stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

Re: [stunnel-users] winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D)
by flash＠vicsmba.com 29 Jun '20

29 Jun '20

It will never be entirely random. Some range more than likely. You may be able to restrict the range. You could certainly set stunnel up for each “random” port. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Brent Kimberley Sent: Friday, June 26, 2020 4:11 PM To: Thomas Ward <teward(a)thomas-ward.net>; stunnel-users(a)stunnel.org; Coviello, Paul <pcoviello(a)ccsusa.com> Subject: Re: [stunnel-users] winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D) What are you trying to accomplish? I.e. Is TLS the best wrapper for the job? (i.e. TCP over TCP.) On Thursday, June 25, 2020, 11:44:38 a.m. EDT, Coviello, Paul <pcoviello(a)ccsusa.com <mailto:pcoviello@ccsusa.com> > wrote: Maybe, I also just found out that the port it goes out is not what I thought it was. It’s a random port. Not sure if it’s doable now. Thanks for your help

1 0

winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D)
by Brent Kimberley 26 Jun '20

26 Jun '20

Hi Paul. With respect to your winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D), did you open the port in your firewall and authorize communication via anti-virus? > Hi I have a windows 10 machine that I?ve got this running on, and the > screen shot below is what I keep getting and I am unable to find the issue, > > Can someone please shed some light as to what is wrong? And what else you may need.

3 4

server is down message
by Coviello, Paul 24 Jun '20

24 Jun '20

Hi I have a windows 10 machine that I've got this running on, and the screen shot below is what I keep getting and I am unable to find the issue, Can someone please shed some light as to what is wrong? And what else you may need. Thanks Paul [cid:image001.png@01D6495F.3B2D17A0]

3 4

Fwd: Update Stunnel 5.44 - Ubuntu 18.04
by Juan Amores 19 Jun '20

19 Jun '20

---------- Forwarded message --------- De: Juan Amores <canalamores(a)gmail.com> Date: jue., 18 jun. 2020 a las 20:03 Subject: *Update Stunnel 5.44 - Ubuntu 18.04* I installed Stunnel4 via apt-get install command. The version you installed for me is old (5.44), I have tried updating it via apt-get update but there are no updated packages in Ubuntu 18.04. Is there a way to update it and keep it working as a service like before? Attached screenshot with linux, stunnel and openssl versions. Any other additional data you need to provide just ask me. [image: stunnel.png] Greetings, Juan Amores

2 2

Fw: How to configure STunnel so that new log file is automatically created after a certain threshold
by Muhammad Muneeb Hashmi 17 Jun '20

17 Jun '20

Hi STunnel Team, Is there a way where a new STunnel log file is automatically generated when the current log file reaches a certain threshold in Windows. Any help will be highly appreciated. Regards,Muneeb

1 0

CAPI_GET_KEY:cryptacquirecontext error
by Michael S. Chusovitin 04 Jun '20

04 Jun '20

Dear stunnel users, whereas Stunnel itself looks fine for me, it seems to have some troubles with CAPI engine. The one I cannot manage still is *"CAPI_GET_KEY:cryptacquirecontext error"* logged when attempting to export the client's key. I tried to add *"engineCtrl = csp_name:Microsoft Enhanced RSA and AES Cryptographic Provider"* to stunnel.conf, and then *"CAPI_**CTX_SET_PROVNAME:**cryptacquirecontext error"* was logged instead of the above one. The same certificate is used happily with no-capi configuration. I suppose the problem is somehow related to sha256 signature in the certificate. Are there any chances to workaround? Stunnel version is 5.48 with OpenSSL 1.0.2o-fips. (in this very case I need to use 32bit version, so no possibility to upgrade). Thanks!

2 5

Re: [stunnel-users] Need help connecting Eudora to mail servers
by Phil Smith III 28 May '20

28 May '20

I'm still tinkering here, trying to get Yahoo+stunnel working to help out Joe Slaven. I still can't get it to work. Yahoo userid is y_phsiii. I manually logged into Yahoo and verified that I have the right password. The config section: -- [Yahoo] client = yes accept = localhost:1234 connect = pop.mail.yahoo.com:995 sslVersion = TLSv1.2 -- Eudora has -- POPPort=1234 -- for that personality. Log: -- 2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] accepted connection from 127.0.0.1:50287 2020.05.27 11:36:48 LOG6[29]: failover: priority, starting at entry #0 2020.05.27 11:36:48 LOG6[29]: s_connect: connecting 98.137.157.46:995 2020.05.27 11:36:48 LOG5[29]: s_connect: connected 98.137.157.46:995 2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] connected remote server from 192.168.1.4:50288 2020.05.27 11:36:48 LOG6[29]: SNI: sending servername: pop.mail.yahoo.com 2020.05.27 11:36:48 LOG6[29]: Peer certificate not required 2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled 2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled 2020.05.27 11:36:48 LOG6[29]: Client certificate not requested 2020.05.27 11:36:48 LOG6[29]: Session id: F26CEF81143B96B8BD0D2C504CBB534082242BF337D3D29DE911CD5AC05B6DE0 2020.05.27 11:36:48 LOG6[29]: TLS connected: new session negotiated 2020.05.27 11:36:48 LOG6[29]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2020.05.27 11:37:48 LOG6[29]: TLS socket closed (SSL_read) 2020.05.27 11:37:48 LOG5[29]: Connection closed: 38 byte(s) sent to TLS, 130 byte(s) sent to socket -- Eudora error (Personality is named just "y" since it's just a test): -- y, Logging into POP Server, PASS [11:33:29 AM] There has been an error transferring your mail. I said: PASS <shhhh! Don't tell anyone.> and then the POP server (y_phsiii(a)127.0.0.1) said: ERR [SYS/TEMP] Server error - Please try again later. --

3 3

blackhole problem - please help to tune stunnel
by Michael S. Chusovitin 28 May '20

28 May '20

Dear stunnel users, please advise how to solve the following: - an Application connects to stunnel-client (installed at the same machine); - stunnel-client tries to connect to stunnel-server (remote), fails and sends RST to the App; - but the App has already sent some datagrams to stunnel-client during TIMEOUTconnect period and they aren't transferred to stunnel-server. Is there any way to make stunnel-client delay its ACK to the App until the connection to stunnel-server is established? Thanks!

1 0

Need help connecting Eudora to mail servers
by Joe Slaven 26 May '20

26 May '20

Below are the contents of my config file: Question 1. Is the output statement correct? I cannot find the log file. I expected it to be in the stunnel folder in the Program (x86) folders Question 2. Is it permissable to install code for all three email servers, using the same ports and settings in Eudora? Question 3. All three have error messages in Eudora ie none of them work via stunnel. Can anyone please show me where I am going wrong? I have listed the error message for Gmail below. There is no log file that I can find. Bigpond error message: There has been an error transferring your mail POP server [JoeS4814(a)127.0.0.1 ] said ERR[AUTH] Username and Password not accepted thanks for helping out, Joe ;*************************************************************** ; STUNNEL LOG output = stunnel.log ; ;***************************************************************** ;******************************************************* ;Yahoo connection ;******************************************************* [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes ; ;******************************************************* ;Bigpond connection ;***************************************************** [bigpond-pop3] client = yes accept = 127.0.0.1:110 connect = pop.bigpond.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.bigpond.com OCSPaia = yes [bigpond-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.bigpond.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.bigpond.com OCSPaia = yes ;************************************* ;Gmail connection ;******************************************** [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes

3 7

[PATCH] Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid
by Simon Arlott 26 May '20

26 May '20

Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid I'd like to be able to use "transparent = source" and "setuid" to drop full root privileges. It is possible to do this by keeping either the CAP_NET_ADMIN or CAP_NET_RAW capability. This is based on https://github.com/dlundquist/sniproxy/commit/0ab83f8f45f73ba18ea5f84ccccd9… The capability will not be inherited if "exec" is used: Name: stunnel Uid: 996 996 996 996 Gid: 988 988 988 988 ... CapInh: 0000000000000000 CapPrm: 0000000000002000 CapEff: 0000000000002000 --- It would be possible to keep CAP_NET_BIND_SERVICE too, to allow reloading a configuration that binds to ports below 1024. I don't think stunnel should keep this capability unless a service needs it at startup. CREDITS.md | 25 ++++++++++ configure.ac | 33 ++++++++++++++ doc/stunnel.8.in | 2 +- doc/stunnel.html.in | 2 +- doc/stunnel.pod.in | 2 +- src/stunnel.c | 109 ++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 170 insertions(+), 3 deletions(-) diff --git a/CREDITS.md b/CREDITS.md index 6567392..5f12f92 100644 --- a/CREDITS.md +++ b/CREDITS.md @@ -27,6 +27,31 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +libcap usage in version 5.57 (from sniproxy): +Copyright 2017 Dustin Lundquist <dustin(a)null-ptr.net> +Copyright 2020 Simon Arlott + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE HOLDERS OR +CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, +EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + Several bugfixes and improvements mostly in versions 3.xx: * Brian Hatch <bri(a)stunnel.org> diff --git a/configure.ac b/configure.ac index 9c2b2b6..f454710 100644 --- a/configure.ac +++ b/configure.ac @@ -352,6 +352,39 @@ AC_ARG_ENABLE(systemd, ] ) +# Disable POSIX capabilities support +AC_MSG_CHECKING([whether to enable POSIX capabilities support]) +AC_ARG_ENABLE(libcap, +[ --disable-libcap disable POSIX capabilities support], + [ + case "$enableval" in + yes) AC_MSG_RESULT([yes]) + AC_SEARCH_LIBS([cap_get_proc], [cap]) + AC_DEFINE([USE_LIBCAP], [1], + [Define to 1 to enable POSIX capabilities]) + ;; + no) AC_MSG_RESULT([no]) + ;; + *) AC_MSG_RESULT([error]) + AC_MSG_ERROR([Bad value \"${enableval}\"]) + ;; + esac + ], + [ + AC_MSG_RESULT([autodetecting]) + AC_SEARCH_LIBS([cap_get_proc], [cap], + [ AC_CHECK_HEADERS([sys/capability.h], [ + AC_DEFINE([USE_LIBCAP], [1], + [Define to 1 to enable POSIX capabilities]) + AC_MSG_NOTICE([libcap support enabled]) + ], [ + AC_MSG_NOTICE([libcap header not found]) + ]) ], [ + AC_MSG_NOTICE([libcap library not found]) + ]) + ] +) + # Disable use of libwrap (TCP wrappers) # it should be the last check! AC_MSG_CHECKING([whether to enable TCP wrappers support]) diff --git a/doc/stunnel.8.in b/doc/stunnel.8.in index b3df016..4b121bc 100644 --- a/doc/stunnel.8.in +++ b/doc/stunnel.8.in @@ -1251,7 +1251,7 @@ setuid .RS 4 .Sp The use of the 'setuid' option will also prevent \fBstunnel\fR from binding to privileged -(<1024) ports during configuration reloading. +(<1024) ports during configuration reloading or enabling of 'transparent = source'. .Sp When the 'chroot' option is used, \fBstunnel\fR will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot diff --git a/doc/stunnel.html.in b/doc/stunnel.html.in index ee9e5d9..95a1b51 100644 --- a/doc/stunnel.html.in +++ b/doc/stunnel.html.in @@ -1506,7 +1506,7 @@ </li> </ul> -The use of the 'setuid' option will also prevent stunnel from binding to privileged (<1024) ports during configuration reloading. +The use of the 'setuid' option will also prevent stunnel from binding to privileged (<1024) ports during configuration reloading or enabling of 'transparent = source'. When the 'chroot' option is used, stunnel will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot jail. diff --git a/doc/stunnel.pod.in b/doc/stunnel.pod.in index e9abd4f..8f14fd9 100644 --- a/doc/stunnel.pod.in +++ b/doc/stunnel.pod.in @@ -1360,7 +1360,7 @@ setuid =back The use of the 'setuid' option will also prevent B<stunnel> from binding to privileged -(<1024) ports during configuration reloading. +(<1024) ports during configuration reloading or enabling of 'transparent = source'. When the 'chroot' option is used, B<stunnel> will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot diff --git a/src/stunnel.c b/src/stunnel.c index 8121e0c..b84ce72 100644 --- a/src/stunnel.c +++ b/src/stunnel.c @@ -58,6 +58,11 @@ #endif /* USE_WIN32 */ +#ifdef USE_LIBCAP +#include <sys/prctl.h> +#include <sys/capability.h> +#endif + /**************************************** prototypes */ #ifdef __INNOTEK_LIBC__ @@ -191,6 +196,59 @@ int drop_privileges(int critical) { #ifdef HAVE_SETGROUPS gid_t gr_list[1]; #endif +#ifdef USE_LIBCAP + SERVICE_OPTIONS *opt; + int need_caps = 0; + cap_t caps; + cap_value_t cap_list[1]; + int keepcaps = 0; +#endif + +#ifdef USE_LIBCAP + for (opt = service_options.next; opt; opt = opt->next) { + if (opt->option.transparent_src) { /* transparent_src is enabled for this service */ + need_caps = 1; + break; + } + } + + /* add permitted flag to capability needed for IP_TRANSPARENT */ + if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) { + const char *cap_failed = NULL; + + caps = cap_get_proc(); + if (caps != NULL) { + cap_list[0] = CAP_NET_RAW; + if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flags[before]"; + goto cap_cleanup_before; + } + + if (cap_set_proc(caps) == -1) { + cap_failed = "cap_set_proc[before]"; + goto cap_cleanup_before; + } + + /* keep capabilities after setuid */ + if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) { + cap_failed = "prctl[before]"; + goto cap_cleanup_before; + } else { + keepcaps = 1; + } + +cap_cleanup_before: + cap_free(caps); + if (cap_failed != NULL && critical) { + sockerror(cap_failed); + return 1; + } + } else if (critical) { + sockerror("cap_get_proc[before]"); + return 1; + } + } +#endif /* set uid and gid */ if(service_options.gid) { @@ -212,6 +270,57 @@ int drop_privileges(int critical) { return 1; } } + +#ifdef USE_LIBCAP + /* enable capability needed for IP_TRANSPARENT */ + if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) { + const char *cap_failed = NULL; + + caps = cap_get_proc(); + if (caps != NULL) { + /* remove every capability from the list */ + cap_clear(caps); + cap_list[0] = CAP_NET_RAW; + + /* take back capability */ + if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flag[after]"; + goto cap_cleanup_after; + } + + if (cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flag[after]"; + goto cap_cleanup_after; + } + + if (cap_set_proc(caps) == -1) { + cap_failed = "cap_set_proc[after]"; + goto cap_cleanup_after; + } + /* from now on it the new capability list is active, + * no other capabilities may be enabled */ + +cap_cleanup_after: + cap_free(caps); + if (cap_failed != NULL && critical) { + sockerror(cap_failed); + return 1; + } + } else if (critical) { + sockerror("cap_get_proc[after]"); + return 1; + } + } + + /* disable keeping capabilities across setuid */ + if (keepcaps && prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) == -1) { + if (critical) { + sockerror("prctl"); + return 1; + } + } +#endif + #endif /* standard Unix */ return 0; } -- 2.17.1 -- Simon Arlott

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users