Hi Brian,

I am looking to have my two stunnel's (client and server) work together to determine if an SSL connection should be closed. The client stunnel will send some data to the server stunnel. The server stunnel will make the decision to close the session. I want to send the extra data in an HTTP GET method request, and I am thinking an additional HTTP request header should do the trick. If I had unlimited time I'd try to make these changes to the SSL code in my browser (Firefox) and the web server (Tomcat) and not use stunnel. I chose to work with stunnel because it's easier than trying to obtain and master the code used in Firefox and Tomcat.

The problem I am seeing is that stunnel is a "dumb" proxy, and as such works quite well with a lot of protocols, because it does not care about the protocol. Getting it to do some protocol specific work is the key.

Regards.

On Wed, Mar 26, 2014 at 8:13 AM, Brian Wilkins <bwilkins@gmail.com> wrote:

I am a little confused by your question. If you control the
unencrypted side, you should be able to use Wireshark to sniff the
connection between your network application's unencrypted channel to
stunnel. Nothing really fancy. Off the top of my head, you could
replay captured packets after you have modified them.

On Wed, Mar 26, 2014 at 8:05 AM, Michael Carlino (RIT Student)
<mac9951@rit.edu> wrote:
> Hello stunnel users,
> I am working with what seems to be the standard stunnel HTTPS configuration.
> I have two instances of stunnel, one as a client and one as a server. The
> client accepts connections from a browser. The server sits in front of
> tomcat. If works like a charm (of course!).
>
> What I need to do seems simple, and I will try to keep my description of it
> generic. In the client stunnel I need to make a small change to the HTTP
> packet. I need to add some data to it. At the server side I need to access
> that added data. The server stunnel may close the SSL session based on that
> data.
>
> So, my question is: can I obtain access to the packet before it's encrypted
> and sent out over SSL? Can I get access to the decrypted packet before it's
> sent on to tomcat?
>
> I know that as a proxy stunnel has to be and tries to be general in nature.
> I am not concerned (right now) with developing a feature that will become
> available to others later. I don't mind if my changes make my development
> version of stunnel single-purpose. My work is academic and proof-of-concept
> in it's nature.
>
> I have collected references and a text book (Network Security with OpenSSL
> by Viega et al). I will continue to walk through and explore the code. Are
> there any programmer resources I can obtain? I see the occasional URL in
> the stunnel source code. I will have to check these URLs.
>
> ---
>
> I just now pursued
> http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt, and I see that
> there is a patch that allows stunnel to do an initial modification to the
> HTTP request to insert a X-Forwarded-For header. This sounds like what I
> need to do! I am going to look for that patch. I hope the source code for
> the patch is available.
>
> Please, if anyone has any advice, war stories, criticism, whatever... I
> would very much appreciate it.
>
> Regards.
>

> _______________________________________________
> stunnel-users mailing list
> stunnel-users@stunnel.org
> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
>