- stunnel-users - stunnel.org

use of CRYPTO_NUM_LOCKS
by Norm Jacobs 29 Mar '13

29 Mar '13

A while ago, the Solaris security group noticed that stunnel uses CRYPTO_NUM_LOCKS to size a lock table in the code at compile time. They noted that there is function CRYPTO_num_locks() that can do the same thing at runtime and have requested that the function be used so that FIPS/non-FIPS support can be switched on by users simply using interposition. As a result of this, I put together this patch that switches to code to use the function instead of macro. -Norm # stunnel should use CRYPTO_num_locks() function instead of CRYPTO_NUM_LOCKS # macro. The function interogates libcrypto at run-time for sizing and the # macro at compile time. If you interpose a a version at runtime to switch # between FIPS/non-FIPS support, the lock table may not be sized correctly. # diff -r -u stunnel-4.55.orig/src/sthreads.c stunnel-4.55/src/sthreads.c --- stunnel-4.55.orig/src/sthreads.c 2012-08-09 14:44:18.000000000 -0700 +++ stunnel-4.55/src/sthreads.c 2013-03-21 23:29:34.912001586 -0700 @@ -212,7 +212,7 @@ #ifdef USE_PTHREAD static pthread_mutex_t stunnel_cs[CRIT_SECTIONS]; -static pthread_mutex_t lock_cs[CRYPTO_NUM_LOCKS]; +static pthread_mutex_t *lock_cs; void enter_critical_section(SECTION_CODE i) { pthread_mutex_lock(stunnel_cs+i); @@ -275,13 +275,15 @@ int sthreads_init(void) { int i; + int num_locks = CRYPTO_num_locks(); /* initialize stunnel critical sections */ for(i=0; i<CRIT_SECTIONS; i++) pthread_mutex_init(stunnel_cs+i, NULL); /* initialize OpenSSL locking callback */ - for(i=0; i<CRYPTO_NUM_LOCKS; i++) + lock_cs = calloc(num_locks, sizeof (*lock_cs)); + for(i=0; i<num_locks; i++) pthread_mutex_init(lock_cs+i, NULL); CRYPTO_set_id_callback(stunnel_thread_id); CRYPTO_set_locking_callback(locking_callback);

1 0

SSL VPN configuration confusion
by TJ 28 Mar '13

28 Mar '13

I'm using stunnel v4.56 on Linux (Ubuntu) and trying to configure a routed tunnel in conjunction with pppd. I could do with some help to figure it out - my biggest problem is not knowing what a good connection configuration or log looks like. I've read lots of (old) patchy articles on how it is done but the instructions are either hopelessly out of date, or plain wrong. During extensive trial and error I found what appeared to be bugs in the Ubuntu distro-packaged v4.42 but as I don't yet know what a successful connection log looks like they may have been red herrings. The main issue I was trying to build out of was (on the server): SSL accepted: new session negotiated Negotiated ciphers: ECDHE-RSA-RC4-SHA SSLv3 Kx=ECDH Au=RSA Enc=RC4(128) Mac=SHA1 TTY=/dev/pts/4 allocated Local mode child started (PID=17247) Remote FD=1 initialized TCP_NODELAY: Socket operation on non-socket (88) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket linger (remote): Socket operation on non-socket (88) Service vpn finished (0 left) At this point there would be no pppX interfaces. I created an up-to-date Debian/Ubuntu package for v4.56 which has been more successful. Both ends of the link have the same x86 (i386) package installed. On the server again: stunnel: LOG6[23986:3073268544]: SSL accepted: new session negotiated stunnel: LOG6[23986:3073268544]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-RC4-SHA (128-bit encryption) stunnel: LOG6[23986:3073268544]: Compression: null, expansion: null stunnel: LOG7[23986:3073268544]: TTY=/dev/pts/5 allocated stunnel: LOG6[23986:3073268544]: Local mode child started (PID=23989) stunnel: LOG7[23986:3073268544]: Remote socket (FD=14) initialized stunnel: LOG3[23986:3073268544]: TCP_NODELAY: Socket operation on non-socket (88) stunnel: LOG4[23986:3073268544]: Failed to set remote socket options pppd[23989]: pppd options in effect: pppd[23989]: debug^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: updetach^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: linkname pella^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: ktune^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: unit 3^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: dump^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: nomp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noauth^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: ^I^I# (from /etc/ppp/options) pppd[23989]: notty^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: crtscts^I^I# (from /etc/ppp/options) pppd[23989]: local^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noaccomp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: asyncmap 0^I^I# (from /etc/ppp/options) pppd[23989]: nopcomp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: silent^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: lcp-echo-failure 4^I^I# (from /etc/ppp/options) pppd[23989]: lcp-echo-interval 30^I^I# (from /etc/ppp/options) pppd[23989]: hide-password^I^I# (from /etc/ppp/options) pppd[23989]: novj^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noipdefault^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noccp^I^I# (from /etc/ppp/peers/pella-vpn) pppd[23989]: noipx^I^I# (from /etc/ppp/options) pppd[23989]: pppd 2.4.5 started by root, uid 0 pppd[23989]: using channel 19 udevd[2122]: device 0xb7b0a6e8 has devpath '/devices/virtual/net/ppp3' udevd[2122]: created empty file '/run/udev/data/n27' for '/devices/virtual/net/ppp3' pppd[23989]: Using interface ppp3 pppd[23989]: Connect: ppp3 <--> /dev/pts/6 Both ends of the link have ppp interfaces but neither have IP addresses. The server configuration is: ----- /etc/stunnel/pella-vpn.conf ----- CAfile = /etc/stunnel/vpn.pem cert = /etc/stunnel/vpn.pem key = /etc/stunnel/vpn.pem output = /var/log/stunnel-vpn.log #verify = 2 debug = 7 client = no foreground = no [vpn] accept = 109.74.x.y:9876 exec = /usr/sbin/pppd execargs = pppd call pella-vpn 10.254.241.1:10.254.241.2 pty = yes ---------- ----- /etc/ppp/peers/pella-vpn ----- unit 3 notty ktune local noipdefault noccp noauth novj nomp nopcomp noaccomp silent updetach linkname pella debug dump ---------- # ifconfig ppp3 ppp3 Link encap:Point-to-Point Protocol POINTOPOINT NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) The client configuration is: ---- /etc/network/interfaces ----- # SSL VPN to Pella iface ppp3 inet ppp unit 3 provider pella-vpn pre-up /sbin/ifconfig ppp0 up ---------- ----- /etc/ppp/peers/pella-vpn ----- # ensure we use ppp3 (ppp0-2 are already in use) unit 3 ktune local noipdefault noccp noauth novj nomp nopcomp noaccomp silent updetach logfd 2 linkname pella pty "/usr/bin/stunnel4 /etc/stunnel/pella.conf.vpn" user "tj" # debugging debug dump ---------- ----- /etc/stunnel/pella.conf.vpn ----- pid = /var/run/stunnel4/pella.pid debug = debug output = /var/log/stunnel-pella.log foreground = no client=yes connect = 109.74.x.y:9876 CAfile = /etc/stunnel/vpn.pem # verify the peer's certificate verify = 2 ---------- # ifup ppp3 pppd options in effect: debug # (from /etc/ppp/peers/pella-vpn) updetach # (from command line) logfd 2 # (from /etc/ppp/peers/pella-vpn) linkname pella # (from /etc/ppp/peers/pella-vpn) ktune # (from /etc/ppp/peers/pella-vpn) unit 3 # (from command line) dump # (from /etc/ppp/peers/pella-vpn) nomp # (from /etc/ppp/peers/pella-vpn) noauth # (from /etc/ppp/peers/pella-vpn) user tj # (from /etc/ppp/peers/pella-vpn) # (from /etc/ppp/options) pty /usr/bin/stunnel4 /etc/stunnel/pella.conf.vpn # (from /etc/ppp/peers/pella-vpn) crtscts # (from /etc/ppp/options) local # (from /etc/ppp/peers/pella-vpn) noaccomp # (from /etc/ppp/peers/pella-vpn) asyncmap 0 # (from /etc/ppp/options) nopcomp # (from /etc/ppp/peers/pella-vpn) silent # (from /etc/ppp/peers/pella-vpn) lcp-echo-failure 4 # (from /etc/ppp/options) lcp-echo-interval 30 # (from /etc/ppp/options) hide-password # (from /etc/ppp/options) novj # (from /etc/ppp/peers/pella-vpn) noipdefault # (from /etc/ppp/peers/pella-vpn) noccp # (from /etc/ppp/peers/pella-vpn) noipx # (from /etc/ppp/options) using channel 43 Using interface ppp3 Connect: ppp3 <--> /dev/pts/5 # ifconfig ppp3 ppp3 Link encap:Point-to-Point Protocol POINTOPOINT NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) # netstat -natp | grep stun tcp 0 0 82.71.a.b:34437 109.74.x.y:9876 ESTABLISHED 24105/stunnel4

1 2

Fw: High memory usage problem.
by mkanet＠yahoo.com 27 Mar '13

27 Mar '13

Jeremy, I know there's an android build of stunnel. Im not trying to be funny, but are you running stunnel on your mobile phone? :) The latest android mobile phones include quadcore CPU's with 2GB's of RAM It would be interesting to see how much of a load a mobile phone can handle with a USB to RJ45 Ethernet interface. Edit: I tried sending this earlier, but it doesn't look like it went through. My apologies in case this is a duplicate. ------------------------ Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! If there's any specific information I can give, please let me know. Regards, Jeremy

3 7

environment/user variable
by Sebastian Rose-Indorf 26 Mar '13

26 Mar '13

Hello, Stunnel is a very helpful tool. But I miss the support of a environment/user variable to reference the configuration file or the folder of the configuration file: such as %GNUPGHOME% in GnuPG or %OPENSSL_CONF% in OpenSSL. Sebastian

1 0

the range of stunnel functionality
by John A. Wallace 26 Mar '13

26 Mar '13

Where can I find more information about the use and functionality of "tstunnel.exe"? Maybe I am going quite blind, but I looked around unsuccessfully. Thanks. John A. Wallace The pen is mightier than the sword, but only if you get in the first stroke.

3 3

stunnel 4.56 released
by Michal Trojnara 23 Mar '13

23 Mar '13

Dear Users, I have released version 4.56 of stunnel. The ChangeLog entry: Version 4.56, 2013.03.22, urgency: HIGH: * New features - Win32 installer automatically configures firewall exceptions. - Win32 installer configures administrative shortcuts to invoke UAC. - Improved Win32 GUI shutdown time. * Bugfixes - Fixed a regression bug introduced in version 4.55 causing random crashes on several platforms, including Windows 7. - Fixed startup crashes on some Win32 systems. - Fixed incorrect "stunnel -exit" process synchronisation. - Fixed FIPS detection with new versions of the OpenSSL library. - Failure to open the log file at startup is no longer ignored. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-4.56.tar.gz: 9cae2cfbe26d87443398ce50d7d5db54e5ea363889d5d2ec8d2778a01c871293 Best regards, Mike

2 2

4.56 FIPS startup issue
by Ian Donaldson 23 Mar '13

23 Mar '13

Hi, I've been using stunnel for years and tried to upgrade to 4.56 today and it fails to start with this error: Clients allowed=125 stunnel 4.56 on i386-pc-solaris2.9 platform Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /opt/local/etc/stunnel.conf FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported Line 36: "[pop3s]": Failed to initialize SSL str_stats: 5 block(s), 118 data byte(s), 210 control byte(s) I note some mention of FIPS in today's release. 4.55 started ok though with the same version of openssl (and crashed a few hours later), so we're back to 4.54 again. Ian D

1 1

stunnel craches in windows 7 x64
by Mosy Mosy 15 Mar '13

15 Mar '13

I have been facing with a strange bug in stunnel 4.55 (and also in tstunnel) in Windows 7 x64 and also in Windows Server 2003 R2 x86. I redirect TCP connections from a win7 client to a win2k3 server. Stunnel works fine when accepting connections and transferring data. But suddenly crashes when the client program (in the client side) closes the connection (maybe the several connections simultaneously). It happens on the server side too. Because of this problem I have to load a little program to relaunch stunnel whenever it is crashed. What I mean by 'crash' is that the windows shows the "stunnel stops working" and giving the choices to restart,stop, or debug the program. If you need more details I will be pleased to help you in this case. Thank you :) PS: I just have downloaded "stunnel-4.56b1" and I'm using it right now. I see no sign of crashing and instability until this moment :) it seems the bug is eliminated :)

1 0

4.55 is unstable
by Death Master 14 Mar '13

14 Mar '13

Windows build of 4.55, 2013.03.03 crashes every 20-60sec under load. OS:Win7 x64 (with all updates) This bug affects both stunnel and tstunnel. Please fix it soon ;)

5 6

stunnel: SSL routinesdecryption failed or bad record mac
by Kishore Paul 13 Mar '13

13 Mar '13

Hello Everyone, I updated to the latest version of stunnel and openssl and am still getting a lot of decryption fails. stunnel: SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac and a few times it just segfaults: [937987.314573] stunnel: segfault at 7f6164025000 ip 00007f616d8b5adc sp 00007f616e6a9af0 error 4 in libcrypto.so.1.0.0[7f616d84a000+19f000] stunnel 4.54 on x86_64-unknown-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1 14 Mar 2012 Is there any way to avoid these errors? I limited my cipher set to just RC4-SHA after seeing that there is an issue even in openssl 1.01e-1 for e_aes_cbc_hmac_sha1.c http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678353 Appreciate your help. Thanks, Kishore

1 0

Need help to configure STUNNEL using proxy socks v5 to send file to a server
by laurent.uk＠bnpparibas.com 11 Mar '13

11 Mar '13

Hi everyone, I need to connect to proxy socks V5 in order to send file in my server. I configure my stunnel like this : sslVersion = SSLv3 client=yes cert = /opt/freeware/etc/stunnel/ca_nopass.pem pid = /var/adm/stunnel_test.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /logs/stunnel/stunnel.log ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ protocol = connect protocolAuthentication = basic protocolHost = ***:8080 [pesit] accept = 12099 connect = ***:433 But it doesn't works! The log from my stunnel client : 2013.03.11 18:57:30 LOG5[26673178:260]: Service pesit accepted connection from ***:48549 2013.03.11 18:57:30 LOG7[26673178:260]: remote socket: FD=1 allocated (non-blocking mode) 2013.03.11 18:57:30 LOG6[26673178:260]: connect_blocking: connecting ::1:10443 2013.03.11 18:57:30 LOG3[26673178:260]: connect_blocking: connect ::1:10443: Connection refused (79) 2013.03.11 18:57:30 LOG7[26673178:260]: remote socket: FD=1 allocated (non-blocking mode) 2013.03.11 18:57:30 LOG6[26673178:260]: connect_blocking: connecting ****:10443 2013.03.11 18:57:30 LOG5[26673178:260]: connect_blocking: connected ****:10443 2013.03.11 18:57:30 LOG5[26673178:260]: Service pesit connected remote server from ****:48551 2013.03.11 18:57:30 LOG7[26673178:260]: Remote FD=1 initialized 2013.03.11 18:57:30 LOG7[26673178:260]: Option TCP_NODELAY set on remote socket 2013.03.11 18:57:30 LOG6[26673178:260]: Client-mode connect protocol negotiations started 2013.03.11 18:57:30 LOG7[26673178:260]: -> CONNECT ****:1080 HTTP/1.1 2013.03.11 18:57:30 LOG7[26673178:260]: -> Host: ****:1080 2013.03.11 18:57:30 LOG7[26673178:260]: -> 2013.03.11 18:57:30 LOG3[26673178:260]: fdgetline: readsocket: Connection reset by peer (73) 2013.03.11 18:57:30 LOG5[26673178:260]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2013.03.11 18:57:30 LOG7[26673178:260]: Service pesit finished (0 left) 2013.03.11 18:57:30 LOG7[26673178:260]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2013.03.11 18:57:32 LOG7[26673178:1]: local socket: FD=0 allocated (non-blocking mode) In my stunnel server, i have the following message : "SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request" 2013.03.11 18:57:30 LOG7[27525210:1]: Service pesitip accepted FD=0 from ****:48551 2013.03.11 18:57:30 LOG7[27525210:265]: Service pesitip started 2013.03.11 18:57:30 LOG7[27525210:265]: Option TCP_NODELAY set on local socket 2013.03.11 18:57:30 LOG5[27525210:265]: Service pesitip accepted connection from 159.50.49.69:48551 2013.03.11 18:57:30 LOG3[27525210:265]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request 2013.03.11 18:57:30 LOG5[27525210:265]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2013.03.11 18:57:30 LOG7[27525210:265]: Service pesitip finished (0 left) 2013.03.11 18:57:30 LOG7[27525210:265]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2013.03.11 18:57:32 LOG7[27525210:1]: local socket: FD=0 allocated (non-blocking mode) Can you help me to configure my stunnel please? Thanks. Regards, Laurent UK This message and any attachments (the "message") is intended solely for the intended addressees and is confidential. If you receive this message in error,or are not the intended recipient(s), please delete it and any copies from your systems and immediately notify the sender. Any unauthorized view, use that does not comply with its purpose, dissemination or disclosure, either whole or partial, is prohibited. Since the internet cannot guarantee the integrity of this message which may not be reliable, BNP PARIBAS (and its subsidiaries) shall not be liable for the message if modified, changed or falsified. Do not print this message unless it is necessary,consider the environment. ---------------------------------------------------------------------------------------------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur ou s'il ne vous est pas destine, merci de le detruire ainsi que toute copie de votre systeme et d'en avertir immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de ce message qui n'est pas conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite. L'Internet ne permettant pas d'assurer l'integrite de ce message electronique susceptible d'alteration, BNP Paribas (et ses filiales) decline(nt) toute responsabilite au titre de ce message dans l'hypothese ou il aurait ete modifie, deforme ou falsifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Mutual Authentication
by Sameer Rahmani 11 Mar '13

11 Mar '13

Hi guys, I want to have secure tunnel to my server and also i want only specified clients can connect via the tunnel to the server. I was reading about mutual authentication but i can't run stunnel using verify=2 or 3 or 4. I confused. Can you please explain for me what should i do to use 2way ssl connection? how does stunnel use this?

2 1

It doesn't work.
by Raemsh Pungavanam 11 Mar '13

11 Mar '13

Hi , i have following issue with latest version of stunnel and openssl. version ====== stunnel - 4.55 openssl - 1.0.1e stunnel.conf ========== # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 # Comment it out on Win32 #cert = /etc/tr69/stunnel.pem key = /etc/tr69/stunnel.pem # chroot = /usr/local/var/run/stunnel/ # PID is created inside chroot jail pid = /var/run/ssl.pid setuid = root setgid = root # Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1.2 # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Authentication stuff verify = 1 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /usr/local/etc/stunnel/certs.pem #CAfile = /etc/tr69/ca.crt # CRL path or file (inside chroot jail): #CRLpath = /crls # or simply use CAfile instead: #CRLfile = /usr/local/etc/stunnel/crls.pem # Some debugging stuff debug = 7 output = /var/log/ssl.log foreground = yes # Use it for client mode client = yes # Service-level configuration [https] CAfile = /flash/Cert.pem accept = 127.0.0.1:8001 connect = acs.qacafe.com:80 #accept = 8080 cat /var/log/ssl.log ============== 2013.03.11 18:29:04 LOG5[5849:0]: stunnel 4.55 on mips-openwrt-linux-uclibc platform 2013.03.11 18:29:04 LOG5[5849:0]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2013.03.11 18:29:04 LOG5[5849:0]: Threading:FORK SSL:+ENGINE+OCSP Auth:none Sockets:POLL+IPv6 2013.03.11 18:29:04 LOG5[5849:0]: Reading configuration from file /etc/tr69/stunnel.conf 2013.03.11 18:29:04 LOG7[5849:0]: Compression not enabled 2013.03.11 18:29:04 LOG7[5849:0]: PRNG seeded successfully 2013.03.11 18:29:04 LOG6[5849:0]: Initializing service [https] 2013.03.11 18:29:04 LOG4[5849:0]: Insecure file permissions on /etc/tr69/stunnel.pem 2013.03.11 18:29:04 LOG7[5849:0]: Loaded verify certificates from /flash/Cert.pem 2013.03.11 18:29:04 LOG7[5849:0]: Loaded /flash/Cert.pem revocation lookup file 2013.03.11 18:29:04 LOG7[5849:0]: SSL options set: 0x00000004 2013.03.11 18:29:04 LOG5[5849:0]: Configuration successful 2013.03.11 18:29:04 LOG7[5849:0]: Service [https] (FD=17) bound to 127.0.0.1:8001 2013.03.11 18:29:04 LOG7[5849:0]: Created pid file /var/run/ssl.pid 2013.03.11 18:29:21 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:36039 2013.03.11 18:29:21 LOG7[5920:0]: Service [https] started 2013.03.11 18:29:21 LOG5[5920:0]: Service [https] accepted connection from 127.0.0.1:36039 2013.03.11 18:29:22 LOG6[5920:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:29:22 LOG7[5920:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:29:22 LOG5[5920:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:29:22 LOG5[5920:0]: Service [https] connected remote server from 61.200.100.100:35694 2013.03.11 18:29:22 LOG7[5920:0]: Remote socket (FD=17) initialized 2013.03.11 18:29:22 LOG7[5920:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:29:22 LOG7[5920:0]: SSL state (connect): before/connect initialization 2013.03.11 18:29:22 LOG7[5920:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:30:15 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:36042 2013.03.11 18:30:15 LOG7[5973:0]: Service [https] started 2013.03.11 18:30:15 LOG5[5973:0]: Service [https] accepted connection from 127.0.0.1:36042 2013.03.11 18:30:15 LOG6[5973:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:30:15 LOG7[5973:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:30:15 LOG5[5973:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:30:15 LOG5[5973:0]: Service [https] connected remote server from 61.200.100.100:35697 2013.03.11 18:30:15 LOG7[5973:0]: Remote socket (FD=17) initialized 2013.03.11 18:30:15 LOG7[5973:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:30:15 LOG7[5973:0]: SSL state (connect): before/connect initialization 2013.03.11 18:30:15 LOG7[5973:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:31:40 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:49029 2013.03.11 18:31:40 LOG7[6023:0]: Service [https] started 2013.03.11 18:31:40 LOG5[6023:0]: Service [https] accepted connection from 127.0.0.1:49029 2013.03.11 18:31:40 LOG6[6023:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:31:40 LOG7[6023:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:31:40 LOG5[6023:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:31:40 LOG5[6023:0]: Service [https] connected remote server from 61.200.100.100:40051 2013.03.11 18:31:40 LOG7[6023:0]: Remote socket (FD=17) initialized 2013.03.11 18:31:40 LOG7[6023:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:31:40 LOG7[6023:0]: SSL state (connect): before/connect initialization 2013.03.11 18:31:40 LOG7[6023:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:33:45 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:49032 2013.03.11 18:33:45 LOG7[6074:0]: Service [https] started 2013.03.11 18:33:45 LOG5[6074:0]: Service [https] accepted connection from 127.0.0.1:49032 2013.03.11 18:33:45 LOG6[6074:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:33:45 LOG7[6074:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:33:45 LOG5[6074:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:33:45 LOG5[6074:0]: Service [https] connected remote server from 61.200.100.100:40054 2013.03.11 18:33:45 LOG7[6074:0]: Remote socket (FD=17) initialized 2013.03.11 18:33:45 LOG7[6074:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:33:45 LOG7[6074:0]: SSL state (connect): before/connect initialization 2013.03.11 18:33:45 LOG7[6074:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:34:22 LOG6[5920:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:34:22 LOG5[5920:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:34:22 LOG7[5920:0]: Remote socket (FD=17) closed 2013.03.11 18:34:22 LOG7[5920:0]: Local socket (FD=4) closed 2013.03.11 18:34:22 LOG7[5920:0]: Service [https] finished 2013.03.11 18:34:22 LOG7[5920:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:34:22 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:34:22 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:34:22 LOG7[5849:0]: Process 5920 finished with code 0 2013.03.11 18:34:22 LOG7[5849:0]: Signal pipe is empty 2013.03.11 18:35:15 LOG6[5973:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:35:15 LOG5[5973:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:35:15 LOG7[5973:0]: Remote socket (FD=17) closed 2013.03.11 18:35:15 LOG7[5973:0]: Local socket (FD=4) closed 2013.03.11 18:35:15 LOG7[5973:0]: Service [https] finished 2013.03.11 18:35:15 LOG7[5973:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:35:15 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:35:15 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:35:15 LOG7[5849:0]: Process 5973 finished with code 0 2013.03.11 18:35:15 LOG7[5849:0]: Signal pipe is empty 2013.03.11 18:36:40 LOG6[6023:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:36:40 LOG5[6023:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:36:40 LOG7[6023:0]: Remote socket (FD=17) closed 2013.03.11 18:36:40 LOG7[6023:0]: Local socket (FD=4) closed 2013.03.11 18:36:40 LOG7[6023:0]: Service [https] finished 2013.03.11 18:36:40 LOG7[6023:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:36:40 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:36:40 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:36:40 LOG7[5849:0]: Process 6023 finished with code 0 2013.03.11 18:36:40 LOG7[5849:0]: Signal pipe is empty 2013.03.11 18:38:45 LOG6[6074:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:38:45 LOG5[6074:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:38:45 LOG7[6074:0]: Remote socket (FD=17) closed 2013.03.11 18:38:45 LOG7[6074:0]: Local socket (FD=4) closed 2013.03.11 18:38:45 LOG7[6074:0]: Service [https] finished 2013.03.11 18:38:45 LOG7[6074:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:38:45 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:38:45 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:38:45 LOG7[5849:0]: Process 6074 finished with code 0 2013.03.11 18:38:45 LOG7[5849:0]: Signal pipe is empty Normally under which circumstances this can happen. please help me totally clue less ... Rgds, Ramesh P

1 0

Stunnel SMP enabled?
by Michael Curran 06 Mar '13

06 Mar '13

I am running an Ubuntu system with Stunnel for 443 connections to an application on the back end. Essentially acting as a load balancer. When I look at the processor stats per processor (this is a 6-cpu system) I see cpu0 with almost 4% usage , compared to the other 5 processors hiting maybe .5% usage across the board. Is stunnel SMP enabled and passes processing amongst all 6 Procs? Or does it bind to one Proc and as long as its active it does all its work on just one PROC. We are having a lot of dropped connections when the overall system CPU hits about 23-25% .. which seems to me that it could be pushing just one CPU hard and the other 5 become basically idle. I am setting up to capture some SAR data to help confirm this effort, but it would if I knew that stunnel was setup for SMP processing.

1 0

Re: [stunnel-users] Stunnel as an "HTTPS to HTTPS" proxy
by Javier 05 Mar '13

05 Mar '13

On Tue, 05 Mar 2013 09:04:41 +0200 "jmwb(a)webmail.co.za" <jmwb(a)webmail.co.za> wrote: > Thank you for your response Javier. > > I now understand how to phrase what I am looking for. What I am looking for is > effectively an SSL Man-in-The-Middle (but please be assured that I am not > looking to build malware). However, I am still not certain from your response > that Stunnel can do this. Can the client-side handle SSL or does it only > support clear-text on the client side? > > jmwb Hi, in the example I gave to you is like this. Hope this can help you to understand how stunnel works in such scenario. 1. Web browser without SSL support. 2. It sends clear text to the IP:port where stunnel client is listening. 3. Stunnel in the client machine send ciphered text to the machine with Stunnel acting as server. 4. Stunnel in the server machine sends clear text to the web server. 5. The web server hasn't SSL support. 6. The communication is reversed to reply to the client side. With a diagram. Browser <> clear text <> stunnel<> ciphered <> stunnel <> clear text <> web server Of course, it is possible to make a MiTM attack between browser and stunnel and stunnel and web server at both sides, but not in between. To accomplish such attack you'll first need to access one of the machines and find such scenario. If both sides support SSL you don't need stunnel (unless one of the sides doesn't support SSL) and, therefore, all communications are ciphered P2P. No clear text. Except keyboard/mouse loggers in the client side. As said, is a secure tunnel, an SSL proxy. As you wish. Regards.

1 0

Re: [stunnel-users] Disable SNI in stunnel win32 version
by Lilienberg, Daniel () 05 Mar '13

05 Mar '13

I want to use my Apache as a secure proxy (where Stunnel adds the SSL layer). With SNI enabled, I must send all hosts I want to connect to which is impossible ? This is for internet proxy usage, so all sites on Internet must be available through the proxy. It worked fine before SNI. From: Brian Wilkins [mailto:[email protected]] Sent: den 5 mars 2013 14:14 To: Lilienberg, Daniel () Subject: Re: [stunnel-users] Disable SNI in stunnel win32 version Does this help? http://langui.sh/2009/11/03/ssl-vhosting-on-the-same-ip-aka-sni/ On Tue, Mar 5, 2013 at 8:10 AM, Lilienberg, Daniel () <daniel.lilienberg(a)volvocars.com<mailto:[email protected]>> wrote: Hi, In my local vmware setup im using Apache with mod_ssl on the server side and Stunnel on client side to make a secure proxy. Im using Chrome as webbrowser to connect locally to the apache which bounces me to internet. In my setup everything worked with the older Stunnel 4.3x, but when you upgraded to a newer Openssl it enabled SNI and now its broken. Can I disable SNI in any way or so I need to recompile stunnel with an older OpenSSL package ? Im running on Win32. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Disable SNI in stunnel win32 version
by Lilienberg, Daniel () 05 Mar '13

05 Mar '13

Hi, In my local vmware setup im using Apache with mod_ssl on the server side and Stunnel on client side to make a secure proxy. Im using Chrome as webbrowser to connect locally to the apache which bounces me to internet. In my setup everything worked with the older Stunnel 4.3x, but when you upgraded to a newer Openssl it enabled SNI and now its broken. Can I disable SNI in any way or so I need to recompile stunnel with an older OpenSSL package ? Im running on Win32.

1 0

Stunnel as an "HTTPS to HTTPS" proxy
by jmwb＠webmail.co.za 04 Mar '13

04 Mar '13

Hi, Please could you tell me if Stunnel supports HTTPS on the client-side i.e. a true SSL proxy with client-side SSL and server-side SSL (or if anyone has developed a version that does)? I have tried searching for this without luck because it is difficult to narrow down the search criteria e.g. Stunnel is already cited as an SSL proxy. jmwb ____________________________________________________________ South Africas premier free email service - www.webmail.co.za For super low premiums, click here. http://www.dialdirect.co.za/landing/oct/1/?vdn=15752

2 1

stunnel 4.55 released (security update)
by Michal Trojnara 03 Mar '13

03 Mar '13

Dear Users, I have released version 4.55 of stunnel. This is a massive bugfix release, including a security bugfix. Update is highly recommended. The ChangeLog entry: Version 4.55, 2013.03.03, urgency: HIGH: * Security bugfix - OpenSSL updated to version 1.0.1e in Win32/Android builds. - Buffer overflow vulnerability fixed in the NTLM authentication of the CONNECT protocol negotiation. See https://www.stunnel.org/CVE-2013-1762.html for details. * New features - SNI wildcard matching in server mode. - Terminal version of stunnel (tstunnel.exe) build for Win32. * Bugfixes - Fixed write half-close handling in the transfer() function (thx to Dustin Lundquist). - Fixed EAGAIN error handling in the transfer() function (thx to Jan Bee). - Restored default signal handlers before execvp() (thx to Michael Weiser). - Fixed memory leaks in protocol negotiation (thx to Arthur Mesh). - Fixed a file descriptor leak during configuration file reload (thx to Arthur Mesh). - Closed SSL sockets were removed from the the transfer() c->fds poll. - Minor fix in handling exotic inetd-mode configurations. - WCE compilation fixes. - IPv6 compilation fix in protocol.c. - Windows installer fixes. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-4.55.tar.gz: 5a4acecfabd454415c727435acdfca7dc46aa542998fb278293f494a6d36d37a Best regards, Mike

1 0

Broken pipes and TCP resets on parallel requests over stunnel
by Jan Bee 22 Feb '13

22 Feb '13

Hi, I'm running stunnel (ubuntu 4.42-1, confirmed with 4.54 that has been built from source) against a backend I've only limited control over which was running fine for a long time. At some point in the last few days, the clients stopped being able to make *concurrent* HTTP requests (by different threads) over the stunnel. The client applications using the tunnel enounter a 'Connection refused' error. The issue has been isolated to curl requests (instead of the original client application). Running a tcpdump on both, loopback and uplink, showed that every additional request results in an ACK from the stunnel to both the client and the remote side and a few ms later a RST, ACK is sent in the *same* direction (again from the stunnel to both client and remote end). The stunnel log shows an error about a broken pipe whenever these failures occur: Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: Socket closed on read Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: Sending SSL write shutdown Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: SSL alert (write): warning: close notify Feb 18 11:09:24 x2 stunnel: LOG6[555:139702117717760]: SSL_shutdown successfully sent close_notify Feb 18 11:09:24 x2 stunnel: LOG5[555:139702117717760]: Error detected on socket (read) file descriptor: Broken pipe (32) Feb 18 11:09:24 x2 stunnel: LOG5[555:139702117717760]: Connection reset: 1320 bytes sent to SSL, 48625 bytes sent to socket Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: Service xtunnel finished (4 left) An strace on the stunnel shows: 6425 <... setsockopt resumed> ) = 0 6425 close(18 <unfinished ...> 6465 poll([{fd=15, events=POLLOUT}, {fd=22, events=POLLIN}], 2, 43200000 <unfinished ...> 6425 <... close resumed> ) = 0 6465 <... poll resumed> ) = 2 ([{fd=15, revents=POLLOUT|POLLERR|POLLHUP}, {fd=22, revents=POLLIN}]) 6425 sendto(13, "<31>Feb 18 11:34:35 stunnel: LOG7[6395:140601236756224]: Service xtunnel finished (4 left)", 99, MSG_NOSIGNAL, NULL, 0 <unf inished ...> 6465 getsockopt(15, SOL_SOCKET, SO_ERROR, [32], [4]) = 0 6425 <... sendto resumed> ) = 99 6465 futex(0x7fe045ec3754, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...> 6425 futex(0x7fe045ec3754, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> 6465 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable) 6425 <... futex resumed> ) = 0 6465 sendto(13, "<29>Feb 18 11:34:35 stunnel: LOG5[6395:140601236686592]: Error detected on socket (read) file descriptor: Broken pipe (32)", 122, MSG_NOSIGNAL, NULL, 0 <unfinished ...> 6425 write(2, "2013.02.15 11:34:35 LOG7[6395:140601236756224]: Service xtunnel finished (4 left)\n", 91 <unfinished ...> 6465 <... sendto resumed> ) = 122 6425 <... write resumed> ) = 91 6465 futex(0x7fe045ec3754, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> 6425 sendto(13, "<31>Feb 18 11:34:35 stunnel: LOG7[6395:140601236756224]: str_stats: 0 block(s), 0 byte(s)", 89, MSG_NOSIGNAL, NULL, 0 <unfinished ...> 6465 <... futex resumed> ) = 0 6465 write(2, "2013.02.15 11:34:35 LOG5[6395:140601236686592]: Error detected on socket (read) file descriptor: Broken pipe (32)\n", 114 <unfinished ...> $ ps auxww|grep stunnel4 shows: root 28587 0.1 0.0 437844 7780 ? Ss 09:37 0:11 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29170 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29171 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29172 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29173 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29174 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf The stunnel config looks like this: foreground=yes debug=7 pid=/var/run/xtunnel.pid client=yes CAfile=/etc/ssl/certs/xtunnel-chains.pem verify=3 engine=dynamic engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:libopencryptoki.so.0 engineCtrl=INIT engineCtrl=PIN:XXXXXX [xtunnel] engineNum=1 key=id_4 cert=/etc/xtunnel/client-cert.pem accept=127.0.0.1:9999 connect=192.168.200.1:8443 Does anyone have an idea what could be going wrong here or how to troubleshoot this any further? Thanks! Jan

1 0

Stunnel in pgsql mode, libpq, and SSL session caching..
by Matt Wise 17 Feb '13

17 Feb '13

Is there any level of SSL Session Caching when using Stunnel in pgsql mode, and using libpq-based Postgres clients? If not, I'm wondering what tuning we can do on the Stunnel side to get the best performance if we have alot of clients that connect very fequently to the servers.. --matt

1 0

STUNNEL --- How to chose the AES cipher with TLS v1.2
by Editor 14 Feb '13

14 Feb '13

Hi to all: In reading the FAQ and looking at the sample configuration file, I do not see an example of how to correctly configure the application to use the more current AES-256 or the AES-128 cipher configurations. I do have the current OpenSSL on the host (a Sun SPARC box). The idea is to use this host as a SSL proxy for a number of services. I did see this reference: options = CIPHER_SERVER_PREFERENCE But not how to then set the SSL cipher except as I found on Google. There was this on the MAN page but it seems to fail in my configuration: ciphers = cipherlist Select permitted SSL ciphers. A colon delimited list of the ciphers to allow in the SSL connection. For example DES-CBC3-SHA:IDEA-CBC-MD5 Thanks. Kevin Reference Ciphers supported by OpenSSL: http://www.openssl.org/docs/apps/ciphers.html

2 1

stunnel port question
by Stewart Anderson 13 Feb '13

13 Feb '13

Hi all, ty in advance for any help. I have a service that I can connect to a destination over stunnel, but I am not able to get the ack I expect. Internal sending service => stunnel => external listening service I think the problem may be that the firewall is blocking inbound traffic. I need to specify a specific port for the firewall team to open so that traffic can get back to my stunnel service, since every time stunnel starts it will be making a connection from a different port on the external facing side of the SSL encapsulation service/pipe/whatever you want to call it!! What would be the best way to configure stunnel for that scenario. I can see the INETD mode but that does not seem to be what I am looking for, I can also see the transparent option but not sure what that really does. Any advice appreciated. Regards Stewart Your Hospital needs YOU! We need you to register as a Public, Patient or Staff member and help shape the future of your healthcare. Call 0800 280 2581 to register by phone or you can email bradfordhospitals(a)capitaregistrars.com<mailto:[email protected]> and ask to be registered as a new member. For more information about our hospitals and Foundation Trust Membership please visit www.bradfordhospitals.nhs.uk<http://www.bradfordhospitals.nhs.uk> This message is confidential. It may also contain privileged information. The contents of this e-mail and any attachments are intended for the named addressee only. Unless you are the named addressee or authorised to receive the e-mail of the named addressee you may not disclose, use or copy the contents of the e-mail. If you are not the person for whom the message was intended, please notify the sender immediately at Bradford Teaching Hospitals NHS Foundation Trust and delete the material from your computer. You must not use the message for any other purpose, nor disclose its contents to any person other than the intended recipient. Bradford Teaching Hospitals NHS Foundation Trust does not accept responsibility for this message and any views or opinions contained in this e-mail are solely those of the author unless expressly stated otherwise.

1 0

Stunnel over a separate proxy?
by Alex Gottschalk 12 Feb '13

12 Feb '13

I've successfully deployed stunnel4 to wrap rsync for transferring data between remote sites and a central repository. The issue I'm running into, is that some of these sites mandate use of a proxy (HTTP or SOCKS5 usually) for outbound network connections. It seems like there is some proxy support in stunnel with the protocol{Host,Authentication,etc} configuration options, but I have had zero luck getting them to work. For example, I've tried making a simple SOCKS5 proxy using ssh, that I'm successfully able to send HTTP traffic over: ssh -g -D1080 proxy-host # create the proxy, open port 1080 on a public interface then in the client stunnel.conf: [rsync] protocol = connect protocolHost = proxy-host:1080 accept = 127.0.0.1:873 connect = rsync-destination:443 Keep in mind this is an already-working stunnel - the only difference is the addition of the protocol and protocolHost lines above. When I run stunnel in the foreground with that configuration change, I get the following error trying to run rsync: $ rsync -v dev.inst.kvpdata rsync://localhost/putdata/ rsync: read error: Connection reset by peer (104) rsync error: error in rsync protocol data stream (code 12) at io.c(605) [sender=2.6.9] And no log messages appear in stunnel's stderr whatsoever. What am I doing wrong? I get identical results using an HTTP proxy with squid, instead of the socks5 proxy. Thanks, please let me know if there's any more information I should include to help with figuring this out. Alex Gottschalk

3 4

transfer() loop executes not transferring any data and truncated data when using unix sockets
by Stephen Balukoff 08 Feb '13

08 Feb '13

Hello! Recently we started seeing some erroneous behavior in one of our load balancer configurations in which we're using stunnel for SSL tunnel termination with web clients. Specifically, the setup looks like the following: Web client ---(SSL)---> stunnel ---(unix socket)--> haproxy ---(tcp/http)---> web server After extensive troubleshooting we were able to determine that when the following parameters are present: * Client forces non-keepalive connection * Client generates a POST request, the response to which (generated by the back-end web server) is greater than about 8k * stunnel and haproxy communicate via unix socket ...then most responses end up being truncated by an extraneous TCP RST packet from stunnel, and the following log lines are generated: Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: transfer() loop executes not transferring any data Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: please report the problem to Michal.Trojnara(a)mirt.net Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: stunnel 4.54 on x86_64-unknown-linux-gnu platform Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6 Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: protocol=TLSv1, SSL_pending=0 Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: sock_open_rd=n, sock_open_wr=Y Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=Y Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: sock_can_rd=Y, sock_can_wr=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: ssl_can_rd=n, ssl_can_wr=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: read_wants_read=Y, read_wants_write=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: write_wants_read=n, write_wants_write=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: shutdown_wants_read=n, shutdown_wants_write=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: socket input buffer: 0 byte(s), ssl input buffer: 0 byte(s) The work arounds we have found are either: 1. Make stunnel and haproxy communicate over a TCP socket bound to the loopback interface (less ideal, as then we're limited to 65k connections) 2. Add the "reset=no" parameter to our stunnel.conf (which seems to fix the problem, but makes me wonder if we're not opening ourselves up to other problems-- like really getting stuck in an infinite loop that that watchdog is intended to avoid.) In any case based on what "reset=no" is supposed to do as well as where that first line of the error output above is being generated in the code, it's clear that the main client data transfer loop in client.c (starting line 519) is being called too often with no data to transfer, which triggers the infinite loop detection in the transfer() function (client.c, starting line 832). My best hypothesis at this point is that the transfer() code was written only with TCP sockets in mind, and that something about the unix socket in use here is triggering that loop too often. Maybe s_poll_wait on line 541 is being called with parameters which are right for a TCP socket but inappropriate for a unix socket? At this point though, we're at the limit of my socket programming ability, so I'm a little stuck. (Would like to have simply fixed this and submitted a patch... but cest la vie, eh.) We'd like to avoid using a TCP socket to communicate between stunnel and haproxy simply because it's a little less efficient, and because there's an artificial 65k limit on the number of back-end connections we can support per loopback IP if we do that. Alternatively, if someone could verify that "reset=no" is an acceptable / safe work around in this case, I'd appreciate that (though, of course, I'd prefer my logs not to get spammed on every connection. :P ) Is there any other data I can provide to help troubleshoot and fix this? Thanks, Stephen -- Stephen Balukoff Blue Box Group, LLC (800)613-4305 x807

3 3

LZ4
by Death Master 06 Feb '13

06 Feb '13

Do you plan adding LZ4(much faster than gzip) support to stunnel?

2 1

Re: [stunnel-users] fix resource leaks and potential null
by Arthur Mesh 05 Feb '13

05 Feb '13

dereferences in 4.54 Reply-To: In-Reply-To: <mailman.1.1359889202.25775.stunnel-users(a)stunnel.org> On Sun, Feb 03, 2013 at 12:00:02PM +0100, stunnel-users-request(a)stunnel.org wrote: > > - char line_text[CONFLINELEN], *errstr; > > + char line_text[CONFLINELEN], *errstr = NULL; > Were you able to identify a case where it's used without > initialization? This is interesting. > It would be a good idea to fix it there instead of implementing a > workaround here. Hi, I will provide the output of coverity run for these defect: int parse_conf(char *name, CONF_TYPE type) { 1997 DISK_FILE *df; At (1): Declaring variable "errstr" without initializer. 1998 char line_text[CONFLINELEN], *errstr; 1999 char config_line[CONFLINELEN], *config_opt, *config_arg; 2000 int line_number, i; 2001 SERVICE_OPTIONS *section, *new_section; 2002 static char *filename=NULL; /* a copy of config file name for reloading */ 2003#ifndef USE_WIN32 2004 int fd; 2005 char *tmpstr; 2006#endif 2007 At (2): Condition "name", taking true branch 2008 if(name) /* not reload */ 2009 filename=str_dup(name); 2010 At (3): Condition "type == 2U", taking true branch 2011 s_log(LOG_NOTICE, "Reading configuration from %s %s", 2012 type==CONF_FD ? "descriptor" : "file", filename); 2013#ifndef USE_WIN32 At (4): Condition "type == 2U", taking true branch 2014 if(type==CONF_FD) { /* file descriptor */ 2015 fd=strtol(filename, &tmpstr, 10); At (5): Condition "tmpstr == filename", taking false branch At (6): Condition "*tmpstr", taking false branch 2016 if(tmpstr==filename || *tmpstr) { /* not a number */ 2017 s_log(LOG_ERR, "Invalid file descriptor number"); 2018 print_syntax(); 2019 return 1; 2020 } 2021 df=file_fdopen(fd); At (7): Falling through to end of if statement 2022 } else 2023#endif 2024 df=file_open(filename, 0); At (8): Condition "!df", taking false branch 2025 if(!df) { 2026 s_log(LOG_ERR, "Cannot read configuration"); 2027 if(type!=CONF_RELOAD) 2028 print_syntax(); 2029 return 1; 2030 } 2031 2032 memset(&new_global_options, 0, sizeof(GLOBAL_OPTIONS)); /* reset global options */ 2033 memset(&new_service_options, 0, sizeof(SERVICE_OPTIONS)); /* reset local options */ 2034 new_service_options.next=NULL; 2035 section=&new_service_options; 2036 parse_global_option(CMD_BEGIN, NULL, NULL); 2037 parse_service_option(CMD_BEGIN, section, NULL, NULL); At (9): Condition "type != 0U", taking true branch 2038 if(type!=CONF_RELOAD) { /* provide defaults for gui.c */ 2039 memcpy(&global_options, &new_global_options, sizeof(GLOBAL_OPTIONS)); 2040 memcpy(&service_options, &new_service_options, sizeof(SERVICE_OPTIONS)); 2041 } 2042 2043 line_number=0; At (10): Condition "file_getline(df, line_text, 16384) >= 0", taking true branch At (19): Condition "file_getline(df, line_text, 16384) >= 0", taking false branch 2044 while(file_getline(df, line_text, CONFLINELEN)>=0) { 2045 memcpy(config_line, line_text, CONFLINELEN); 2046 ++line_number; 2047 config_opt=config_line; At (11): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking true branch At (12): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking false branch 2048 while(isspace((unsigned char)*config_opt)) 2049 ++config_opt; /* remove initial whitespaces */ At (13): Condition "i >= 0", taking true branch At (14): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking true branch At (15): Condition "i >= 0", taking true branch At (16): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking false branch 2050 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i) 2051 config_opt[i]='\0'; /* remove trailing whitespaces */ At (17): Condition "config_opt[0] == 0", taking true branch 2052 if(config_opt[0]=='\0' || config_opt[0]=='#' || config_opt[0]==';') /* empty or comment */ At (18): Continuing loop 2053 continue; 2054 if(config_opt[0]=='[' && config_opt[strlen(config_opt)-1]==']') { /* new section */ 2055 if(!new_service_options.next) { 2056 errstr=parse_global_option(CMD_END, NULL, NULL); 2057 if(errstr) { 2058 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr); 2059 file_close(df); 2060 return 1; 2061 } 2062 } 2063 ++config_opt; 2064 config_opt[strlen(config_opt)-1]='\0'; 2065 new_section=str_alloc(sizeof(SERVICE_OPTIONS)); 2066 memcpy(new_section, &new_service_options, sizeof(SERVICE_OPTIONS)); 2067 new_section->servname=str_dup(config_opt); 2068 new_section->session=NULL; 2069 new_section->next=NULL; 2070 section->next=new_section; 2071 section=new_section; 2072 continue; 2073 } 2074 config_arg=strchr(config_line, '='); 2075 if(!config_arg) { 2076 s_log(LOG_ERR, "Line %d: \"%s\": No '=' found", line_number, line_text); 2077 file_close(df); 2078 return 1; 2079 } 2080 *config_arg++='\0'; /* split into option name and argument value */ 2081 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i) 2082 config_opt[i]='\0'; /* remove trailing whitespaces */ 2083 while(isspace((unsigned char)*config_arg)) 2084 ++config_arg; /* remove initial whitespaces */ 2085 errstr=parse_service_option(CMD_EXEC, section, config_opt, config_arg); 2086 if(!new_service_options.next && errstr==option_not_found) 2087 errstr=parse_global_option(CMD_EXEC, config_opt, config_arg); 2088 if(errstr) { 2089 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr); 2090 file_close(df); 2091 return 1; 2092 } 2093 } 2094 file_close(df); 2095 At (20): Condition "new_service_options.next", taking true branch 2096 if(new_service_options.next) { /* daemon mode: initialize sections */ At (21): Condition "section", taking false branch 2097 for(section=new_service_options.next; section; section=section->next) { 2098 s_log(LOG_INFO, "Initializing service [%s]", section->servname); 2099 errstr=parse_service_option(CMD_END, section, NULL, NULL); 2100 if(errstr) 2101 break; 2102 } At (22): Falling through to end of if statement 2103 } else { /* inetd mode: need to initialize global options */ 2104 errstr=parse_global_option(CMD_END, NULL, NULL); 2105 if(errstr) { 2106 s_log(LOG_ERR, "Global options: %s", errstr); 2107 return 1; 2108 } 2109 s_log(LOG_INFO, "Initializing inetd mode configuration"); 2110 section=&new_service_options; 2111 errstr=parse_service_option(CMD_END, section, NULL, NULL); 2112 } CID 32706: Uninitialized pointer read (UNINIT)At (23): Using uninitialized value "errstr". 2113 if(errstr) { CID 32693: Dereference after null check (FORWARD_NULL) [select defect] 2114 s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr); 2115 return 1; 2116 } > > - s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr); > > + s_log(LOG_ERR, "Service [%s]: %s", section ? section->servname : "", > > + errstr); > Again it would be useful to fix the root cause instead of implementing a > workaround. Coverity output: At (1): Condition "name", taking true branch 2008 if(name) /* not reload */ 2009 filename=str_dup(name); 2010 At (2): Condition "type == 2U", taking true branch 2011 s_log(LOG_NOTICE, "Reading configuration from %s %s", 2012 type==CONF_FD ? "descriptor" : "file", filename); 2013#ifndef USE_WIN32 At (3): Condition "type == 2U", taking true branch 2014 if(type==CONF_FD) { /* file descriptor */ 2015 fd=strtol(filename, &tmpstr, 10); At (4): Condition "tmpstr == filename", taking false branch At (5): Condition "*tmpstr", taking false branch 2016 if(tmpstr==filename || *tmpstr) { /* not a number */ 2017 s_log(LOG_ERR, "Invalid file descriptor number"); 2018 print_syntax(); 2019 return 1; 2020 } 2021 df=file_fdopen(fd); At (6): Falling through to end of if statement 2022 } else 2023#endif 2024 df=file_open(filename, 0); At (7): Condition "!df", taking false branch 2025 if(!df) { 2026 s_log(LOG_ERR, "Cannot read configuration"); 2027 if(type!=CONF_RELOAD) 2028 print_syntax(); 2029 return 1; 2030 } 2031 2032 memset(&new_global_options, 0, sizeof(GLOBAL_OPTIONS)); /* reset global options */ 2033 memset(&new_service_options, 0, sizeof(SERVICE_OPTIONS)); /* reset local options */ 2034 new_service_options.next=NULL; 2035 section=&new_service_options; 2036 parse_global_option(CMD_BEGIN, NULL, NULL); 2037 parse_service_option(CMD_BEGIN, section, NULL, NULL); At (8): Condition "type != 0U", taking true branch 2038 if(type!=CONF_RELOAD) { /* provide defaults for gui.c */ 2039 memcpy(&global_options, &new_global_options, sizeof(GLOBAL_OPTIONS)); 2040 memcpy(&service_options, &new_service_options, sizeof(SERVICE_OPTIONS)); 2041 } 2042 2043 line_number=0; At (9): Condition "file_getline(df, line_text, 16384) >= 0", taking true branch At (18): Condition "file_getline(df, line_text, 16384) >= 0", taking false branch 2044 while(file_getline(df, line_text, CONFLINELEN)>=0) { 2045 memcpy(config_line, line_text, CONFLINELEN); 2046 ++line_number; 2047 config_opt=config_line; At (10): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking true branch At (11): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking false branch 2048 while(isspace((unsigned char)*config_opt)) 2049 ++config_opt; /* remove initial whitespaces */ At (12): Condition "i >= 0", taking true branch At (13): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking true branch At (14): Condition "i >= 0", taking true branch At (15): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking false branch 2050 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i) 2051 config_opt[i]='\0'; /* remove trailing whitespaces */ At (16): Condition "config_opt[0] == 0", taking true branch 2052 if(config_opt[0]=='\0' || config_opt[0]=='#' || config_opt[0]==';') /* empty or comment */ At (17): Continuing loop 2053 continue; 2054 if(config_opt[0]=='[' && config_opt[strlen(config_opt)-1]==']') { /* new section */ 2055 if(!new_service_options.next) { 2056 errstr=parse_global_option(CMD_END, NULL, NULL); 2057 if(errstr) { 2058 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr); 2059 file_close(df); 2060 return 1; 2061 } 2062 } 2063 ++config_opt; 2064 config_opt[strlen(config_opt)-1]='\0'; 2065 new_section=str_alloc(sizeof(SERVICE_OPTIONS)); 2066 memcpy(new_section, &new_service_options, sizeof(SERVICE_OPTIONS)); 2067 new_section->servname=str_dup(config_opt); 2068 new_section->session=NULL; 2069 new_section->next=NULL; 2070 section->next=new_section; 2071 section=new_section; 2072 continue; 2073 } 2074 config_arg=strchr(config_line, '='); 2075 if(!config_arg) { 2076 s_log(LOG_ERR, "Line %d: \"%s\": No '=' found", line_number, line_text); 2077 file_close(df); 2078 return 1; 2079 } 2080 *config_arg++='\0'; /* split into option name and argument value */ 2081 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i) 2082 config_opt[i]='\0'; /* remove trailing whitespaces */ 2083 while(isspace((unsigned char)*config_arg)) 2084 ++config_arg; /* remove initial whitespaces */ 2085 errstr=parse_service_option(CMD_EXEC, section, config_opt, config_arg); 2086 if(!new_service_options.next && errstr==option_not_found) 2087 errstr=parse_global_option(CMD_EXEC, config_opt, config_arg); 2088 if(errstr) { 2089 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr); 2090 file_close(df); 2091 return 1; 2092 } 2093 } 2094 file_close(df); 2095 At (19): Condition "new_service_options.next", taking true branch 2096 if(new_service_options.next) { /* daemon mode: initialize sections */ At (20): Comparing "section" to null implies that "section" might be null. At (21): Condition "section", taking false branch 2097 for(section=new_service_options.next; section; section=section->next) { 2098 s_log(LOG_INFO, "Initializing service [%s]", section->servname); 2099 errstr=parse_service_option(CMD_END, section, NULL, NULL); 2100 if(errstr) 2101 break; 2102 } At (22): Falling through to end of if statement 2103 } else { /* inetd mode: need to initialize global options */ 2104 errstr=parse_global_option(CMD_END, NULL, NULL); 2105 if(errstr) { 2106 s_log(LOG_ERR, "Global options: %s", errstr); 2107 return 1; 2108 } 2109 s_log(LOG_INFO, "Initializing inetd mode configuration"); 2110 section=&new_service_options; 2111 errstr=parse_service_option(CMD_END, section, NULL, NULL); 2112 } CID 32706: Uninitialized pointer read (UNINIT) [select defect] At (23): Condition "errstr", taking true branch 2113 if(errstr) { CID 32693: Dereference after null check (FORWARD_NULL)At (24): Dereferencing null pointer "section". 2114 s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr); 2115 return 1; 2116 } > > - if(!strcasecmp(fl->name, string)) { > > + if(string && !strcasecmp(fl->name, string)) { > Could you give an example parameter where "string" may be NULL here? 2238/* facilities only make sense on Unix */ 2239#if !defined (USE_WIN32) && !defined (__vms) At (1): Condition "strchr(string, 46)", taking true branch 2240 if(strchr(string, '.')) { /* we have a facility specified */ 2241 new_global_options.facility=-1; 2242 string=strtok(arg_copy, "."); /* break it up */ 2243 At (2): Condition "fl->name", taking true branch 2244 for(fl=facilities; fl->name; ++fl) { At (3): Condition "!strcasecmp(fl->name, string)", taking true branch 2245 if(!strcasecmp(fl->name, string)) { 2246 new_global_options.facility=fl->value; At (4): Breaking from loop 2247 break; 2248 } 2249 } At (5): Condition "new_global_options.facility == -1", taking false branch 2250 if(new_global_options.facility==-1) 2251 return 1; /* FAILED */ 2252 string=strtok(NULL, "."); /* set to the remainder */ 2253 } 2254#endif /* USE_WIN32, __vms */ 2255 2256 /* time to check the syslog level */ At (6): Comparing "string" to null implies that "string" might be null. At (7): Condition "string", taking false branch 2257 if(string && strlen(string)==1 && *string>='0' && *string<='7') { 2258 new_global_options.debug_level=*string-'0'; 2259 return 0; /* OK */ 2260 } 2261 new_global_options.debug_level=8; /* illegal level */ At (8): Condition "fl->name", taking true branch 2262 for(fl=levels; fl->name; ++fl) { CID 11183: Dereference after null check (FORWARD_NULL)At (9): Passing null pointer "string" to function "strcasecmp(char const *, char const *)", which dereferences it. 2263 if(!strcasecmp(fl->name, string)) { 2264 new_global_options.debug_level=fl->value; 2265 break; 2266 } 2267 } 2268 if(new_global_options.debug_level==8) 2269 return 1; /* FAILED */ 2270 return 0; /* OK */ 2271} Let me know if more info is required. Thanks

5 16

fix resource leaks and potential null dereferences in 4.54
by Arthur Mesh 03 Feb '13

03 Feb '13

Hi, I am trying to figure out where bug reports should be submitted. https://www.stunnel.org/lists.html references this mailing list, so here is my attempt at a bug report with a potential fix. If this is not an appropriate list, please redirect me. A coverity run has uncovered quite a few memory and other resource leaks, plus some potential NULL dereferences. Inline is an attempt to fix them. Imho, these are mostly self-explanatory, but if someone needs more details, I would be happy to provide those as well. Thanks diff -ru stunnel-4.54/src/options.c stunnel-4.54.p/src/options.c --- stunnel-4.54/src/options.c 2012-10-09 01:50:54.000000000 -0700 +++ stunnel-4.54.p/src/options.c 2013-01-29 16:26:00.000000000 -0800 @@ -1988,7 +1988,7 @@ int parse_conf(char *name, CONF_TYPE type) { DISK_FILE *df; - char line_text[CONFLINELEN], *errstr; + char line_text[CONFLINELEN], *errstr = NULL; char config_line[CONFLINELEN], *config_opt, *config_arg; int line_number, i; SERVICE_OPTIONS *section, *new_section; @@ -2104,7 +2104,8 @@ errstr=parse_service_option(CMD_END, section, NULL, NULL); } if(errstr) { - s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr); + s_log(LOG_ERR, "Service [%s]: %s", section ? section->servname : "", + errstr); return 1; } @@ -2253,7 +2254,7 @@ } new_global_options.debug_level=8; /* illegal level */ for(fl=levels; fl->name; ++fl) { - if(!strcasecmp(fl->name, string)) { + if(string && !strcasecmp(fl->name, string)) { new_global_options.debug_level=fl->value; break; } @@ -2428,6 +2429,7 @@ if(get_last_socket_error()!=S_ENOPROTOOPT) { s_log(LOG_ERR, "Failed to get %s OS default", ptr->opt_str); sockerror("getsockopt"); + close(fd); return 1; /* FAILED */ } td=str_dup("write-only"); @@ -2442,6 +2444,7 @@ ptr->opt_str, ta, tl, tr, td); str_free(ta); str_free(tl); str_free(tr); str_free(td); } + close(fd); return 0; /* OK */ } Only in stunnel-4.54.p/src: options.c.orig diff -ru stunnel-4.54/src/protocol.c stunnel-4.54.p/src/protocol.c --- stunnel-4.54/src/protocol.c 2012-10-09 01:46:47.000000000 -0700 +++ stunnel-4.54.p/src/protocol.c 2013-01-29 16:26:00.000000000 -0800 @@ -244,30 +244,36 @@ /**************************************** smtp */ static void smtp_client(CLI *c) { - char *line; + char *line = NULL; do { /* copy multiline greeting */ + str_free(line); /* okay to str_free(NULL) */ line=fd_getline(c, c->remote_fd.fd); fd_putline(c, c->local_wfd.fd, line); } while(isprefix(line, "220-")); fd_putline(c, c->remote_fd.fd, "EHLO localhost"); do { /* skip multiline reply */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); } while(isprefix(line, "250-")); if(!isprefix(line, "250 ")) { /* error */ + str_free(line); s_log(LOG_ERR, "Remote server is not RFC 1425 compliant"); longjmp(c->err, 1); } fd_putline(c, c->remote_fd.fd, "STARTTLS"); do { /* skip multiline reply */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); } while(isprefix(line, "220-")); if(!isprefix(line, "220 ")) { /* error */ + str_free(line); s_log(LOG_ERR, "Remote server is not RFC 2487 compliant"); longjmp(c->err, 1); } + str_free(line); } static void smtp_server(CLI *c) { @@ -290,21 +296,27 @@ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "220")) { s_log(LOG_ERR, "Unknown server welcome"); + str_free(line); longjmp(c->err, 1); } fd_printf(c, c->local_wfd.fd, "%s + stunnel", line); + str_free(line); line=fd_getline(c, c->local_rfd.fd); if(!isprefix(line, "EHLO ")) { s_log(LOG_ERR, "Unknown client EHLO"); + str_free(line); longjmp(c->err, 1); } fd_printf(c, c->local_wfd.fd, "250-%s Welcome", line); + str_free(line); fd_putline(c, c->local_wfd.fd, "250 STARTTLS"); line=fd_getline(c, c->local_rfd.fd); if(!isprefix(line, "STARTTLS")) { s_log(LOG_ERR, "STARTTLS expected"); + str_free(line); longjmp(c->err, 1); } + str_free(line); fd_putline(c, c->local_wfd.fd, "220 Go ahead"); } @@ -316,15 +328,19 @@ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "+OK ")) { s_log(LOG_ERR, "Unknown server welcome"); + str_free(line); longjmp(c->err, 1); } fd_putline(c, c->local_wfd.fd, line); + str_free(line); fd_putline(c, c->remote_fd.fd, "STLS"); line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "+OK ")) { s_log(LOG_ERR, "Server does not support TLS"); + str_free(line); longjmp(c->err, 1); } + str_free(line); } static void pop3_server(CLI *c) { @@ -332,17 +348,21 @@ line=fd_getline(c, c->remote_fd.fd); fd_printf(c, c->local_wfd.fd, "%s + stunnel", line); + str_free(line); line=fd_getline(c, c->local_rfd.fd); if(isprefix(line, "CAPA")) { /* client wants RFC 2449 extensions */ fd_putline(c, c->local_wfd.fd, "+OK Stunnel capability list follows"); fd_putline(c, c->local_wfd.fd, "STLS"); fd_putline(c, c->local_wfd.fd, "."); + str_free(line); line=fd_getline(c, c->local_rfd.fd); } if(!isprefix(line, "STLS")) { + str_free(line); s_log(LOG_ERR, "Client does not want TLS"); longjmp(c->err, 1); } + str_free(line); fd_putline(c, c->local_wfd.fd, "+OK Stunnel starts TLS negotiation"); } @@ -353,18 +373,22 @@ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "* OK")) { + str_free(line); s_log(LOG_ERR, "Unknown server welcome"); longjmp(c->err, 1); } fd_putline(c, c->local_wfd.fd, line); + str_free(line); fd_putline(c, c->remote_fd.fd, "stunnel STARTTLS"); line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "stunnel OK")) { + str_free(line); fd_putline(c, c->local_wfd.fd, "* BYE stunnel: Server does not support TLS"); s_log(LOG_ERR, "Server does not support TLS"); longjmp(c->err, 2); /* don't reset */ } + str_free(line); } static void imap_server(CLI *c) { @@ -387,6 +411,7 @@ /* process server welcome and send it to client */ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "* OK")) { + str_free(line); s_log(LOG_ERR, "Unknown server welcome"); longjmp(c->err, 1); } @@ -396,22 +421,29 @@ if(capa) *capa='K'; /* disable CAPABILITY within greeting */ fd_printf(c, c->local_wfd.fd, "%s (stunnel)", line); + str_free(line); while(1) { /* process client commands */ line=fd_getline(c, c->local_rfd.fd); /* split line into id and tail */ id=str_dup(line); tail=strchr(id, ' '); - if(!tail) + if(!tail) { + str_free(line); + str_free(id); break; + } *tail++='\0'; if(isprefix(tail, "STARTTLS")) { fd_printf(c, c->local_wfd.fd, "%s OK Begin TLS negotiation now", id); + str_free(line); + str_free(id); return; /* success */ } else if(isprefix(tail, "CAPABILITY")) { fd_putline(c, c->remote_fd.fd, line); /* send it to server */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); /* get the capabilites */ if(*line=='*') { /* @@ -421,6 +453,7 @@ * LOGIN would fail as "unexpected command", anyway */ fd_printf(c, c->local_wfd.fd, "%s STARTTLS", line); + str_free(line); line=fd_getline(c, c->remote_fd.fd); /* next line */ } fd_putline(c, c->local_wfd.fd, line); /* forward to the client */ @@ -429,24 +462,35 @@ fd_putline(c, c->local_wfd.fd, "* BYE unexpected server response"); s_log(LOG_ERR, "Unexpected server response: %s", line); + str_free(line); + str_free(id); break; } + str_free(line); + str_free(id); } else if(isprefix(tail, "LOGOUT")) { fd_putline(c, c->local_wfd.fd, "* BYE server terminating"); fd_printf(c, c->local_wfd.fd, "%s OK LOGOUT completed", id); + str_free(id); + str_free(line); break; } else { fd_putline(c, c->local_wfd.fd, "* BYE stunnel: unexpected command"); fd_printf(c, c->local_wfd.fd, "%s BAD %s unexpected", id, tail); s_log(LOG_ERR, "Unexpected client command %s", tail); + str_free(line); + str_free(id); break; } } /* clean server shutdown */ fd_putline(c, c->remote_fd.fd, "stunnel LOGOUT"); line=fd_getline(c, c->remote_fd.fd); - if(*line=='*') + if(*line=='*') { + str_free(line); line=fd_getline(c, c->remote_fd.fd); + } + str_free(line); longjmp(c->err, 2); /* don't reset */ } @@ -458,15 +502,19 @@ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "200 ") && !isprefix(line, "201 ")) { s_log(LOG_ERR, "Unknown server welcome"); + str_free(line); longjmp(c->err, 1); } fd_putline(c, c->local_wfd.fd, line); fd_putline(c, c->remote_fd.fd, "STARTTLS"); + str_free(line); line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "382 ")) { s_log(LOG_ERR, "Server does not support TLS"); + str_free(line); longjmp(c->err, 1); } + str_free(line); } /**************************************** connect */ @@ -548,13 +596,17 @@ /* not "HTTP/1.0 200 Connection established" */ s_log(LOG_ERR, "CONNECT request rejected"); do { /* read all headers */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); } while(*line); + str_free(line); longjmp(c->err, 1); } + str_free(line); s_log(LOG_INFO, "CONNECT request accepted"); do { line=fd_getline(c, c->remote_fd.fd); /* read all headers */ + str_free(line); } while(*line); } @@ -588,10 +640,13 @@ if(line[9]!='4' || line[10]!='0' || line[11]!='7') { /* code 407 */ s_log(LOG_ERR, "NTLM authorization request rejected"); do { /* read all headers */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); } while(*line); + str_free(line); longjmp(c->err, 1); } + str_free(line); ntlm2_txt=NULL; do { /* read all headers */ line=fd_getline(c, c->remote_fd.fd); @@ -599,6 +654,7 @@ ntlm2_txt=str_dup(line+25); else if(isprefix(line, "Content-Length: ")) content_length=atol(line+16); + str_free(line); } while(*line); if(!ntlm2_txt) { /* no Proxy-Authenticate: NTLM header */ s_log(LOG_ERR, "Proxy-Authenticate: NTLM header not found"); Only in stunnel-4.54.p/src: protocol.c.orig diff -ru stunnel-4.54/src/stunnel.c stunnel-4.54.p/src/stunnel.c --- stunnel-4.54/src/stunnel.c 2012-08-18 14:11:53.000000000 -0700 +++ stunnel-4.54.p/src/stunnel.c 2013-01-29 16:26:00.000000000 -0800 @@ -119,12 +119,16 @@ fatal("Could not open /dev/null"); #endif /* standard Unix */ main_initialize(); - if(main_configure(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL)) + if(main_configure(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL)) { + close(fd); return 1; + } if(service_options.next) { /* there are service sections -> daemon mode */ #if !defined(__vms) && !defined(USE_OS2) - if(daemonize(fd)) + if(daemonize(fd)) { + close(fd); return 1; + } close(fd); /* create_pid() must be called after drop_privileges() * or it won't be possible to remove the file on exit */ Only in stunnel-4.54.p/src: stunnel.c.orig

3 4

X509 certificate info extract and use
by Pierre-Yves Bonnetain 03 Feb '13

03 Feb '13

Hello, We're looking for a way to add some kind of cross-control between an application and the TLS tunnelling tool that protects the data. I'll give an example, that may be easier to understand. My BigDatabase has it's login/password authentication process. Since my customers want to access the database through bad Internet, we set up a SSL/TLS frontend. Each customer has his own X509 certificate, with all proper bells and jingles in it. The frontend checks the certificate (CA sig, validity, revocation, etc.) and then, as it should, passes the unencrypted flow to the application. There is no way (or, rather, we have not found any way) to cross-check that the certificate AND the requested, application-level login, are linked together. This means that my evil neighbour, which bribed my gullible cat to get my login and password, could connect to my account (app-level auth) using his X509 cert (TLS tunnel auth). We would like to perform this cross-check between X509 certificate AND application-level auth. >From our point of view, this means that we need to "extract and send" some parts of the certificate (DN, validity dates, etc.) to some secondary tool/proxy. This one will check if the data is coherent wrt application credentials. M. Henrik Riomar sent a patch (http://www.stunnel.org/pipermail/stunnel-users/2012-October/003909.html) on the list last october that is one step closer to what we are looking for. We could build from it. Maybe some of you have already solved this kind of problem, or know of a tool that answer to this kind of needs ? Tia, -- Pierre-Yves Bonnetain-Nesterenko B&A Consultants - Sécurité informatique - www.ba-consultants.fr Tel. : +33 (0) 563 277 241 - Fax : +33 (0) 567 737 829

2 5

inetd mode endpoint count check
by Michael Weiser 03 Feb '13

03 Feb '13

Hello, a client setup such as this: client = yes foreground = yes connect = example.com:80 exec = cat execargs = cat causes stunnel-4.54 to fail with error: Service [stunnel]: Inetd mode must define one endpoint The attached patch fixes the problem for me. Dunno if the endpoint check is too lax for other cases then, though. -- Thanks, Micha

2 1

transparent proxy ssl for a socket server
by Alex Needham 29 Jan '13

29 Jan '13

Hi I have to figure out how to get some ssl encapsulation for an application we have that only servs on obscure ports, the app needs to retain the source ip adress of the client requests. So i looked at stunnel, its working great in transparent mode where the stunnel server is the default gateway of the socket server, but I would like to get the stunnel server onto the same machine as the socket server and keep the client src ip. Testing with a apache as a backend as its easy to test. running centos 6.3 (2.6.32-279.19.1.el6.x86_64), updated an hour ago, built stunnel 4.54 from src.rpm. The players stunnel-boxen external=192.168.0.1, internal=192.168.1.1 web/socket-boxen internal=192.168.1.11, dg=192.168.1.1 The configs Config A - works ok debug = 7 foreground = yes #not chrooted runnnig as root no setuid,setguid [socket-1234] cert=blarg.crt key=blarg.key accept = 192.168.0.1:1234 connect = 192.168.1.11:80 transparent = source Config B - Not so good connect = 192.168.1.1:80 <- inside interface of stunnel box iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 /etc/sysctl.conf no route filtering and forwarding is on am i trying something impossible? or am i missing something? Any help greatly appreciated, if I get this going I'll happily do a nice neater write up for others. Cheers Alex

2 1

child process reaping
by Michael Weiser 29 Jan '13

29 Jan '13

Hello, recent versions (4.47+ I think) of stunnel introduce the following code in stunnel.c: --- stunnel-4.46/src/stunnel.c 2011-11-03 10:06:59.000000000 +0100 +++ stunnel-4.54/src/stunnel.c 2012-08-18 23:11:53.000000000 +0200 [...] } else { /* inetd mode */ [...] + signal(SIGCHLD, SIG_IGN); /* ignore dead children */ + signal(SIGPIPE, SIG_IGN); /* ignore broken pipe */ + client_main(alloc_client_session(&service_options, 0, 1)); } In Linux, child processes seem to inherit their parent's SIGCHLD handler setting. This means that all of stunnel's child processes will be unable to wait for their children. This causes the following uucp-over-stunnel setup I have: CAfile = /etc/ssl/certs/cacert.pem cert = /etc/ssl/certs/suucpcert.pem key = /etc/ssl/private/suucpkey.unenc verify = 2 service = suucp exec = /usr/sbin/uucico execargs = uucico -l to fail horribly with messages such as this: uucico weiser - (2013-01-29 01:25:15.33 3676) Call complete (6 seconds 21620 bytes 35103 bps) uuxqt weiser root (2013-01-29 01:25:17.36 3677) Executing X.weiserSEQ1 (rbsmtp) uuxqt weiser root (2013-01-29 01:25:17.96 3677) ERROR: waitpid: No child processes uuxqt weiser root (2013-01-29 01:25:17.96 3677) Execution failed (X.weiserSEQ1) Restoring SIGCHLD to SIG_DFL just before execvp()'ing the child as in the attached patch seems to fix it. I also attach a small test case for reproducing. It can be run like this: nc -l -p 12345 -e "stunnel sigchldtest.conf" 127.0.0.1 & openssl s_client -quiet -verify 0 -connect 127.0.0.1:12345 and should produce the following output: child: 2654 child 2654 died When automatic child reaping it active it will fail like this: child: 2538 waitpid: No child processes BTW: On Mac OS X, the SIGCHLD handler setting does not seem to be inherited by children. -- Thanks, Micha

1 0

MATCH CERT AGAINST LDAP
by Alejandro Fernandez 26 Jan '13

26 Jan '13

Hi there! I would like to know if it's possible with stunnel, as is, to match a client certificate against a certstore in a directory service, instead of a file, so to be able to revoke from a service such as Fedora 389 some access. Please, understand that the idea is not to access the LDAP itself, but to access some service within a network and grant such access based on a directory service query. Thanks everyone, Alejandro

1 0

Re: [stunnel-users] Stunnel setup for SSL connection with POP3 server
by Ludolf Holzheid 25 Jan '13

25 Jan '13

On Thu, 2013-01-24 21:09:13 +0530, shanmuganathan sedukumar wrote: > > Hi Ludolf, > Thanks for your input. I will try the same :) Hello Shanmuganathan, always reply to the list, so others are able to follow (and to comment). > One more clarification, we have multiple mail accounts configured in the same POP3 server. In our application, for each email account the username/password credentials would vary. So, in stunnel config file do we need to specify the credentials with parameters? If so, how do we need to specify the credentials for all the accounts? As far as I understood, stunnel has nothing to do with the POP3 authentication. It merely provides with an (encrypted) transport layer for the (plain text) POP3 session. I.e., you have to specify the credentials in your application. HTH, Ludolf -- Bihl+Wiedemann GmbH Floßwörthstr. 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 e-mail: lholzheid(a)bihl-wiedemann.de website: www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim HRB 5796

1 0

stunnel for Solaris 10
by shanmuganathan sedukumar 24 Jan '13

24 Jan '13

Hi All, I'm new and about to start with stunnel. We are facing certain issues with our application server (operating on Solaris 10), as it is unable to establish SSL connection with an email exchange server (P0P3). So, we have planned to use stunnel for establishing SSL connection. May I get some guidelines on installation and configuration part, if anything available? Regards,Shanmuganathan

2 2

Hello, I am trying to connect to FIX server, and getting stunnel error.
by 724live 21 Jan '13

21 Jan '13

Hello, I am working on a project with FIX protocol, but have SSL connection error. *This is the stunnel.log info:* 2013.01.21 20:38:09 LOG5[5388:6900]: connect_blocking: connected XX.XX.XX.XX:2525 2013.01.21 20:38:09 LOG5[5388:6900]: Service [demo] connected remote server from 10.0.0.59:9532 2013.01.21 20:38:09 LOG7[5388:6900]: Remote socket (FD=620) initialized 2013.01.21 20:38:09 LOG7[5388:6900]: SNI: host name: XX.XX.XX.XX 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): before/connect initialization 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 write client hello A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server hello A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server certificate A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server done A 2013.01.21 20:38:09 LOG3[5388:6900]: error queue: 14098077: error:14098077:SSL routines:SSL3_SEND_CLIENT_KEY_ EXCHANGE:bad rsa encrypt 2013.01.21 20:38:09 LOG3[5388:6900]: SSL_connect: 4068078: error:04068078:rsa routines:RSA_EAY_PUBLIC_ENCRYPT:key size too small 2013.01.21 20:38:09 LOG5[5388:6900]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.01.21 20:38:09 LOG7[5388:6900]: Remote socket (FD=620) closed 2013.01.21 20:38:09 LOG7[5388:6900]: Local socket (FD=540) closed 2013.01.21 20:38:09 LOG7[5388:6900]: Service [demo] finished (0 left) I will appreciate if you can guide me with help. It will help to make your Archive Searchable. Thank you, Isaac

2 1

unknown protocol
by Brandon Glenn 11 Jan '13

11 Jan '13

I am currently trying to setup stunnel to help me send emails from a program that sends alerts but does not use SSL, to a cloud email service that I use that requires SSL. I have the configuration setup trying to find out where the error is, and I am down to this last error. SSL23_GET_CLIENT_HELLO:unknown protocol Here is my config file. ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2012 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem sslVersion = all ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; The default certificate cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Set client mode client = yes ; GMail ssmtp settings [ssmtp] accept = 25 connect = 174.129.0.38:465 ; GMail pop3s settings [pop3s] accept = 110 connect = 174.129.0.38:995 ; GMail imaps settings [imaps] accept = 143 connect = 174.129.0.38:993 ; Example SSL front-end to a web server ;[https] ;accept = 443 ;connect = 80 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; Microsoft implementations do not use SSL close-notify alert and thus ; they are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; vim:ft=dosini

2 1

Error 111 (net::ERR_TUNNEL_CONNECTION_FAILED): Unknown error.
by Mr Nerdy 03 Jan '13

03 Jan '13

Hi. I installed Stunnel to secure the traffic to my HFS web-server at home. Everything works fine except that if I am trying to connect through a firewall (e.g. from work) Chrome shows an error message: Error 111 (net::ERR_TUNNEL_CONNECTION_FAILED): Unknown error.

1 0

Stunnel v4.54 SSL_connect: Peer suddenly disconnected
by Arun Kumar 02 Jan '13

02 Jan '13

Team, I am configuring stunnel for the first time. My Requirement: "NetApp DataFabricManager" application on SLES10 SP4 platform <------ (LDAP over Stunnel) -----> Windows 2003 Active Directory, for Active Directory user authentication. Stunnel.conf: ----------------------------------------------------------- setuid = root setgid = root client = yes debug = 7 output = /root/stunnel.log cert = /opt/crt_key.pem key = /opt/crt_key.pem pid = /var/run/stunnel.pid verify = 3 CAfile = /opt/crt_key.pem options = NO_SSLv2 [ldap] accept = 389 connect = winad1-197-187:636 [ldap-ha] accept = 8389 connect = winad2-197-189:636 ----------------------------------------------------------- ocm5-197-196:~ # dfm ldap list Address Port Last Use Last Failure ------------------------------------------ ------ -------------------------- -------------------------- 127.0.0.1 389 2013-01-02 14:01:52.000000 127.0.0.1 8389 2013-01-02 13:49:35.000000 ocm5-197-196:~ # ocm5-197-196:~ # dfm ldap find user1 Warning: Failed to bind to ldap server '127.0.0.1' as user 'CN=Administrator,CN=Users,DC=<zz>,DC=<xx>,DC=<yy>,DC=com': Can't contact LDAP server Error: Failed to search for user1. ocm5-197-196:~ # NOTE: If i add active directory server IP in the above list, instead of 127.0.0.1, ldap authentication works fine. ocm5-197-196:~ # cat /etc/services ... ..... ........ #### This is a Manual Entry made by root user for AD authentication services & Stunnel Integration ######## ldap-ha 8389/tcp # 2nd LDAP host for DC redundancy [Redirected to 2nd DC by Stunnel, see /etc/stunnel/stunnel.conf] ldap-ha 8389/udp # 2nd LDAP host for DC redundancy [Redirected to 2nd DC by Stunnel, see /etc/stunnel/stunnel.conf] ocm5-197-196:~ # stunnel /root/stunnel-4.54/tools/stunnel.conf stunnel.log: 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Clients allowed=500 2013.01.02 14:00:42 LOG5[7102:47010476379680]: stunnel 4.54 on x86_64-unknown-linux-gnu platform 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Compiled/running with OpenSSL 0.9.8a 11 Oct 2005 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Threading:PTHREAD SSL:+ENGINE Auth:none Sockets:POLL+IPv6 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Reading configuration from file /root/stunnel-4.54/tools/stunnel.conf 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Compression not enabled 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Snagged 64 random bytes from /root/.rnd 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Wrote 1024 new random bytes to /root/.rnd 2013.01.02 14:00:42 LOG7[7102:47010476379680]: PRNG seeded successfully 2013.01.02 14:00:42 LOG6[7102:47010476379680]: Initializing service [ldap] 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Key file: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Private key loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded verify certificates from /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded /opt/crt_key.pem revocation lookup file 2013.01.02 14:00:42 LOG7[7102:47010476379680]: SSL options set: 0x01000004 2013.01.02 14:00:42 LOG6[7102:47010476379680]: Initializing service [ldap-ha] 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Key file: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Private key loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded verify certificates from /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded /opt/crt_key.pem revocation lookup file 2013.01.02 14:00:42 LOG7[7102:47010476379680]: SSL options set: 0x01000004 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Configuration successful 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Service [ldap] (FD=7) bound to 0.0.0.0:389 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Service [ldap-ha] (FD=8) bound to 0.0.0.0:8389 2013.01.02 14:00:42 LOG7[7103:47010476379680]: Created pid file /var/run/stunnel.pid 2013.01.02 14:01:52 LOG7[7103:47010476379680]: Service [ldap] accepted (FD=3) from 127.0.0.1:60332 2013.01.02 14:01:52 LOG7[7103:1073809728]: Service [ldap] started 2013.01.02 14:01:52 LOG5[7103:1073809728]: Service [ldap] accepted connection from 127.0.0.1:60332 2013.01.02 14:01:52 LOG6[7103:1073809728]: connect_blocking: connecting 192.168.10.7:636 2013.01.02 14:01:52 LOG7[7103:1073809728]: connect_blocking: s_poll_wait 192.168.10.7:636: waiting 10 seconds 2013.01.02 14:01:52 LOG5[7103:1073809728]: connect_blocking: connected 192.168.10.7:636 2013.01.02 14:01:52 LOG5[7103:1073809728]: Service [ldap] connected remote server from 192.168.10.1:40664 2013.01.02 14:01:52 LOG7[7103:1073809728]: Remote socket (FD=10) initialized 2013.01.02 14:01:52 LOG7[7103:1073809728]: SSL state (connect): before/connect initialization 2013.01.02 14:01:52 LOG7[7103:1073809728]: SSL state (connect): SSLv3 write client hello A 2013.01.02 14:01:52 LOG3[7103:1073809728]: SSL_connect: Peer suddenly disconnected <------------------ 2013.01.02 14:01:52 LOG5[7103:1073809728]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.01.02 14:01:52 LOG7[7103:1073809728]: Remote socket (FD=10) closed 2013.01.02 14:01:52 LOG7[7103:1073809728]: Local socket (FD=3) closed 2013.01.02 14:01:52 LOG7[7103:1073809728]: Service [ldap] finished (0 left) I initially started with stunnel-4.14 available with SLES10 GA OS media. Noticed peer disconnected issue. I went through the stunnel mailing list archive for related issues, but didn't get much help. Finally upgraded stunnel to v4.54 & to no progress. google hits mentioned that its configuration issue / client is not accepting sockets.. but finally no clue how to proceed. Kindly assist "SSL_connect: Peer suddenly disconnected" & SSL handshake work. Warm Regards, Arun UNIX admin

2 3

Looking to confirm that stunnel is encrypting traffic via wireshark
by David Trebacz 31 Dec '12

31 Dec '12

I'm using stunnel to encrypt newsgroup traffic. Essentially use stunnel to encrypt port 119 traffic (from the Pan Newsreader) then securely communicate over 563 with astraweb secure servers. The whole set-up is described in detail in this blog post: http://blog.trebacz.com/2012/03/installing-stunnel-to-enable-ssl.html The system has been "working" for several months, but someone on the blog asked how to confirm it. I checked my logs and each time I'm finished using Pan/Stunnel to download anything I get several entries in my syslog like: stunnel: LOG5[2111:140426048358144]: Connection closed: 3259 byte(s) sent to SSL, 16756212 byte(s) sent to socket I started to wonder does this mean some of the traffic was encrypted, but most wasn't? I fired up wireshark filtered the results to show port 563 traffic ( filter set to tcp.port == 563) as was suggested in another post ( http://ubuntuforums.org/showpost.php?p=5400958&postcount=9) Wireshark does show the traffic is correctly flow through port 563 with astrawebs newsservers when requesting data, but how do I know the traffic is encrypted? I inspected likely packets to contain encrypted data and I don't see anything in plain text (but they're zlib compressed also).

1 0

How to set DSCP in stunnel?
by Death Master 30 Dec '12

30 Dec '12

How to set DSCP in stunnel? For some reasons I can't set DSCP via iptables(server side is on ovz VPS). Is there such feature? If no - please add it(it will be very usefull for me ;) )

3 3

Embedded linux run time problem (starting version 4.53), and work around
by Bao, Robert 28 Dec '12

28 Dec '12

To those running stunnel on Embedded Linux ARMv4 platform, You may have noticed that stunnel (starting from version 4.53 to the latest) will crash immediately even if you run as "stunnel -version". The work around is to remove "-pie" and "-fPIE" from CFLAG in Makefile. Michal, You may fix this problem permanently in config file when you roll out the official 5.00 version. Thanks, and happy holidays. Robert Bao Software House Tyco International

1 0

core dump when running stunnel on Arm based board
by ning ji 21 Dec '12

21 Dec '12

Hi everyone, i'm new to this. got a task to update stunnel from 4.52 to 5.00b1. 1. ./configure --host arm-none-linux-gnueabi --target arm-none-linux-gnueabi --prefix= i compared the makefile with the one in our 4.52 code base, same. 2. build with make -C stunnel CROSS_COMPILE=arm-none-linux-gnueabi- ARCH=arm 3. scp to ARM board, run without arugments, core dump. (the line number might be different as i was putting printfs. but as long as it enters parse_commandline, it crashes) [New LWP 867]Cannot access memory at address 0x70797263(gdb) bt#0 parse_commandline (name=0xbefdce29 "/opt/ultra/config/stunnel.conf", parameter=0xbefdce48 "-version") at options.c:1940#1 0x0003ba04 in main_configure (arg1=0xbefdce29 "/opt/ultra/config/stunnel.conf", arg2=0xbefdce48 "-version") at stunnel.c:199#2 0x0003bd44 in main_unix (argv=<optimized out>, argc=<optimized out>)at stunnel.c:135#3 main (argc=3, argv=0xbefdcd24) at stunnel.c:110my question is, it crashed when just entering parse_commandline( ),the 2 arguments look fine to me.How could this happen ?Many thanks !

5 11

public domain [PATCH] to stunnel 500b3 for Windows CE / Windows Mobile, "no log window bug" on WCE, UNICODE wce/w32, and compilation issues fixed
by Pierre DELAAGE 18 Dec '12

18 Dec '12

Dear All, Please find enclosed a patch in "diff -cr orig patched" format, applying to stunnel v500b3 as found here https://www.stunnel.org/downloads.html This patch mainly addresses compilation and unicode issues for Windows CE targets + ONE issue preventing stunnel to display error logs in error Window on WCE. This code has been made common to WCE AND W32, by selecting proper win32 api calls common to both platforms. For example : InsertMenuItem does not exist on WCE, but InsertMenu can do the same job. ShellExecute does not exist on WCE, but...ShellExecuteEx does exist on both platforms and can do the job. I use MS EVC 4sp4 compiler with WCE 420 SDK, on a vista sp2 host platform. Once debugged the code works fine on WM6 HTC smartphones. Should work on WM5. It needs a windows CE openssl lib (I recompiled MY patched version of openssl 1.0.2snap20121213 successfully: I have sent a patch to those openssl gentlemen, hoping that they will integrate it one fine day..., something not so obvious ...). You will find my openssl "patch to port", by following carefully this thread at openssl diffusion list : http://marc.info/?l=openssl-dev&m=135574071824906&w=2 two messages are more important than the others : one containing the patch on the code. Another one containing 2 useful scripts. The present stunnel patch addresses the following issues : ************* I] COMPILATION FAILURES It is important to state that to detect more type mismatching (that can be error prone at runtime), I delibarately use /WX option on both WCE and W32 compilers: this flag takes each warning as an error. This is very useful for UNICODE clean coding as, without this option, the compiler will just warn when seeing a short* (unicode string) used as a char* (ansi string), which leads to big pb at run time. 1/ orig/src/client.c just a warning on missing "return". 2/ evc.mak new SSLDIR to openssl V102snap20121213 Missing flag x86 needed to get inline function InterlockedExchange from winbase.h. Added dependency to evc.mak itself, as in vc.mak Added commctrl.lib for CommandBar routines (although, strangely, the program was running without that !) 3/ gui.c : UNICODE port for W32/WCE. WM_WINDOWSPOSCHHANGED replaces WM_SHOWINDOW, as the latter is unsupported in WCE. some mismatch between prototype and function definition for service_install. Visible now is a BOOL, as it is more consistant with its value and usage. Some "return TRUE" have been replaced by "return 0" as stated in msdn doc. Trick to delete menuitems : itemcount does not exist in WCE, but the delete loop is using the return value of deletemenu. message_boxT created for Tchar vars such as section->help ShellExecute replaced by shellExecuteEx, common to WCE and W32 4/ prototypes.h : declared message_boxT 5/ resolver.c : UNICODE issue on LoadLibrary 6/ stunnel.c type cast for time_t 7/ vc.mak : inc32 for openssl includes /WX warning as error flag to see every potential casting problem around UNICODE ************* II] OPERATIONAL ERRORS (at run-time) 1/ error log windows is displayed empty : cause = WM_SHOWWINDOW does not exist on WCE, although the constant is declared ! solution : use WM_WINDOWPOSCHANGED instead... 2/ Unsolved, unfortunaltely : on WCE only, on start, there is an error message, but no real error behind : "CommandBar_InsertMenuBar : error 120 : this function is only valid in win32 mode" I am still searching... ************* III] MINOR IMPROVMENT 1/replaced some win3.1 ugly fonts See resources.rc : some nice FONT on About and Password dlgbox...to replace ugly windows3.1 style bold font... Note : I use stunnel to establish a simple "vpn" between smartphones and a corporate linux server mainly for HTTPS/POPS/SMTPS support. Stunnel is very relevant in that matter, over solutions based on SSH (although we use also ssh), from a communication cost point of view : ssh establishes permanent socket between client and server, so that the communication is charged by the mobile network provider : and these charges are very expensive. On the contrary stunnel only establishes ssl sockets on demand so that financial charges are limited to strict necessary. Please note that stunnel brings "client based certificate authentication" to POP/SMTP mobile mail user agents which only BASICALLY supports SSL with server authentication, but NO client authentication, such as M$ Outlook for Mobile (unless you pay for an exchange server and exchange client licence). Here again stunnel is very relevant. Note 2 : TODO list and Wish list : 1/ there is a remaining runtime bug on WCE : On start there is a warning that is NOT causing any failure in the software. Very difficult to analyse... 2/ find a notepad for WCE... 3/ in log.c...I really it would be good to replace hard coded values for socket errors by symbolic constant. 4/ fips openssl for WCE and then stunnel for WCE... I hope you will find this patch useful. Michal, thank you for your excellent work, Yours sincerely, Pierre Delaage

2 1

WCE 3.0 run-time error, how to work around it?
by Bao, Robert 12 Dec '12

12 Dec '12

Mike, The stunnel version used in our current product is 4.34. It worked well under Windows CE 3.0 and 5.0. However I got run-time error for 5.00 beta version under WCE 3.0 (even though I disabled IPv6, took out winsock2.h/ws2tcpip.h, included winsock.h, defined "struct addrinfo", etc ). The error is: Error detected on SSL (read) file descriptor: Bad protocol option (WSAENOPROTOOPT) (10042) What else I need to do to resolve or work around it? Thank you. Robert Bao Software House Tyco International

2 2

Win CE build errors: main_execute() removed from stunnel.c file? "hwnd" link error.
by Bao, Robert 07 Dec '12

07 Dec '12

Came across another Win CE build issue in the current stunnel 4.54 version. Got link error for main_execute() referenced in nogui.c file. I noticed that the implementation of "main_execute()" was in stunnel.c file in old versions, but is not there anymore. Also got "hwnd" linking issue. Looks like "hwnd" is initialized/created in gui.c file, and used in log.c/client.c/option.c files. It is not initialized/created in nogui.c file. I am using the NOGUIOBJS/tstunnel.exe option in building the stunnel, and got this linking error. Any suggestions on how to fix these or work around them? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

3 12

protocols options clarification
by John A. Wallace 06 Dec '12

06 Dec '12

The Service Level Options of the manual includes the following points: protocol = proto application protocol to negotiate SSL (e.g. starttls or stls) protocol option should not be used with SSL encryption on a separate port. Currently supported protocols: CIFS Connect Etc.. However, in the listed protocols supported neither "starttls" or "stls" appears, even though they appear to be options as far as I can see from the above explanation. Am I missing something here, or should they be among those in the list, and can one use this setting: Protocol=starttls Also, I don't really understand what this statement is telling me: "protocol option should not be used with SSL encryption on a separate port." John A. Wallace

3 2

Re: [stunnel-users] protocols options clarification
by jw72253＠verizon.net 06 Dec '12

06 Dec '12

2 1

how to use My Own Signed Wildcard cert
by robbi3j 05 Dec '12

05 Dec '12

Can anyone help ... have looked through the forums but cannot get this to work I want to configure Stunnel to use my already signed wildcard cert how to I go about importing it ? .. i have the cert file with the private key attached which is password protected can anyone help as its driving me nuts ! -- View this message in context: http://old.nabble.com/how-to-use-My-Own-Signed-Wildcard-cert-tp34756779p347… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 3

Console-only version for Windows
by Clodo 03 Dec '12

03 Dec '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There is a binary version of stunnel for Windows WITHOUT the gui, console/terminal only? I have some different problems with the GUI edition: - - Fail to read filename with spaces? - - If is already in execution and i run stunnel.exe with some other parameters, they are ignored and simply give the focus to the current instance, so issue with launching multiple instances. Why there isn't any console-only version, exacly like the standard linux distribution? The Cygwin version works great, but isn't portable, doesn't work without Cygwin environment. There are some big trouble about that, or simply doesn't exists the .mak project file? I'm also available to pay with a donation a build like that. I'm waiting for feedback. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQEVAwUBUKPN8i/ixHrG0m4LAQLxdwf/RF1faK3tksXnl6qm8Bi6HIFaG72tmFMJ LwQuY0gJh7rYDJs3NUQwh4XczMqi+5a8/SRZFojSewI2WfeZgLuXC58iq5nkAULm quaEN5ynjen80RJ7MtGg9weoHcpV1kug5HKJUwYZLU0lp8CvEGNhl8sgGT/bCUS7 gzdfi1d3YohBbEn8XZZgmmUmp1oShY4dh47Sd4vVlzaL3WkxqNIasCJJCwWk7lUz dPuy8XCi6y+Aes1T2SF87GAwvdkr0FbPiN0GcCXGczZxNjOiGNGOwqaHnxDknibr kHoGU/vv1PKWU5AYGiryD/YiUt0nHC/7I7IKU3tFu3smmFR8BTOwKA== =lLyE -----END PGP SIGNATURE-----

4 5