stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

[PATCH]: Debugging output
by Andrew Watts 08 Nov '11

08 Nov '11

Hi. According to the manpage for the output=<file> configuration directive, if this is set then it should replace syslog facility logging. However, stunnel 4.45 (and ealier version) on linux send debugging information to both syslog and a logfile when output is specified. The following patch makes stunnel behave according to the manpage "append log messages to a file instead of using syslog": ==================================== --- a/src/log.c +++ b/src/log.c @@ -163,7 +163,7 @@ static void log_raw(const int level, con line=str_printf("%s %s: %s", stamp, id, text); if(level<=global_options.debug_level) { #if !defined(USE_WIN32) && !defined(__vms) - if(global_options.option.syslog) + if(global_options.option.syslog && !global_options.output_file) syslog(level, "%s: %s", id, text); #endif /* USE_WIN32, __vms */ if(outfile) ==================================== ~ Andy

2 2

Error detected on socket (read) file descriptor: Broken pipe (32)
by Alex Magee 08 Nov '11

08 Nov '11

Hello, I'm trying to use stunnel to workaround a wine bug which prevents an old Windows mail client from accessing my mail server through a pop3s 995 port. I'm not an expert on linux, stunnel, sockets or ssl. The process seems to start off well, establishes a connection to the correct remote mail server, and negotiates an ssl connection, but then terminates with: Error detected on socket (read) file descriptor: Broken pipe (32) I've played with various settings in the stunnel.conf file, but with no success. A Google search turned up one other example of this problem back in Nov 2010, but no solution was forthcoming. Does anyone have any suggestions of what might be the problem? The level 7 debug stunnel.log file follows at the end, with TCP addresses masked. The system is SUSE Linux 11.4. Using the latest versions of ssl and stunnel. Thanks, Alex stunnel.log -------------- local socket: FD=0 allocated (non-blocking mode) Service pmail-pop3 accepted FD=0 from 127.0.0.1:48828 Service pmail-pop3 started Option TCP_NODELAY set on local socket Service pmail-pop3 accepted connection from 127.0.0.1:48828 remote socket: FD=1 allocated (non-blocking mode) connect_blocking: connecting xxx.xxx.xxx.xxx:995 connect_blocking: s_poll_wait xxx.xxx.xxx.xxx:995: waiting 10 seconds connect_blocking: connected xxx.xxx.xxx.xxx:995 Service pmail-pop3 connected remote server from 192.168.1.47:46187 Remote FD=1 initialized Option TCP_NODELAY set on remote socket SNI: host name: yyy.yyy.yyy..com SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL state (connect): SSLv3 read finished A 1 items in the session cache 1 client connects (SSL_connect()) 1 client connects that finished 0 client renegotiations requested 0 server connects (SSL_accept()) 0 server connects that finished 0 server renegotiations requested 0 session cache hits 0 external session cache hits 0 session cache misses 0 session cache timeouts SSL connected: new session negotiated Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 Socket closed on read Sending SSL write shutdown Error detected on socket (read) file descriptor: Broken pipe (32) Connection reset: 79 bytes sent to SSL, 64 bytes sent to socket Service pmail-pop3 finished (0 left) str_stats: 0 block(s), 0 byte(s)

2 2

stunnel 4.46 released
by Michal Trojnara 07 Nov '11

07 Nov '11

Dear Users, I have released version 4.46 of stunnel. The ChangeLog entry: Version 4.46, 2011.11.04, urgency: LOW: * New features - Added Unix socket support (e.g. "connect = /var/run/stunnel/ socket"). - Added "verify = 4" mode to ignore CA chain and only verify peer certificate. - Removed the limit of 16 IP addresses for a single 'connect' option. - Removed the limit of 256 stunnel.conf sections in PTHREAD threading model. It is still not possible have more than 63 sections on WIN32 platform. http://msdn.microsoft.com/en-us/library/windows/desktop/ms740141(v=vs.85).a… * Optimizations - Reduced per-connection memory usage. - Performed a major refactoring of internal data structures. Extensive internal testing was performed, but some regression bugs are expected. * Bugfixes - Fixed WIN32 compilation with Mingw32. - Fixed non-blocking API emulation layer in UCONTEXT threading model. - Fixed signal handling in UCONTEXT threading model. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.46.tar.gz: 8ea8943bdfcd74a2e66dc00d4ed17b402bbd39d040a125901534f6f4308da99d Best regards, Mike

2 1

Stunnel & Haproxy
by Christophe Rahier 03 Nov '11

03 Nov '11

Hi, I'd like to user Stunnel with Haproxy on a Debian Squeeze server. I downloaded these files: wget ftp://ftp.stunnel.org/stunnel/obsolete/4.x/stunnel-4.44.tar.gz wget http://haproxy.1wt.eu/download/patches/stunnel-4.44-xforwarded-for.diff I patch the file with patch -p1 < ../stunnel-4.44-xforwarded-for.dif After this, I try to "make". I've a lot of errors and I don't understand, I'm not a Linux guru! :-( Errors : Making all in src make[1]: Entering directory `/tmp/stunnel-4.44/src' make all-am make[2]: Entering directory `/tmp/stunnel-4.44/src' gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c In file included from str.c:38: common.h:383:19: error: lhash.h: No such file or directory common.h:384:17: error: ssl.h: No such file or directory common.h:386:20: error: crypto.h: No such file or directory common.h:387:17: error: md4.h: No such file or directory common.h:388:17: error: des.h: No such file or directory In file included from str.c:39: prototypes.h:117: error: expected specifier-qualifier-list before 'SSL_CTX' prototypes.h:368: error: expected specifier-qualifier-list before 'SSL' prototypes.h:391: warning: struct has no members prototypes.h:469: error: 'PEM_BUFSIZE' undeclared here (not in a function) str.c: In function 'str_canary': str.c:210: warning: implicit declaration of function 'RAND_bytes' str.c: In function 'str_stats': str.c:239: warning: format '%d' expects type 'int', but argument 3 has type 'size_t' str.c:239: warning: format '%d' expects type 'int', but argument 4 has type 'size_t' str.c:239: warning: format '%d' expects type 'int', but argument 5 has type 'long unsigned int' make[2]: *** [stunnel-str.o] Error 1 make[2]: Leaving directory `/tmp/stunnel-4.44/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/tmp/stunnel-4.44/src' make: *** [all-recursive] Error 1 Could you help me? Thanks for your help. Regards, Christophe

4 6

Why does verify=3 require the entire cert chain to be present in cafile?
by al_9x＠yahoo.com 03 Nov '11

03 Nov '11

If the leaf (server) cert is declared trusted (added to the cafile), there is no point in walking the trust chain.

5 15

[PATCH] Unix socket tunnelling
by Antoine Catton 02 Nov '11

02 Nov '11

Hi, I was looking for solution for tunneling a MySQL socket through encrypted IPv6. And I found this bunch of patches for stunnel <http://www.exceliance.fr/download/free/patches/stunnel/unix-sockets/>. Unfortunately, there's no patch for stunnel 4.44. So I rebased it in order to make it work (I attached it to this email). FYI, I’m not the author of this patch, I just adapted it for stunnel 4.44. The author seems to be this french company <http://www.exceliance.fr/en>. I just glanced over it, I didn't review it. Anyway, I think it would be a great thing to integrate it into stunnel in order to avoid rebasing the patch for every stunnel new version. Besides, it is a very useful feature. Integrating this patch would imply updating the documentation of stunnel configuration. As far as I know it add another general option “unix-sockets-dir” which is “/var/run/” by default. All the socket path must start by a slash, and this path will be appended to “unix-sockets-dir” option. Thank you. Regards, -- Antoine Catton Nexedi Intern

2 1

FD_MAX question
by Eckert, Doug 27 Oct '11

27 Oct '11

Greetings, We're using stunnel-4.15-2.el5.1 as provided on the RHEL 5 update 7 distro. Is there any way to override the FD_MAX setting (64 IIRC), perhaps as a stunnel.conf option? Doug Eckert Technical Architect Global Business & Technology Services Dow Jones | A News Corporation Company P.O. Box 300 | Princeton NJ 08543-0300 (W) 609.520.4993 (C) 732.666.3681 Email: doug.eckert(a)dowjones.com<mailto:alias@dowjones.com> [cid:image001.png@01CC93D6.2E9FF0E0]

3 4

Re: [stunnel-users] Why does verify=3 require the entire cert chain to be present in cafile?
by Jochen Bern 26 Oct '11

26 Oct '11

On 10/25/2011 09:54 PM, al_9x(a)yahoo.com wrote: > verify=3 means checking is done against local certs. My point is that > if the actual server cert is stored locally (i.e. trusted) that should > be enough. When I put just the server cert in cafile validation (and > connection) fails, but when I put the whole chain, it succeeds. Why > isn't the server cert sufficient? Mostly guessing here, but: 1. stunnel uses the OpenSSL libraries. The verify(1) manpage says: "The verify program uses the same functions as the internal SSL and S/MIME verification, therefore this description applies to these verify operations too. [...] The verify operation consists of a number of separate steps. Firstly a certificate chain is built up starting from the supplied certificate and ending in the root CA. It is an error if the whole chain cannot be built up. The chain is built up by looking up the issuers certificate of the current certificate. If a certificate is found which is its own issuer it is assumed to be the root CA." -- http://www.openssl.org/docs/apps/verify.html#VERIFY_OPERATION So I'd guess that the algorithm you're at odds with is part of OpenSSL, rather than something stunnel can change. 2. Certificates are to be considered invalid once they have been revoked, and in order to check the CRL, you have to determine the issuing CA. Whose certificate has to be checked against its parent CA, etc. all the way to the Root CA. A "verification" mechanism which does not check for explicit revocation would have to be considered faulty for *most*, if not all, application cases - the fact that automated CRL checking is still pretty much absent in mechanisms which do not *mandate* a working Internet connection notwithstanding. 3. Since you're apparently trying to set up a point-to-point SSL connection with preconfigured direct trust, my guess would be that you'd be better off if the server would use a self-signed cert (either altogether, or in addition to the current one - say, on an additional port). However, since you never mentioned what kind of software you're trying to get to talk to each other, I'm at a loss suggesting *how* you might do that. Regards, J. Bern -- Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

2 2

Re: [stunnel-users] Why does verify=3 require the entire cert chain to be present in cafile?
by Jean-Yves F. Barbier 26 Oct '11

26 Oct '11

On Tue, 25 Oct 2011 15:54:26 -0400 al_9x(a)yahoo.com wrote: ... > verify=3 means checking is done against local certs. My point is that > if the actual server cert is stored locally (i.e. trusted) that should > be enough. When I put just the server cert in cafile validation (and > connection) fails, but when I put the whole chain, it succeeds. Why > isn't the server cert sufficient? Because the SVR cert is used to signed your own cert, this ensure liability between svr & cli; and if it was only the SVR cert, how could you revoke client by client? You would be obliged to revoke all clients at once - which doesn't look like a very good strategy if you've got 1000's of clients... -- You will be dead within a year.

3 2

stunnel 4.45 released
by Michal Trojnara 24 Oct '11

24 Oct '11

Dear Users, I have released version 4.45 of stunnel. The ChangeLog entry: Version 4.45, 2011.10.24, urgency: LOW: * New features - "protocol = proxy" support to send original client IP address to haproxy: http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt This requires accept-proxy bind option of haproxy 1.5-dev3 or later. - Added Win32 configuration reload without a valid configuration loaded. - Added compatibility with LTS OpenSSL versions 0.9.6 and 0.9.7. Some features are only available in OpenSSL 1.0.0 and later. * Performance optimizations - Use SSL_MODE_RELEASE_BUFFERS if supported by the OpenSSL library. - Libwrap helper processes are no longer started if libwrap is disabled in all sections of the configuration file. * Internal improvements - Protocol negotiation framework was rewritten to support additional code to be executed after SSL_accept()/SSL_connect(). - Handling of memory allocation errors was rewritten to gracefully terminate the process (thx to regenrecht for the idea). * Bugfixes - Fixed -l option handling in stunnel3 script (thx to Kai Gülzau). - Script to build default stunnel.pem was fixed (thx to Sebastian Kayser). - MinGW compilation script (mingw.mak) was fixed (thx to Jose Alf). - MSVC compilation script (vc.mak) was fixed. - A number of problems in WINSOCK error handling were fixed. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.45.tar.gz: cbce8279c1ba7a07bfefeb2e477f682bfd326519f8a7ed296e35210599898a2d Best regards, Mike

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users