<div dir="ltr">Hi Guys,<div><br></div><div>I've got a small issue where I'm trying to use multiple SNI rules in an STunnel frontend:</div><div><br></div><div>STunnel Version is:</div><div><div>stunnel -version</div><div>stunnel 5.11 on x86_64-unknown-linux-gnu platform</div><div>Compiled/running with OpenSSL 1.0.1e 11 Feb 2013</div><div>Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI</div><div><br></div><div>Global options:</div><div>debug = daemon.notice</div><div>RNDbytes = 64</div><div>RNDfile = /dev/urandom</div><div>RNDoverwrite = yes</div><div><br></div><div>Service-level options:</div><div>ciphers = FIPS (with "fips = yes")</div><div>ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no")</div><div>curve = prime256v1</div><div>options = NO_SSLv2</div><div>options = NO_SSLv3</div><div>sessionCacheSize = 1000</div><div>sessionCacheTimeout = 300 seconds</div><div>stack = 65536 bytes</div><div>TIMEOUTbusy = 300 seconds</div><div>TIMEOUTclose = 60 seconds</div><div>TIMEOUTconnect = 10 seconds</div><div>TIMEOUTidle = 43200 seconds</div><div>verify = none</div><div><br></div><div><br></div><div>stunnel.conf is:</div><div><div>[https]</div><div>accept = 443</div><div>connect = 80</div><div>[www_test]</div><div> sni = https:<a href="http://test.com">test.com</a><br></div><div> sni = https:<a href="http://www.test.com">www.test.com</a><br></div><div> connect = <a href="http://192.168.64.220:80">192.168.64.220:80</a></div><div><br></div><div>[testing]</div><div> sni = https:<a href="http://testing.com">testing.com</a></div><div> sni = https:<a href="http://www.testing.com">www.testing.com</a></div><div> connect = <a href="http://192.168.64.253:80">192.168.64.253:80</a></div></div><div><br></div><div><br></div><div>I've created local DNS rules for each of these Hosts but the problem is that only the last entered sni rule gets matched so for example <a href="http://www.test.com">www.test.com</a> works but <a href="http://test.com">test.com</a> does not. Its the same for <a href="http://testing.com">testing.com</a> and <a href="http://www.testing.com">www.testing.com</a></div><div><br></div><div><br></div><div>This is what the log file show too:</div><div><br></div><div><div>2015.03.03 20:01:19 LOG7[12776]: Service [https] accepted (FD=21) from <a href="http://192.168.63.50:53123">192.168.63.50:53123</a></div><div>2015.03.03 20:01:19 LOG7[12808]: Service [https] started</div><div>2015.03.03 20:01:19 LOG5[12808]: Service [https] accepted connection from <a href="http://192.168.63.50:53123">192.168.63.50:53123</a></div><div>2015.03.03 20:01:19 LOG7[12808]: SSL state (accept): before/accept initialization</div><div>2015.03.03 20:01:19 LOG6[12808]: SNI: requested servername: <a href="http://testing.com">testing.com</a></div><div>2015.03.03 20:01:19 LOG3[12808]: SNI: no pattern matched servername: <a href="http://testing.com">testing.com</a></div><div>2015.03.03 20:01:19 LOG7[12808]: SSL alert (write): fatal: unrecognized name</div><div>2015.03.03 20:01:19 LOG3[12808]: SSL_accept: 1408A0E2: error:1408A0E2:SSL routines:SSL3_GET_CLIENT_HELLO:clienthello tlsext</div><div>2015.03.03 20:01:19 LOG5[12808]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket</div><div>2015.03.03 20:01:19 LOG7[12808]: Local socket (FD=21) closed</div><div>2015.03.03 20:01:19 LOG7[12808]: Service [https] finished (7 left)</div><div>2015.03.03 20:01:29 LOG6[12805]: Read socket closed (readsocket)</div><div>2015.03.03 20:01:29 LOG7[12805]: Sending close_notify alert</div><div>2015.03.03 20:01:29 LOG7[12805]: SSL alert (write): warning: close notify</div><div>2015.03.03 20:01:29 LOG6[12805]: SSL_shutdown successfully sent close_notify alert</div><div>2015.03.03 20:01:30 LOG6[12805]: SSL socket closed (SSL_read)</div><div>2015.03.03 20:01:30 LOG7[12805]: Sent socket write shutdown</div><div>2015.03.03 20:01:30 LOG5[12805]: Connection closed: 485 byte(s) sent to SSL, 642 byte(s) sent to socket</div><div>2015.03.03 20:01:30 LOG7[12805]: Remote socket (FD=14) closed</div><div>2015.03.03 20:01:30 LOG7[12805]: Local socket (FD=13) closed</div><div>2015.03.03 20:01:30 LOG7[12805]: Service [www_test] finished (6 left)</div><div>2015.03.03 20:01:49 LOG7[12776]: Service [https] accepted (FD=13) from <a href="http://192.168.63.50:53128">192.168.63.50:53128</a></div><div>2015.03.03 20:01:49 LOG7[12809]: Service [https] started</div><div>2015.03.03 20:01:49 LOG5[12809]: Service [https] accepted connection from <a href="http://192.168.63.50:53128">192.168.63.50:53128</a></div><div>2015.03.03 20:01:49 LOG7[12809]: SSL state (accept): before/accept initialization</div><div>2015.03.03 20:01:49 LOG6[12809]: SNI: requested servername: <a href="http://testing.com">testing.com</a></div><div>2015.03.03 20:01:49 LOG3[12809]: SNI: no pattern matched servername: <a href="http://testing.com">testing.com</a></div><div>2015.03.03 20:01:49 LOG7[12809]: SSL alert (write): fatal: unrecognized name</div><div>2015.03.03 20:01:49 LOG3[12809]: SSL_accept: 1408A0E2: error:1408A0E2:SSL routines:SSL3_GET_CLIENT_HELLO:clienthello tlsext</div><div>2015.03.03 20:01:49 LOG5[12809]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket</div><div>2015.03.03 20:01:49 LOG7[12809]: Local socket (FD=13) closed</div><div>2015.03.03 20:01:49 LOG7[12809]: Service [https] finished (6 left)</div></div><div><br></div><div>I have seen a couple of patch files floating around but they are for older versions and I can't get them to compile into the v5.11 version.</div><div><br></div><div>Any thoughts?</div><div><br></div><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr">With Kind Regards.<br><br>Scott McKeown<br>Loadbalancer.org<br><a href="http://www.loadbalancer.org" target="_blank">http://www.loadbalancer.org</a><br><div>Tel (UK) - +44 (<span style="font-family:arial;font-size:small">0) 3303801064 (24x7)</span></div><div><span style="font-family:arial;font-size:small">Tel (US) - +1 888.867.9504 (Toll Free)(24x7)</span></div></div></div>
</div></div>