- stunnel-users - stunnel.org

[Sebastian.Leske@sleske.name: Bug#637932: stunnel4: segfault if certificate file cannot be read during verification]
by Rodrigo Gallardo 17 Aug '11

17 Aug '11

----- Forwarded message from Sebastian Leske <Sebastian.Leske(a)sleske.name> ----- Date: Mon, 15 Aug 2011 21:21:05 +0200 Package: stunnel4 Version: 3:4.40-1 Severity: normal I use certificate verification with stunnel4 (verify=2 in stunnel.conf). I accidentally changed the access rights of a PEM file required for verification to be unreadable. As a consequence, stunnel4 incorrectly reports "Verification error: self signed certificateVerification error: self signed certificate" (the cert in question is not self-signed), then segfaults. With stunnel4 version 4.29-1_i386, this does not occur: stunnel4 correctly reports that it cannot access the PEM file. Log and backtrace (generated with setting foreground=yes in stunnel.conf): Starting program: /usr/bin/stunnel4 /etc/stunnel/stunnel.conf [Thread debugging using libthread_db enabled] 2011.08.15 21:16:54 LOG5[9584:3082946768]: stunnel 4.40 on i486-pc-linux-gnu platform 2011.08.15 21:16:54 LOG5[9584:3082946768]: Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 2011.08.15 21:16:54 LOG5[9584:3082946768]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2011.08.15 21:16:54 LOG5[9584:3082946768]: Reading configuration from file /etc/stunnel/stunnel.conf 2011.08.15 21:16:54 LOG6[9584:3082946768]: Compression enabled using zlib method 2011.08.15 21:16:54 LOG6[9584:3082946768]: Initializing SSL context for service pop3sl 2011.08.15 21:16:54 LOG6[9584:3082946768]: SSL context initialized 2011.08.15 21:16:54 LOG6[9584:3082946768]: Initializing SSL context for service https 2011.08.15 21:16:54 LOG6[9584:3082946768]: SSL context initialized 2011.08.15 21:16:54 LOG6[9584:3082946768]: Initializing SSL context for service ssmtp 2011.08.15 21:16:54 LOG6[9584:3082946768]: SSL context initialized 2011.08.15 21:16:54 LOG5[9584:3082946768]: Configuration successful [New Thread 0xb7fdfb70 (LWP 9593)] 2011.08.15 21:16:57 LOG5[9584:3086875504]: Service pop3sl accepted connection from 127.0.0.1:60903 2011.08.15 21:16:57 LOG6[9584:3086875504]: connect_blocking: connecting 213.187.93.221:995 2011.08.15 21:16:57 LOG5[9584:3086875504]: connect_blocking: connected 213.187.93.221:995 2011.08.15 21:16:57 LOG5[9584:3086875504]: Service pop3sl connected remote server from 192.168.1.101:39914 2011.08.15 21:16:57 LOG4[9584:3086875504]: CERT: Verification error: self signed certificate in certificate chain 2011.08.15 21:16:57 LOG4[9584:3086875504]: Certificate check failed: depth=2, /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA 2011.08.15 21:16:57 LOG3[9584:3086875504]: error queue: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7fdfb70 (LWP 9593)] 0xb7ca2119 in ?? () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 (gdb) bt #0 0xb7ca2119 in ?? () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 #1 0xb7ca3c1b in calloc () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 #2 0x0804cd20 in ?? () #3 0x080574bf in ?? () #4 0x08057529 in ?? () #5 0x08058129 in ?? () #6 0x0804d945 in ?? () #7 0x0804e79b in ?? () #8 0x0804fafe in ?? () #9 0xb7f98c39 in start_thread () from /lib/i386-linux-gnu/i686/cmov/libpthread.so.0 #10 0xb7d0196e in clone () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 (gdb) -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (500, 'testing'), (500, 'stable') Architecture: i386 (i686) Kernel: Linux 3.0.0-1-686-pae (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages stunnel4 depends on: ii adduser 3.110 add and remove users and groups ii libc6 2.13-10 Embedded GNU C Library: Shared lib ii libssl1.0.0 1.0.0d-3 SSL shared libraries ii libwrap0 7.6.q-16 Wietse Venema's TCP wrappers libra ii netbase 4.34 Basic TCP/IP networking system ii openssl 1.0.0d-3 Secure Socket Layer (SSL) binary a ii perl-modules 5.12.4-2 Core Perl modules stunnel4 recommends no packages. Versions of packages stunnel4 suggests: pn logcheck-database <none> (no description available) -- no debconf information ----- End forwarded message ----- -- Rodrigo Gallardo

2 1

Sending "LOGOUT" when using StartTLS offloading?
by Markus Borst 17 Aug '11

17 Aug '11

I have to cope with a very unusual imap server behavior, but maybe stunnel can help me: Can stunnel send an imap command ("XX LOGOUT"), just before closing the tcp session? Setup: I use stunnel for SSL/TLS offloading, both via extra port (993) and StartTLS emulation (143). Our imap server (Mercury) has a very peculiar feature: If a tcp connection is closed without properly closing the imap session first (LOGOUT), the server discards certain attributes, specifically, it "forgets" all deletions since last logout. Since many imap clients just tear down the connection in certain cases (for example Thunderbird going into offline mode, many webmailers or stunnel reaching it's "TIMEOUTidle"), this causes mails to be undeleted. We currently use an older version of the mailserver, since only the newest is broken. Needless to say, this does not go well with our users. A fixed version of the imap server may never come, so, until we can switch all users to a new mail system: Is it possible to use stunnel to send an additional imap command before closing the tcp connection (something like "999 LOGOUT")? The command should be sent no matter why the connection is closed, either because the client closed it, a timeout is reached or stunnel is unloaded. If the connection is already cleanly logged out, this doesn't matter, in all other situations it would help. Would it be possible to send such a command, or could this be added as a new feature? Greetings Markus Borst -- ==== Achtung! Umzug: neuer Raum: ==== TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst S4/14/2.4.06 Adresse: Mornewegstr. 30 64293 Darmstadt Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 1

SIP encryption with stunnel
by margot.basa 16 Aug '11

16 Aug '11

Hello all, I would like to know if stunnel is able to encrypt a SIP message (UDP or TCP => TLS...) For example: Terminal A can send/receive SIP messages on transport layer UDP or TCP but not TLS. Server B can send/receive SIP messages only in TLS. If terminal A sends a SIP REGISTER message to Server B, does stunnel is able to intercept the message and transform it ? port 5060 => port 5061 TCP => TLS sip uri => sips uri Do you think it's possible with stunnel ? Thank you very much for your input. Regards Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

Stunnel and CryptoAPI
by ratmahat＠hush.ai 15 Aug '11

15 Aug '11

Hello everyone! I have an interesting question, which i didn't find any answer to after several searches. 1. What if I want to enable client verification with client certificate provided by smart card? Is it possible? 2. Does stunnel has the capability to access Windows certificate store in order to verificate the client certificate with the CA in the store? If anyone ever dealt with this, I'd really appreciate this. Thanks, Rat.

1 0

Odd stunnel problem
by Tristan Schmelcher 09 Aug '11

09 Aug '11

My company uses stunnel on a telecom product and we have run into a strange problem. One of our customers sees an issue every couple weeks where the stunnel process becomes busted. Attempts to establish a connection through stunnel to any host hang indefinitely. Interface stats indicate that stunnel sends and receives a flurry of packets--as if a TLS connection was successfully established--but the local plaintext socket connection to stunnel never passes data. For example, if attempting to run telnet over stunnel, the telnet client just sits there and doesn't write anything to the terminal. During this time the network is otherwise functioning fine. Unfortunately nothing is logged by stunnel when this happens and we haven't been able to reproduce the problem in a controlled environment. Does anyone have any ideas what might be happening? We currently use stunnel 4.35 with debug = warning, sslVersion = TLSv1, and verify = 2.

2 2

stunnel for android
by dddfr 09 Aug '11

09 Aug '11

Hi, I want to use stunnel server in Android Phone ,I don't know how to use it,can you tell me? Thanks! 2011-08-10 dddfr

1 0

doubts with stunnel.conf
by Gabriel Monnerat 09 Aug '11

09 Aug '11

Hello, I am noob in stunnel and I trying configure my environment but I have one problem. My stunnel.conf is: foreground = yes output = /srv/slapgrid/slappart1/var/log/stunnel.log pid = /srv/slapgrid/slappart1/var/run/stunnel.pid syslog = no debug = 7 foreground = yes delay = yes client = yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 key = /srv/slapgrid/slappart1/srv/ca/private/mykey.key cert = /srv/slapgrid/slappart1/srv/ca/certs/mycert.crt [varnish_SOFTINST-51] accept = 10.0.235.44:26012 connect = [2a01:e34:ec03:*:*:*:*:*]:15000 In the stunnel compilation the option "--enable-ipv6" was used. And ipv6 address is one zope server to connect using https I have this traceback: 2011.08.09 00:19:51 LOG7[12724:140272018274048]: local socket: FD=7 allocated (non-blocking mode) 2011.08.09 00:19:51 LOG7[12724:140272018274048]: Service varnish_SOFTINST-51 accepted FD=7 from 10.0.235.44:39673 2011.08.09 00:19:51 LOG7[12724:140272018409232]: Service varnish_SOFTINST-51 started 2011.08.09 00:19:51 LOG7[12724:140272018409232]: Option TCP_NODELAY set on local socket 2011.08.09 00:19:51 LOG5[12724:140272018409232]: Service varnish_SOFTINST-51 accepted connection from 10.0.235.44:39673 2011.08.09 00:19:59 LOG3[12724:140272018409232]: Error resolving '[2a01:e34:ec03:*:*:*:*:*]': Neither nodename nor servname known (EAI_NONAME) 2011.08.09 00:19:59 LOG3[12724:140272018409232]: No host resolved 2011.08.09 00:19:59 LOG5[12724:140272018409232]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.08.09 00:19:59 LOG7[12724:140272018409232]: Service varnish_SOFTINST-51 finished (0 left) 2011.08.09 00:19:59 LOG7[12724:140272018409232]: str_stats: 0 block(s), 0 byte(s) 2011.08.09 00:20:09 LOG7[12724:140272018274048]: local socket: FD=7 allocated (non-blocking mode) 2011.08.09 00:20:09 LOG7[12724:140272018274048]: Service varnish_SOFTINST-51 accepted FD=7 from 10.0.235.44:39675 2011.08.09 00:20:09 LOG7[12724:140272018409232]: Service varnish_SOFTINST-51 started 2011.08.09 00:20:09 LOG7[12724:140272018409232]: Option TCP_NODELAY set on local socket 2011.08.09 00:20:09 LOG5[12724:140272018409232]: Service varnish_SOFTINST-51 accepted connection from 10.0.235.44:39675 2011.08.09 00:20:14 LOG7[12724:140272018274048]: Dispatching signals from the signal pipe 2011.08.09 00:20:14 LOG5[12724:140272018274048]: Received signal 15; terminating 2011.08.09 00:20:14 LOG7[12724:140272018274048]: str_stats: 0 block(s), 0 byte(s) 2011.08.09 00:20:14 LOG7[12724:140272018274048]: removing pid file /srv/slapgrid/slappart1/var/run/stunnel.pid Please, someone can help me? maybe I am doing stupid things.. thanks in advance -- Gabriel M. Monnerat

2 3

Stunnel 4.41 dies after a while
by René Plattner 08 Aug '11

08 Aug '11

Hi, I have compiled version 4.41 with xforwarded-for patch successfully for our webmail system (Stunnel <-> Haproxy <-> Horde Webmail). After a while the stunnel daemon dies and following message appears in log: Aug 8 12:05:06 vlb2 [local3.err] stunnel: LOG3[3231:3085343632]: SSL_accept: 140760FC: error:140760FC:SSL routines: SSL23_GET_CLIENT_HELLO:unknown protocol Any ideas/suggestions? OS: Centos 5.5 openssl: 0.9.8e-12.el5_5.7 Configuration: ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Disable SSLv2 options = NO_SSLv2 ; List of allowed Ciphers ciphers = ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH ; Disable FIPS fips = no ; Some security enhancements for UNIX systems - comment them out on Win32 setuid = nobody setgid = nobody chroot = /usr/local/var/lib/stunnel/ ; PID is created inside chroot jail pid = /stunnel-webmail.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Option for Dummy MSIE TIMEOUTclose=0 ; Option for errorness SSL implementation options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = local3.4 ; Run as Daemon foreground = no ; Service-level configuration [https] cert = z1.pem accept = ip1:443 connect = p1 xforwardedfor = yes [https] cert = z2.pem accept = ip2:443 connect = p2 xforwardedfor = yes [wmt] cert = z3.pem accept = ip3:443 connect = p3 xforwardedfor = yes regards René Plattner

1 0

Tray icon options
by Sebastian Rose-Indorf 08 Aug '11

08 Aug '11

Hello, many thanks for the new Stunnel versions! I have installed 4.42b3 manually (Vista SP2 64 bit). The tray icon options "Edit stunnel.conf" and "Reload stunnel.conf" do not find the conf file, and the option "Manual" has no effect. At program start Stunnel finds the Conf file without problems (start link: "drive1/path1/stunnel.exe drive2/path2/stunnel.conf"). Greetings seb

1 0

Re: [stunnel-users] webmail compose page get expire and logout
by jayesh.shinde 08 Aug '11

08 Aug '11

Hi Ludolf , Sorry for my previous typing mistake , There is *no* firewall rules between any of my 3 servers My problem is when I open webmail with https:// and compose any email and click on send button then page is getting expire and I am getting logout. Kindly note that my other webmail pages with https:// are working properly. Where as with http:// the compose email and send works properly without any problem. That is if I open the webmail vai stunnel https config then only problem comes. So I am searching solution and config option with the same. Let me know if any config info require from my end. I am checking out with the option which you have suggested and will reply you shortly. Regards Jayesh Shinde On 08/08/2011 01:02 PM, Ludolf Holzheid wrote: > On Mon, 2011-08-08 12:30:03 +0530, jayesh.shinde wrote: >> > >> > [..] >> > >> > I checked by defining the TIMEOUTs but I am not able to figure out why >> > the page is getting expire and I am getting logout ? >> > There is firewall rule between any servers. > I didn't fully understand your problem, but if your secured tunnel > crosses a stateful firewall (e.g. a NAT router), you might try to > switch on TCP keepalive: > > socket = l:SO_KEEPALIVE=1 > > You might also play with the TCP_KEEP* socket options. > > HTH, > > Ludolf > > -- --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 > 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 > Mannheim, Germany > ---------------------------------------------------------------

1 1