Some troubles with PROXY protocol

Hi, I try to use PROXY protocol ability for my virtual server, but this options work for root section only. E.g. it not work for this simple case: [virtual_server] accept = 443 connect = localhost:1081 cert = /etc/stunnel/serverCA.crt key = /etc/stunnel/serverCA.key verify = 2 CAfile = /etc/stunnel/serverCA.crt [server_ru] sni = virtual_server:server.ru cert = /etc/stunnel/server.cer key = /etc/stunnel/server.pem connect = localhost:7000 protocol = proxy <-- option don not work there This problem exist due some code bug: NOEXPORT void client_try(CLI *c) { init_local(c); if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); // we'll switch to target section (c->opt) there only! init_remote(c); } else { protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); protocol(c, PROTOCOL_POST_SSL); } ... Simple adhoc solution work for me: if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); init_remote(c); // force initiate PROXY protocol protocol(c, PROTOCOL_PRE_SSL); } It's crutch and not general solution certain. But some code refactoring needs for more correct fix. I think that this bug will be fixed in future versions. Thanks for stunnel! :) /Alexey V. Drozdov e-mail: anyquist@yandex.ru

On 2014-03-26 23:44, Alexey V. Drozdov wrote:
if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy
Good point. My patch (to be included in stunnel 5.01) is: --- client.c.orig 2014-03-31 18:36:23.000000000 +0200 +++ client.c 2014-03-31 18:43:08.000000000 +0200 @@ -219,7 +219,11 @@ NOEXPORT void client_try(CLI *c) { init_local(c); - if(!c->opt->option.client && c->opt->protocol<0) { + if(!c->opt->option.client && c->opt->protocol<0 +#ifndef OPENSSL_NO_TLSEXT + && !c->opt->servername_list_head +#endif + ) { /* server mode and no protocol negotiation needed */ init_ssl(c); init_remote(c); Mike
participants (2)
-
Alexey V. Drozdov
-
Michal Trojnara