- stunnel-users - stunnel.org

Re: [stunnel-users] Stunnel as an "HTTPS to HTTPS" proxy
by Javier 05 Mar '13

05 Mar '13

On Tue, 05 Mar 2013 09:04:41 +0200 "jmwb(a)webmail.co.za" <jmwb(a)webmail.co.za> wrote: > Thank you for your response Javier. > > I now understand how to phrase what I am looking for. What I am looking for is > effectively an SSL Man-in-The-Middle (but please be assured that I am not > looking to build malware). However, I am still not certain from your response > that Stunnel can do this. Can the client-side handle SSL or does it only > support clear-text on the client side? > > jmwb Hi, in the example I gave to you is like this. Hope this can help you to understand how stunnel works in such scenario. 1. Web browser without SSL support. 2. It sends clear text to the IP:port where stunnel client is listening. 3. Stunnel in the client machine send ciphered text to the machine with Stunnel acting as server. 4. Stunnel in the server machine sends clear text to the web server. 5. The web server hasn't SSL support. 6. The communication is reversed to reply to the client side. With a diagram. Browser <> clear text <> stunnel<> ciphered <> stunnel <> clear text <> web server Of course, it is possible to make a MiTM attack between browser and stunnel and stunnel and web server at both sides, but not in between. To accomplish such attack you'll first need to access one of the machines and find such scenario. If both sides support SSL you don't need stunnel (unless one of the sides doesn't support SSL) and, therefore, all communications are ciphered P2P. No clear text. Except keyboard/mouse loggers in the client side. As said, is a secure tunnel, an SSL proxy. As you wish. Regards.

1 0

Re: [stunnel-users] Disable SNI in stunnel win32 version
by Lilienberg, Daniel () 05 Mar '13

05 Mar '13

I want to use my Apache as a secure proxy (where Stunnel adds the SSL layer). With SNI enabled, I must send all hosts I want to connect to which is impossible ? This is for internet proxy usage, so all sites on Internet must be available through the proxy. It worked fine before SNI. From: Brian Wilkins [mailto:bwilkins@gmail.com] Sent: den 5 mars 2013 14:14 To: Lilienberg, Daniel () Subject: Re: [stunnel-users] Disable SNI in stunnel win32 version Does this help? http://langui.sh/2009/11/03/ssl-vhosting-on-the-same-ip-aka-sni/ On Tue, Mar 5, 2013 at 8:10 AM, Lilienberg, Daniel () <daniel.lilienberg(a)volvocars.com<mailto:daniel.lilienberg@volvocars.com>> wrote: Hi, In my local vmware setup im using Apache with mod_ssl on the server side and Stunnel on client side to make a secure proxy. Im using Chrome as webbrowser to connect locally to the apache which bounces me to internet. In my setup everything worked with the older Stunnel 4.3x, but when you upgraded to a newer Openssl it enabled SNI and now its broken. Can I disable SNI in any way or so I need to recompile stunnel with an older OpenSSL package ? Im running on Win32. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Disable SNI in stunnel win32 version
by Lilienberg, Daniel () 05 Mar '13

05 Mar '13

Hi, In my local vmware setup im using Apache with mod_ssl on the server side and Stunnel on client side to make a secure proxy. Im using Chrome as webbrowser to connect locally to the apache which bounces me to internet. In my setup everything worked with the older Stunnel 4.3x, but when you upgraded to a newer Openssl it enabled SNI and now its broken. Can I disable SNI in any way or so I need to recompile stunnel with an older OpenSSL package ? Im running on Win32.

1 0

Stunnel as an "HTTPS to HTTPS" proxy
by jmwb＠webmail.co.za 04 Mar '13

04 Mar '13

Hi, Please could you tell me if Stunnel supports HTTPS on the client-side i.e. a true SSL proxy with client-side SSL and server-side SSL (or if anyone has developed a version that does)? I have tried searching for this without luck because it is difficult to narrow down the search criteria e.g. Stunnel is already cited as an SSL proxy. jmwb ____________________________________________________________ South Africas premier free email service - www.webmail.co.za For super low premiums, click here. http://www.dialdirect.co.za/landing/oct/1/?vdn=15752

2 1

stunnel 4.55 released (security update)
by Michal Trojnara 03 Mar '13

03 Mar '13

Dear Users, I have released version 4.55 of stunnel. This is a massive bugfix release, including a security bugfix. Update is highly recommended. The ChangeLog entry: Version 4.55, 2013.03.03, urgency: HIGH: * Security bugfix - OpenSSL updated to version 1.0.1e in Win32/Android builds. - Buffer overflow vulnerability fixed in the NTLM authentication of the CONNECT protocol negotiation. See https://www.stunnel.org/CVE-2013-1762.html for details. * New features - SNI wildcard matching in server mode. - Terminal version of stunnel (tstunnel.exe) build for Win32. * Bugfixes - Fixed write half-close handling in the transfer() function (thx to Dustin Lundquist). - Fixed EAGAIN error handling in the transfer() function (thx to Jan Bee). - Restored default signal handlers before execvp() (thx to Michael Weiser). - Fixed memory leaks in protocol negotiation (thx to Arthur Mesh). - Fixed a file descriptor leak during configuration file reload (thx to Arthur Mesh). - Closed SSL sockets were removed from the the transfer() c->fds poll. - Minor fix in handling exotic inetd-mode configurations. - WCE compilation fixes. - IPv6 compilation fix in protocol.c. - Windows installer fixes. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-4.55.tar.gz: 5a4acecfabd454415c727435acdfca7dc46aa542998fb278293f494a6d36d37a Best regards, Mike

1 0

Broken pipes and TCP resets on parallel requests over stunnel
by Jan Bee 22 Feb '13

22 Feb '13

Hi, I'm running stunnel (ubuntu 4.42-1, confirmed with 4.54 that has been built from source) against a backend I've only limited control over which was running fine for a long time. At some point in the last few days, the clients stopped being able to make *concurrent* HTTP requests (by different threads) over the stunnel. The client applications using the tunnel enounter a 'Connection refused' error. The issue has been isolated to curl requests (instead of the original client application). Running a tcpdump on both, loopback and uplink, showed that every additional request results in an ACK from the stunnel to both the client and the remote side and a few ms later a RST, ACK is sent in the *same* direction (again from the stunnel to both client and remote end). The stunnel log shows an error about a broken pipe whenever these failures occur: Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: Socket closed on read Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: Sending SSL write shutdown Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: SSL alert (write): warning: close notify Feb 18 11:09:24 x2 stunnel: LOG6[555:139702117717760]: SSL_shutdown successfully sent close_notify Feb 18 11:09:24 x2 stunnel: LOG5[555:139702117717760]: Error detected on socket (read) file descriptor: Broken pipe (32) Feb 18 11:09:24 x2 stunnel: LOG5[555:139702117717760]: Connection reset: 1320 bytes sent to SSL, 48625 bytes sent to socket Feb 18 11:09:24 x2 stunnel: LOG7[555:139702117717760]: Service xtunnel finished (4 left) An strace on the stunnel shows: 6425 <... setsockopt resumed> ) = 0 6425 close(18 <unfinished ...> 6465 poll([{fd=15, events=POLLOUT}, {fd=22, events=POLLIN}], 2, 43200000 <unfinished ...> 6425 <... close resumed> ) = 0 6465 <... poll resumed> ) = 2 ([{fd=15, revents=POLLOUT|POLLERR|POLLHUP}, {fd=22, revents=POLLIN}]) 6425 sendto(13, "<31>Feb 18 11:34:35 stunnel: LOG7[6395:140601236756224]: Service xtunnel finished (4 left)", 99, MSG_NOSIGNAL, NULL, 0 <unf inished ...> 6465 getsockopt(15, SOL_SOCKET, SO_ERROR, [32], [4]) = 0 6425 <... sendto resumed> ) = 99 6465 futex(0x7fe045ec3754, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...> 6425 futex(0x7fe045ec3754, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> 6465 <... futex resumed> ) = -1 EAGAIN (Resource temporarily unavailable) 6425 <... futex resumed> ) = 0 6465 sendto(13, "<29>Feb 18 11:34:35 stunnel: LOG5[6395:140601236686592]: Error detected on socket (read) file descriptor: Broken pipe (32)", 122, MSG_NOSIGNAL, NULL, 0 <unfinished ...> 6425 write(2, "2013.02.15 11:34:35 LOG7[6395:140601236756224]: Service xtunnel finished (4 left)\n", 91 <unfinished ...> 6465 <... sendto resumed> ) = 122 6425 <... write resumed> ) = 91 6465 futex(0x7fe045ec3754, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> 6425 sendto(13, "<31>Feb 18 11:34:35 stunnel: LOG7[6395:140601236756224]: str_stats: 0 block(s), 0 byte(s)", 89, MSG_NOSIGNAL, NULL, 0 <unfinished ...> 6465 <... futex resumed> ) = 0 6465 write(2, "2013.02.15 11:34:35 LOG5[6395:140601236686592]: Error detected on socket (read) file descriptor: Broken pipe (32)\n", 114 <unfinished ...> $ ps auxww|grep stunnel4 shows: root 28587 0.1 0.0 437844 7780 ? Ss 09:37 0:11 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29170 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29171 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29172 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29173 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf root 29174 0.0 0.0 43876 1180 ? S 09:37 0:00 /usr/bin/stunnel4 /etc/xtunnel/stunnel.conf The stunnel config looks like this: foreground=yes debug=7 pid=/var/run/xtunnel.pid client=yes CAfile=/etc/ssl/certs/xtunnel-chains.pem verify=3 engine=dynamic engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:libopencryptoki.so.0 engineCtrl=INIT engineCtrl=PIN:XXXXXX [xtunnel] engineNum=1 key=id_4 cert=/etc/xtunnel/client-cert.pem accept=127.0.0.1:9999 connect=192.168.200.1:8443 Does anyone have an idea what could be going wrong here or how to troubleshoot this any further? Thanks! Jan

1 0

Stunnel in pgsql mode, libpq, and SSL session caching..
by Matt Wise 17 Feb '13

17 Feb '13

Is there any level of SSL Session Caching when using Stunnel in pgsql mode, and using libpq-based Postgres clients? If not, I'm wondering what tuning we can do on the Stunnel side to get the best performance if we have alot of clients that connect very fequently to the servers.. --matt

1 0

STUNNEL --- How to chose the AES cipher with TLS v1.2
by Editor 14 Feb '13

14 Feb '13

Hi to all: In reading the FAQ and looking at the sample configuration file, I do not see an example of how to correctly configure the application to use the more current AES-256 or the AES-128 cipher configurations. I do have the current OpenSSL on the host (a Sun SPARC box). The idea is to use this host as a SSL proxy for a number of services. I did see this reference: options = CIPHER_SERVER_PREFERENCE But not how to then set the SSL cipher except as I found on Google. There was this on the MAN page but it seems to fail in my configuration: ciphers = cipherlist Select permitted SSL ciphers. A colon delimited list of the ciphers to allow in the SSL connection. For example DES-CBC3-SHA:IDEA-CBC-MD5 Thanks. Kevin Reference Ciphers supported by OpenSSL: http://www.openssl.org/docs/apps/ciphers.html

2 1

stunnel port question
by Stewart Anderson 13 Feb '13

13 Feb '13

Hi all, ty in advance for any help. I have a service that I can connect to a destination over stunnel, but I am not able to get the ack I expect. Internal sending service => stunnel => external listening service I think the problem may be that the firewall is blocking inbound traffic. I need to specify a specific port for the firewall team to open so that traffic can get back to my stunnel service, since every time stunnel starts it will be making a connection from a different port on the external facing side of the SSL encapsulation service/pipe/whatever you want to call it!! What would be the best way to configure stunnel for that scenario. I can see the INETD mode but that does not seem to be what I am looking for, I can also see the transparent option but not sure what that really does. Any advice appreciated. Regards Stewart Your Hospital needs YOU! We need you to register as a Public, Patient or Staff member and help shape the future of your healthcare. Call 0800 280 2581 to register by phone or you can email bradfordhospitals(a)capitaregistrars.com<mailto:bradfordhospitals@capitaregistrars.com> and ask to be registered as a new member. For more information about our hospitals and Foundation Trust Membership please visit www.bradfordhospitals.nhs.uk<http://www.bradfordhospitals.nhs.uk> This message is confidential. It may also contain privileged information. The contents of this e-mail and any attachments are intended for the named addressee only. Unless you are the named addressee or authorised to receive the e-mail of the named addressee you may not disclose, use or copy the contents of the e-mail. If you are not the person for whom the message was intended, please notify the sender immediately at Bradford Teaching Hospitals NHS Foundation Trust and delete the material from your computer. You must not use the message for any other purpose, nor disclose its contents to any person other than the intended recipient. Bradford Teaching Hospitals NHS Foundation Trust does not accept responsibility for this message and any views or opinions contained in this e-mail are solely those of the author unless expressly stated otherwise.

1 0

Stunnel over a separate proxy?
by Alex Gottschalk 12 Feb '13

12 Feb '13

I've successfully deployed stunnel4 to wrap rsync for transferring data between remote sites and a central repository. The issue I'm running into, is that some of these sites mandate use of a proxy (HTTP or SOCKS5 usually) for outbound network connections. It seems like there is some proxy support in stunnel with the protocol{Host,Authentication,etc} configuration options, but I have had zero luck getting them to work. For example, I've tried making a simple SOCKS5 proxy using ssh, that I'm successfully able to send HTTP traffic over: ssh -g -D1080 proxy-host # create the proxy, open port 1080 on a public interface then in the client stunnel.conf: [rsync] protocol = connect protocolHost = proxy-host:1080 accept = 127.0.0.1:873 connect = rsync-destination:443 Keep in mind this is an already-working stunnel - the only difference is the addition of the protocol and protocolHost lines above. When I run stunnel in the foreground with that configuration change, I get the following error trying to run rsync: $ rsync -v dev.inst.kvpdata rsync://localhost/putdata/ rsync: read error: Connection reset by peer (104) rsync error: error in rsync protocol data stream (code 12) at io.c(605) [sender=2.6.9] And no log messages appear in stunnel's stderr whatsoever. What am I doing wrong? I get identical results using an HTTP proxy with squid, instead of the socks5 proxy. Thanks, please let me know if there's any more information I should include to help with figuring this out. Alex Gottschalk

3 4