stunnel-users

1 participants
3311 discussions

stunnel server configuration requirement to handle CBC protection
by Simner, John 13 Nov '13

13 Nov '13

Hi, Having recently used stunnel on the phone as a server to encrypt the communication between an external client and a simple TCP server socket on the phone, one of the clients have raised the following.... Phone resets a TLS conection from client, when CBC protection is enabled on tomcat server. The phone syslog shows: Oct 28 14:26:14 10 user.crit syslog: CommsChannelExtenderRx(28881): ./src/CommsChannelExtenderRx.cpp:186 Header section invalid To prevent a SSL/TLS BEAST attack (CVE-2011-3389) Oracle Java (JSSE) has implemented a CBC protection which can be set with System Property jsse.enableCBCProtection. The default value is true. What was done: Start client and connect it with a phone. The TLS connection is established, but then the phone resets the connection, and client is not working. When I set jsse.enableCBCProtection to false at the tomcat server, the phone accepts the connection and client is working. To prevent man-in-the-middle attacks, the phone should be able to handle the fragmented TLS block when CBC protection is activated on the client tomcat server. I have been unable to find the appropriate stunnel configuration item to support this. Please could you inform me how this is handled through stunnel. Thank you for your assistance and I look forward to your responses. Thanks.. John John Simner BSc(Hons) MSc CEng. MIET Software Engineer Unify Enterprise Communications Ltd. Devices Development K Block, Technology Drive, Beeston, Nottingham, NG9 1LA Tel.: +44 (0) 19088 17378 Email: john.simner(a)unify.com <mailto:[email protected]> www.unify.co.uk<http://www.unify.co.uk/> Follow us: [Social_media_icons] <http://www.unify.com/social-media> Unify Enterprise Communications Limited. Registered Office: Brickhill Street, Willen Lake, Milton Keynes, MK15 0DJ Registered No: 5903714, England. This email contains confidential information and is for the exclusive use of the addressee. If you are not the addressee then any distribution, copying, or use of this email is prohibited. If received in error, please advise the sender and delete immediately. We accept no liability for any loss or damage suffered by any person arising from use of this email.

4 10

Patch for Start TLS for LDAP clients (RFC 2830)
by Bart Dopheide 07 Nov '13

07 Nov '13

Hi, I noticed that latest/greatest stunnel does not support the Start TLS operation for LDAP (RFC2830). Yet, I need it in my organisation as a quick workaround. After fiddling with OpenLDAP, tracing, and reading RFC 2830 a bit, I patched stunnel 4.56 and the patch has not failed me yet. But I must remark that I am no LDAP expert, nor an certified stunnel hacker. So, I will submit this patch as a first suggestion. Will you consider the feature request of implementing the Start TLS feature as described in RFC 2830? Cheers, Bart Dopheide My patch suggestion is: dopheideb@anguish:/tmp$ diff -aur stunnel-4.56 stunnel-4.56-ldap-starttls-patch diff -aur stunnel-4.56/src/protocol.c stunnel-4.56-ldap-starttls-patch/src/protocol.c --- stunnel-4.56/src/protocol.c 2013-03-13 14:41:16.000000000 +0100 +++ stunnel-4.56-ldap-starttls-patch/src/protocol.c 2013-11-05 11:19:10.388365359 +0100 @@ -53,6 +53,7 @@ static void imap_client(CLI *); static void imap_server(CLI *); static void nntp_client(CLI *); +static void openldap_client(CLI *); static void connect_server(CLI *); static void connect_client(CLI *); @@ -82,6 +83,7 @@ {"pop3", {{PROTOCOL_PRE_SSL, pop3_server}, {PROTOCOL_PRE_SSL, pop3_client}}}, {"imap", {{PROTOCOL_PRE_SSL, imap_server}, {PROTOCOL_PRE_SSL, imap_client}}}, {"nntp", {{PROTOCOL_NONE, NULL}, {PROTOCOL_PRE_SSL, nntp_client}}}, + {"openldap",{{PROTOCOL_NONE, NULL}, {PROTOCOL_PRE_SSL, openldap_client}}}, {"connect", {{PROTOCOL_PRE_CONNECT, connect_server}, {PROTOCOL_PRE_SSL, connect_client}}}, {NULL, {{PROTOCOL_NONE, NULL}, {PROTOCOL_NONE, NULL}}} }; @@ -513,6 +515,88 @@ str_free(line); } +/**************************************** LDAP, RFC 2830 */ + +u8 ldap_startssl_message[0x1d + 2] = +{ + 0x30, /* tag = UNIVERSAL SEQUENCE */ + 0x1d, /* len = 29 (the remaining number of bytes in this message) */ + 0x02, /* messageID */ + 0x01, /* len = 1 */ + 0x01, /* value = 1 (this is messageID 1) */ + /* --- */ + 0x77, /* protocolOp = APPLICATION (23) (=ExtendedRequest) + * 0b01xxxxxx => APPLICATION + * 0bxx1xxxxx => ? + * 0xxxx10111 => 23 + */ + 0x18, /* len = 24 */ + 0x80, /* type = requstName? */ + 0x16, /* len = 22 */ + /* OID: 1.3.6.1.4.1.1466.20037 (=LDAP_START_TLS_OID)*/ + '1', '.', + '3', '.', + '6', '.', + '1', '.', + '4', '.', + '1', '.', + '1', '4', '6', '6', '.', + '2', '0', '0', '3', '7' + /* No requestValue, as per RFC2830 (in 2.1: "The requestValue field is absent") */ +}; +static void openldap_client(CLI *c) { + u8 buffer[1]; + u8 ldap_response[256]; + + s_log(LOG_DEBUG, "Requesting LDAP Start TLS"); + write_blocking(c, c->remote_fd.fd, ldap_startssl_message, ldap_startssl_message[1] + 2); + + read_blocking(c, c->remote_fd.fd, buffer, 1); + if(buffer[0] != 0x30) { + s_log(LOG_ERR, "start tag is not UNIVERSAL SEQUENCE"); + longjmp(c->err, 1); + } + + s_log(LOG_DEBUG, "Reading LDAP message size (1 byte)."); + read_blocking(c, c->remote_fd.fd, buffer, 1); + + s_log(LOG_DEBUG, "Reading LDAP message (%u byte(s))", buffer[0]); + read_blocking(c, c->remote_fd.fd, ldap_response, buffer[0]); + + if(ldap_response[0] != 0x02) { + s_log(LOG_ERR, "LDAP response does not start with type messageID"); + longjmp(c->err, 1); + } + if(ldap_response[1] != 0x01) { + s_log(LOG_ERR, "This is not an extendedResp(1)"); + longjmp(c->err, 1); + } + if(ldap_response[2] != 0x01) { + s_log(LOG_ERR, "Non-matching messageID"); + longjmp(c->err, 1); + } + if(ldap_response[3] != 0x78) { + s_log(LOG_ERR, "This is not a protocolOp for APPLICATION ExtendedResponse"); + longjmp(c->err, 1); + } + if(ldap_response[4] != 0x07) { + s_log(LOG_ERR, "Expected 0x07 indicating extendedResp is 7 bytes long"); + longjmp(c->err, 1); + } + if(ldap_response[5] != 0x0a) { + s_log(LOG_ERR, "This is not an extendedResp"); + longjmp(c->err, 1); + } + if(ldap_response[6] != 0x01) { + s_log(LOG_ERR, "This is not an extendedResp"); + longjmp(c->err, 1); + } + if(ldap_response[7] != 0x00) { + s_log(LOG_ERR, "This is not resultCode success"); + longjmp(c->err, 1); + } +} + /**************************************** connect */ static void connect_server(CLI *c) { dopheideb@anguish:/tmp$

3 2

stunnel x forwarded not working
by Libindas 05 Nov '13

05 Nov '13

Hi all, We are facing problem with stunnel + HAproxy + Tomcat Client -----> Stunnel-----> HAProxy----> Tomcat { I need get client IP in Tomcat Servers} I have compiled(stunnel-4.32 + stunnel-4.32-xforwarded-for.diff) and installed but not working. Really appreciate your help Thanks Libin

2 1

Trouble sending email via smtp with a particular gmail address
by Brian Morgan 01 Nov '13

01 Nov '13

I'm having trouble sending email through stunnel with our customer service email address. We use google premium services for our hosted email. I can send through stunnel using my own personal account, but when I switch to the cust service account, I get the error: "Failed to send an E-mail through the specified SMTP server [127.0.0.1]: The SMTP server requires a secure connection or the client was not authenticated. The server response was 5.5.1 Authentication Required." And yes, I double/triple checked credentials and can login through the gmail interface with them just fine. I also tried changing the password to a strong password which did not help. gmail settings in stunnel.conf: [gmail-smtp] client = yes accept = 127.0.0.1:259 connect = smtp.gmail.com:465 I also tried port 587 but that produces another error: "Failed to send an E-mail through the specified SMTP server [127.0.0.1]: Failure sending mail." Any ideas?

2 4

Clear LogWindow without Restart stunnel possible?
by Ben Stover 01 Nov '13

01 Nov '13

Can I somehow clear the current LogWindows WITHOUT exit+restarting stunnel?

2 1

Question Regarding Client Installer
by Andrew Smith 29 Oct '13

29 Oct '13

We currently use Stunnel to allow our clients to connect to their Databases that are hosted by us. I think this product is great. However, I am a newbie to Stunnel as our previous resource has passed away. What I would like to know now to do is create an installer for clients machines that have the correct configuration files in etc... I am sure this is pretty easy and I will be able to do it this once I am guided in the correct direction. Thanks in advance! ________________________________ Andrew Smith Support Technical Services Analyst P: 614-875-4910 x109 F: 614-875-4088 E: andrew.smith(a)harriscomputer.com [http://www.harriscomputer.com/images/signatures/HarrisSchools.jpg] [http://www.harriscomputer.com/images/signatures/DivisionofHarris.gif]<http://www.harriscomputer.com/> 6110 Enterprise Parkway Grove City, OH 43123 www.harris-schoolsolutions.com<http://www.harris-schoolsolutions.com> This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

2 1

Re: [stunnel-users] Is it usual/recommended to have key and cert in ONE stunnel.pem file?
by Ben Stover 29 Oct '13

29 Oct '13

Hello John, thank you for your clarification. Two more additional questions: According to stunnel guide I created a cert + key with the following command: openssl.exe req -new -x509 -days 3650 -nodes -config stunnel.cnf -out stunnelcert.pem -keyout stunnelkey.pem 1.) For what do I need here the -config stunnel.cnf parameter? I am prompted by openssl for the content values during generation anyway. Can stunnel.cnf be seen only as a default value pattern for the created cert during generation? Can I omit this parameter? 2.) After creation of cert+key I have to specify them (as client) in stunnel.conf (with "o") as follows: cert = stunnelcert.pem key = stunnelkey.pem Is this sufficient? Thank you Ben On Mon, Oct 28, 2013 at 06:39:15PM +0100, Ben Stover wrote: > According to some tutorial pages I generated with OpenSSL a (selfsigned) certificate. > > This file stunnel.pem contains the certifictae as well as the private key. > > Is this usual/recommended? Hello John, That sort of falls into the "tragedy waiting to happen" category. The certificate is supposed to be given to clients, and the key belongs to the server and has to be kept private or there's really no point in using SSL. > Or should user put these two parts in two independent files? Yes, absolutely. In fact I suppose you're using Windows or went through some hoop-jumping to combine them, because in "normal" OpenSSL usage the key is generated first and then the certs are requested and signed by the CA (or selfsigning) key. /jl

2 1

VPAT Section 508 Compliance
by Tracy Drake - QI-C 28 Oct '13

28 Oct '13

Hello Stunnel Support! I am seeking a VPAT showing the level Sec 508 compliance so that we can move toward making Stunnel a GSA-approved software. I guess the biggest question is whether or not Stunnel is considered to be section 508 compliant. Please advise as to where/how I can obtain this information. -- Tracy Drake CSM Senior Consultant GSA-FAS FAME Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

Is it usual/recommended to have key and cert in ONE stunnel.pem file?
by Ben Stover 28 Oct '13

28 Oct '13

According to some tutorial pages I generated with OpenSSL a (selfsigned) certificate. This file stunnel.pem contains the certifictae as well as the private key. Is this usual/recommended? Or should user put these two parts in two independent files? Ben

2 1

Is "fips=no" recommended?
by Ben Stover 25 Oct '13

25 Oct '13

I stunnel.conf there is a parameter fips=no which is currently commented out here. Is it (resp. when is it) recommended to activate this parameter? Ben

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users