- stunnel-users - stunnel.org

Binding to non-local sockets
by Janusz Dziemidowicz 09 Sep '12

09 Sep '12

Hi, attached is very simple patch that allows to set IP_FREEBIND under Linux (IP_BINDANY/IPV6_BINDANY under FreeBSD) on an accept socket. I've stumbled upon this need due to the following situation (which I believe might be quite common): - I've already had stunnel instance happily serving one website on port 443, single domain - a need occurred to set up another domain - SNI cannot be used, because Windows XP doesn't support it (and it is still a very large user base) - no problem, I thought, I have a few public IPs available, just set stunnel up on another IP - and here comes the problem, I have two frontend servers with VRRP configured to migrate public IP between them, only one server has the public IP at a time - under normal circumstances it is impossible to bind to an address that does not exist on the server (in case of one domain I've simply bound stunnel to 0.0.0.0) - starting stunnel manually when the address migrates is not an option (VRRP daemon probably can start it, but I was not happy with that solution, I want all services working constantly on both servers so there are no surprises in case of a failover) - setting IP_FREEBIND on accept socket solves the problem, stunnel is working on both machines and I can migrate the public IPs however I want As stunnel already exposes low level socket options, adding support for IP_FREEBIND is very simple. I've also added similar FreeBSD options (tested on FreeBSD 9.0). Oh, and the patch is public domain;) -- Janusz Dziemidowicz

1 0

SSL3_GET_RECORD:wrong version number
by Bob Tentinger 06 Sep '12

06 Sep '12

I have a POS application (SWIFTLINK) that uses Stunnel to send email on Windows XP. This is the error**************** SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number ***************** I have searched the Internet and none of the resolutions help.

2 1

Race condition in libwrap_auth can hang threads waiting on libwrap process
by Andrew Skalski 05 Sep '12

05 Sep '12

I ran into an issue with stunnel (verified with the latest version) where under certain conditions, client connections will hang in the "Waiting for a libwrap process" state. The problem is a race condition in src/libwrap.c: 170 --num_busy; /* the child process has been released */ 171 if(num_busy==num_processes-1) { /* need to wake up a thread */ 172 retval=pthread_cond_signal(&cond); /* signal waiting threads */ 173 if(retval) { 174 errno=retval; 175 ioerror("pthread_cond_signal"); 176 longjmp(c->err, 1); 177 } 178 } Removing the statement "if (num_busy==num_processes-1)" is one way to fix the problem. The conditions under which the race condition occur are: - All libwrap processes are busy, and multiple threads are waiting [num_busy == num_processes] - One thread releases its libwrap process (this signals one of the waiting threads) - Another thread releases its libwrap process before the signaled thread has a chance to acquire and increment num_busy. Once that happens, all queued threads are stuck waiting on the condition variable, until stunnel is hit with enough concurrent connections to max out num_busy again. (Depending on traffic patterns, this may not happen for a long time.) Andy Skalski

2 1

transpartent=destination setting fails with runtime error
by Stefan Lauterbach 03 Sep '12

03 Sep '12

*In the latest versions of stunnel including stunnel-4.54b8, activating the option for transparent destination with transparent=destination fails. The following error is found in the log with this configuration (tested on CentOS 6.2 and 6.3): INTERNAL ERROR: No target for remote socket This bug seems to be introduced with version 4.51 by rewriting the code and introducing additional sanity checks for the configuration. The following patch seems to resolve the problem: --- src/client.c.~1~ 2012-03-05 12:11:06.000000000 +0100 +++ src/client.c 2012-08-27 00:29:36.000000000 +0200 @@ -303,7 +303,7 @@ c->bind_addr=NULL; /* don't bind */ /* setup c->remote_fd, now */ - if(c->opt->option.remote) { /* try remote first for exec+connect targets */ + if(c->opt->option.remote || c->opt->option.transparent_dst) { /* try remote first for exec+connect targets */ c->remote_fd.fd=connect_remote(c); } else if(c->opt->option.program) { /* exec+connect uses local fd */ c->remote_fd.fd=connect_local(c); *

1 0

MySQL replication + SSL/stunnel
by Gareth Evans 27 Aug '12

27 Aug '12

Hello, I'm failing miserably to implement replication over any kind of SSL (that is, MySQL's native (alleged) SSL support) or stunnel. I'd be grateful for any tips or advice. I have tried using OpenSSL and MySQL in various flavours: CentOS 6.2, OpenSSL v1.0.0, MySQL v5.1.63 Ubuntu 12.04, OpenSSL v1.0.1, MySQL v 5.5.24 and stunnel4 on both - certs created with OpenSSL in each case. I get an eror 1045 access denied from the MySQL native SSL approach, and mysql -u ejbkslave -pejbkslavepw -h127.0.0.1 -P3307 ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 from stunnel (connecting two Ubuntu 12.04 VM's on my PC, with the latest updates) - if you know what causes this error and/or could point me towards some good documentation, I'd be grateful. I've copied and amended stunnel.conf-sample and just added debug and accept/connect info in each case. I've seen various reports around the web that OpenSSL+MySQL don't work together at the moment, but it seems some people can repicate the problem while others can't - I've tried the previous version of OpenSSL (1.0.0e on Ubuntu) still without success. Most frustrating!! Thanks Gareth

2 1

Stunnel performance about multiple session
by Yuqiong Sun 27 Aug '12

27 Aug '12

Hi, I am using stunnel as an encrypted channel between one server and multiple clients. Each client will transfer a very small piece of data every 20 seconds. Therefore I want to compare the tradeoff between maintaining multiple sessions with tearing down and re-establish connection every time. I read the performance table in stunnel doc and got a brief idea, but I hope to evaluate the performance for my specific hardware and software setup to make a better decision. I guess my question is how to measure the Max. concurrent sessions? Should I start multiple stunnel instances on client side? Also, how can I tear down a connection automatically after each time data transfer? Thanks Yuqiong

2 1

Behavior
by Javier 17 Aug '12

17 Aug '12

Hi, I want to report 2 different behaviors, one, related to logs and, the other, to close delay. - About the logs, there is a funny thing. If you reload stunnel.conf the log style and amount of information differs from the starting one. I'm under Windows 2000 and these are the general options in stunnel.conf: debug = debug delay = yes output = stunnel.log fips = no The differences can be seen in the attached text file. First part is how is being seen if you don't reload the conf file. The second, after you reload. I, by myself, prefer the second log style. - About the close delay, I don't know when it started to happen (maybe in the version you removed the multiple instance of stunnel or maybe later), but what happens is that stunnel delays about 1-2 seconds to close. It didn't happen before. It was immediately. And has nothing to do with how many services you have, it delays with one service or ten services or… whatever. My system specs, the same as above. But it happens in Windows XP as well, and with the latest 4.54 beta too (the one that has removed the annoying app error (thank you so much for this :-) )). Have a look to them ;-) and confirm if possible :-) Thanks.

1 0

Stunnel high memory usage?
by Matt Wise 16 Aug '12

16 Aug '12

We use Stunnel 4.5.2 in our environment of Ubuntu 10.04/12.04 systems in various clouds. We're leveraging PGPool for SSL encryption of a lot of different types of traffic ... Zookeeper, Postgresql, and AMQP traffic are some examples for us. Mostly everything works great .. its fast, and very reliable. I've just noticed though that on a particular group of machines we are seeing really high memory usage on the Stunnel process that seems to grow and grow over time. I found this Stunnel process using over 350MB of ram yesterday ... and on an m1.small in Amazon, thats a big chunk! Here's our client config file: > cert = /etc/stunnel/localhost-pgpool.pem > key = /etc/stunnel/localhost-pgpool.key > CAfile = /etc/stunnel/localhost-pgpool_ca.pem > verify = 2 > delay = no > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/localhost-pgpool.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > session = 86400 > debug = 4 > [localhost-pgpool] > accept = 127.0.0.1:5001 > failover = rr > connect = prod-pgpool1-uswest1:6433 > connect = prod-pgpool2-uswest1:6433 My first thought was that perhaps the Session cache was too large... so I dropped it to '3600'. Now instead of 360MB, I'm seeing Stunnel sit at around 170MB. Is the session ID cache just caching thousands and thousands of new session IDs without properly re-using them? It seems like the session ID cache should never have more than: Currently_Used_Session_IDs + Session_IDs_unused_but_last_used_within_the_last_hour Any thoughts on what might be going on? --Matt

1 0

Application Failed to Initialize Properly (0xc0150002)
by Thomas Eifert 09 Aug '12

09 Aug '12

New problem here. Stunnel version 4.53. I just did a fresh install of Windows XP Pro x86 SP3, and did all the Windows updates as well. Whenever I try to launch Stunnel or install the service, I get the error: "Application Failed to Initialize Properly (0xc0150002)" I've never seen this before. I thought it might have something to do with not having the Visual C++ Redistributables, so I installed those too, with the same result. Has anyone else seen this issue? Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

3 4

Stunnel waits for a long time if client does not negotiate SSL
by Denis Solovyov 09 Aug '12

09 Aug '12

Hello, I use stunnel 4.53 to provide pop3s for existing pop3 service. I start stunnel from xinetd, and then exec pop3 utility from stunnel. If a legal pop3s client connects to a server, everything's fine. But if I try to do "telnet host 995" with a simple telnet client and then just do nothing (or even close telnet client without quitting) stunnel process keeps waiting for a very long time (actually maybe forever, I just kill it). The last line in log in such case "Service [stunnel] accepted connection from xx.xx.xx.xx:xxxx". No stunnel TIMEOUT* options have effect in this situation. What can I do to avoid such "waiting"? Maybe stunnel should have something like "SSL negotiation timeout"? Or is there a way to emulate it? (Analyzing `ps` or `netstat` is a bad idea of course.) With the best regards, Denis Solovyov

2 3