[stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?

Mon May 13 18:07:57 CEST 2019

I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below.

Stunnel client   --connect-->    Stunnel server
pppd client       --connect-->    pppd server
10.0.1.2             <--data-->     10.0.1.1

OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started.

So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection.

Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this?

Any suggestions highly appreciated.

# ps -axu | grep pppd
user 43231 0.0  0.0   476 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd)
user 39187 0.0  0.0   468 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd)

# tail -n 10 /var/log/daemon
pppd[39187] pppd 2.3.5 started by user, uid 0
pppd[43231] Using interface ppp1
pppd[43231] Connect: ppp0 <--> /dev/ttyp2
pppd[43231] Local IP address 10.0.1.1
pppd[43231] Remote IP address 10.0.1.2
pppd[39187] pppd 2.3.5 started by user, uid 0
pppd[39187] Using interface ppp0
pppd[39187] Connect: ppp0 <--> /dev/ttyp5
pppd[39187] Couldn't set interface address: Address 10.0.1.1 or destination 10.0.1.2 already exists

Stunnel configurations for server and client:

1. Server's configuration
...
foreground = yes
debug = 7

socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;socket = l:SO_LINGER=1:60

; Session cache
sessionCacheSize = 100
sessionCacheTimeout = 600

stack = 65536

TIMEOUTbusy = 600
TIMEOUTconnect = 10
TIMEOUTidle = 43200
TIMEOUTclose = 5

[ppp]
accept = LOCAL-IP:PORT
exec = /usr/sbin/pppd
execargs = lock 10.0.1.1:10.0.1.2 local debug noauth
;execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth
pty = yes
CAfile = ca.crt
cert = server.crt
key = server.key
verifyChain = yes

2. Stunnel client's configuration
...
foreground = yes
debug = 7

socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

; Session cache
sessionCacheSize = 1
sessionCacheTimeout = 600

failover = rr

[ppp]
client = yes
retry = yes
connect = REMOTE-IP:PORT
exec = /usr/sbin/pppd
execargs = defaultroute persist lock passive 10.0.1.2:10.0.1.1 local debug noauth name ppp-client
pty = yes
CAfile = ca.crt
cert = client.crt
key = client.key
verifyChain = yes
checkHost = REMOTE-HOSTNAME
;checkIP = 1.2.3.4
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.stunnel.org/pipermail/stunnel-users/attachments/20190513/5b2b74ec/attachment.html>