: Socket closed on read 2011.08.22 16:59:01 LOG7[438154:1104947520]: Sending SSL write shutdown 2011.08.22 16:59:01 LOG7[438154:1104947520]: SSL alert (write): warning: close notify 2011.08.22 16:59:01 LOG6[438154:1104947520]: SSL_shutdown successfully sent close_notify 2011.08.22 16:59:01 LOG7[438154:1104947520]: SSL alert (read): warning: close notify 2011.08.22 16:59:01 LOG7[438154:1104947520]: SSL closed on SSL_read 2011.08.22 16:59:01 LOG7[438154:1104947520]: Sending socket write shutdown 2011.08.22 16:59:01 LOG5[438154:1104947520]: Connection closed: 49445 bytes sent to SSL, 8175 bytes sent to socket -- Thank You, Andrew Heuneman Senior Systems Administrator Reading Plus®/Taylor Associates Helping students become proficient silent readers. <http://twitter.com/readingplus> <http://www.facebook.com/pages/Reading-Plus/165970877038>

2 1

Internal error after reload modified server mode section
by Javier 07 Sep '11

07 Sep '11

Hi, I didn't found this question, so I hope isn't duplicate. I'm using the latest stable 4.42 version and I'm running Windows 2000 and I want to ask is this is a normal behavior. What is happening is that, after change the server section in the config file (the rest are all client mode), if it has been any connection to that server (and only if it has been a connection), when I reload the modified conf, it gives...: INTERNAL ERROR: get_alloc_list_ptr: Bad magic str_stats: 380 block(s), 96684 byte(s) This happens after no errors in the load (except for DH being hardcoded), SSL context initialized Configuration successful after open every service (clients and server) and then, after the error, closes every service. Trying to reload the conf, doesn't nothing, just stunnel hangs (is not responding to reloads). The only way to restart all is to close stunnel and reopen. Then, the configuration is accepted without problems and works perfectly. This happens, as I said, after modify the conf file and if it was a connection. The section is related to a local test server, where I modify the IP and/or ports where to accept and where to connect. As general options I have: debug = debug delay = yes And the server section: [mySSL] client = no cert = mytestpem.pem accept = 127.0.0.1:443 connect = 127.0.0.1:80 What I'm doing wrong? Is the normal behavior? Is it a new bug? Regards, Javier.

3 5

Compiling Stunnel For Windows
by Albert 05 Sep '11

05 Sep '11

Hi, I want to compile stunnel for windows, to include the XMPP patch (that I managed to apply cleanly to the current stunnel code) that I saw on the mailing list earlier as I need to get it to connect to a SSL only server in client mode. I followed the instructions in the Install.w32 file 1) apt-get install gcc-mingw32 - Worked fine with no issues 2) Download the recent zlib from http://www.zlib.net/ , Update the following definitions in win32/Makefile.gcc file: etc *snip* Worked fine as far as I can tell 3) Download the recent OpenSSL in unpack it to /usr/src/ directory., cd /usr/src && tar zvxf ~/openssl-(version).tar.gz I got OpenSSL 1.0.0d 4) Build OpenSSL with cross_mingw32.sh script. I ran instead ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared zlib-dynamic && make it seems to have worked fine 5) Download and unpack stunnel-(version).tar.gz. -got stunnel 4.42 6) Configure stunnel. cd stunnel-(version) && ./configure --with-ssl=/path/to/openssl-(version) This step worked fine 7) Build windows executable. cd src && make stunnel.exe The first few compile steps work fine, but I get stuck on: ...i586-mingw32msvc/bin/ld: cannot find -lcrypto.dll I did a few hours of troubleshooting and trying to move a few files around but couldn't find crypto.dll anywhere I'm running a fresh install of Ubuntu 11.04 in a VM if that makes any difference. Help would be greatly appreciated :) Thanks, Albert

2 1

Changing the secure tunnel 'encryption' method ....
by VANDOOREN, Pascal 02 Sep '11

02 Sep '11

Hello Everyone, I have a question, Why use you a certificate and not a hash AES, or other crypting algorithm to make a secure tunnel ? Because i use not a validate cert and i can only generate a cert valid for maximum 1year ... In the config file you can let the choice to use the cert or hash .. It's only a idea Kind regards Pascal -- This e-mail is confidential. If you are not the addressee or an authorized recipient of this message, any distribution, copying, publication or use of this information for any purpose is prohibited. Please notify the sender immediately by e-mail and then delete this message. Ce message est confidentiel. Si vous n'etes pas le destinataire designe de ce message ou une personne autorisee a l'utiliser, toute distribution, copie, publication ou usage a quelques fins que ce soit des informations contenues dans ce message sont interdits. Merci d'informer immediatement l'expediteur par messagerie electronique et d'ensuite detruire ce message. --

1 0

Windows version not starting when Run
by Dayo Akande 31 Aug '11

31 Aug '11

The main thing that I'm seeing as the error is: "Could not load DH parameters from stunnel.pem" Below is the entire log file, I am so stumped here. I appreciate any help. No limit detected for the number of clients make_sockets: s_socket#1: FD=272 allocated (blocking mode) make_sockets: s_socket#2: FD=276 allocated (blocking mode) make_sockets: s_accept: FD=292 allocated (non-blocking mode) stunnel 4.42 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service pop3s Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded Could not load DH parameters from stunnel.pem Using hardcoded DH parameters DH initialized with 2048-bit key ECDH initialized with curve prime256v1 SSL options set: 0x01180004 SSL context initialized Initializing SSL context for service imaps Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded Could not load DH parameters from stunnel.pem Using hardcoded DH parameters DH initialized with 2048-bit key ECDH initialized with curve prime256v1 SSL options set: 0x01180004 SSL context initialized Line 91: "socket = l:TCP_NODELAY=1 ": Specified option name is not valid here str_stats: 152 block(s), 11942 byte(s) Server is down

2 2

Re: [stunnel-users] CRL
by Uldis Biks 31 Aug '11

31 Aug '11

1 0

CRL
by Uldis Biks 31 Aug '11

31 Aug '11

2 2

stunnel : binding in ipv6+ipv4 : problem
by Guylhem Aznar 26 Aug '11

26 Aug '11

Hello I have a problem with stunnel : I just don't know how to specify 2 different port forwarding, one for all ipv4 connections to port 443, the other for all ipv6 connections. Either one seem to work, but I can't have both at the same time. In my /etc/hosts : 127.0.0.1 localhost ::1 localhost6 0.0.0.0 listenall4 :: listenall6 In my stunnel.conf: [sslh] accept = listenall4:443 connect = 127.0.0.1:444 TIMEOUTclose = 0 [ssl6] accept = listenall6:443 connect = 6.guylhem.org:80 TIMEOUTclose = 0 I have read that linux can block ipv6 sockets if the ipv4 socket is created first, but here the order doesn't change anything. I though that stunnel was ipv6 capable, but apparently it doesn't play well with ipv4 on the same port. So I tried to remove one of the listenall : the listenall4 is important, but listenall6 is not. Yet giving a AAAA only host like 6.guylhem.org does not help - even if it goes before the listenall4. So I'm stuck. Has anyone patched stunnel for such a situation? Guylhem

1 0

FW: Mysql doesnt run with stunnel
by Freeh Sophia 26 Aug '11

26 Aug '11

Craig Retief <stunnel <at> rsw.co.za> writes: > > I see that on your server you have specified your config for mysqls like > this: > Hi Craig, That fixed it for me. Thanks! Freeh Sophia Marketing GmbH Emanuelstr. 3, 10317 Berlin Deutschland Telefon: +49 (33) 5310967 Email: freehsophia(a)gmail.com Site: http://flug.airego.de/

1 0

stunnel4 tcp_nodelay
by Madhu R 21 Aug '11

21 Aug '11

Hi, We are using stunnel in order to tunnel http proxy traffic. Is it better in this case to turn on Nagle's algo? I have tried to set socket=l:TCP_NODELAY=0 and socket=r:TCP_NODELAY=0 in the global config, but when I look at debug log it keeps saying option tcp_nodelay is set on local and remote socket. Is this a bug, or is there a different way of turning off tcp_nodelay (since I understand this is on by default now) Regds

1 0

Security issue in 4.4X effect older version?
by Richard L. Houston 19 Aug '11

19 Aug '11

Hi All, Sorry if this has been asked and answered. Saw the security warning about Stunnel 4.40 and 4.41 at http://www.securityfocus.com/bid/49254/info Are older version vulnerable as well or just those two specific versions? Specificity in the 4.2X series? Thanks for your help. +------------------------------------+ Best regards, -Richard Houston -R.L.H. Consulting -E-Mail rhouston(a)rlhc.net -WWW http://www.rlhc.net -Blog http://www.rlhc.net/blog/ -Twitter http://www.twitter.com/rlhc/

1 0

centos 6 - stunnel 4.42 unusable (libssl trap divide error) in FIPS mode (default)
by draeath 19 Aug '11

19 Aug '11

I just finished building and configuring stunnel 4.42 on my x86_64 CentOS6 box. It appears to run, but not long into the SSL connection stunnel dies. Log info below. This only happens if I do NOT specify --disable-fips during ./configure (as it enables FIPS by default). I assume this is because FIPS compliancy requires a key to have a passphrase, which my key does not have? [root@host stunnel]# tail -f /var/log/stunnel.log /var/log/messages ==> /var/log/stunnel.log <== 2011.08.19 16:27:36 LOG7[31681:139656510936832]: Option TCP_NODELAY set on local socket 2011.08.19 16:27:36 LOG5[31681:139656510936832]: Service ntop accepted connection from 12.117.176.190:13258 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): before/accept initialization 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 read client hello A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 write server hello A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 write certificate A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 write key exchange A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 write server done A 2011.08.19 16:27:36 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 flush data 2011.08.19 16:27:37 LOG7[31681:139656510936832]: SSL state (accept): SSLv3 read client key exchange A ==> /var/log/messages <== Aug 19 16:27:24 host stunnel: LOG5[31680:139656510941120]: FIPS mode enabled Aug 19 16:27:24 host stunnel: LOG6[31680:139656510941120]: Initializing SSL context for service ntop Aug 19 16:27:24 host stunnel: LOG4[31680:139656510941120]: Insecure file permissions on /usr/local/etc/stunnel/stunnel.pem Aug 19 16:27:24 host stunnel: LOG6[31680:139656510941120]: SSL context initialized Aug 19 16:27:24 host stunnel: LOG5[31680:139656510941120]: Configuration successful Aug 19 16:27:36 host stunnel: LOG5[31681:139656510936832]: Service ntop accepted connection from 12.117.176.190:13257 Aug 19 16:27:36 host stunnel: LOG3[31681:139656510936832]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Aug 19 16:27:36 host stunnel: LOG5[31681:139656510936832]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Aug 19 16:27:36 host stunnel: LOG5[31681:139656510936832]: Service ntop accepted connection from 12.117.176.190:13258 Aug 19 16:27:37 host kernel: stunnel[31724] trap divide error ip:7f044fd0d3d1 sp:7f0450b98a40 error:0 in libssl.so.1.0.0[7f044fce2000+53000]

1 0

Tr:SIP encryption with stunnel
by margot.basa 19 Aug '11

19 Aug '11

Hello all, Can someone give me information about SIP encryption with stunnel please ? Is it possible to transform a SIP message on TCP into a SIP TLS message with stunnel ? Thank you very much for your help, Regards > Message du 16/08/11 11:38 > De : "margot.basa" > A : stunnel-users(a)stunnel.org > Copie à : > Objet : SIP encryption with stunnel > > Hello all, I would like to know if stunnel is able to encrypt a SIP message (UDP or TCP => TLS...) For example: Terminal A can send/receive SIP messages on transport layer UDP or TCP but not TLS. Server B can send/receive SIP messages only in TLS. If terminal A sends a SIP REGISTER message to Server B, does stunnel is able to intercept the message and transform it ? port 5060 => port 5061 TCP => TLS sip uri => sips uri Do you think it's possible with stunnel ? Thank you very much for your input. Regards > > Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

When X-FORWARDED-FOR for Stunnel ?
by Elodie BOSSIER 19 Aug '11

19 Aug '11

Greetings, Why you don't implement X-FORWARDED-FOR into stunnel ? I have found this patch : http://haproxy.1wt.eu/download/patches/stunnel-4.32-xforwarded-for.diff but this on is to much old, i'm with stunnel 4.41 and i can't go to 4.32 because i need SNI, implemented since 4.38 I have attempt to modify the patch to match with the current version, in begining it's ok but not after, all line code have changed and i'm not developer. X-FORWARDED-FOR is very important and exist on mostly all the frontend web and usuable by all the web server. Someone told me to switch to Nginx because X-FORWARDED-FOR don't exist in Stunnel ... I would like stay on Stunnel because it's only a light tunnel. The patch have only 219 lines, could you help me please to addapt it to the version 4.41 and/or add this feature into Stunnel please ? This is the "manual" to apply the patch : http://www.buro9.com/blog/2009/12/07/installing-haproxy-load-balance-http-a… Just need to add "xforwardedfor=yes" into your config file and should be OK. With this feature, I won't have need to "play" with this (censured) of transparent = source, iptables rules, tcpdump and root exec ... Thanks so much ... Elodie.

3 5

stunnel 4.42 released
by Michal Trojnara 18 Aug '11

18 Aug '11

Dear Users, I have released version 4.42 of stunnel. This is a security bugfix release. Upgrade is highly recommended! The ChangeLog entry: Version 4.42, 2011.08.18, urgency: HIGH: * New features - New verify level 0 to request and ignore peer certificate. This feature is useful with the new Windows GUI menu to save cached peer certificate chains, as SSL client certificates are not sent by default. - Manual page has been updated. - Removed support for changing Windows Service name with "service" option. * Bugfixes - Fixed a heap corruption vulnerability in versions 4.40 and 4.41. It may possibly be leveraged to perform DoS or remote code execution attacks. - The -quiet commandline option was applied to *all* message boxes. - Silent install (/S option) no longer attempts to create stunnel.pem. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.42.tar.gz: d33c407bfc4f58070e818081bd082c38f91cab7691ccbb794da63143c535de3b Best regards, Mike

1 0

stunnel transparent mode
by Julian D. Seifert 18 Aug '11

18 Aug '11

Hi List, I have a little issue trying to get stunnel running for encapsulating an existing service with SSL. We are running a really old legacy ircd service and would like to provide SSL for the users without having to actually hack that into the really old code base. (Yes we could just use another more modern software but let's just say there are "political" reasons as to why this is not an option) For an ircd we need transparency as in "the ircd should think the connection is not coming from localhost") ANYWAY... so I am working with stunnel 4.39 right now. First a question if I understand it correctly how stunnel will work. I have the ircd running on IP1:6667. I created a service section like this. [ircd] accept = 7000 connect = 6667 transparent = source (And applied the iptables/routing related stuff mentioned in the documentation) Should this already work? Will stunnel "manipulate" packets so that the IRCD "sees" connections from the Peers IP's? And will the Answers the ircd sends to the peers get "intercepted" by stunnel so it can "remanipulate" the answers into the SSL connection? If I try it like I get "local_bind (original port): Cannot assign requested address (99) stunnel" and clients get connection abort. Or is this what "transparent = both" is for? With 4.39 I had an issue trying to use "transparent = both". Stunnel always displayed an error message saying "Each service must define two endpoints" (more or less). I got it to compile by commenting out the one line in options.c causing the error... #### snip #### } else { /* standalone mode checks */ if((unsigned int)section->option.accept + (unsigned int)section->option.program + (unsigned int)section->option.remote + (unsigned int)section->option.sni #ifndef USE_WIN32 + (unsigned int)section->option.transparent_dst #endif /* USE_WIN32 */ !=2) { section_error(last_line, section->servname, "Each service must define two endpoints"); return 0; } ### snap ### Commented out the line within the ifndef. Anyway... I hope somebody can clarify for me how stunnel works and what transparent mode is the one I need. (I want to transparently provide the ircd service with connections so it seems they are directly from the peers and not from stunnel(localhost)) regards, Julian Seifert -- I hate mondays...

2 7

[[email protected]: Bug#637932: stunnel4: segfault if certificate file cannot be read during verification]
by Rodrigo Gallardo 17 Aug '11

17 Aug '11

----- Forwarded message from Sebastian Leske <Sebastian.Leske(a)sleske.name> ----- Date: Mon, 15 Aug 2011 21:21:05 +0200 Package: stunnel4 Version: 3:4.40-1 Severity: normal I use certificate verification with stunnel4 (verify=2 in stunnel.conf). I accidentally changed the access rights of a PEM file required for verification to be unreadable. As a consequence, stunnel4 incorrectly reports "Verification error: self signed certificateVerification error: self signed certificate" (the cert in question is not self-signed), then segfaults. With stunnel4 version 4.29-1_i386, this does not occur: stunnel4 correctly reports that it cannot access the PEM file. Log and backtrace (generated with setting foreground=yes in stunnel.conf): Starting program: /usr/bin/stunnel4 /etc/stunnel/stunnel.conf [Thread debugging using libthread_db enabled] 2011.08.15 21:16:54 LOG5[9584:3082946768]: stunnel 4.40 on i486-pc-linux-gnu platform 2011.08.15 21:16:54 LOG5[9584:3082946768]: Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 2011.08.15 21:16:54 LOG5[9584:3082946768]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2011.08.15 21:16:54 LOG5[9584:3082946768]: Reading configuration from file /etc/stunnel/stunnel.conf 2011.08.15 21:16:54 LOG6[9584:3082946768]: Compression enabled using zlib method 2011.08.15 21:16:54 LOG6[9584:3082946768]: Initializing SSL context for service pop3sl 2011.08.15 21:16:54 LOG6[9584:3082946768]: SSL context initialized 2011.08.15 21:16:54 LOG6[9584:3082946768]: Initializing SSL context for service https 2011.08.15 21:16:54 LOG6[9584:3082946768]: SSL context initialized 2011.08.15 21:16:54 LOG6[9584:3082946768]: Initializing SSL context for service ssmtp 2011.08.15 21:16:54 LOG6[9584:3082946768]: SSL context initialized 2011.08.15 21:16:54 LOG5[9584:3082946768]: Configuration successful [New Thread 0xb7fdfb70 (LWP 9593)] 2011.08.15 21:16:57 LOG5[9584:3086875504]: Service pop3sl accepted connection from 127.0.0.1:60903 2011.08.15 21:16:57 LOG6[9584:3086875504]: connect_blocking: connecting 213.187.93.221:995 2011.08.15 21:16:57 LOG5[9584:3086875504]: connect_blocking: connected 213.187.93.221:995 2011.08.15 21:16:57 LOG5[9584:3086875504]: Service pop3sl connected remote server from 192.168.1.101:39914 2011.08.15 21:16:57 LOG4[9584:3086875504]: CERT: Verification error: self signed certificate in certificate chain 2011.08.15 21:16:57 LOG4[9584:3086875504]: Certificate check failed: depth=2, /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA 2011.08.15 21:16:57 LOG3[9584:3086875504]: error queue: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7fdfb70 (LWP 9593)] 0xb7ca2119 in ?? () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 (gdb) bt #0 0xb7ca2119 in ?? () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 #1 0xb7ca3c1b in calloc () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 #2 0x0804cd20 in ?? () #3 0x080574bf in ?? () #4 0x08057529 in ?? () #5 0x08058129 in ?? () #6 0x0804d945 in ?? () #7 0x0804e79b in ?? () #8 0x0804fafe in ?? () #9 0xb7f98c39 in start_thread () from /lib/i386-linux-gnu/i686/cmov/libpthread.so.0 #10 0xb7d0196e in clone () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 (gdb) -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (500, 'testing'), (500, 'stable') Architecture: i386 (i686) Kernel: Linux 3.0.0-1-686-pae (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages stunnel4 depends on: ii adduser 3.110 add and remove users and groups ii libc6 2.13-10 Embedded GNU C Library: Shared lib ii libssl1.0.0 1.0.0d-3 SSL shared libraries ii libwrap0 7.6.q-16 Wietse Venema's TCP wrappers libra ii netbase 4.34 Basic TCP/IP networking system ii openssl 1.0.0d-3 Secure Socket Layer (SSL) binary a ii perl-modules 5.12.4-2 Core Perl modules stunnel4 recommends no packages. Versions of packages stunnel4 suggests: pn logcheck-database <none> (no description available) -- no debconf information ----- End forwarded message ----- -- Rodrigo Gallardo

2 1

Sending "LOGOUT" when using StartTLS offloading?
by Markus Borst 17 Aug '11

17 Aug '11

I have to cope with a very unusual imap server behavior, but maybe stunnel can help me: Can stunnel send an imap command ("XX LOGOUT"), just before closing the tcp session? Setup: I use stunnel for SSL/TLS offloading, both via extra port (993) and StartTLS emulation (143). Our imap server (Mercury) has a very peculiar feature: If a tcp connection is closed without properly closing the imap session first (LOGOUT), the server discards certain attributes, specifically, it "forgets" all deletions since last logout. Since many imap clients just tear down the connection in certain cases (for example Thunderbird going into offline mode, many webmailers or stunnel reaching it's "TIMEOUTidle"), this causes mails to be undeleted. We currently use an older version of the mailserver, since only the newest is broken. Needless to say, this does not go well with our users. A fixed version of the imap server may never come, so, until we can switch all users to a new mail system: Is it possible to use stunnel to send an additional imap command before closing the tcp connection (something like "999 LOGOUT")? The command should be sent no matter why the connection is closed, either because the client closed it, a timeout is reached or stunnel is unloaded. If the connection is already cleanly logged out, this doesn't matter, in all other situations it would help. Would it be possible to send such a command, or could this be added as a new feature? Greetings Markus Borst -- ==== Achtung! Umzug: neuer Raum: ==== TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst S4/14/2.4.06 Adresse: Mornewegstr. 30 64293 Darmstadt Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 1

SIP encryption with stunnel
by margot.basa 16 Aug '11

16 Aug '11

Hello all, I would like to know if stunnel is able to encrypt a SIP message (UDP or TCP => TLS...) For example: Terminal A can send/receive SIP messages on transport layer UDP or TCP but not TLS. Server B can send/receive SIP messages only in TLS. If terminal A sends a SIP REGISTER message to Server B, does stunnel is able to intercept the message and transform it ? port 5060 => port 5061 TCP => TLS sip uri => sips uri Do you think it's possible with stunnel ? Thank you very much for your input. Regards Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

Stunnel and CryptoAPI
by ratmahat＠hush.ai 15 Aug '11

15 Aug '11

Hello everyone! I have an interesting question, which i didn't find any answer to after several searches. 1. What if I want to enable client verification with client certificate provided by smart card? Is it possible? 2. Does stunnel has the capability to access Windows certificate store in order to verificate the client certificate with the CA in the store? If anyone ever dealt with this, I'd really appreciate this. Thanks, Rat.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users