stunnel-users

1 participants
3311 discussions

PATCH: multiple SNI options per slave section
by David Owen 27 Sep '13

27 Sep '13

Hello and thank you for stunnel! After switching from my web-server's built-in SSL support, I now have a much more secure system and SNI, too! In stunnel(8), I read this about the sni option: "sni option can also be specified more than once within a single slave service." However, I couldn't get it to work, and reading the source code verified that only one sni option is tracked per section. So, I present my patch to allow multiple sni options. It enables configurations like these: [https] ... [group1] sni = https:a.example.org sni = https:b.example.org ... [group2] sni = https:c.example.org sni = https:d.example.org ... If you have a naming scheme that doesn't lend itself to the wildcard matching already supported, this can cut your config size quite a bit. DETAILS The sni option for any section was originally tracked in the section->sni member (a string). Now, a linked-list of sni options is added to the section structure, with every sni option being appended to the end. For server setup, each slave section walks over its list, splitting each sni option and adding that slave section to the master's slave list. Splitting options and adding slaves to masters works as before, but now the slave section iterates over a list instead of referencing a single string. For client setup, each slave section checks that it has either no sni options, or exactly one. Multiple sni options results in an error. If exactly one option is found, it is copied to the old sni field of the section struct. The old sni field has been renamed to servername_to_request, as it is now used only in client mode, and this makes its purpose more clear. When no sni option is found, servername_to_request is initialized from the protocolHost or connect options, as before. I hope this patch is useful to others. Please let me know how I can make it acceptable for inclusing in the stunnel distribution. Thanks, David

1 0

Proxy HTTPS via stunnel without any certificates on proxy/stunnel box
by Gary Chodos 25 Sep '13

25 Sep '13

Greetings, We are trying to decide between SNIProxy and stunnel for the following task: - Client browser hits https://foo.bar.org, which resolves to an IP that corresponds to the stunnel machine listening on 443. - stunnel "forwards" (sorry if this is not the correct technical term) the connection to a different machine, specified by a different IP address, which is also configured to believe it is foo.bar.org and actually has a web server listening on 443 and houses the SSL key/cert. - when stunnel hits the end server, the latter sees the stunnel IP address as source, not the original user's (who initiated the web request for https://foo.bar.org). I believe this is default behavior, but just noting it for completeness. Is it possible to accomplish this (stunnel listening on and connecting to https endpoints) without housing any certs/keys on the stunnel machine itself, because we want the second server to deal with all that and we do not have access to those keys anyway. And of course, the users which go to the https://foo.bar.org should not see any cert mismatches as a result of loading https://foo.bar.org which, for the user, will resolve to the stunnel/proxy IP, rather than the end server which actually had a running web server and keys/cert. Sorry if the above detail is insufficient; do let me know. Thanks for your help. Gary

2 2

Port assignment in .conf file for local email client unique?
by Ben Stover 25 Sep '13

25 Sep '13

Assume I want to connect from my local email client to two (!) remote email servers The corresponding instructions in .conf file looks like (my guess): [smtps-firstacct] accept = 127.0.0.1:259 connect = smtps.myisp1.com:465 [smtps-secondacct] accept = 127.0.0.1:259 connect = smtps.myisp2.com:465 Questions: 1.) a configuration like above with the same "accept" port 259 is NOT possible because stunnel does not know to which remote email server he has to connect. To distinguish two different remote email server I always have to select TWO different accept-ports like [smtps-firstacct] accept = 127.0.0.1:259 connect = smtps.myisp1.com:465 [smtps-secondacct] accept = 127.0.0.1:258 connect = smtps.myisp2.com:465 Correct? 2.) Can I use arbitrary accept-ports like 1242 or 23199 or is there a port range from I have to select one? 3.) Moreover assume I want to make the SSL connection transparent can I select an accept-port 25? 4.) I read somewhere that I have always to specify in email client for POP3/SMTP an address 127.0.0.1:9999 and NOT 127.0.0.1:259 in order to connect to local stunnel service. Because local stunnel service is always listening on port 9999. Is this correct? Thank you Ben

2 2

One "client=yes" instruction per .conf file sufficient?
by Ben Stover 25 Sep '13

25 Sep '13

Is one client=yes instruction line per conf file enough? Does is mean all instructions in current .conf file belong to a client configuration or does it mean only the following command (=lines below) are intended for client usage? Ben

2 1

postgres protocol
by Robert Bernier 21 Sep '13

21 Sep '13

Hi, I've been looking at using stunnel connecting it directly to postgres. As per the man page, https://www.stunnel.org/static/stunnel.html, I was able to get postgres version 8.3 working. However, I've not suceeded using postgres version 9.2. Any insights would be appreciated. Thanks -- Robert Bernier PostgreSQL Business Intelligence Analyst robert7390(a)comcast.net http://www.linkedin.com/pub/robert-bernier/69/6a6/921 http://beknown.com/robert-bernier

1 0

Difference between verify=2, 3 and 4
by Nikolaus Rath 20 Sep '13

20 Sep '13

Hello, Thanks for writing stunnel, it looks like a great tool! I have, however, a really hard time understanding the difference between verify=2,3 and 4. In the manpage, I found verify = level verify peer certificate level 0 - request and ignore peer certificate level 1 - verify peer certificate if present level 2 - verify peer certificate level 3 - verify peer with locally installed certificate level 4 - ignore CA chain and only verify peer certificate default - no verify Levels 0-2 seem pretty clear cut, but then it becomes confusing for me. First, I do not understand how level 3 differs from level2. What does "against a locally installed certificate" mean? It seems to me that I certainly need to have a local copy of the trusted CAs even in level 2 -- at least I hope that they aren't somehow build in to stunnel. But there is also just one CApath option, so will that be used for level 2 or level 3? For level 4, the "ignore the CA chain" path is fine -- but where do I put the peer certificates that I'm willing to accept? CApath seems wrong, but cert is already used for the server's own certificate... Best, -Nikolaus -- »Time flies like an arrow, fruit flies like a Banana.« PGP fingerprint: 5B93 61F8 4EA2 E279 ABF6 02CF A9AD B7F8 AE4E 425C

6 13

Looking for a tech talk speaker on Secure Networking
by Chris Westin 16 Sep '13

16 Sep '13

I organize the speakers for the SF Bay Area Large-Scale Production Engineering meetup (http://www.meetup.com/SF-Bay-Area-Large-Scale-Production-Engineering/ ; take a look at the "PAST" tab to see the kinds of events we've had). For our event on Thursday October 17, 2013, I'm looking for speakers on the topic of "Secure Networking" (event: http://www.meetup.com/SF-Bay-Area-Large-Scale-Production-Engineering/events… ). As you can see from looking at our past events, I pick a topic, and then try to get 2-3 talks on that topic. Talks are usually 20-25 minutes long. This is a technical audience, and they don't appreciate a marketing pitch. They're eager to get into the nuts and bolts of the topic, including demos, code samples, and architecture. If you're going to be in the Bay Area then, and would be interested in giving a talk, please let me know here, or (preferably) through meetup.com. Thanks, Chris Westin

1 0

Re: [stunnel-users] IRC-Reconnect failed with "[10053] Software caused connection abort"(mIRC) and "SSL_connect: Peer suddenly disconnected"(tstunnel.exe)
by ralf29587＠gmx.de 13 Sep '13

13 Sep '13

Could some admin please remove my uploaded VCard and either my Name or my E-Mail-Adress shown on stunnel.org ?? Thanks a million!

1 0

stunnel accept a t3 connection?
by Scott Sikorski 10 Sep '13

10 Sep '13

I am curious if stunnel can support listening for an incoming t3 connection? I am having difficulty getting t3s to work between WebSphere and WebLogic for API calls and am curious if an alternative such as stunnel will work. I have stunnel installed betwen a client and the destination host, but the client doesn't seem to want to accept a t3://127.0.0.1:14010 connection but when I change this to http://127.0.0.1:14010 it works fine. Anything you can share would be appreciated. Mostly, if it will never work, that would be nice to know as to not spend more time troubleshooting. Best Regards, Scott Sikorski scottgsikorski(a)yahoo.com

2 1

Fullduplex in stunnel
by Krzysztof Kwiatkowski 07 Sep '13

07 Sep '13

Hi, I'm planning to use stunnel to do stress testing of my application. I decided to use stunnel because I've noticed that full-duplex has been added to version 3.2 (around 1999) and my application handles high throughput. AFAIK Stunnel uses openssl. Also I know that openssl doesn't handle fullduplex traffic very well. In fact without any tricks, half-duplex is most what I could get from openssl. As the full-duplex feature has been added to stunnel in 1999 (so long time ago) can you confirm that it is still there and full-duplex is still supported? If it is a case, how it is possible that stunnel handles fullduplex? Krzysztof Kwiatkowski

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users