September 2012 - stunnel-users

SSL renegotiation patch
by Janusz Dziemidowicz 19 Sep '12

19 Sep '12

Hi, since I couldn't find a better place I'm sending a simple patch that allows to disable SSL renegotiation here. Possible reasons for this: - famous renegotiation SSL flaw, patched in OpenSSL a long time ago, but not everyone can or want to upgrade OpenSSL - renegotiation makes some DoS attacks much easier (see http://www.thc.org/thc-ssl-dos/) regardless of it being a secure one or not - it is really not needed in many cases The approach is based on what is being done in Apache. The default is to allow renegotation, so there should be no surprises for anyone after upgrade. Patch applies on latest (4.54b4) stunnel beta. Feel free to comment:) -- Janusz Dziemidowicz

3 13

Re: [stunnel-users] Binding to non-local sockets
by Janusz Dziemidowicz 19 Sep '12

19 Sep '12

2012/9/12 Willy Tarreau <w(a)1wt.eu>: > Janusz, > > I just saw your mail on stunnel-users. You don't need to use IP_FREEBIND > to bind to a non-existent address under Linux. You can simply enable > sys.net.ipv4.ip_nonlocal_bind to do this. This is how most users deal > with VRRP setups. It does not allow the backup server to receive the > traffic aimed at the missing address, but it allows the process to bind > even when the address is missing so that it becomes operational upon a > switchover. I am aware of this sysctl. However, this will allows any process on the system to bind to any address. In my case I prefer to enable this on per process basis to avoid any possible configuration errors in any other service running on my machines. Since stunnel already had low level socket options exposed I've simply added IP_FREEBIND to the list;) -- Janusz Dziemidowicz

1 0

Re: [stunnel-users] Trouble with smtp client connection and TLS inWindows
by David Schomaker 13 Sep '12

13 Sep '12

Adding "protocol = smtp" was the solution to my problem. Thank you Leonardo! Regards, David Schomaker ----- Original Message ----- From: "Leandro Avila" <leandro.avila(a)ymail.com> To: "David Schomaker" <david(a)schomaker.net>, "stunnel" <stunnel-users(a)stunnel.org> Date: Thu, 13 Sep 2012 09:26:00 -0700 Subject: Re: [stunnel-users] Trouble with smtp client connection and TLS inWindows David, Perhaps the issue is on the server side. A quick look to the SMTP server on smtp.smarshmail.com will show 220 smtp.smarshmail.com ESMTP Service is ready on Server 1 (EQ). EHLO 250-smtp.smarshmail.com Hello [123.456.790.101] 250-SIZE 36700160 250-PIPELINING 250-DSN 250-ENHANCEDSTATUSCODES 250-STARTTLS 250-AUTH GSSAPI NTLM 250-8BITMIME 250-BINARYMIME 250 CHUNKING QUIT 221 2.0.0 Service closing transmission channel I would try adding the following option to your stunnel configuration protocol = smtp I'm not certain but looks like you need to issue the STARTTLS to negociate the secure connection with this server. Check the stunnel manual for further explanation on the option http://www.stunnel.org/static/stunnel.html Hope this helps ----------------- Leandro Avila ----- Original Message ----- From: David Schomaker <david(a)schomaker.net> To: stunnel <stunnel-users(a)stunnel.org> Cc: Sent: Monday, September 10, 2012 10:32 PM Subject: [stunnel-users] Trouble with smtp client connection and TLS in Windows I need to configure stunnel to connect to smtp via TLS and am not able to get it to work either running 4.53 or 4.54beta. Perhaps I have the conf file created incorrectly. The stunnel.conf is as follows: +++++++++++++++++++++++++++++++++++++++ ; Debugging stuff (may useful for troubleshooting) debug = 7 output = c:\temp\stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMARSH-pop3] client = yes accept = 127.0.0.1:110 connect = pop.smarshmail.com:995 [SMARSH-smtp] client = yes SSLversion=TLSv1 accept = 127.0.0.1:25 connect = smtp.smarshmail.com:587 +++++++++++++++++++++++++ Pop works great. The log on an smtp session is as follows: +++++++++++++++++++++++++ 2012.09.10 12:48:31 LOG7[1984:300]: Service [SMARSH-smtp] accepted (FD=508) from 127.0.0.1:49517 2012.09.10 12:48:31 LOG7[1984:300]: Creating a new thread 2012.09.10 12:48:31 LOG7[1984:300]: New thread created 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] started 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] accepted connection from 127.0.0.1:49517 2012.09.10 12:48:31 LOG6[1984:2796]: connect_blocking: connecting 199.47.168.58:587 2012.09.10 12:48:31 LOG7[1984:2796]: connect_blocking: s_poll_wait 199.47.168.58:587: waiting 10 seconds 2012.09.10 12:48:31 LOG5[1984:2796]: connect_blocking: connected 199.47.168.58:587 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] connected remote server from 192.168.108.158:49518 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) initialized 2012.09.10 12:48:31 LOG7[1984:2796]: SNI: host name: smtp.smarshmail.com 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): before/connect initialization 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): SSLv3 write client hello A 2012.09.10 12:48:31 LOG7[1984:2796]: SSL alert (write): fatal: protocol version 2012.09.10 12:48:31 LOG3[1984:2796]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.09.10 12:48:31 LOG5[1984:2796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Local socket (FD=508) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] finished (0 left) 2012.09.10 12:48:40 LOG7[1984:300]: Dispatching signals from the signal pipe 2012.09.10 12:48:43 LOG7[1984:300]: Processing SIGNAL_TERMINATE 2012.09.10 12:48:43 LOG5[1984:300]: Terminated ++++++++++++++++++++++++++ Is sTunnel using SSLv3 rather than TLSv1? If so how do I force TLS? Thanks... _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Trouble with smtp client connection and TLS in Windows
by David Schomaker 13 Sep '12

13 Sep '12

I need to configure stunnel to connect to smtp via TLS and am not able to get it to work either running 4.53 or 4.54beta. Perhaps I have the conf file created incorrectly. The stunnel.conf is as follows: +++++++++++++++++++++++++++++++++++++++ ; Debugging stuff (may useful for troubleshooting) debug = 7 output = c:\temp\stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMARSH-pop3] client = yes accept = 127.0.0.1:110 connect = pop.smarshmail.com:995 [SMARSH-smtp] client = yes SSLversion=TLSv1 accept = 127.0.0.1:25 connect = smtp.smarshmail.com:587 +++++++++++++++++++++++++ Pop works great. The log on an smtp session is as follows: +++++++++++++++++++++++++ 2012.09.10 12:48:31 LOG7[1984:300]: Service [SMARSH-smtp] accepted (FD=508) from 127.0.0.1:49517 2012.09.10 12:48:31 LOG7[1984:300]: Creating a new thread 2012.09.10 12:48:31 LOG7[1984:300]: New thread created 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] started 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] accepted connection from 127.0.0.1:49517 2012.09.10 12:48:31 LOG6[1984:2796]: connect_blocking: connecting 199.47.168.58:587 2012.09.10 12:48:31 LOG7[1984:2796]: connect_blocking: s_poll_wait 199.47.168.58:587: waiting 10 seconds 2012.09.10 12:48:31 LOG5[1984:2796]: connect_blocking: connected 199.47.168.58:587 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] connected remote server from 192.168.108.158:49518 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) initialized 2012.09.10 12:48:31 LOG7[1984:2796]: SNI: host name: smtp.smarshmail.com 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): before/connect initialization 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): SSLv3 write client hello A 2012.09.10 12:48:31 LOG7[1984:2796]: SSL alert (write): fatal: protocol version 2012.09.10 12:48:31 LOG3[1984:2796]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.09.10 12:48:31 LOG5[1984:2796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Local socket (FD=508) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] finished (0 left) 2012.09.10 12:48:40 LOG7[1984:300]: Dispatching signals from the signal pipe 2012.09.10 12:48:43 LOG7[1984:300]: Processing SIGNAL_TERMINATE 2012.09.10 12:48:43 LOG5[1984:300]: Terminated ++++++++++++++++++++++++++ Is sTunnel using SSLv3 rather than TLSv1? If so how do I force TLS? Thanks...

2 1

Stunnel message
by Philip Wong 12 Sep '12

12 Sep '12

Hi all, I'm still learning stunnel for my company support. l feel difficult to understand what's the meaning of some stunnel log message. Is there any doc listed the log messages with some explanation? Thanks, Philip

1 0

stunnel conf alternatives
by John A. Wallace 11 Sep '12

11 Sep '12

I have stunnel 4.53 on x86-pc-mingw32-gnu platform on Win7 OS. I use it minimally at this point but I would like to see whether I can expand my use of it if possible. When I installed it, I simply saved all the program's files into one folder without actually using the Windows installer program, and then I made some entries in the "stunnel.conf" to make it serve my purpose. Right now to start the program I can go to a Windows command prompt in the stunnel folder and type "stunnel stunnel.conf". Then a little icon appears in the notification area of Windows Taskbar. What would happen, I mean how would it differ, if I just typed "stunnel" instead of having to specify the "stunnel.conf" file too? And how would I be able to make use of it in that case? Thanks.

2 1

Binding to non-local sockets
by Janusz Dziemidowicz 09 Sep '12

09 Sep '12

Hi, attached is very simple patch that allows to set IP_FREEBIND under Linux (IP_BINDANY/IPV6_BINDANY under FreeBSD) on an accept socket. I've stumbled upon this need due to the following situation (which I believe might be quite common): - I've already had stunnel instance happily serving one website on port 443, single domain - a need occurred to set up another domain - SNI cannot be used, because Windows XP doesn't support it (and it is still a very large user base) - no problem, I thought, I have a few public IPs available, just set stunnel up on another IP - and here comes the problem, I have two frontend servers with VRRP configured to migrate public IP between them, only one server has the public IP at a time - under normal circumstances it is impossible to bind to an address that does not exist on the server (in case of one domain I've simply bound stunnel to 0.0.0.0) - starting stunnel manually when the address migrates is not an option (VRRP daemon probably can start it, but I was not happy with that solution, I want all services working constantly on both servers so there are no surprises in case of a failover) - setting IP_FREEBIND on accept socket solves the problem, stunnel is working on both machines and I can migrate the public IPs however I want As stunnel already exposes low level socket options, adding support for IP_FREEBIND is very simple. I've also added similar FreeBSD options (tested on FreeBSD 9.0). Oh, and the patch is public domain;) -- Janusz Dziemidowicz

1 0

SSL3_GET_RECORD:wrong version number
by Bob Tentinger 05 Sep '12

05 Sep '12

I have a POS application (SWIFTLINK) that uses Stunnel to send email on Windows XP. This is the error**************** SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number ***************** I have searched the Internet and none of the resolutions help.

2 1

Race condition in libwrap_auth can hang threads waiting on libwrap process
by Andrew Skalski 04 Sep '12

04 Sep '12

I ran into an issue with stunnel (verified with the latest version) where under certain conditions, client connections will hang in the "Waiting for a libwrap process" state. The problem is a race condition in src/libwrap.c: 170 --num_busy; /* the child process has been released */ 171 if(num_busy==num_processes-1) { /* need to wake up a thread */ 172 retval=pthread_cond_signal(&cond); /* signal waiting threads */ 173 if(retval) { 174 errno=retval; 175 ioerror("pthread_cond_signal"); 176 longjmp(c->err, 1); 177 } 178 } Removing the statement "if (num_busy==num_processes-1)" is one way to fix the problem. The conditions under which the race condition occur are: - All libwrap processes are busy, and multiple threads are waiting [num_busy == num_processes] - One thread releases its libwrap process (this signals one of the waiting threads) - Another thread releases its libwrap process before the signaled thread has a chance to acquire and increment num_busy. Once that happens, all queued threads are stuck waiting on the condition variable, until stunnel is hit with enough concurrent connections to max out num_busy again. (Depending on traffic patterns, this may not happen for a long time.) Andy Skalski

2 1

transpartent=destination setting fails with runtime error
by Stefan Lauterbach 03 Sep '12

03 Sep '12

*In the latest versions of stunnel including stunnel-4.54b8, activating the option for transparent destination with transparent=destination fails. The following error is found in the log with this configuration (tested on CentOS 6.2 and 6.3): INTERNAL ERROR: No target for remote socket This bug seems to be introduced with version 4.51 by rewriting the code and introducing additional sanity checks for the configuration. The following patch seems to resolve the problem: --- src/client.c.~1~ 2012-03-05 12:11:06.000000000 +0100 +++ src/client.c 2012-08-27 00:29:36.000000000 +0200 @@ -303,7 +303,7 @@ c->bind_addr=NULL; /* don't bind */ /* setup c->remote_fd, now */ - if(c->opt->option.remote) { /* try remote first for exec+connect targets */ + if(c->opt->option.remote || c->opt->option.transparent_dst) { /* try remote first for exec+connect targets */ c->remote_fd.fd=connect_remote(c); } else if(c->opt->option.program) { /* exec+connect uses local fd */ c->remote_fd.fd=connect_local(c); *

1 0