- stunnel-users - stunnel.org

[stunnel patch] transparent proxy on linux 2.6 using cttproxy patch
by MAtteo HCE Valsasna 22 Aug '05

22 Aug '05

hi folks: as suggested in http://www.stunnel.org/faq/transparent.html#ToC3, I modified the stunnel code to use the transparent proxy funcionality on 2.6 (and possibly 2.4) linux kernels with the cttproxy patch (http://www.balabit.com/products/oss/tproxy/, I used )cttproxy-2.6.12-2.0.2. on a clean 2.6.12.5 kernel) the patch is higly incomplete, but it works (see TODO). please try it if you are interested in transparent stunnel. any feedback il welcome. MAtteo the code is heavly based on the examples distributed along with the cttproxy patch, many thanks to Balázs Scheidler for its great work and for making it GPL. with this patch, I was able to run a stunnel in server mode with the transparent option, and the application server I connected to saw the IP address of the stunnel client. of course, this code il also redistributed under the GPL. conditions for running stunnel in transparent mode: if you want to try this patch, you MUST modify the hardcoded IP address in client.c to the IP address of the stunnel server (look for DOIT! in the source code). any improvements wellcome. the stunnel server must run a linux kernel patched with the cttproxy patch the stunnel server and the application server cannot be the same host the application server must believe that it has to route all packets of transparently tunneled connections via the stunnel server. thus the two server should be on the same subnet. I was also able to use linux policy routing to avoid modifying the general routing on the application server: transparently tunneled connections are directed to a different IP on the application server, where a policy rule applies a specific routing table to packets with that source address (see at the end of this message). TODO: stunnel must explicitly bind to an *existing* local address (not loopback) before calling setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"). now the address is hardcoded in the patch, it should automatically find a local address to bind to (or get it from the config file) now the code will only run with tproxy patch version 2.0.2 it should be less strict about tproxy version (make it a configurable option in stunnel?). which tproxy version will it run with? auto detect or configure kernel version (2.2 vs 2.4 or 2.6 with cttproxy), or better add it in .configure ----begin patch----- *** /tmp/stunnel-4.11/src/client.c 2005-07-02 08:55:58.000000000 +0200 --- stunnel-4.11/src/client.c 2005-08-22 12:19:57.000000000 +0200 *************** *** 44,49 **** --- 44,60 ---- #define SHUT_RDWR 2 #endif + #define LINUX_NETFILTER + #define LINUX_TPROXY + + /* transparent proxy */ + #ifdef LINUX_NETFILTER + #include <linux/netfilter_ipv4.h> + #endif + #ifdef LINUX_TPROXY + #include <linux/netfilter_ipv4/ip_tproxy.h> + #endif + /* TCP wrapper */ #ifdef USE_LIBWRAP #include <tcpd.h> *************** *** 921,926 **** --- 932,944 ---- int s; /* destination socket */ u16 i; + // struct in_addr *local=NULL; + #ifdef LINUX_TPROXY + int f; + struct in_tproxy itp; + struct sockaddr_in tproxy_sin; + #endif + /* setup address_list */ if(c->opt->option.delayed_lookup) { resolved_list.num=0; *************** *** 945,960 **** if(alloc_fd(s)) return -1; ! if(c->bind_addr.num) { /* explicit local bind or transparent proxy */ ! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION)); ! if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) { ! sockerror("bind transparent"); ! closesocket(s); ! return -1; ! } ! } ! ! /* try to connect for the 1st time */ s_ntop(c->connecting_address, &addr); s_log(LOG_DEBUG, "%s connecting %s", c->opt->servname, c->connecting_address); --- 963,1053 ---- if(alloc_fd(s)) return -1; ! if(c->bind_addr.num && !c->opt->option.transparent) { ! /* explicit local bind, not transparent mode */ ! ! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION)); ! if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) { ! sockerror("bind transparent"); ! closesocket(s); ! return -1; ! } ! sockerror("local bind succeeded"); ! } ! ! if (c->opt->option.transparent){ ! ! /* transparent proxy support on 2.[46] linux kernels */ ! /* added by MAtteo HCE Valsasna (matteo.valsasna(a)uninsubria.it), 20050822 */ ! /* requires tproxy kernel patch (http://www.balabit.com/products/oss/tproxy */ ! /* based on examples in cttproxy patch */ ! ! /* FIXME: should detect 2.2 kernel or 2.[46] + cttproxy patch and use appropriate code */ ! ! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION)); ! ! /* check tproxy version */ ! itp.op = TPROXY_VERSION; ! itp.v.version = 0x00000000; ! ! getsockopt(s, SOL_IP, IP_TPROXY, &itp, &f); ! s_log(LOG_NOTICE, "pre getsockopt(s, SOL_IP, IP_TPROXY): %x", itp.v.version); ! ! /* FIXME: should accept a range of tproxy versions - which? */ ! ! if (itp.v.version != 0x02000002) { ! itp.v.version = 0x02000002; ! if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) ! { ! sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); ! getsockopt(s, SOL_IP, IP_TPROXY, &itp, &f); ! s_log(LOG_NOTICE, "err getsockopt(s, SOL_IP, IP_TPROXY): %x", itp.v.version); ! return -1; ! } ! } ! else{ ! s_log(LOG_NOTICE, "getsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION) returned right version"); ! } ! ! /* bind to local address */ ! /* FIXME: must become dynamic */ ! tproxy_sin.sin_family = AF_INET; ! /* DOIT! add a local IP address here */ ! inet_aton("192.168.179.71", &tproxy_sin.sin_addr); ! /* do not request a specific source port */ ! tproxy_sin.sin_port = htons(0); ! ! if (bind(s, (struct sockaddr *) &tproxy_sin, sizeof(tproxy_sin)) == -1) ! { ! sockerror("bind"); ! return -1; ! } ! s_log(LOG_NOTICE, "bound to local: %s", inet_ntoa(tproxy_sin.sin_addr)); ! ! /* assign foreign address */ ! itp.op = TPROXY_ASSIGN; ! itp.v.addr.faddr = bind_addr.in.sin_addr; ! itp.v.addr.fport = 0; ! ! if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) ! { ! s_log(LOG_NOTICE, "error assigning foreign address: %s", inet_ntoa(bind_addr.in.sin_addr)); ! sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); ! return -1; ! } ! s_log(LOG_NOTICE, "assigned foreign address: %s", inet_ntoa(bind_addr.in.sin_addr)); ! ! /* set connect flag on socket */ ! itp.op = TPROXY_FLAGS; ! itp.v.flags = ITP_CONNECT|ITP_ONCE; ! if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) ! { ! sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)"); ! return -1; ! } ! } ! ! /* try to connect for the 1st time */ s_ntop(c->connecting_address, &addr); s_log(LOG_DEBUG, "%s connecting %s", c->opt->servname, c->connecting_address); ----end patch----- EXTRAS source routing on the application server intended usage: the application server is a squid proxy with pubblic adresses. its default gw is an HW-based router (not the transparent stunnel server). we want normal traffic (i.e. not handled by transparent stunnel) to continue to use normal routing. only traffic handled by stunnel should be routed back to the stunnel server. a new IP address (10.0.0.1) is added on the application server specifically for this purpose. stunnel server will forward connections to this address, normal clients will use another address. then, only traffic originating from this address needs to be routed back to the stunnel server. the stunnel server has IP 10.0.0.254 (but it can have more, of course) in /etc/iproute2/rt_tables add a line defining a new routing table: 10 inr.tproxy # add a rule to the new routing table ip r a table inr.tproxy default via 10.0.0.254 # create ip policy routing rule: packets with source address = # 10.0.0.1 should be routed according to the inr.tproxy table ip rule add type unicast from 10.0.0.1 table inr.tproxy priority 220 # apply policy routing changes ip route flush cache

1 0

RE: stunnel and OpenSSL v0.9.8 - tunneling the UDP. Possible?
by rz1a＠mail.ru 20 Aug '05

20 Aug '05

Hello Michal, OK. Securing a plain UDP will suffice at first! Are there any plans to use DTLS? Thank you in advance. -- Best regards, Tony

1 0

stunnel and OpenSSL v0.9.8 - tunneling the UDP. Possible?
by rz1a＠mail.ru 19 Aug '05

19 Aug '05

Hello stunnel-users, OpenSSL from v0.9.8 onwards (I'm told) supports a thing called DTLS. On the OpenSSL's list I was told that it's the tool one needs to use for UDP tunneling. Are there any plans to use this OpenSSL's functionality in the stunnel? I need to securely tunnel the UDP traffic, namely multicasted datagramms. -- Best regards, Tony.

2 1

stunnel on windows
by Paul Cottingham 19 Aug '05

19 Aug '05

Folks, I'm in need of some help in setting up stunnel on windows, I get either Error reading certificate file: {path}/stunnel.pem {path}/stunnel.pem: No such process (3) So I am assuming the second error {path}/stunnel.pem: No such process (3) the path statement is correct and therefore something else is not correct but I have no idea where and what Regards Paul

1 0

Stunnel HTTPS Client Issue
by Salar Madadi 19 Aug '05

19 Aug '05

Hello, We are having a problem with our application using STUNNEL and are stuck. I have detailed the issue below with more detailed info about our setup. I am not very familiar with the SSL protocol so I am having trouble identifying the differences between the log samples I posted to determine what the issue may be. Any help would be greatly appreciated. Thanks, Salar Madadi - Latest Developments Inc. Problem Description ************************************ We are using Stunnel to provide an HTTPS client for use with the UPS ShipXML service. Our application is an xBase++ 1.82 service using the XB2.NET library, running on a windows 2003 server. The application opens a connection to stunnel, which then connects to the UPS https server to send and retrieve an xml response with shipping data. UPS made a change to their service last week related to load balancing and our application has not worked since then. When we send an XML document to UPS we receive the exact same XML document back as if it has been bounced instead of the proper response. Our setup was working until they made the change and they have no idea what is going on. Stunnel Version ***************************************** The problem initially happened with stunnel v. 4.05 and openSSL v. 0.9.7c. I have also tried it with stunnel v. 4.11 and openSSL v. 0.9.7f and the same result occurs. Stunnel.conf settings *********************************** #Stunnel server configuration file key=stunnel.pem #up this number to 7 to get full log details #leave it at 3 to just get critical error messages debug=7 output=test.log client=yes verify=0 [psuedo-https] accept = 8080 connect = www.ups.com:443 TIMEOUTclose = 0 Stunnel log samples ************************************** Here are some log samples. The first is a log sample of when it was working. The second is one when it stopped working and the third is from when it was still not working using the latest version of stunnel/openssl. LOG 1 - Working 2005.05.24 23:37:39 LOG7[184:2796]: psuedo-https accepted FD=216 from 127.0.0.1:3349 2005.05.24 23:37:39 LOG7[184:2796]: FD 216 in non-blocking mode 2005.05.24 23:37:39 LOG7[184:2796]: Creating a new thread 2005.05.24 23:37:39 LOG7[184:2796]: New thread created 2005.05.24 23:37:39 LOG7[184:1840]: psuedo-https started 2005.05.24 23:37:39 LOG5[184:1840]: psuedo-https connected from 127.0.0.1:3349 2005.05.24 23:37:39 LOG7[184:1840]: FD 208 in non-blocking mode 2005.05.24 23:37:39 LOG7[184:1840]: psuedo-https connecting 153.2.228.50:443 2005.05.24 23:37:39 LOG7[184:1840]: remote connect #1: EWOULDBLOCK: retrying 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: FD=208, DIR=write 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: ok 2005.05.24 23:37:39 LOG7[184:1840]: Remote FD=208 initialized 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): before/connect initialization 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write client hello A 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: FD=208, DIR=read 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: ok 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read server hello A 2005.05.24 23:37:39 LOG5[184:1840]: VERIFY IGNORE: depth=1, /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority 2005.05.24 23:37:39 LOG5[184:1840]: VERIFY IGNORE: depth=1, /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority 2005.05.24 23:37:39 LOG5[184:1840]: VERIFY IGNORE: depth=0, /C=US/ST=New Jersey/L=Mahwah/O=United Parcel Service/OU=Internet Systems/CN=www.ups.com 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read server certificate A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read server done A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write client key exchange A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write change cipher spec A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write finished A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 flush data 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: FD=208, DIR=read 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: ok 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read finished A 2005.05.24 23:37:39 LOG7[184:1840]: 3 items in the session cache 2005.05.24 23:37:39 LOG7[184:1840]: 3 client connects (SSL_connect()) 2005.05.24 23:37:39 LOG7[184:1840]: 3 client connects that finished 2005.05.24 23:37:39 LOG7[184:1840]: 0 client renegotiatations requested 2005.05.24 23:37:39 LOG7[184:1840]: 0 server connects (SSL_accept()) 2005.05.24 23:37:39 LOG7[184:1840]: 0 server connects that finished 2005.05.24 23:37:39 LOG7[184:1840]: 0 server renegotiatiations requested 2005.05.24 23:37:39 LOG7[184:1840]: 0 session cache hits 2005.05.24 23:37:39 LOG7[184:1840]: 0 session cache misses 2005.05.24 23:37:39 LOG7[184:1840]: 0 session cache timeouts 2005.05.24 23:37:39 LOG6[184:1840]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2005.05.24 23:37:40 LOG7[184:1840]: SSL alert (read): warning: close notify 2005.05.24 23:37:40 LOG7[184:1840]: SSL closed on SSL_read 2005.05.24 23:37:40 LOG7[184:1840]: SSL write shutdown (output buffer empty) 2005.05.24 23:37:40 LOG7[184:1840]: Socket write shutdown (output buffer empty) 2005.05.24 23:37:40 LOG7[184:1840]: SSL alert (write): warning: close notify 2005.05.24 23:37:40 LOG6[184:1840]: SSL_shutdown successfully sent close_notify 2005.05.24 23:37:40 LOG7[184:1840]: Socket closed on read 2005.05.24 23:37:40 LOG5[184:1840]: Connection closed: 726 bytes sent to SSL, 648 bytes sent to socket 2005.05.24 23:37:40 LOG7[184:1840]: psuedo-https finished (0 left) LOG 2 - NOT WORKING 2005.08.15 15:46:07 LOG7[2636:3432]: psuedo-https accepted FD=180 from 127.0.0.1:3141 2005.08.15 15:46:07 LOG7[2636:3432]: FD 180 in non-blocking mode 2005.08.15 15:46:07 LOG7[2636:3432]: Creating a new thread 2005.08.15 15:46:07 LOG7[2636:3432]: New thread created 2005.08.15 15:46:07 LOG7[2636:1316]: psuedo-https started 2005.08.15 15:46:07 LOG5[2636:1316]: psuedo-https connected from 127.0.0.1:3141 2005.08.15 15:46:07 LOG7[2636:1316]: FD 172 in non-blocking mode 2005.08.15 15:46:07 LOG7[2636:1316]: psuedo-https connecting 65.171.127.243:443 2005.08.15 15:46:07 LOG7[2636:1316]: remote connect #1: EWOULDBLOCK: retrying 2005.08.15 15:46:07 LOG7[2636:1316]: waitforsocket: FD=172, DIR=write 2005.08.15 15:46:07 LOG7[2636:1316]: waitforsocket: ok 2005.08.15 15:46:07 LOG7[2636:1316]: remote connect #2: EINVAL: ok 2005.08.15 15:46:07 LOG7[2636:1316]: Remote FD=172 initialized 2005.08.15 15:46:07 LOG7[2636:1316]: SSL state (connect): before/connect initialization 2005.08.15 15:46:07 LOG7[2636:1316]: SSL state (connect): SSLv3 write client hello A 2005.08.15 15:46:07 LOG7[2636:1316]: waitforsocket: FD=172, DIR=read 2005.08.15 15:46:12 LOG7[2636:1316]: waitforsocket: ok 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 read server hello A 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 read finished A 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 write change cipher spec A 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 write finished A 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 flush data 2005.08.15 15:46:12 LOG7[2636:1316]: 17 items in the session cache 2005.08.15 15:46:12 LOG7[2636:1316]: 230 client connects (SSL_connect()) 2005.08.15 15:46:12 LOG7[2636:1316]: 230 client connects that finished 2005.08.15 15:46:12 LOG7[2636:1316]: 0 client renegotiatations requested 2005.08.15 15:46:12 LOG7[2636:1316]: 0 server connects (SSL_accept()) 2005.08.15 15:46:12 LOG7[2636:1316]: 0 server connects that finished 2005.08.15 15:46:12 LOG7[2636:1316]: 0 server renegotiatiations requested 2005.08.15 15:46:12 LOG7[2636:1316]: 213 session cache hits 2005.08.15 15:46:12 LOG7[2636:1316]: 0 session cache misses 2005.08.15 15:46:12 LOG7[2636:1316]: 0 session cache timeouts 2005.08.15 15:46:12 LOG6[2636:1316]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.08.15 15:46:14 LOG7[2636:1316]: SSL_read returned WANT_: retrying 2005.08.15 15:46:14 LOG7[2636:1316]: SSL_read returned WANT_: retrying 2005.08.15 15:46:14 LOG7[2636:1316]: SSL alert (read): warning: close notify 2005.08.15 15:46:14 LOG7[2636:1316]: SSL closed on SSL_read 2005.08.15 15:46:14 LOG7[2636:1316]: SSL write shutdown (output buffer empty) 2005.08.15 15:46:14 LOG7[2636:1316]: Socket write shutdown (output buffer empty) 2005.08.15 15:46:14 LOG7[2636:1316]: SSL alert (write): warning: close notify 2005.08.15 15:46:14 LOG6[2636:1316]: SSL_shutdown successfully sent close_notify 2005.08.15 15:46:14 LOG5[2636:1316]: Connection closed: 738 bytes sent to SSL, 5754 bytes sent to socket 2005.08.15 15:46:14 LOG7[2636:1316]: psuedo-https finished (0 left) LOG 3 - NOT WORKING WITH LATEST VERSION OF STUNNEL/OPENSSL 2005.08.18 20:45:13 LOG7[2212:3324]: psuedo-https accepted FD=164 from 127.0.0.1:1076 2005.08.18 20:45:13 LOG7[2212:3324]: Creating a new thread 2005.08.18 20:45:13 LOG7[2212:3324]: New thread created 2005.08.18 20:45:13 LOG7[2212:3388]: psuedo-https started 2005.08.18 20:45:13 LOG7[2212:3388]: FD 164 in non-blocking mode 2005.08.18 20:45:13 LOG5[2212:3388]: psuedo-https connected from 127.0.0.1:1076 2005.08.18 20:45:13 LOG7[2212:3388]: FD 188 in non-blocking mode 2005.08.18 20:45:13 LOG7[2212:3388]: psuedo-https connecting 153.2.228.50:443 2005.08.18 20:45:13 LOG7[2212:3388]: connect_wait: waiting 10 seconds 2005.08.18 20:45:13 LOG7[2212:3388]: connect_wait: connected 2005.08.18 20:45:13 LOG7[2212:3388]: Remote FD=188 initialized 2005.08.18 20:45:16 LOG5[2212:3388]: VERIFY IGNORE: depth=1, /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority 2005.08.18 20:45:16 LOG5[2212:3388]: VERIFY IGNORE: depth=1, /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority 2005.08.18 20:45:16 LOG5[2212:3388]: VERIFY IGNORE: depth=0, /C=US/ST=New Jersey/L=Mahwah/O=United Parcel Service/OU=Internet System/OU=Terms of use at www.verisign.com/rpa (c)05/CN=www.ups.com 2005.08.18 20:45:17 LOG6[2212:3388]: SSL connected: new session negotiated 2005.08.18 20:45:17 LOG6[2212:3388]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2005.08.18 20:45:20 LOG7[2212:3388]: SSL_read returned WANT_READ: retrying 2005.08.18 20:45:20 LOG7[2212:3388]: SSL_read returned WANT_READ: retrying 2005.08.18 20:45:20 LOG7[2212:3388]: SSL closed on SSL_read 2005.08.18 20:45:20 LOG7[2212:3388]: Socket write shutdown 2005.08.18 20:45:20 LOG7[2212:3388]: SSL write shutdown 2005.08.18 20:45:20 LOG6[2212:3388]: SSL_shutdown successfully sent close_notify 2005.08.18 20:45:20 LOG5[2212:3388]: Connection closed: 738 bytes sent to SSL, 8248 bytes sent to socket 2005.08.18 20:45:20 LOG7[2212:3388]: psuedo-https finished (0 left) Output of stunnel.exe -version ************************************* stunnel 4.11 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7f 22 Mar 2005 Global options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = stunnel.pem RNDbytes = 64 RNDoverwrite = yes service = stunnel session = 300 seconds taskbar = yes verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds 2005.08.18 21:06:04 LOG3[2508:3100]: Server is down

2 1

Win32 Local Privilege Escalation when Stunnel installed as a System service
by Ian 18 Aug '05

18 Aug '05

Hi, There is a trivial to exploit Local Privilege Escalation when stunnel is installed as a system service on windows. Who should I inform of this so a fix can be made? Thanks Ian --

5 4

stunnel Bug Tracking System
by Michal Trojnara 10 Aug '05

10 Aug '05

Dear Users, I've installed a Bug Tracking System for stunnel. You can enter bugs and feature requests here: http://stunnel.mirt.net/flyspray/ Best regards, Mike

1 0

stunnel for postgresql in windows
by babu 10 Aug '05

10 Aug '05

Hi all, I have seen stunnel example for mysql. how to use stunnel for postgresql in windows.. Thanks babu --------------------------------- To help you stay safe and secure online, we've developed the all new Yahoo! Security Centre.

2 2

nonblocking: Operation not supported by this device (19)
by Tuc＠T-B-O-H 09 Aug '05

09 Aug '05

Hi, This morning I stopped using the splash screen on boot on my FreeBSD 4.11 system, using stunnel 4.11 and now when I use stunnel I get: "stunnel[PID]: nonblocking: Operation not supported by device (19)" Why would changing if I use a splash screen or not make this difference?! Thanks, Tuc

1 0

Any examples of Stunnel usage in "enterprise environments"?
by Claus Lund 06 Aug '05

06 Aug '05

Hi everybody, I was just wondering if there are any public examples of widespread Stunnel usage in an enterprise environments? I'm a UNIX admin where I work and we are currently working on trying to find a solution for encrypting all network traffic to and from the UNIX machines (all the clients are using Windows boxes). We are running a variety of services on the boxes including Samba, homegrown services for our 3-tier app, Oracle, DB2 etc... I already have proof of concept setups for every network service that we offer but I think some "real-world examples" would go a long to convince my boss (and the Windows admins) that Stunnel is a viable option for us. Thank you in advance, Claus

2 1

Re: [stunnel-users] Stunnel dumping core
by Andrew Gay 05 Aug '05

05 Aug '05

> Envelope-to: gay@localhost > Delivery-date: Thu, 04 Aug 2005 16:49:55 +0100 Michael Tronjara wrote: > Politeness is required on this list. *plonk* > > Mike Michael, might I suggest your understanding of that word differs from the majority of us on this list. Many times people have written in pointing out problems with stunnel crashing, dumping core, locking up, yet all you can offer is 'never report problems with older versions', 'you have no right to complain', etc etc, and now you have the arrogance to tell us all we have no clue how to report bugs. I get the feeling you are upset because so many of us discover problems with this software. Andrew

4 6

RE: [stunnel-users] Stunnel dumping core
by Stephen Tanner 04 Aug '05

04 Aug '05

I was trying to see if it was a common issue when stunnel is unable to connect. I didn't ask for snide remarks. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:stunnel-users-bounces@mirt.net] On Behalf Of Michal Trojnara Sent: Thursday, August 04, 2005 3:48 AM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel dumping core "Stephen Tanner" <stanner(a)leeclerk.org> wrote: > Sometimes shutting it down while > it is doing this, it will dump core. Here is an axample of a good core dump error report. http://stunnel.mirt.net/pipermail/stunnel-users/2004-August/000009.html http://stunnel.mirt.net/pipermail/stunnel-users/2004-August/000015.html The report should include at least: - stunnel version line (for example "stunnel 4.05 on powerpc-ibm-aix5.2.0.0 FORK with OpenSSL 0.9.7d 17 Mar 2004"). - stack backtrace. It's a good idea to read: http://www.chiark.greenend.org.uk/~sgtatham/bugs.html Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Stunnel dumping core
by Stephen Tanner 04 Aug '05

04 Aug '05

I've been running stunnel to tunnel syslog-ng messages to a loghost. On some occasions, be it a network maintenance issue or fluke, if a server loses connection to the loghost, stunnel starts spewing broken pipe messages to syslog. Sometimes shutting it down while it is doing this, it will dump core. Anyone have an idea on what might be causing this? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

2 1

Error resolving '...' (Windows)
by Oliver Ackermann (infowing AG) 03 Aug '05

03 Aug '05

On a Windows 2000 machine I always get the following error when I try to start stunnel (4.11): Error resolving 'x.y.z.23': Neither nodename nor servname known (EAI_NONAME) The client should connect to a server using SSL. x.y.z.23 is a static IP address of the client. The client has multiple IP addresses and stunnel should use this one to connect to the server. Contents of stunnel.conf: client=yes [service] local=x.y.z.23 accept=12345 connect=server:12345 Why does stunnel try to "resolve" this IP? Is the configuration correct? Thanks for your help! Oliver

2 1

ftp support for stunnel-4.11 (still has errors, do not know why)
by ZHUANG YUYAO 03 Aug '05

03 Aug '05

hi, here is the initial patch (pre-pre-pre-alpha! just a demo/test) for adding ftp support to stunnel-4.11. Known bugs: 1) only tested under linux. debian 3.1 (testing), gcc version 3.3.5 (Debian 1:3.3.5-13) 2) ftp_alloc_port() in ftp.c is not yet finished. just a demo; 3) only works when configured with --with-threads=ucontext. does not work with --with-threads=pthread! 4) libwrap support is not tested. 5) only tested with flashfxp (3.0.2 build(1043) implicit SSL); 6) still contains memory leaks. 7) can only successfully transfer(RETR) small files whose size is less than about 90K bytes. stunnel hangs while transferring a larger file, looks like poll() in scan_waiting_queue() (network.c line 164) can not receive a POLLOUT event from ssl_wfd->fd after successfully transfered 90K bytes. the log file is also included in this mail. bug #7 really frustrats me. still do not know why. could anyone please give me some hints? Zhuang Yuyao.

1 1

some thoughts of add ftp server proxy support to stunnel4. comments required
by ZHUANG YUYAO 30 Jul '05

30 Jul '05

Hi, I am thinking about adding ftp protocol support to stunnel4. first, some restrictions to simplify the implimentation: 1) only support for stunnel running in server mode, users can use ftp clients which support ssl connection (ie. FlashFXP) to connect to the real ftp server through stunnel daemon; 2) only support standalone service mode of stunnel. (inted support may be added later, I've just read the source code related to standalone service, and have not got any clue about how to support inetd.) 3) only support FTP implicit SSL and PASSIVE mode; the code may look like this: (the real ftp server is at 192.168.10.254, listening on port 21.) 1) start a stunnel daemon nonmally with accept = 990, remote = 192.168.10.254:21, protocol = ftp; 2) when a connection come in, parse the ftp server response, search for "227 Entering Passive Mode (192,168,10,254,133,22)", then got the data connection IP: 192.168.10.254 PORT: 34070; 3) plus 1 to the data connction port 34070, then we got 34071 which will be used as stunnel accept port; 4) create a LOCAL_OPTIONS structure instance opt (prototypes.h) dynamically, set opt->accept=1, opt->local_addr same to the parent stunnel, change its port to 34071, opt->remote_addr = real data connection (IP: 192.168.10.254 PORT: 34070); opt->fd = socket(), bind(); 5) set local_option->next = opt; 6) s_poll_add (&fds, opt->fd, 1, 0); (stunnel.c) (the local variable fds needs to be changed to a global variable, by the way, I think it is also required if stunnel want real SIGHUP configuration-on-the-fly support) 7) changed server response to "227 Entering Passive Mode (STUNNEL_LOCAL_HOST,133,23)", then send back to client. 8) the client will then connect to STUNNEL_LOCAL_HOST port = 34071, negotiate SSL session and send/receive data; 9) after ftp session finished (How to know a ftp session is finished?), free the dynamic LOCAL_OPTIONS opt, remove opt->fd from fds, close the data sessoin. There are only two source file (stunnel.c, protocol.c) need to be modified to implement these functions. Any suggestions will be appreciated. Thank you. Zhuang Yuyao 2005/7/28

3 3

Configuration and startup?
by JACK ROBERT BIESIADECKI 29 Jul '05

29 Jul '05

Hi, I am new to stunnel and Linux. I am trying to set up a secure connection to a server which can be accessed from any web browser on a designated port. I need to be able to access a web browser server administration interface, this is over http, I need to make this an https connection. I have compiled and installed stunnel on a Linux machine (FC4) but can't seem to get any response from it or make it work. If anyone can explain, step by step, how to configure stunnel for general https usage, it would be greatly appreciated. I have looked through the documentation but I have not been able to get it to work. I have also noticed that webmin supports stunnel but there is nothing in it. I added this to the conf file: [https] accept = 8080 connect = 28477 TIMEOUTclose = 0 Thanks

1 0

3.x branch updates
by Brian Hatch 29 Jul '05

29 Jul '05

As y'all can probably see, I've started climbing out from the rock under which I've been living (the rock called "too many kids".) If there are folks who have issues or bugs in stunnel 3.x, let's get talking off list so we can make another release. I'd like to include only security or bug fixes. The 4.x branch is totally fine, and I see no reason to add new features to the 3.x branch. This would be one of at most a few last bug fix releases for the 3.x branch so I can lay it to rest. -- Brian Hatch "Look, somebody's got to have Systems and some damn perspective around Security Engineer here. Boom, sooner or later. http://www.ifokr.org/bri/ *BOOM*!" Every message PGP signed

1 0

Linux pppd VPN network notwork very well
by Colin McKinnon 27 Jul '05

27 Jul '05

Hi all, I've got two two LANs behind masquerading routers that I've linked via a stunnel + pppd vpn. When it works, it works, but I've got a couple of problems - has anybody out there in Stunnel Land managed to fix / workaround these? 1) The connection goes down fairly regluarly. I've setup a cron job to move a few packets back and forth to make sure that the ADSL connection at both ends stays up (pppd set not do demand stuff). There's nothing in the logs to suggest that the ADSL *is* going down, but I thought it would eliminate a lot of possibilities. (see log entries below). Currently the link is going down at lesat once per day. Uptime varies greatly. I can't see anyway of asking stunnel to try again if the pppd exits (see conf below) other than manually restarting it. I'm hoping to scale the VPN up to multiple sites - with one connection, I can just do /etc/rc.d/stunnel restart - but if I've got multiple instances of stunnel running with different configs it gets a bit messy to reset a single connection. I did think about having multiple hard links to the stunnel binary, so each VPN will have a different process name attached to it, but this strikes me as a bit of a hack. 2) bandwidth on the link is poor. I consistently get 1/4 of the bandwidth (measured using scp to copy largish files) compared with bypassing the stunnel/pppd pair (same route between LANs). While I expected some overhead, this seems rather a lot. 3) latency is a lot higher too 4) The VPN seems to stutter more regularly than the direct connection ...I mean that I don't seem to be getting any traffic for 5-10 seconds then it resumes without any loss of data (e.g. when using ssh). The routers at either end are relatively dumb so (as I understand it) there's not many options for using IPIP or GRE tunnelling). Anybody got any suggestions as to how I can make it (particularly) more reliable and (also) a bit faster? TIA, Colin McKinnon pppd -------- pppd local nodeflate nobsdcomp nodefaultroute 10.1.17.208:10.1.20.202 log entries: ---------------- Stunnel started manually: Jul 19 08:25:59 serv8 stunnel[740]: stunnel 4.05 on i686-suse-linux-gnu PTHREAD with OpenSSL 0.9.7d 17 Mar 2004 Jul 19 08:25:59 serv8 stunnel[740]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed Jul 19 08:25:59 serv8 pppd[743]: pppd 2.4.2 started by stunnel, uid 100 Jul 19 08:25:59 serv8 pppd[743]: Using interface ppp0 Jul 19 08:25:59 serv8 pppd[743]: Connect: ppp0 <--> /dev/pts/1 Everything works fine (although a little slow) then... Jul 19 10:36:32 serv8 pppd[743]: No response to 4 echo-requests Jul 19 10:36:32 serv8 pppd[743]: Serial link appears to be disconnected. Jul 19 10:36:34 serv8 pppd[743]: Script /etc/ppp/ip-down finished (pid 1668), status = 0x0 Jul 19 10:36:34 serv8 ip-down: SIOCDELRT: No such process Jul 19 10:36:36 serv8 pppd[743]: Connection terminated. Jul 19 10:36:36 serv8 pppd[743]: Connect time 130.6 minutes. Jul 19 10:36:36 serv8 pppd[743]: Sent 58200 bytes, received 57227 bytes. Jul 19 10:36:36 serv8 pppd[743]: Connect time 130.6 minutes. Jul 19 10:36:36 serv8 pppd[743]: Sent 58200 bytes, received 57227 bytes. Jul 19 10:36:36 serv8 pppd[743]: Exit. Jul 19 10:36:36 serv8 stunnel[741]: readsocket: Input/output error (5) Jul 19 10:36:36 serv8 stunnel[741]: Connection reset: 68626 bytes sent to SSL, 66280 bytes sent to socket Stunnel config --------------------- foreground = no client = yes setuid = stunnel setgid = dialout CAfile = /etc/stunnel/3bCArootCert.pem cert = /etc/stunnel/system.pem verify = 2 session = 3600 [ppp] connect = remotehost:2020 exec = /usr/sbin/pppd execargs = pppd local nodeflate nobsdcomp nodefaultroute 10.1.17.208:10.1.20.202 pty = yes (converse at other end) Routing at 'cleint' end --------------------------------- Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.1.20.202 * 255.255.255.255 UH 0 0 0 ppp0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 10.1.20.0 * 255.255.255.0 U 0 0 0 ppp0 10.1.17.0 * 255.255.255.0 U 0 0 0 eth2 loopback * 255.0.0.0 U 0 0 0 lo default 192.168.1.1 0.0.0.0 UG 0 0 0 eth1 (eth1 conects to the ADSL router, eth2 to the LAN)

2 2

newbie q: stunnel -d and -r options
by Jagannadha Bhattu 27 Jul '05

27 Jul '05

I was reading a book where they discussed using stunnel as client and server proxy with -d -r and -c options. I have SuSE 9.3 and the stunnel on it has different options. Then I found that we have to use config file. I used it to configure my server. I defined the following section: [myserver] accept = 12345 connect = 12323 Here my server listens on 12323. I have my server already running. Now I typed stunnel and nothing happened. I typed "pgrep stunnel" and could not see anything. Apparently I have not understood how stunnel works. Can some one let me know how can I configure to use stunnel to secure my server app and my client app which are not ssl aware. I also have a question. The book which I am reading says, stunnel acts as a proxy for a server app. If my server app is listening on A then if I want stunnel to service all clients connecting to A then how can it do it as that port is already serviced by my server app. Thanks JB

2 1

error compilation stunnel-4.11 for ARM9
by Stage Iup - Fabrice & Frederic 27 Jul '05

27 Jul '05

Hi all, I would like to compile stunnel-4.11for a board based on a ATMEL at91rm9200. I try to compile this with this commande [root@StageIup stunnel-4.11]# CC=/usr/local/arm/3.0/bin/arm-linux-gcc ./configure --host=arm-linux --prefix=/home/fabrice/dev/stunnel/stunnel-armtest --with-ssl=/home/fabrice/dev/openssl But I have the following error configure: **************************************** PTY device files checking for "/dev/ptmx"... configure: error: cannot check for file existence when cross compiling If any body have an idea about how to resolve this problem or how to compile stunnel for ARM ... Thanks -- Cordialement Fabrice -- IFOTEC Tél : 04 76 67 53 53

1 0

samba over stunnel performance
by Brian Szymanski 26 Jul '05

26 Jul '05

Howdy... I'm trying to run samba over stunnel on a wireless connection. Here's the setup: unix box <- wifi -> windows laptop Unfortunately, reading files from the shared drive is extremely slow. If I look at the stunnel box on my windows machine, it is pumping out about 20 messages/second that say: LOG7[2140:3636]: SSL_read returned WANT_READ: retrying On two >1GHz machines, this is utilizing about 5% of cpu, and 4% of the 11Mbps link. Clearly there is room for improvement here! I tried poking around with stunnel.conf on the server to no avail - specifically, I commented out the lines: ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle And restarted stunnel - same miserable performance (roughly the same throughput, and resource usage). Is there something about the SMB protocol that would cause stunnel to not deal with it well? If so, is there a configuration option somewhere I can tune, or do I have to RTFS & hack it to get decent performance here? Any tips would be greatly appreciated. Thanks in advance! Cheers, Brian Brian Szymanski Software and Systems Developer Media Matters for America ski(a)mediamatters.org aim: xbrianskix

2 2

zlib + win2000 = crash
by lascjr＠bol.com.br 26 Jul '05

26 Jul '05

Hi, I successfully installed and executed stunnel without compression and with compression RLE, but with compression ZLIB I receive the following message in the startup: 2005.07.25 08:24:28 LOG5[1408:1524]: stunnel 4.11 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 2005.07.25 08:24:28 LOG3[1408:1976]: Error reading certificate file: stunnel.pem 2005.07.25 08:24:28 LOG3[1408:1976]: error stack: 25070067 : error:25070067:DSO support routines:DSO_load:could not load the shared library 2005.07.25 08:24:28 LOG3[1408:1976]: error stack: 25078067 : error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library 2005.07.25 08:24:28 LOG3[1408:1976]: error stack: 25070067 : error:25070067:DSO support routines:DSO_load:could not load the shared library 2005.07.25 08:24:28 LOG3[1408:1976]: SSL_CTX_use_certificate_chain_file: 25078067: error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library 2005.07.25 08:24:28 LOG3[1408:1976]: Server is down I made download of archive ZLIB1.DLL in the client and in the server, the startup is normal, but after the beginning of the communications the server crash. I use Win2000 Server SP4 in the server and Win2000 Pro in the client. thanks Luis A S C Junior

2 1

Stunnel 4.05 on arm-linux
by Stage Iup - Fabrice & Frederic 26 Jul '05

26 Jul '05

Hi all I would to use stunnel on a board based on the AT91RM9200. I'm actually trying to use Stunnel 4.05 for armv4l. I can launch it but when i try to connect to https (through a thttpd server), nothings happen. In the arm-linux terminal, i've got the following informations: [root@EmbeddedLinux sbin]$./stunnel stunnel.conf 1970.01.01 03:03:47 LOG5[488:16384]: stunnel 4.04 on armv4l-unknown-linux-gnu PTHREAD+LIBWRAP with OpenSSL 1970.01.01 03:03:47 LOG5[488:16384]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed ./stunnel: relocation error: ./stunnel: undefined symbol: request_init If any body have an idea about how to resolve this problem... -- With regards Fabrice JAUME -- IFOTEC Tél : 04 76 67 53 53

2 1

Problems compiling on AIX5.2 -- ld: 0711-317 ERROR: Undefined symbol: .inflateEnd
by Claus Lund 25 Jul '05

25 Jul '05

Hi everybody, I am trying to get stunnel 4.11 compiled on my AIX boxes but I am not having much luck. I am using GCC 3.3.2 on AIX 5.2. OpenSSL has been compiled and is working on those same boxes (OpenSSL 0.9.8). I configured stunnel using: root@tax178:/tmp/stunnel/stunnel-4.11 # ./configure --sysconfdir=/etc/stunnel --prefix=/usr/local --disable-libwrap And everything seems to go OK during the config steps. When I try to build stunnel it comes up with a series of warnings and eventually dies with a bunch of errors. First the warnings: "nt.Po"; else rm -f ".deps/client.Tpo"; exit 1; fi client.c: In function `init_local': client.c:178: warning: passing arg 3 of `ngetpeername' from incompatible pointer type client.c: In function `make_sockets': client.c:894: warning: passing arg 3 of `ngetsockname' from incompatible pointer type client.c:902: warning: passing arg 3 of `naccept' from incompatible pointer type client.c: In function `connect_wait': client.c:996: warning: passing arg 5 of `getsockopt' from incompatible pointer type if gcc -DPACKAGE_NAME=\"stunnel\" -D" "/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c: In function `print_socket_options': options.c:1401: warning: passing arg 5 of `getsockopt' from incompatible pointer type if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\"" "ps/sthreads.Tpo" ".deps/sthreads.Po"; else rm -f ".deps/sthreads.Tpo"; exit 1; fi sthreads.c: In function `stack_info': sthreads.c:343: warning: int format, long unsigned int arg (arg 4) sthreads.c:343: warning: int format, long unsigned int arg (arg 5) sthreads.c:343: warning: int format, long unsigned int arg (arg 6) sthreads.c:343: warning: int format, long unsigned int arg (arg 7) if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\"" "tunnel.Tpo" ".deps/stunnel.Po"; else rm -f ".deps/stunnel.Tpo"; exit 1; fi stunnel.c: In function `accept_connection': stunnel.c:206: warning: passing arg 3 of `naccept' from incompatible pointer type if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\"" And then the final errors: "/bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/include -o stunnel client.o log.o options.o protocol.o network.o resolver.o ssl.o sthreads.o stunnel.o pty.o -lnsl -ldl -L/usr/local/lib -lssl -lcrypto gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/include -o stunnel client.o log.o options.o protocol.o network.o resolver.o ssl.o sthreads.o stunnel.o pty.o -lnsl -ldl -L/usr/local/lib -lssl -lcrypto ld: 0711-317 ERROR: Undefined symbol: .inflateEnd ld: 0711-317 ERROR: Undefined symbol: .deflateEnd ld: 0711-317 ERROR: Undefined symbol: .inflateInit_ ld: 0711-317 ERROR: Undefined symbol: .deflateInit_ ld: 0711-317 ERROR: Undefined symbol: .deflate ld: 0711-317 ERROR: Undefined symbol: .inflate ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more information. collect2: ld returned 8 exit status make: 1254-004 The error code from the last command is 1." Hopefully there will be some C/AIX gurus out there who can help me get past this problem... Thank you in advance, Claus

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users