- stunnel-users - stunnel.org

Re: unexpected shutdown of stunnel
by Paul Dekkers 18 May '05

18 May '05

Hi, For what it's worth: >I use Freebsd and made an update from stunnel 4.8 to stunnel 4.10 from >the ports today. Now I noticed that stunnel stops after a while. > > I experienced the same, only my configuration ran in server- instead of client-mode. The only thing that I did while building the port was using -DWITH_IPV6, but I assume that shouldn't be a problem. >And these are the last lines of the log:005.05.15 10:34:00 > > I used debug = 5, and I didn't see anything usefull in the logs. I'm glad someone has the same problem and has better logging then I have ;-) The last log line was the incoming session, that's it. >Everything went fine with 4.8, now stunnel is not running anymore after >a short period of time (few minutes). > > I'm back to the 4.7 we had previously. We're using this in production, so I couldn't really experiment much with the 4.10. Regards, Paul

1 0

CN field of server cert
by spambox＠poczta.onet.pl 16 May '05

16 May '05

Hi stunnel-users, There is example configuration:  I don't know how to enforce stunnel to verify CN field from server provided certificate. Even if i change "connect" field to next one stunnel will not complain. So, am I wrong that when someone hijack (mitm) this connection and provide any server cert signed by ThawteServerCA then I loose? Please add this verification to stunnel when verify is set to 2 or better as an separate option "verify_cn?" which could be used in service-level context. Usting this option with that described below I can drop 'verify' and 'CAfile' at all and feel much better. :) There is another verification method that could be added - not related to verify option. In most cases I know public cert of remote server. So I also know sha1/md5 fingerprint of that cert. Security could improve v.much by just adding these lines to my example configuration: fingerprint_md5=F5:BD:C3:C8:D5:4B:03:EA:57:BB:81:72:46:6B:26:54 fingerprint_sha1=CE:3A:0D:3E:DA:4B:77:A3:53:C0:9E:A8:65:B7:F8:C2:09:71:43:41 Another good service-level option? There are some other good options that could be ported from openssl/s_client: "-ssl2, -ssl3, -tls1, -no_ssl2, -no_ssl3, -no_tls1" Regards.

3 3

unexpected shutdown of stunnel
by Daniel Graupner 15 May '05

15 May '05

Hello, I use Freebsd and made an update from stunnel 4.8 to stunnel 4.10 from the ports today. Now I noticed that stunnel stops after a while. Here is my conf: chroot = /usr/local/stunnel pid = /stunnel.pid setuid = stunnel setgid = stunnel debug = 7 output = /usr/local/stunnel/stunnel.log client = yes [https] accept = localhost:9999 connect = <ssl-apache>:443 TIMEOUTclose = 0 And these are the last lines of the log:005.05.15 10:34:00 LOG7[60990:0]: Waiting 0 second(s) for 3 file descriptor(s) 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 3, FD=8, (INOUT)->(OUT) 2005.05.15 10:34:00 LOG7[60990:3]: SSL alert (write): warning: close notify 2005.05.15 10:34:00 LOG7[60990:3]: SSL_shutdown retrying 2005.05.15 10:34:00 LOG7[60990:3]: SSL doesn't need to read or write 2005.05.15 10:34:00 LOG7[60990:0]: Waiting 0 second(s) for 3 file descriptor(s) 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=4, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 1, FD=6, (IN)->() 2005.05.15 10:34:00 LOG7[60990:0]: CONTEXT 3, FD=8, (IN)->(IN) 2005.05.15 10:34:00 LOG7[60990:3]: SSL alert (read): warning: close notify 2005.05.15 10:34:00 LOG7[60990:3]: SSL closed on SSL_read 2005.05.15 10:34:00 LOG7[60990:3]: Socket write shutdown 2005.05.15 10:34:00 LOG5[60990:3]: Connection closed: 197 bytes sent to SSL, 784 bytes sent to socket 2005.05.15 10:34:00 LOG7[60990:3]: https finished (0 left) 2005.05.15 10:34:00 LOG7[60990:3]: removing pid file /stunnel.pid Everything went fine with 4.8, now stunnel is not running anymore after a short period of time (few minutes). Regards, Daniel.

1 0

Problems with stunnel 4.10 compilation
by Oleg Ivanov 14 May '05

14 May '05

Hello. I've compiled stunnel 4.10 without any problems on my Gentoo workstation and RedHat server. But now I need to install it into my old legacy Mandrake 8.2 server and here I've got into troubles. I've updated zlib and openssl (configuring it with "zlib" option) to their latest versions, then tried to make stunnel and got following errors: --- /usr/lib/libcrypto.a(c_zlib.o): In function `zlib_compress_block': c_zlib.o(.text+0x48): undefined reference to `compress' /usr/lib/libcrypto.a(c_zlib.o): In function `zz_uncompress': c_zlib.o(.text+0x145): undefined reference to `inflateInit_' c_zlib.o(.text+0x159): undefined reference to `inflate' c_zlib.o(.text+0x16c): undefined reference to `inflateEnd' c_zlib.o(.text+0x18b): undefined reference to `inflateEnd' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make: *** [all-recursive] Error 1 --- It seems like problems with zlib so I've double-checked it - but zlib 1.2.2 is really installed. If I recompile openssl without "zlib" option then I can make stunnel but it can't initialize zlib compression algorithm that I really need. And if I compile openssl with zlib - stunnel fails on make with errors. Can anyone help with it please? I really stuck 8( PS: My system's parameters according to support page requirements: # uname -a Linux localhost 2.4.27-vs1.29 #2 SMP Tue Oct 5 15:51:37 CDT 2004 i686 unknown glibc version: 2.2.4 # gcc -v Reading specs from /usr/lib/gcc-lib/i586-mandrake-linux-gnu/2.96/specs gcc version 2.96 20000731 (Mandrake Linux 8.2 2.96-0.76mdk) # openssl version OpenSSL 0.9.7g 11 Apr 2005 Best Regards, Oleg Ivanov. -- Oleg Ivanov mailto: saruman(a)unigsm.com

1 1

Connection details patch for 4.10
by Oleg Ivanov 14 May '05

14 May '05

Hello. I've modified the old "conndetails_peter" patch by Peter D. Gray to let it work with stunnel 4.10. I've also added to it information about compression (available compression methods and negotiated method). Patch creates a file "conn.LOCAL_HOST:LOCAL_PORT" in a configurable temp directory (config file: "infodir" option). The file is deleted when the client disconnects. Full description of original can be found at: http://www.stunnel.org/patches/desc/conndetails_peter.html Hope it will be useful for someone. Best Regards, Oleg Ivanov. -- Oleg Ivanov mailto: saruman(a)unigsm.com diff -cr ../stunnel-4.10.orig/src/client.c src/client.c *** ../stunnel-4.10.orig/src/client.c 2005-05-13 00:43:24.000000000 -0200 --- src/client.c 2005-05-13 01:34:36.000000000 -0200 *************** *** 94,99 **** --- 94,114 ---- c->opt=opt; c->local_rfd.fd=rfd; c->local_wfd.fd=wfd; + + if(options.info_dir) { + sprintf(c->info_fname, "%s/pid.%d", options.info_dir, getpid()); + c->info_file = fopen(c->info_fname, "w"); + if(!c->info_file) { + s_log(LOG_ERR, "failed to create: %s (continuing)", c->info_fname); + c->info_fname[0] = 0; + } else { + s_log(LOG_DEBUG, "connection detail to be written to: %s", + c->info_fname); + fprintf(c->info_file, "# connection details\n" + "STUNNEL_PID=%d\n", getpid()); + } + } + return c; } *************** *** 203,208 **** --- 218,228 ---- s_log(LOG_NOTICE, "%s connected from %s", c->opt->servname, c->accepting_address); } + if(c->info_file) { + fprintf(c->info_file, "SERVICE=\"%s\"\n", c->opt->servname); + fprintf(c->info_file, "REMOTE_HOST=\"%s\"\nREMOTE_PORT=%d\n", + c->accepting_address, ntohs(c->peer_addr.addr[0].in.sin_port)); + } return 0; /* OK */ } *************** *** 237,242 **** --- 257,289 ---- } #endif s_log(LOG_DEBUG, "Remote FD=%d initialized", fd); + if(c->info_file) { + struct sockaddr_in addr; + int addrlen = sizeof(addr); + if(getsockname(fd, (struct sockaddr *)&addr, &addrlen)) { + // ignore error + } else { + char newname[STRLEN]; + + /* record our end of the tunnel, and change name of file to match */ + enter_critical_section(CRIT_NTOA); /* inet_ntoa is not mt-safe */ + fprintf(c->info_file, "LOCAL_HOST=\"%s\"\nLOCAL_PORT=%d\n", + inet_ntoa(addr.sin_addr), ntohs(addr.sin_port)); + sprintf(newname, "%s/conn.%s:%d", + options.info_dir, + inet_ntoa(addr.sin_addr), ntohs(addr.sin_port)); + leave_critical_section(CRIT_NTOA); + + /* done with file, close it now */ + fprintf(c->info_file, "# EOF\n"); + fclose(c->info_file); + c->info_file = NULL; + + /* rename so it's easy for the client to find */ + rename(c->info_fname, newname); + strcpy(c->info_fname, newname); + } + } c->remote_fd.fd=fd; c->remote_fd.is_socket=1; /* Always! */ if(set_socket_options(fd, 2)<0) *************** *** 674,679 **** --- 721,737 ---- reset(c->local_wfd.fd, "linger (local_wfd)"); } } + /* Cleanup connection info file which isn't useful anymore */ + if(options.info_dir) { + if(c->info_file) { + fclose(c->info_file); + c->info_file = NULL; + } + if(c->info_fname) { + unlink(c->info_fname); /* ignore errors */ + s_log(LOG_INFO, "removed info file: %s", c->info_fname); + } + } } static void print_cipher(CLI *c) { /* print negotiated cipher */ *************** *** 683,689 **** #else SSL_CIPHER *cipher; char buf[STRLEN]; ! int len; cipher=SSL_get_current_cipher(c->ssl); SSL_CIPHER_description(cipher, buf, STRLEN); --- 741,748 ---- #else SSL_CIPHER *cipher; char buf[STRLEN]; ! int len, cnt; ! SSL_COMP *comp=NULL; cipher=SSL_get_current_cipher(c->ssl); SSL_CIPHER_description(cipher, buf, STRLEN); *************** *** 691,696 **** --- 750,809 ---- if(len>0) buf[len-1]='\0'; s_log(LOG_INFO, "Negotiated ciphers: %s", buf); + + if(c->info_file) { + X509 *peer; + + fprintf(c->info_file, "CIPHER_DESC=\"%s\"\n", buf); + fprintf(c->info_file, "CIPHER_ALGO=\"%s\"\n", + SSL_CIPHER_get_name(cipher)); + fprintf(c->info_file, "CIPHER_BITS=%d\n", + SSL_CIPHER_get_bits(cipher, NULL)); + // Show compression info + if (c->ssl->ctx->comp_methods == NULL) { + // No compression methods available + fprintf(c->info_file, "No compression methods available\n"); + } else { + int cntMethods = sk_SSL_COMP_num(c->ssl->ctx->comp_methods); + fprintf(c->info_file, "%d compression method(s) available:\n", cntMethods); + for (cnt=0; cnt<cntMethods; cnt++) { + comp=sk_SSL_COMP_value(c->ssl->ctx->comp_methods, cnt); + fprintf(c->info_file, "%d\t%s ", comp->id, comp->name); + switch (comp->id) { + case 0xe0: + fprintf(c->info_file, "(zlib)\n"); break; + case 0xe1: + fprintf(c->info_file, "(rle)\n"); break; + default: + fprintf(c->info_file, "(unknown)\n"); break; + } + } + } + if (c->ssl->s3->tmp.new_compression == NULL) { + fprintf(c->info_file, "SSL_COMP=NULL\n"); + } else { + fprintf(c->info_file, "SSL_COMP.id=%d ", + c->ssl->s3->tmp.new_compression->id); + switch (comp->id) { + case 0xe0: + fprintf(c->info_file, "(zlib)\n"); break; + case 0xe1: + fprintf(c->info_file, "(rle)\n"); break; + default: + fprintf(c->info_file, "(unknown)\n"); break; + } + } + peer = SSL_get_peer_certificate(c->ssl); + if(peer) { + X509_NAME_oneline(X509_get_subject_name(peer), buf, STRLEN); + fprintf(c->info_file, "SSL_CLIENT_DN=\"%s\"\n", buf); + + X509_NAME_oneline(X509_get_issuer_name(peer), buf, STRLEN); + fprintf(c->info_file, "SSL_CLIENT_I_DN=\"%s\"\n", buf); + + X509_free(peer); + } + } #endif } *************** *** 953,958 **** --- 1066,1075 ---- s_ntop(c->connecting_address, &addr); s_log(LOG_DEBUG, "%s connecting %s", c->opt->servname, c->connecting_address); + if(c->info_file) { + fprintf(c->info_file, "TUNNEL_HOST=\"%s\"\nTUNNEL_PORT=%d\n", + c->connecting_address, ntohs(addr.in.sin_port)); + } if(!connect(s, &addr.sa, addr_len(addr))) return s; /* no error -> success (should not be possible) */ error=get_last_socket_error(); Only in src: client.c.orig Only in src: client.c~ diff -cr ../stunnel-4.10.orig/src/options.c src/options.c *** ../stunnel-4.10.orig/src/options.c 2005-05-13 00:43:24.000000000 -0200 --- src/options.c 2005-05-13 00:44:16.000000000 -0200 *************** *** 664,669 **** --- 664,693 ---- break; } + /* infodir */ + switch(cmd) { + case CMD_INIT: + options.info_dir=NULL; + break; + case CMD_EXEC: + if(strcasecmp(opt, "infodir")) + break; + if(arg[0]) { /* not empty */ + if(strlen(arg) > STRLEN - 20) return "infodir pathname too long"; + options.info_dir=stralloc(arg); + } else { + options.info_dir=NULL; + } + return NULL; /* OK */ + case CMD_DEFAULT: + break; + case CMD_HELP: + log_raw("%-15s = writable directory to store connection info into", + "infodir"); + break; + } + + if(cmd==CMD_EXEC) return option_not_found; return NULL; /* OK */ diff -cr ../stunnel-4.10.orig/src/prototypes.h src/prototypes.h *** ../stunnel-4.10.orig/src/prototypes.h 2005-05-13 00:43:24.000000000 -0200 --- src/prototypes.h 2005-05-13 00:47:03.000000000 -0200 *************** *** 113,118 **** --- 113,119 ---- int verify_level; int verify_use_only_my; long ssl_options; + char *info_dir; /* directory for connection info */ /* some global data for stunnel.c */ #ifndef USE_WIN32 *************** *** 264,269 **** --- 265,272 ---- FD *ssl_rfd, *ssl_wfd; /* Read and write SSL descriptors */ int sock_bytes, ssl_bytes; /* Bytes written to socket and ssl */ s_poll_set fds; /* File descriptors */ + FILE *info_file; /* text file with connection information */ + char info_fname[STRLEN]; /* file name (full path) for info_file */ } CLI; extern int max_clients; *************** *** 305,311 **** /**************************************** Prototypes for sthreads.c */ typedef enum { ! CRIT_KEYGEN, CRIT_INET, CRIT_CLIENTS, CRIT_WIN_LOG, CRIT_SESSION, CRIT_SECTIONS } SECTION_CODE; --- 308,314 ---- /**************************************** Prototypes for sthreads.c */ typedef enum { ! CRIT_KEYGEN, CRIT_INET, CRIT_CLIENTS, CRIT_WIN_LOG, CRIT_SESSION, CRIT_NTOA, CRIT_SECTIONS } SECTION_CODE;

1 0

syslog on Solaris2.9
by Geoff LeBoldus 13 May '05

13 May '05

I can't seem to get stunnel-4.10 to log properly to syslog. Stunnel logs the startup, but doesn't log any individual tunnel information. If I specify its own file and debug = 7, it logs everything as expected. I've tried a number of different configuration combinations without success. Any thoughts? Here's my current config snippets - stunnel.conf debug = local0.debug -syslog.conf local0.debug /var/log/syslog Stunnel startup from /var/log/syslog May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] stunnel 4.10 on sparc-sun-solaris2.9 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] stunnel 4.10 on sparc-sun-solaris2.9 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Snagged 64 random bytes from /home/geoff/.rnd May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Wrote 1024 new random bytes to /home/geoff/.rnd May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] RAND_status claims sufficient entropy for the PRNG May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.info] PRNG seeded successfully May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Certificate: /opt/local/etc/stunnel/stunnel.pem May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] Key file: /opt/local/etc/stunnel/stunnel.pem May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.info] file ulimit = 1024 (can be changed with 'ulimit -n') May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.info] poll() used - no FD_SETSIZE limit for file descriptors May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] 500 clients allowed May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.notice] 500 clients allowed May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] FD 5 in non-blocking mode May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] FD 6 in non-blocking mode May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] FD 7 in non-blocking mode May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] SO_REUSEADDR option set on accept socket May 13 15:31:31 server_name stunnel[4576]: [ID 702911 local0.debug] ldaps bound to 0.0.0.0:1212 May 13 15:31:31 server_name stunnel[4577]: [ID 702911 local0.debug] Created pid file /stunnel.pid May 13 15:31:31 server_name stunnel[4577]: [ID 702911 local0.debug] Waiting -1 second(s) for 2 file descriptor(s) -- Geoff LeBoldus Systems Programmer Information Technology Services

1 0

Session Reuse Information for Stunnel
by vasudha.upadhyaya＠convergys.com 11 May '05

11 May '05

I know that Stunnel reuses sessions. Can anyone tell me the default time that stunnel reuses the old session. And to set a value for session timeout do I use the option: session = timeout session cache timeout Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

2 1

zlib compression
by Oleg Ivanov 09 May '05

09 May '05

Hello. I have installed stunnel 4.09 both as client (on my computer) and as server (on server). Both has zlib compression enabled and I can see that zlib initializes properly in the logs (it says "Compression enabled using zlib method"). But when I send any data over that tunnel I can't see any signs of compression - amount of traffic is almost the same as over plain connection. Am I doing something wrong? Or I'm misunderstanding the purpose of this compression ability? And if the traffic indeed must be reduced - why I can't see that and how can I make it work properly? Thank you for your answers. Best Regards, Oleg Ivanov. -- Oleg Ivanov mailto: saruman(a)unigsm.com

2 2

connect ip = accept ip on multihomed server ?
by Dennis Spreen 09 May '05

09 May '05

hi all, with a configuration (stunnel4.10) like this [conc1] accept = 100 connect = 99 stunnel accepts all requests on all ips on port 100 but connects with the localhost to port 99. is it possible to configure stunnel that if it accepts a connection on 1.2.3.4:100 it connects to 1.2.3.4:99 ? I know it is possible to use accept = 1.2.3.4:100 connect = 1.2.3.4:99 .... accept = 1.2.3.250:100 connect = 1.2.3.250:99 but i'm on a c-class and that would require about 250 entries in the config file. Is there a better way to do this? regards dennis

1 0

Problems in Stunnel4.10
by vasudha.upadhyaya＠convergys.com 06 May '05

06 May '05

Hi, We have been using stunnel 4.05 and recently downloded the stunnel 4.10 and deployed in our environmrnt. All the traffice is going via the Load Balancer Cisco CSS with SSL Module to the unix server(with stunnel4.10 on them). We also 4.10 deployed on the Windows2000 as a client. The CSS sends keep Alives to check the health of the servers(whether they are up or not).And I guess due to this the stunnel on unix servers crashes immediately and there is a access violation error. Attached is the truss output for one of the unix servers.Stunnel4.10 was compiled using OpenSSL0.97d and OpenSSL0.97g, and still we get the same problem.Attached is the stunnel.conf also.[attachment "stunnel.conf" deleted by Vasudha Upadhyaya/CCMG/CVG] (See attached file: truss.out) (See attached file: stunnel.conf) Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0