issue making stunnel 4.35 use an apache http proxy to go out?
I've got an Apache proxy on port 3128 that will allow our clients to get outbound with a 'CONNECT" to a few services.. I'm trying to make stunnel use this service, and it seems to be ignoring my configuration completely. Tcpdumps show NO packets going outbound on port 3128... any ideas what i'm doing wrong? This config allows an inbound connection to port 1234 to hit port 2345 (a local service), while also handling the setup of an inbound connection to localhost:514 to a remote host on port 1514... debug = 7 pid = /var/run/stunnel.pid service = stunnel syslog = yes foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 fips = no # Localhost:1234 hits localhost:2345 [cseservices] client = no accept = 1234 connect = 127.0.0.1:2345 CAfile = /etc/stunnel/ssl/tunnel-CAs.cert.pem cert = /etc/stunnel/ssl/server.pub key = /etc/stunnel/ssl/server.key verify = 2 ## Localhost:514 hits remotehost:1514 [syslog] client = yes accept = 514 connect = xxx:1514 CAfile = /var/lib/puppet/ssl/certs/ca.pem key = /var/lib/puppet/ssl/private_keys/xxx.pem cert = /var/lib/puppet/ssl/certs/xxx.pem session = 5 TIMEOUTidle = 600 TIMEOUTbusy = 600 TIMEOUTclose = 300 TIMEOUTconnect = 10 verify = 2 protocol=connect protocolHost=proxy:3128 protocolAuthentication=basic —Matt
Am I reading the source code right ... it seems like there might be a bug in the way it looks for the protocol option:
if(c->opt->option.client) { if(!strcmp(c->opt->protocol, "cifs")) cifs_client(c); else if(!strcmp(c->opt->protocol, "smtp")) smtp_client(c); else if(!strcmp(c->opt->protocol, "pop3")) pop3_client(c); else if(!strcmp(c->opt->protocol, "imap")) imap_client(c); else if(!strcmp(c->opt->protocol, "nntp")) nntp_client(c); else if(!strcmp(c->opt->protocol, "connect")) connect_client(c); else if(!strcmp(c->opt->protocol, "pgsql")) pgsql_client(c);
It seems most places in the code get their 'options' by checking c->opt->option.<option name>... but here, it is looking for c->opt->protocol.. I'm not sure, but that just seems different than everywhere else? On Apr 8, 2011, at 9:26 AM, Matt Wise wrote:
I've got an Apache proxy on port 3128 that will allow our clients to get outbound with a 'CONNECT" to a few services.. I'm trying to make stunnel use this service, and it seems to be ignoring my configuration completely. Tcpdumps show NO packets going outbound on port 3128... any ideas what i'm doing wrong? This config allows an inbound connection to port 1234 to hit port 2345 (a local service), while also handling the setup of an inbound connection to localhost:514 to a remote host on port 1514...
debug = 7 pid = /var/run/stunnel.pid service = stunnel syslog = yes foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 fips = no
# Localhost:1234 hits localhost:2345 [cseservices] client = no accept = 1234 connect = 127.0.0.1:2345 CAfile = /etc/stunnel/ssl/tunnel-CAs.cert.pem cert = /etc/stunnel/ssl/server.pub key = /etc/stunnel/ssl/server.key verify = 2
## Localhost:514 hits remotehost:1514 [syslog] client = yes accept = 514 connect = xxx:1514 CAfile = /var/lib/puppet/ssl/certs/ca.pem key = /var/lib/puppet/ssl/private_keys/xxx.pem cert = /var/lib/puppet/ssl/certs/xxx.pem session = 5 TIMEOUTidle = 600 TIMEOUTbusy = 600 TIMEOUTclose = 300 TIMEOUTconnect = 10 verify = 2 protocol=connect protocolHost=proxy:3128 protocolAuthentication=basic
—Matt
_______________________________________________ stunnel-users mailing list stunnel-users@stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users
participants (1)
-
Matt Wise