- stunnel-users - stunnel.org

windows load levels
by Alex Turner 05 Sep '06

05 Sep '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.11.7/437 - Release Date: 04/09/2006

2 1

Stunnel and CryptoApi
by Marco Aldegheri 05 Sep '06

05 Sep '06

Hello list! Someone knows if there is any way to integrate a Windows stunnel in client mode with the Windows Certificate Store? As OpenVPN does with the cryptoapicert parameter in my opinion it would be very useful because: 1. the private key would not just reside in a pem file but could be set not exportable. 2. the private key could be saved on a smartcard. I found a japaneese wstunnel project that seems to do it but I couldn't find any document about it in english and the gui is only in japaneese. Any hints? Thank you, Marco Aldegheri __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Real address of client
by Gonzalo Diethelm 04 Sep '06

04 Sep '06

Hello, linux: Linux asus-gonzo 2.6.15-26-686 #1 SMP PREEMPT Thu Aug 3 03:13:28 UTC 2006 i686 GNU/Linux stunnel: stunnel 4.14 on i486-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 apache: Apache/2.0.55 I am using stunnel in Ubuntu to provide https serving to an http-only Apache installation. The stunnel config is: cert = /home/gonzo/src/bg/run/SSL/server.crt key = /home/gonzo/src/bg/run/SSL/server.crt chroot = /var/run/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = no [https] accept = 443 connect = 80 TIMEOUTclose = 0 Everything works perfectly, except for one minor detail: on the server, my PHP scripts do not have access to the real IP address of the client, and they always see this value as 127.0.0.1. I am aware the manual says that, if you use -l or -L, there will be an additional REMOTE_HOST environment variable with the desired IP address, but I am not sure how to make this work from a setup like mine, where the http server process is already running. Any help or hints are greatly appreciated. Best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

4.16 compilation fails for openssl without engine
by Hans Werner Strube 01 Sep '06

01 Sep '06

When openssl was compiled without engine support, compilation of src/ssl.c in stunnel-4.16 fails because of a misplaced #endif. Patch: --- src/ssl.c.ORI Thu Jun 29 23:12:03 2006 +++ src/ssl.c Fri Sep 1 11:30:25 2006 @@ -286,8 +286,6 @@ s_log(LOG_DEBUG, "Engine %d initialized", current_engine+1); } -#endif - ENGINE *get_engine(int i) { if(i<1 || i>current_engine) return NULL; @@ -294,4 +292,6 @@ return engines[i-1]; } +#endif + /* End of ssl.c */

1 0

Duplicate 220 in protocol.c, smtp_server
by Hans Werner Strube 01 Sep '06

01 Sep '06

At least since stunnel 4.15 - but not yet in 4.09 (don't know about the intermediate versions) - there is a (cosmetic only?) bug in the "welcome" forwarding of the smtp_server in protocol.c (lines 177-187 in 4.16): fdgetline(c, c->remote_fd.fd, line); if(!isprefix(line, "220")) { s_log(LOG_ERR, "Unknown server welcome"); longjmp(c->err, 1); } fdprintf(c, c->local_wfd.fd, "220%s + stunnel", line); fdgetline(c, c->local_rfd.fd, line); if(!isprefix(line, "EHLO ")) { s_log(LOG_ERR, "Unknown client EHLO"); longjmp(c->err, 1); } Although the line read from remote_fd.fd already starts with "220", another 220 is prepended in forwarding to local_wfd.fd, line 182. This seems to haveno adverse effects, but this line should better be changed to: fdprintf(c, c->local_wfd.fd, "%s + stunnel", line);

1 0

stunnel 4.16 released
by Michal Trojnara 01 Sep '06

01 Sep '06

A new version of stunnel has been released. Version 4.16, 2006.08.31, urgency: MEDIUM: * New features sponsored by Hewlett-Packard - A new global option to control engine: engineCtrl = <command>[:<parameter>] - A new service-level option to select engine to read private key: engineNum = <engine number> - OCSP support: ocsp = <URL> * New features - A new option to select version of SSL protocol: sslVersion = all|SSLv2|SSLv3|TLSv1 - Visual Studio vc.mak by David Gillingham <dgillingham(a)gmail.com>. - OS2 support by Paul Smedley (http://smedley.info) * Bugfixes - An ordinary user can install stunnel again. - Compilation problem with --enable-dh fixed. - Some minor compilation warnings fixed. - Service-level CRL cert store implemented. - GPF on protocol negotiations fixed. - Problem detecting addrinfo() on Tru64 fixed. - Default group is now detected by configure script. - Check for maximum number of defined services added. - OpenSSL_add_all_algorithms() added to SSL initialization. - configure script sections reordered to detect pthread library funcions. - RFC 2487 autodetection improved (thx to Hans Werner Strube). High resolution s_poll_wait() not currently supported by UCONTEXT threading. - More precise description of cert directory file names (thx to Muhammad Muquit). * Other changes - Maximum number of services increased from 64 to 256 when poll() is used. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1 hash for stunnel-4.16.tar.gz file: 6772e0c7f26c2596564ba66978597db8cd229a72 Best regards, Mike

2 1

Windows simultaneous sockets
by Alex 26 Aug '06

26 Aug '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ -- www.deployview.com www.nerds-central.com www.project-network.com

1 0

stunnel and AJP
by Jones Scott - sjones 26 Aug '06

26 Aug '06

Has anyone used stunnel to secure AJP traffic from apache to jboss *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

2 1

stunnel 4-15 through proxy server
by Ingvar Tjøstheim 25 Aug '06

25 Aug '06

Hello I am on a network at work behind a firewall and a proxy server. I can connect to my friends linux computer with putty using proxy configuration and port 443. My friend set up his SSH server on port 443, of course. Yesterday, back home, I installed the following on my Windows2000 computer: Win32OpenSSL-v0.9.8b stunnel ver 4-14 FreeProxy version 3.92 This is the stunnel config file for my home computer: client=no verify=0 [wow] accept = 443 connect = 127.0.0.1:3456 TIMEOUTclose = 0 I set up my router to forward port 443 to this computer. I also registered a DynDNS domain and set up a client to update it. Then, still at home, I prepared another computer which I brought to work today. I installed the following on an XP machine: Win32OpenSSL-v0.9.8b stunnel ver 4-14 (which I upgraded to 4.15 today) SockScap_sc32r238 I set up SockScap to connect to 127.0.0.1 on port 2345 and used it to tunnel a program to the internet through my LAN and this Win2K computer. This was working fine when I was at home. My network at home has no proxy server, and I changed stunnel on my XP computer once at work to version 4-15. Then I added the two protocol lines in the config file as you see below. This is the config file on my XP computer at work: verify = 0 client = yes [wow] accept = 2345 protocol = connect protocolHost = www-proxy.DOMAINNAME.no:80 connect = MYDOMAINNAME.dnsalias.com:443 TIMEOUTclose = 0 Now, the funny thing is that it doesn't work. I used to have a SSH server on my computer at home (which is not running now), and I could connect to it from work. I know the setup could work if I just did things right. I know the FreeProxy and SockScap stuff works, cause it did at home. stunnel and the network is the only difference. Still I get these messages on the XP machine running stunnel as client at work when the SockScap program connects to it: 2006.08.25 10:02:29 LOG5[1280:2940]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.08.25 10:02:29 LOG5[1280:2940]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.08.25 10:02:29 LOG5[1280:2156]: No limit detected for the number of clients 2006.08.25 10:02:59 LOG5[1280:664]: wow connected from 127.0.0.1:3723 2006.08.25 10:03:05 LOG5[1280:972]: wow connected from 127.0.0.1:3725 2006.08.25 10:03:09 LOG5[1280:664]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.08.25 10:03:15 LOG5[1280:972]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ...and it doesn't work. The program I try using through the tunnel never manages to connect. Anyone have a clue? Thank you very much!

1 0

Re: [stunnel-users] safestring and safename insecure
by Hans Werner Strube 24 Aug '06

24 Aug '06

Michal Trojnara wrote: > Assuming on some systems isprint(x) != isprint(x&0xff): any idea how to > exploit this "insecure" code? > > BTW: At least on Linux and Mac OS X isprint() returns 0 in both cases. The same holds for Solaris. I did not actually encounter an error but just got the idea that something may be insecure here by looking at the lines. After all, isprint etc. are often table-based macros without range-checking the argument. And "man isprint" clearly says that the character is unsigned: (Solaris:) The macro isascii() is defined on all integer values; the rest are defined only where the argument is an int, the value of which is representable as an unsigned char, or EOF, (Linux:) These functions check whether c, which must have the value of an unsigned char or EOF, falls into a certain character class according to the current locale.

1 0