- stunnel-users - stunnel.org

using ECDH with stunnel
by Carl 11 Feb '10

11 Feb '10

Is is possible to use ECDH with stunnel? When using s_server and specifying the cipher I can establish a connection. But when using stunnel and specifing the same cipher, the connection is rejected with "no shared cipher". e.g. openssl s_server -cert server.pem -cipher DHE-RSA-AES256-SHA It appears the difference is that s_server uses "default temp ECDH parameters" while stunnel doesn't have a default nor is there a way to specify the ECDH parameters. >From what I understand the ECDH parameters cannot be included with the certificate, unlike DH parameters. Is my understanding correct? Thanks, Carl

2 2

SSL connection through Proxy server with authentication
by Girish Kolari 09 Feb '10

09 Feb '10

Hi I am trying to create a SSL connection through Proxy server with authentication. my stunnel.conf file ----- part of the conf file connect = <Proxy server IP: Port number> protocol=connect protocolHost=<Destination server:Port number> protocolUsername = useme protocolPassword = test ----- but it fails to establish connection. Log details: ----- part of log generated 2010.02.09 16:07:49 LOG5[14506:2952859648]: Negotiations for connect (client side) started 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> CONNECT <Destination server:Port number> HTTP/1.1 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Host: 6<Destination server:Port number> 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Proxy-Authorization: basic dXNlbWU6dGVzdA== 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> 2010.02.09 16:07:49 LOG3[14506:2952859648]: Unexpected socket close (fdgetline) 2010.02.09 16:07:49 LOG5[14506:2952859648]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.02.09 16:07:49 LOG7[14506:2952859648]: Service IDrive finished (0 left) ----- I tried with proxy server without authentication it works great, but not sure why Proxy server with authentication is not working. Is it I am missing some thing or am I doing something wrong? I appreciate all suggestion and help on this. Thanks & Regards Girish Kolari

1 0

Stunnel and multiple endpoints.
by Richard Harvey 08 Feb '10

08 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi guys, I'm new to stunnel and I'm looking for a way to run stunnel on a single port. Then based on the client certificate, proxy that connection (in clear) to a different IP:port. If this something I can do with stunnel or am i barking up the wrong tree so to speak. Any help would be a appreciated guys. Cheers Ric - -- Richard Harvey European Linux Administrator Core Systems Ticketmaster +44 (0)207 9804328 80228 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAktv5ZIACgkQlh7dZJ0PyjcfxQCfWA5PO0d/uDf/Mqq2BrFsu5wf xBYAoKmKW8760P91JR3oeviKwjd/1o/A =o+/U -----END PGP SIGNATURE-----

3 5

Re: [stunnel-users] Memory problems
by Peter Griffin 05 Feb '10

05 Feb '10

A portion of the messages in /var/log/stunnel.log before I disabled logging as I thought it would help: 2010.02.04 22:46:28 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:32 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:55 LOG3[1615:140132734469904]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:46:57 LOG3[1615:140132734400272]: SSL_read: Connection reset by peer (104) 2010.02.04 22:47:12 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:47:35 LOG3[1615:140132735235856]: SSL_read: Connection reset by peer (104) 2010.02.04 22:48:08 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:23 LOG3[1615:140132735235856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:42 LOG3[1615:140132733982480]: transfer() loop executes not transferring any data 2010.02.04 22:48:42 LOG3[1615:140132733982480]: please report the problem to Michal.Trojnara(a)mirt.net 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket open: rd=yes wr=no, ssl open: rd=no wr=yes 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: wants: SSL_read rd=no wr=no, SSL_write rd=no wr=yes, SSL_shutdown rd=no wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket input buffer: 16384 byte(s), ssl input buffer: 0 byte(s) 2010.02.04 22:48:42 LOG3[1615:140132733982480]: check_SSL_pending=0 2010.02.04 22:48:52 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:56 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:01 LOG3[1615:140132734330640]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:03 LOG3[1615:140132734400272]: SSL socket closed on SSL_read with 7294 byte(s) in buffer 2010.02.04 22:49:05 LOG3[1615:140132734469904]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:16 LOG3[1615:140132721108752]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:26 LOG3[1615:140132733982480]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:28 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:34 LOG3[1615:140132733982480]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:49:35 LOG3[1615:140132720899856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:35 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected

1 0

Does stunnel support IPv6, and proxying from IPv4 to IPv6?
by Jeff Schmidt 05 Feb '10

05 Feb '10

Hello, I was wondering, does stunnel have IPv6 support? If so, does such support extend to the point of allowing the 'local' side of the connection (e.g. from a server process, or from a client application) to be made with IPv4, while the 'global' side is IPv6? If so, is it possible to use stunnel in an unencrypting mode (that is, not encrypting the data with SSL, but just using stunnel to proxy traffic between IPv4 and IPv6)? The reason I ask is that I am looking for a solution to allow me to IPv6-enable 'legacy' IPv4 applications. When I started thinking about this problem, I almost immediately remembered using stunnel in the past to SSL-enable IPv4 applications which didn't have built-in SSL support, and it occured to me that there was a lot of similarity between the non-SSL application problem, and the non-IPv6 application problem - that is, it seems like possibly, you could setup a sort of IPv6 tunnel using stunnel (or something similar), where the legacy application makes an local IPv4 connection to the stunnel/proxy software, and the proxy then makes an IPv6 connection, just like stunnel accepts local IPv4 connections (unecrypted) and then creates a second, proxied connection which is encrypted. Does that make any sense? (I hope so). So, can stunnel be used with both IPv4 and IPv6 simultaneously?

1 0

Memory problems
by Peter Griffin 05 Feb '10

05 Feb '10

Hi, I'm using stunnel 4.22 with OpenSSL 0.9.7m - I am using 4.22 because of the xforwarded-for patch and 4.27 is not supported. I am running stunnel in standalone mode on a P4 3.2Ghz with 1Gb of Ram. When I start haproxy & stunnel after a reboot, free memory starts at about 750Mb then slowly degrades to about 45Mb. After 8 more hours or so of operation our site was completely unbrowsable. I checked our firewall for unusual traffic, and there were none. Running top does not indicate any processes which are consuming all that memory and that is what I find weid. Only a reboot frees up the memory. Should I be running stunnel on more Ram? stunnel -v output: [root@lb1 ~]# stunnel -version stunnel 4.22 on x86_64-unknown-linux-gnu with OpenSSL 0.9.7m 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none stunnel.conf: #setuid=stunnel #setgid=proxy #debug = 3 #output = /var/log/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=10.0.1.50:443 connect=10.0.1.50:80 TIMEOUTclose=0 xforwardedfor=yes

1 0

HTTP Connect proxy patch
by Dmitry Gromov 05 Feb '10

05 Feb '10

Hi! It seems like the latest patch to support HTTP Connect proxy is for 4.05 version. Any one knows if it is compatible with the latest version? If not, is there more recent version of the patch? I also wonder why this never made to the code... Seems like a very useful feature. Thanks, Dmitry -- DG NJ

2 4

after 4.31 no more logging to syslog
by Axel Reinhold 05 Feb '10

05 Feb '10

> > with stunnel up to 4.29 i got syslog messages to /var/log/maillog. > > with stunnel 4.30 the startup was broken - some chroot-issues, > > with your patches i could get it running - with 4.31 stunnel is > > working for me but i don't get any syslogging any more - is there > > a way to get the old behaviour again? > > Please test: > ftp://stunnel.mirt.net/stunnel/stunnel-4.32b1.tar.gz > and let us know if it works for you. > > Best regards, > Mike > Dear Mike, looks very good - works for me 100%. Thanks. Cheers Axel

1 0

after 4.31 no more logging to syslog
by Axel Reinhold 04 Feb '10

04 Feb '10

with stunnel up to 4.29 i got syslog messages to /var/log/maillog. with stunnel 4.30 the startup was broken - some chroot-issues, with your patches i could get it running - with 4.31 stunnel is working for me but i don't get any syslogging any more - is there a way to get the old behaviour again? root@bongo opt]# grep stunnel /var/log/maillog Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.8l 5 Nov 2009 Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: file ulimit = 1024 (can be changed with 'ulimit -n') Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: poll() used - no FD_SETSIZE limit for file descriptors Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: 500 clients allowed Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 9 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 10 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 11 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: imaps bound to 0.0.0.0:993 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 12 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: pop3s bound to 0.0.0.0:995 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 13 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: arcorpop3 bound to 127.0.0.1:3003 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 14 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: bnvhpop3 bound to 127.0.0.1:3004 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 15 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: netidpop3 bound to 127.0.0.1:3005 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 16 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: icybolt bound to 127.0.0.1:3006 Jan 27 21:38:25 bongo stunnel: LOG7[31991:16384]: Created pid file /var/run/stunnel.pid Axel

2 1

Stunnel 4.31 released
by Michal Trojnara 03 Feb '10

03 Feb '10

The ChangeLog entry: Version 4.31, 2010.02.03, urgency: MEDIUM: * New features - Log file reopen on USR1 signal was added. * Bugfixes - Some regression issues introduced in 4.30 were fixed. SHA-1 value for stunnel-4.31.tar.gz: f51fc544a0554f6eee2bfca1fcb8ddcb8386ce32 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0