113778 2005-11-28 04:38 0000 stabilize net-misc/stunnel-4.20 (was: net-misc/stunnel-4.14 defuncts) 2007-11-03 16:00:15 0000 1 1 1 Unclassified Gentoo Linux Ebuilds unspecified All Linux RESOLVED FIXED STABLEREQ P2 normal --- 1 gejzer@ibt.com.pl arm@gentoo.org maintainer-needed@gentoo.org ramereth@gentoo.org wschlich@gentoo.org gejzer@ibt.com.pl 2005-11-28 04:38:14 0000 ive upgraded to stunnel 4.14 and now after every connection i see zombie processes of stunnel. strace shows that their parents are waiting for some action: ps auxw | grep stun stunnel 26754 0.0 1.0 3660 1948 ? SNs 13:30 0:00 stunnel stunnel 26755 0.0 0.0 0 0 ? ZN 13:30 0:00 [stunnel] <defunct> strace -p 26754 Process 26754 attached - interrupt to quit poll( in the logfile i can find only this: Nov 28 13:36:22 felix stunnel: LOG5[28707:1]: Connection closed: 37 bytes sent to SSL, 49 bytes sent to socket Nov 28 13:36:22 felix stunnel: LOG5[28707:1]: stack_info: size=65536, current=4668 (7%), maximum=4668 (7%) so stunnel thinks its closed the connection and should have exited but it does not do that. i am running stunnel through xinetd and have no problems with previous (i believe it was 4.10) version. my emerge info: Portage 2.0.53_rc7 (default-linux/x86/2005.1, gcc-3.4.4, glibc-2.3.5-r3, 2.6.14-gentoo i686) ================================================================= System uname: 2.6.14-gentoo i686 Pentium II (Deschutes) Gentoo Base System version 1.12.0_pre11 distcc 2.18.3 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632) [enabled] dev-lang/python: 2.4.2 sys-apps/sandbox: 1.2.13 sys-devel/autoconf: 2.13, 2.59-r7 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1 sys-devel/binutils: 2.16.1 sys-devel/libtool: 1.5.20-r1 virtual/os-headers: 2.6.11-r3 ACCEPT_KEYWORDS="x86 ~x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-pipe -march=pentium2 -O3 -fstack-protector" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config /usr/share/config /var/bind /var/qmail/control" CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d" CXXFLAGS="-pipe -march=pentium2 -O3 -fstack-protector" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig collision-protect distcc distlocks sandbox sfperms strict userpriv usersandbox" GENTOO_MIRRORS="http://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror http://gentoo.mirror.solnet.ch http://trumpetti.atm.tut.fi/gentoo/" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_TMPDIR="/home/portagetmp" PORTDIR="/usr/portage" SYNC="rsync://1g.compfort.com.pl/gentoo-portage" USE="x86 alsa apm arts avi berkdb bitmap-fonts bzip2 caps chroot clearpasswd crypt curl eds elf emboss encode expat foomaticdb gd gif glibc-omitfp gmp gpm gstreamer hardened idn imlib kde libg++ libwww mad mbox mhash mikmod minimal motif mp3 mpeg ncurses nptl nptlonly ogg oggvorbis opengl oss pam pam_chroot pam_timestamp pcre pdflib perl png pwdb python qt quicktime readline sdl sendfile sftplogging ssl symlink tcpd threads truetype-fonts type1-fonts udev vorbis xinetd xml2 xmms xv zlib userland_GNU kernel_linux elibc_glibc" Unset: ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTDIR_OVERLAY stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7i 14 Oct 2005 gejzer@ibt.com.pl 2005-11-28 04:47:14 0000 another comment on this subject: stunnel says i have ipv6 compiled although i have not used ipv6 USE flag. jakub@gentoo.org 2005-11-28 08:14:59 0000 Please, remove aliz from metadata.xml wrt Bug 112192... ramereth@gentoo.org 2005-11-28 13:31:04 0000 Doing a quick glance on their mailing list, I don't see anything that describes this exactly. The only suggestion I saw was try running it without a chroot and in the foreground. See what that does. About the ipv6 thing, I've noticed that their configure script isn't acknowledging the option correctly. I'll have to poke around and see why that is, but for now I'm not sure whats going on. gejzer@ibt.com.pl 2005-11-29 08:43:34 0000 ok here are my findings: running stunnel in the foreground standalone with no other options changed (that is, compression chroot socket options and setuid turned on) works flawlessly and stunnel properly closes connections - no defunct processess left. running it through xinetd with all above options disabled has the effect i initially described. after turning level 7 logging i can see: ... 2005.11.29 17:38:17 LOG7[16594:1]: SSL write shutdown 2005.11.29 17:38:17 LOG7[16594:0]: Waiting 60 second(s) for 2 file descriptor(s) 2005.11.29 17:38:17 LOG7[16594:0]: CONTEXT 1, FD=0, (IN)->() 2005.11.29 17:38:17 LOG7[16594:0]: CONTEXT 1, FD=1, (OUT)->(OUT) 2005.11.29 17:38:17 LOG7[16594:1]: SSL alert (write): warning: close notify 2005.11.29 17:38:17 LOG7[16594:1]: SSL_shutdown retrying 2005.11.29 17:38:17 LOG7[16594:1]: SSL doesn't need to read or write 2005.11.29 17:38:17 LOG7[16594:0]: Waiting 60 second(s) for 1 file descriptor(s) 2005.11.29 17:38:17 LOG7[16594:0]: CONTEXT 1, FD=0, (IN)->(IN) 2005.11.29 17:38:17 LOG7[16594:1]: SSL socket closed on SSL_read 2005.11.29 17:38:17 LOG7[16594:1]: Socket write shutdown 2005.11.29 17:38:17 LOG5[16594:1]: Connection closed: 37 bytes sent to SSL, 49 bytes sent to socket 2005.11.29 17:38:17 LOG7[16594:1]: stunnel finished (0 left) 2005.11.29 17:38:17 LOG5[16594:1]: stack_info: size=65536, current=4444 (6%), maximum=4444 (6%) 2005.11.29 17:38:17 LOG7[16594:1]: Context 1 closed 2005.11.29 17:38:17 LOG7[16594:0]: Waiting -1 second(s) for 0 file descriptor(s) it seems stunnel is happy with the connection although i am a little bit worried about the last message? i'll try recompiling stunnel 4.14 with different threading model and see what (if anything) changes. are you by any chance subscribed to stunnel mailing list? if so you could forward the info to them :) gejzer@ibt.com.pl 2005-11-29 09:00:10 0000 OK ladies and gentlemen here are my latest findings ;) stunnel through xinetd works great with fork and pthread threading model. it does not work so well with ucontext model (defunct processess). i would recommend using one of the above, especially that ucontext has had some security and performance problems in the past. when NO ipv6 option is used with configure (--disable-ipv6 and such), stunnel compiles with ipv4 option as expected when no USE flag ipv6 is used. another question is why is there USE flag 'ssl' used in stunnel ebuild ? it is not used by ebuild script at all. hope this information helps someone out there best regards, ramereth@gentoo.org 2005-11-29 09:23:39 0000 (In reply to comment #5) > stunnel through xinetd works great with fork and pthread threading model. > it does not work so well with ucontext model (defunct processess). > > i would recommend using one of the above, especially that ucontext has had some > security and performance problems in the past. Looking at the configure script, it seems as though it'll enable all those threading models if you don't set it at compile time? Are you suggesting I pick between using pthread or fork? > when NO ipv6 option is used with configure (--disable-ipv6 and such), stunnel > compiles with ipv4 option as expected when no USE flag ipv6 is used. Ok, so you're saying that the use flag for ipv6 is working as expected or isn't? > another question is why is there USE flag 'ssl' used in stunnel ebuild ? it is > not used by ebuild script at all. Thats from the ssl-cert eclass I use in the ebuild. I agree the useflag makes it redundant, but the eclass is useful for this ebuild. ramereth@gentoo.org 2005-11-29 09:27:42 0000 Actually, I take that back.. It seems to pick ucontext first. So I'll need to pick between pthread or fork. Think that should be a useflag or just default to one or the other? gejzer@ibt.com.pl 2005-11-29 09:42:41 0000 Created an attachment (id=73800) patched ebuild gejzer@ibt.com.pl 2005-11-29 09:43:22 0000 (In reply to comment #6) > (In reply to comment #5) > Looking at the configure script, it seems as though it'll enable all those > threading models if you don't set it at compile time? Are you suggesting I pick > between using pthread or fork? dont know whether it compiles them all in but it chooses the specified one when run. and it also modifies its version string indicating the threading model used. havent found an option to choose between them during runtime. thus, i would recommend choosing threading model that works fine. > > > when NO ipv6 option is used with configure (--disable-ipv6 and such), stunnel > > compiles with ipv4 option as expected when no USE flag ipv6 is used. > > Ok, so you're saying that the use flag for ipv6 is working as expected or isn't? ok i have messed it up a little :) if you specify --disable-ipv6, ipv6 gets compiled in. seems to be their error: ./configure --disable-ipv6 ... checking whether to enable IPv6 support... yes ... if you omit ipv6 option, only ipv4 gets compiled in. ive found another mistake in the ebuild of stunnel 4.14. configure option for disabling wrappers is now --disable-libwrap. > > > another question is why is there USE flag 'ssl' used in stunnel ebuild ? it is > > not used by ebuild script at all. > > Thats from the ssl-cert eclass I use in the ebuild. I agree the useflag makes it > redundant, but the eclass is useful for this ebuild. > have no idea about eclasses yet thanks for the info though :) i have included a modified version of the ebuild for stunnel 4.14. please check it and tell me what you think. gejzer@ibt.com.pl 2005-11-29 09:48:57 0000 heh it seems stunnel reacts exactly the same odd way when it comes to libwrap. if you specify disable-libwrap, it disables it. if you specify enable-libwrap, it disables it as well :) so another if use flag needed just as with ipv6 case. ramereth@gentoo.org 2005-11-29 09:55:47 0000 Yeah, I noticed in their changelog that they changed the tcp wrappers name and was going to update the ebuild once I had this issue sorted. About the --disable-ipv6 not working as aspected, I just tried what you suggested and that indeed does what its supposed to do. I'll see about getting on their mailing list and finding out whats going on. Thanks for working all of this out! I'll let you know what I find out on my end. jakub@gentoo.org 2007-07-07 16:05:41 0000 Please, test w/ 4.20; if it still doesn't work for you, attach a unified diff against that version and reopen. gejzer@ibt.com.pl 2007-07-07 20:31:07 0000 time flows so quickly... almost two years have passed, i'm using stunnel version 4.20 now with default ebuild and i dont recall any problems whatsoever. jakub@gentoo.org 2007-09-01 10:01:20 0000 Thanks for reporting back. Arches, please stabilize 4.20; been in the tree since February without any bugs. josejx@gentoo.org 2007-09-01 14:21:08 0000 Seems to work here, marked ppc stable. The ppc64 keyword seems to have been dropped, so I also added ~ppc64 and will leave ppc64 CC'd for later stabilization. jer@gentoo.org 2007-09-01 16:18:24 0000 ? jer@gentoo.org 2007-09-01 16:21:11 0000 Stable for HPPA. CC'ing ia64 as they probably want in as well. armin76@gentoo.org 2007-09-01 16:57:47 0000 ia64 doesn't want to stabilize it miknix@gentoo.org 2007-09-02 19:13:39 0000 net-misc/stunnel-4.20 stunnel libs namely libstunnel.so are being built without -fPIC on AMD64. fauli@gentoo.org 2007-09-05 06:11:40 0000 x86 stable armin76@gentoo.org 2007-09-05 11:30:38 0000 alpha stable, thanks Tobias miknix@gentoo.org 2007-09-05 20:23:44 0000 Created an attachment (id=130113) stunnel-4.20-fPIC.diff Patch to make libstunnel.so being compiled with -fPIC. NOTE: The stunnel executable is also being built with same objects (built with -fPIC) as libstunnel.so. miknix@gentoo.org 2007-09-05 22:43:33 0000 Created an attachment (id=130118) stunnel-4.20-fPIC.diff Errr.. Just forget the other patch.. I was thinking in another thing when I made it. It should work this time.. It builds ONLY libstunnel.so with PIC. miknix@gentoo.org 2007-09-17 23:48:58 0000 (From update of attachment 130118) Useless patch.. Its building correctly without it.. Guess I didn't saw the fPIC on the first time. Sorry for delaying amd64 stabilization. net-misc/stunnel-4.20 USE="ssl tcpd -ipv6 (-selinux)" - Emerges on AMD64. - Tested by tunneling http data to an apache server. The certificates generated by ebuild didn't work on my setup. I had to create new ones. rbu@gentoo.org 2007-09-20 12:43:35 0000 amd64 stable. Please have a look into the auto-created certificates. They're not signed correctly. joker@gentoo.org 2007-09-20 20:51:53 0000 sparc stable corsair@gentoo.org 2007-10-08 07:54:15 0000 ppc64 stable 73800 2005-11-29 09:42 0000 patched ebuild stunnel-4.14.ebuild text/plain IyBDb3B5cmlnaHQgMTk5OS0yMDA1IEdlbnRvbyBGb3VuZGF0aW9uCiMgRGlzdHJpYnV0ZWQgdW5k ZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSB2MgojICRIZWFk ZXI6IC92YXIvY3Zzcm9vdC9nZW50b28teDg2L25ldC1taXNjL3N0dW5uZWwvc3R1bm5lbC00LjE0 LmVidWlsZCx2IDEuMSAyMDA1LzExLzIwIDAzOjE2OjQyIHJhbWVyZXRoIEV4cCAkCgppbmhlcml0 IHNzbC1jZXJ0IGV1dGlscyBmbGFnLW8tbWF0aWMKCkRFU0NSSVBUSU9OPSJUTFMvU1NMIC0gUG9y dCBXcmFwcGVyIgpIT01FUEFHRT0iaHR0cDovL3N0dW5uZWwubWlydC5uZXQvIgpTUkNfVVJJPSJo dHRwOi8vd3d3LnN0dW5uZWwub3JnL2Rvd25sb2FkL3N0dW5uZWwvc3JjLyR7UH0udGFyLmd6IgoK TElDRU5TRT0iR1BMLTIiClNMT1Q9IjAiCktFWVdPUkRTPSJ+YWxwaGEgfmFtZDY0IH5hcm0gfnBw YyB+c3BhcmMgfng4NiIKSVVTRT0iaXB2NiBzZWxpbnV4IHRjcGQiCgpERVBFTkQ9InZpcnR1YWwv bGliYwoJPj1kZXYtbGlicy9vcGVuc3NsLTAuOS42aiIKUkRFUEVORD0iPj1kZXYtbGlicy9vcGVu c3NsLTAuOS42agoJc2VsaW51eD8gKCBzZWMtcG9saWN5L3NlbGludXgtc3R1bm5lbCApIgoKc3Jj X3VucGFjaygpIHsKCXVucGFjayAke0F9CgkjIEhhY2sgYXdheSBnZW5lcmF0aW9uIG9mIGNlcnRp ZmljYXRlCglzZWQgLWkgcy9eaW5zdGFsbC1kYXRhLWxvY2FsOi9kby1ub3QtcnVuLXRoaXM6LyAi JHtTfSIvdG9vbHMvTWFrZWZpbGUuaW4KfQoKc3JjX2NvbXBpbGUoKSB7Cglsb2NhbCBteWNvbmYK CglteWNvbmY9Ii0td2l0aC10aHJlYWRzPXB0aHJlYWQgYHVzZV9lbmFibGUgdGNwZCBsaWJ3cmFw YCIKCglpZiB1c2UgaXB2NiA7IHRoZW4KCQlteWNvbmY9IiR7bXljb25mfSBgdXNlX2VuYWJsZSBp cHY2YCIKCWZpCgoJZWNvbmYgJHtteWNvbmZ9IHx8IGRpZSAiZWNvbmYgZGllZCIKCWVtYWtlIHx8 IGRpZSAiZW1ha2UgZGllZCIKfQoKc3JjX2luc3RhbGwoKSB7CgltYWtlIERFU1RESVI9JHtEfSBp bnN0YWxsIHx8IGRpZSAibWFrZSBpbnN0YWxsIGZhaWxlZCIKCXJtIC1yZiAke0R9L3Vzci9zaGFy ZS9kb2MvJHtQTn0KCXJtIC1mICR7RH0ve2V0Yy9zdHVubmVsL3N0dW5uZWwuY29uZi1zYW1wbGUs dXNyL3NiaW4vc3R1bm5lbDN9CglybSAtZiAke0R9L3Vzci9zaGFyZS9tYW4vbWFuOC97c3R1bm5l bC5mci44LHN0dW5uZWwucGwuOH0KCglkb2RvYyBBVVRIT1JTIEJVR1MgQ1JFRElUUyBJTlNUQUxM IE5FV1MgUE9SVFMgUkVBRE1FIFRPRE8gQ2hhbmdlTG9nIFwKCQlkb2MvZW4vdHJhbnNwcm94eS50 eHQKCWRvaHRtbCBkb2Mvc3R1bm5lbC5odG1sIGRvYy9lbi9WTkNfU3R1bm5lbEhPV1RPLmh0bWwg dG9vbHMvY2EuaHRtbCBcCgkJdG9vbHMvaW1wb3J0Q0EuaHRtbAoKCWluc2ludG8gL2V0Yy9zdHVu bmVsCglkb25ld2lucyAke0ZJTEVTRElSfS9zdHVubmVsLmNvbmYgc3R1bm5lbC5jb25mCgluZXdp bml0ZCAke0ZJTEVTRElSfS9zdHVubmVsLnJjNiBzdHVubmVsCgkjIENoZWNrIGlmIHRoZXJlJ3Mg Y3VycmVudGx5IGFuIGNlcnQgYWxyZWFkeSB0aGVyZQoJaWYgWyAhIC1mIC9ldGMvc3R1bm5lbC9z dHVubmVsLmtleSBdOyB0aGVuCgkJZG9jZXJ0IHN0dW5uZWwKCWZpCgoJa2VlcGRpciAvdmFyL3J1 bi9zdHVubmVsCn0KCnBrZ19wb3N0aW5zdCgpIHsKCWVuZXdncm91cCBzdHVubmVsCgllbmV3dXNl ciBzdHVubmVsIC0xIC0xIC0xIHN0dW5uZWwKCgljaG93biBzdHVubmVsOnN0dW5uZWwgJHtST09U fS92YXIvcnVuL3N0dW5uZWwKCWNob3duIHN0dW5uZWw6c3R1bm5lbCAke1JPT1R9L2V0Yy9zdHVu bmVsL3N0dW5uZWwue2NvbmYsY3J0LGNzcixrZXkscGVtfQoJY2htb2QgMDY0MCAke1JPT1R9L2V0 Yy9zdHVubmVsL3N0dW5uZWwue2NvbmYsY3J0LGNzcixrZXkscGVtfQoKCWlmIFsgISAteiAiJChl Z3JlcCAnL2V0Yy9zdHVubmVsL3N0dW5uZWwucGlkJyBcCgkJJHtST09UfS9ldGMvc3R1bm5lbC9z dHVubmVsLmNvbmYgKSIgXSA7IHRoZW4KCgkJZXdhcm4gIkFzIG9mIHN0dW5uZWwtNC4wOSwgdGhl IHBpZCBmaWxlIHdpbGwgYmUgbG9jYXRlZCBpbiAvdmFyL3J1bi9zdHVubmVsLiIKCQlld2FybiAi UGxlYXNlIHN0b3Agc3R1bm5lbCwgZXRjLXVwZGF0ZSwgYW5kIHN0YXJ0IHN0dW5uZWwgYmFjayB1 cCB0byBlbnN1cmUiCgkJZXdhcm4gInRoZSB1cGRhdGUgdGFrZXMgcGxhY2UiCgkJZXdhcm4gIiIK CQlld2FybiAiVGhlIG5ldyBsb2NhdGlvbiB3aWxsIGJlIC92YXIvcnVuL3N0dW5uZWwvc3R1bm5l bC5waWQiCgkJZWJlZXAgMwoJCWVwYXVzZSAzCglmaQp9Cg== 130113 2007-09-05 20:23 0000 stunnel-4.20-fPIC.diff stunnel-4.20-fPIC.diff text/plain LS0tIHN0dW5uZWwtNC4yMC9zcmMvTWFrZWZpbGUuaW4ub2xkCTIwMDctMDktMDUgMTk6NTg6MDMu MDAwMDAwMDAwICswMTAwCisrKyBzdHVubmVsLTQuMjAvc3JjL01ha2VmaWxlLmluCTIwMDctMDkt MDUgMTk6NTg6MDcuMDAwMDAwMDAwICswMTAwCkBAIC05MCw3ICs5MCw3IEBAIERFRkFVTFRfSU5D TFVERVMgPSAtSS4gLUkkKHNyY2RpcikKIGRlcGNvbXAgPSAkKFNIRUxMKSAkKHRvcF9zcmNkaXIp L2F1dG8vZGVwY29tcAogYW1fX2RlcGZpbGVzX21heWJlID0gZGVwZmlsZXMKIENPTVBJTEUgPSAk KENDKSAkKERFRlMpICQoREVGQVVMVF9JTkNMVURFUykgJChJTkNMVURFUykgJChBTV9DUFBGTEFH UykgXAotCSQoQ1BQRkxBR1MpICQoQU1fQ0ZMQUdTKSAkKENGTEFHUykKKwkkKENQUEZMQUdTKSAk KEFNX0NGTEFHUykgLWZQSUMgJChDRkxBR1MpCiBMVENPTVBJTEUgPSAkKExJQlRPT0wpIC0tdGFn PUNDIC0tbW9kZT1jb21waWxlICQoQ0MpICQoREVGUykgXAogCSQoREVGQVVMVF9JTkNMVURFUykg JChJTkNMVURFUykgJChBTV9DUFBGTEFHUykgJChDUFBGTEFHUykgXAogCSQoQU1fQ0ZMQUdTKSAk KENGTEFHUykK 130118 2007-09-05 22:43 0000 stunnel-4.20-fPIC.diff stunnel-4.20-fPIC.diff text/plain LS0tIHN0dW5uZWwtNC4yMC9zcmMvTWFrZWZpbGUuYW0ub2xkCTIwMDctMDktMDUgMjM6MzM6NTQu MDAwMDAwMDAwICswMTAwCisrKyBzdHVubmVsLTQuMjAvc3JjL01ha2VmaWxlLmFtCTIwMDctMDkt MDUgMjM6MzQ6NDMuMDAwMDAwMDAwICswMTAwCkBAIC0xOCw3ICsxOCw3IEBAIHNiaW5fU0NSSVBU UyA9IHN0dW5uZWwzCiAjIFVuaXggc2hhcmVkIGxpYnJhcnkKIAogbGliX0xUTElCUkFSSUVTID0g bGlic3R1bm5lbC5sYQotbGlic3R1bm5lbF9sYV9TT1VSQ0VTID0gJChzaGFyZWRfc291cmNlcykK K2xpYnN0dW5uZWxfbGFfU09VUkNFUyA9IC1mUElDICQoc2hhcmVkX3NvdXJjZXMpCiBsaWJzdHVu bmVsX2xhX0xERkxBR1MgPSAtYXZvaWQtdmVyc2lvbgogCiAjIFJlZCBIYXQgImJ5IGRlc2lnbiIg YnVnICM4MjM2OQo=