stunnel-users

stunnel-users@stunnel.org

5 participants
3293 discussions

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net). But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net), make sure it's using http/1.1, etc?

4 3

Is it possible to hide "Acceptable client certificate CA names" during SSL handshaking?
by hshh 12 Nov '24

12 Nov '24

Since version 5.68, when stunnel is configured with verifyPeer=yes, CApath=/path and CAfile=/path/file, the 'Acceptable client certificate CA names' and required certificates are displayed during SSL handshaking. Is it possible to hide this information?

3 4

s_ssl_read_eof: SSL_ERROR_WANT_READ: Retrying
by stavultras＠gmail.com 07 Nov '24

07 Nov '24

Hello, i've encountered a very strange issue when you use stunnel 7.53 (doesn't matter actually, happens in 5.68 as well) like this: [server] accept = 443 protocol = socks [client] accept = 1080 protocol = socks connect = server:443 with iptables -A OUTPUT -p tcp -d 10.8.0.1 -j REDIRECT --to-ports 1080, I see in 95% cases in logs for every request from curl: curl http://10.8.0.1 (server's internal IP), however, it never happens if you use client like this: [client] accept = 1080 connect = server:443 and curl -x socks5://127.0.0.1:1080 http://10.8.0.1 (internal server's IP). Technically it affects nothing, but I still guess there's a small time overhead due to retry. Maybe i'm wrong. Please advise. Thanks.

1 0

Re: [stunnel-users] CPU 100%
by Eric Eberhard 06 Nov '24

06 Nov '24

Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

socks mode doesn't verify peer
by stavultras＠gmail.com 05 Nov '24

05 Nov '24

Hello. I'm trying to configure "protocol = socks" with "redirect = 127.0.0.1:80" and "verifyPeer = yes", but accordingly to the debug logs stunnel doesn't verify peer when I'm trying to connect without client's certificate, for an example, from browser: https://192.168.200.131:9013/, where 192.168.200.131 is stunnel server. Config file: [socks] cert = /usr/local/etc/stunnel/server.pem CAfile = /usr/local/etc/stunnel/client.crt verifyPeer = yes redirect = 127.0.0.1:80 accept = 0.0.0.0:9013 protocol = socks Debug log: 2024.10.02 07:24:19 LOG6[9]: No peer certificate received 2024.10.02 07:24:19 LOG6[9]: Session id: AFA5F9CE2997328612F76E3B3572FE00C71C53ED31A98567E56DCC084EF580AD 2024.10.02 07:24:19 LOG7[9]: TLS state (accept): SSLv3/TLS write session ticket 2024.10.02 07:24:19 LOG6[9]: TLS accepted: new session negotiated 2024.10.02 07:24:19 LOG6[9]: TLSv1.3 ciphersuite: TLS_AES_128_GCM_SHA256 (128-bit encryption) 2024.10.02 07:24:19 LOG6[9]: Peer temporary key: X25519, 253 bits 2024.10.02 07:24:19 LOG7[9]: Compression: null, expansion: null 2024.10.02 07:24:19 LOG7[9]: Waiting for the SOCKS request 2024.10.02 07:24:19 LOG3[9]: Unsupported SOCKS version 0x47 2024.10.02 07:24:19 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket It tries to accept SOCKS info even without certificate and doesn't redirect to 127.0.0.1:80. In browser, I'm getting: Secure Connection Failed An error occurred during a connection to 192.168.200.131:9013. PR_CONNECT_RESET_ERROR Error code: PR_CONNECT_RESET_ERROR Can you check why it happens? Thank you.

1 9

"direct" protocol support
by stavultras＠gmail.com 05 Nov '24

05 Nov '24

Hello, is it possible to implement "direct" protocol support? For an example: You have OpenVPN TCP on a server and let's say SSH (or any other TCP software) and you want to use stunnel on the same port or under the same SNI. Configs would like: [server] accept = 443 protocol = direct [client_openvpn_tcp] sni=test.com protocolHost = 127.0.0.1:2000 connect = server:443 accept = 127.0.0.1:2000 [client_ssh] sni=test.com protocolHost = 127.0.0.1:22 connect = server:443 accept = 127.0.0.1:222 I know, you can use "protocol = socks", but in this case you can't use this thing directly with your software that doesn't support socks5 (OpenVPN isn't a fully good example, because it supports socks5 proxy). SSH is a good example if you want to use it under TLS on the same port with OpenVPN TCP and other TCP applications. It will be useful for many other applications without socks5 support and if you won't occupy more than 1 port or SNI. P.S.: I'm still trying to use socks5 code from stunnel to implement "direct" protocol, but i'm not very good at C. Thanks.

1 2

Smpp with stunnel
by Andrew Z 16 Oct '24

16 Oct '24

Hello, I'm trying to leverage stunnel with smpp to communicate over by smppS protocol. I saw an older message from Pierre Delaage (2019) outlining the process ( https://www.stunnel.org/pipermail/stunnel-users/2010-September/002752.html). Unfortunately, that is not working for me. What may I be overlooking? Data: Fedora 39, stunnel 5.72 on x86_64-redhat-linux-gnu platform stunnel config from /etc/stunnel: cat ./stunnel.conf output = /var/log/stunnel.log foreground = yes [smpps] client = yes accept = 3775 connect = <vendor dnsname>:3550 cert = /tmp/nginx-selfsigned.crt key=/tmp/nginx-selfsigned.key sslVersion=all [root@dell5000 stunnel]# stunnel ./stunnel.conf 2024.10.16 13:52:44 LOG5[ui]: stunnel 5.72 on x86_64-redhat-linux-gnu platform 2024.10.16 13:52:44 LOG5[ui]: Compiled with OpenSSL 3.1.1 30 May 2023 2024.10.16 13:52:44 LOG5[ui]: Running with OpenSSL 3.1.4 24 Oct 2023 2024.10.16 13:52:44 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2024.10.16 13:52:44 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2024.10.16 13:52:44 LOG5[ui]: UTF-8 byte order mark not detected 2024.10.16 13:52:44 LOG5[ui]: FIPS mode disabled 2024.10.16 13:52:44 LOG4[ui]: Service [smpps] needs authentication to prevent MITM attacks 2024.10.16 13:52:44 LOG5[ui]: Configuration successful 2024.10.16 13:53:02 LOG5[0]: Service [smpps] accepted connection from 192.168.1.114:11270 2024.10.16 13:53:02 LOG5[0]: s_connect: connected <vendor IP>:3550 2024.10.16 13:53:02 LOG5[0]: Service [smpps] connected remote server from 192.168.1.114:55508 2024.10.16 13:53:07 LOG5[0]: Connection closed: 293 byte(s) sent to TLS, 0 byte(s) sent to socket the smpp client is pointed to localhost:3775 and I running in the container. As such the "localhost" is "host.containers.internal". Here is the smpp log: 2024-10-16 17:53:02 INFO 1 Establishing SSL connection to host.containers.internal:3775 2024-10-16 17:53:02 INFO 1 Connecting to IPv4Address(type='TCP', host='host.containers.internal', port=3775) ... 2024-10-16 17:53:02 WARNING 1 SMPP connection established from 192.168.1.114 to port 40554 2024-10-16 17:53:02 INFO 1 Connection made to host.containers.internal:3775 2024-10-16 17:53:02 WARNING 1 Requesting bind as transceiver 2024-10-16 17:53:07 WARNING 1 SMPP 192.168.1.114 disconnected from port 40554: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionLost'>: Connection to the other side was lost in a non-clean fashion: Connection lost. ] 2024-10-16 17:53:07 ERROR 1 Connection lost. Reason: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly. ] 2024-10-16 17:53:07 INFO 1 Reconnecting after 10 seconds ... 2024-10-16 17:53:17 INFO 1 Connecting to IPv4Address(type='TCP', host='host.containers.internal', port=3775) ... 2024-10-16 17:53:17 WARNING 1 SMPP connection established from 192.168.1.114 to port 54806 2024-10-16 17:53:17 INFO 1 Connection made to host.containers.internal:3775 2024-10-16 17:53:17 WARNING 1 Requesting bind as transceiver 2024-10-16 17:53:22 WARNING 1 SMPP 192.168.1.114 disconnected from port 54806: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionLost'>: Connection to the other side was lost in a non-clean fashion: Connection lost. ] 2024-10-16 17:53:22 ERROR 1 Connection lost. Reason: [Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionDone'>: Connection was closed cleanly. ] 2024-10-16 17:53:22 INFO 1 Reconnecting after 10 seconds ... 2024-10-16 17:53:32 ERROR 1 Request timed out after 30 secs: PDU [command: CommandId.bind_transceiver, sequence_number: 1, command_status: CommandStatus.ESME_ROK system_id: b'XXXXX' password: b'XXXXX' system_type: b'' interface_version: 52 addr_ton: <AddrTon.UNKNOWN: 1> addr_npi: <AddrNpi.UNKNOWN: 1> address_range: None ] 2024-10-16 17:53:32 ERROR 1 Bind failed [[Failure instance: Traceback (failure with no frames): <class 'smpp.pdu.error.SMPPRequestTimoutError'>: Request timed out after 30 secs: PDU [command: CommandId.bind_transceiver, sequence_number: 1, command_status: CommandStatus.ESME_ROK system_id: b'XXXX' password: b'XXXXX' system_type: b'' interface_version: 52 addr_ton: <AddrTon.UNKNOWN: 1> addr_npi: <AddrNpi.UNKNOWN: 1> address_range: None ] ]]. Disconnecting...

1 0

stunnel overhead: Tunneling over stunnel - How does this affect MTU?
by Marek Küthe 15 Oct '24

15 Oct '24

Hello, I am tunneling packets via stunnel using OpenVPN. I would now like to have an MTU in my tunnel where no fragmentation occurs. Hence my question: What overhead does stunnel introduce? Is the plaintext with a length one-to-one translated into the ciphertext? How large is the stunnel / TLS header? I look forward to any answer! Regards Marek Küthe -- Marek Küthe m.k(a)mk16.de er/ihm he/him

1 0

Newbie: installation and config
by ajbguinto＠yahoo.com 30 Sep '24

30 Sep '24

Hi, I am tasked to make stunnel work in our organization but a newbie I seem not to be able to follow the instructions for installation. can you help me out? plan to install this on our servers that will cater to oracle / mssql in transit data encryption. how do I know if im installing on a client or a server? will this work standalone (server will act as server and client too). how will this be configured.

2 5

External PSK and TLS 1.3
by mike ads 18 Sep '24

18 Sep '24

Hello, I'm looking for a solution to connect to a server using TLS 1.3 and an external PSK. Does stunnel support this? I see that there are configuration options to set TLS 1.3, and configuration options to specify a PSK; if those were used together, would that result in TLS 1.3 with the PSK? If so, how would I choose between ephemeral vs non-ephemeral DH? This doesn't seem to be an option. Ephemeral is an important choice for forward secrecy. Would it default to ephemeral? Thank you.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users