- stunnel-users - stunnel.org

Verify=3 cache expiration
by Edouard Dessioux 16 Apr '08

16 Apr '08

Hi everyone, I'm using stunnel v4.16 on a Windows 2003 Server, and I'm working with stunnel in verify=3 mode. I wanted to know if the stunnel needs to be restarted after a certificates has been removed ? If not, how long is the cache expiration delay before being taken into account ? Regards, Edouard DESSIOUX Directeur de Projets Tibco Mobile 3, rue Danton - 92240 Malakoff Tél : +33 (0)1 55 58 04 59 - Fax : +33 (0)1 55 58 03 89 - Mob. +33 (0)6 34 02 61 54 E-mail : edessioux(a)tibco.fr - www.tibcomobile.fr Faites un geste pour la planète, n'imprimez ce message que si nécessaire.

1 0

SCM repo?
by Alberto Giménez 12 Apr '08

12 Apr '08

Hello, Is there any public SCM (SVN, GIT, whatever) repository? I haven't seen anything on the website and I'd like to try to implement a new feature. Thanks in advance. -- Alberto Giménez

2 1

Stunnel 4.22 compiling issues on Solaris 10
by cod3fr3ak 09 Apr '08

09 Apr '08

I have sucessfully compiled Stunnel 4.22 on Solaris 10, but still recieve the sam errors during the configure. Initially I tried using Openssl-0.9.8f from Sun Freeware. Then I built and compiled Openssl-0.9.8g, but I still recieved the following errors on the build: configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking for obsolete RSAref library... no checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... no configure: WARNING: /usr/local/ssl/include/openssl/engine.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: /usr/local/ssl/include/openssl/engine.h: proceeding with the compiler's result checking for /usr/local/ssl/include/openssl/engine.h... yes <ftp://ftp.sunfreeware.com/pub/freeware/sparc/10/openssl-0.9.8f-sol10-sparc-…>

1 0

Using stunnel + haproxy for SSL support
by Alberto Giménez 04 Apr '08

04 Apr '08

Hi, I'm having trouble using stunnel and haproxy to load balance https and http traffic. To be honest, I really don't know wether it is stunnel or haproxy related so I am going to contact both lists :) I have set up a haproxy load balancer as http proxy for two backend Apache2 webservers. It works fine. I also have stunnel on the same LB to add SSL suport (with xforwardedfor patch installed). It works fine (mostly). The issue is related to Apache trailing slash thingie. If I query https://haproxy.domain.loc/hatest/ it works perfectly, but if I omit the trailing slash: https://haproxy.domain.loc/hatest then following things happen: - Browser makes SSL connection with stunnel on port 443. - stunnel deciphers and forwards the request on the haproxy attached to LB's port 80. - haproxy (now using plain http) forwards to one of the backends. - Apache2 located on the backend replies with "301 moved permanently" to force the browser to add the trailing slash. As Apache was queried by *haproxy in plain http*, the 301 includes http:// on the Location header. HTTPS is over from now! - The client browser then rewrites the address to http://haproxy.domain.loc/hatest/ and SSL is lost forever. I've been googling and searching the lists but nothing found, just this old message: http://mirt.net/pipermail/stunnel-users/2007-January/001437.html Has anyone found a workaround for that issue? Thanks in advance. -- Alberto Giménez

2 1

Problems with Stunnel 4.22 build
by GGrant 04 Apr '08

04 Apr '08

There's a problem with the Stunnel 4.22 build as there's undefined IDs in the resources.rc file. To get around this get the resources.rc file from an earlier build (e.g. Stunnel 4.21) and replace it. It should compile happily -- View this message in context: http://www.nabble.com/Problems-with-Stunnel-4.22-build-tp16491431p16491431.… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

23 secs to list 5000 files using stunnel and samba on linux
by Paul Kerin 04 Apr '08

04 Apr '08

Hi I'm using the following s/w versions on RHEL3: Stunnel: 4.04 (also experimenting with 4.22, no difference so far) Samba: 3.0.9-1.3E.10 Kernel: 2.4.21-32.0.1.EL Stunnel is used to encrypt samba connections from linux clients because redhat 3 doesn't support NTLMv2 (cifs not standard and probably not an option). To list 5000 files (simply typing ls within a mounted directory on the client) it consistently takes around 20-23 seconds to return the data. Listing is almost instantaneous when using a windows client, or using a linux client without stunnel. As a side note, if I pipe the result to /dev/null it takes around 9 seconds (?). The network forwarding path from the samba client to samba server is: smbclient > localhost:924 > stunnel > remotehost:923 > stunnel > samba server (port 446) Tcpdump shows that when using stunnel about 10500 packets are generated, minus stunnel it's more like 500. I'd expect some overhead related to SSL, but 21 times the traffic seems a little excessive. I've experimented with socket options such as TCP_NODELAY, SO_LINGER, SO_RCVLOWAT, SO_OOBINLINE, etc with no improvement at all. However, my understanding of these is pretty superficial so I'm not confident I've exhausted all options here (ie perhaps combining multiple settings at once). I've got stunnel debug set to 7 on client and server. No errors and no logging at all except for the initial handshake when the mount is created. Including the tcpdump would probably be excessive at this stage. In summary, using stunnel the data gets transmitted in packets usually containing around 200 bytes, whereas without stunnel it's mostly 1408 byte packets. Any suggestions? Thanks Paul

4 4

Stunnel Newbie - Compiling Stunnel and adding patches for Windows
by GGrant 02 Apr '08

02 Apr '08

Hi, I've downloaded the Stunnel source code and I am trying to compile it with the Visual C++ compiler (cl.exe). I am not sure what to do as I cannot find the Makefile.w32. So how do I go about it? Also how do you apply a user patch to the source code/ Must I copy and paste the code to the required files? Cheers -- View this message in context: http://www.nabble.com/Stunnel-Newbie---Compiling-Stunnel-and-adding-patches… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Stunnel-Openssl: Problems with certificate chain
by Pietro Di Primo 31 Mar '08

31 Mar '08

Hi, My name is Pietro Di Primo and I work on the INFN Grid project (http://grid.infn.it/) I'm trying to develop an application based on stunnel. Everything works well when I use user certificates (signed by our CA), but i need to use (on the client side) a particular proxy. This proxy contains a public and a private key, and the public key of the user that generated it (I atteched a file with a such proxy). On the server side I have the CA certificate but not the user's one, so I can't verify the client (unable to get local issuer certificate). I tried to get the user certificate using the SSL_get_peer_cert_chain function on the server, but it returns NULL. On the client side I tried SSL_CTX_use_certificate_chain_file, Also I tried to get a STACK_OF(X509) and use SSL_CTX_use_certificate (for proxy certificate), and SSL_CTX_add_extra_chain_cert (to include the user's certificate), but it still doesn't work. Can you help me please? Best Regards -- --- Ing. Pietro Di Primo INFN - Istituto Nazionale di Fisica Nucleare Grid Computing Research Area Via S. Sofia 78 95123 CATANIA (Italy) Voice : +39 095 378-5446/5517 Fax. : +39 095 378 5518 Mobile : +39 320 8591527 E-mail : pietro.diprimo(a)ct.infn.it Skype : pietrodiprimo

1 0

Re: [stunnel-users] Enhancement request - Increase thread stack size
by Mccue, Richard Alan 26 Mar '08

26 Mar '08

Michal Trojnara wrote: >> I load an engine into Stunnel to access the private key. The engine loads >> without incident, but Stunnel consistently aborts when creating a session >> with the first peer because the thread stack is too small. > > I'm not sure if it's a good idea to sacrifice stunnel scalability for > compatibility with this engine. Thread stack size is one of the main > limitations for the number of concurrent threads on 32-bit platforms. IMHO > it's better to fix the engine code to allocate its buffers on the heap.> > > What do you think? All things considered, I must agree that reducing the engine use of the stack would be the better solution. I'll look it over and see if I can find anything sizable on the stack to move. Thanks for the suggestion! - Rich

2 2

New libwrap code
by Randy McMurchy 26 Mar '08

26 Mar '08

Hi all, My apologies if this has been discussed (I've reviewed the archives since 4.21 was released), and if so please just point me in the right direction. I read in some of the messages there's been a revamp (overhaul, changes, whatever) of the libwrap code in Stunnel-4.21. I'm not having any issues using the new version, however, I'm seeing it spawn 5 processes where in every other version I've used in the past there has always only been one process spawned. Here's what I see: root 3408 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3409 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3410 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3411 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel root 3412 1 0 17:50 pts/10 00:00:00 /usr/bin/stunnel stunnel 3413 1 0 17:50 ? 00:00:00 /usr/bin/stunnel Is this a product of the new libwrap code? I turned debug messages WAY up and I see over and over startup messages for all 5 processes. Example of one: 2008.03.25 17:50:24 LOG5[3407:3082803904]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 2008.03.25 17:50:24 LOG5[3407:3082803904]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP 2008.03.25 17:50:24 LOG6[3407:3082803904]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.03.25 17:50:24 LOG6[3407:3082803904]: poll() used - no FD_SETSIZE limit for file descriptors 2008.03.25 17:50:24 LOG5[3407:3082803904]: 500 clients allowed 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 9 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 10 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: FD 11 in non-blocking mode 2008.03.25 17:50:24 LOG7[3407:3082803904]: SO_REUSEADDR option set on accept socket 2008.03.25 17:50:24 LOG7[3407:3082803904]: swat bound to 0.0.0.0:904 2008.03.25 17:50:24 LOG7[3413:3082803904]: Created pid file /run/stunnel.pid 2008.03.25 17:50:42 LOG7[3413:3082803904]: swat accepted FD=12 from 192.168.11.212:1535 2008.03.25 17:50:42 LOG7[3413:3086076816]: swat started 2008.03.25 17:50:42 LOG7[3413:3086076816]: FD 12 in non-blocking mode 2008.03.25 17:50:42 LOG7[3413:3086076816]: Waiting for a libwrap process 2008.03.25 17:50:42 LOG7[3413:3086076816]: Acquired libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: Releasing libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: Released libwrap process #0 2008.03.25 17:50:42 LOG7[3413:3086076816]: swat permitted by libwrap from 192.168.11.212:1535 2008.03.25 17:50:42 LOG5[3413:3086076816]: swat accepted connection from 192.168.11.212:1535 When I connect to swat (Samba config tool) it again goes through a process of using all 5 of the system processes. Sorry for being so verbose here. My question is: Has something changed so that there is more than one process spawned (and used) when Stunnel is started? Any help would be appreciated. -- Randy

1 0