- stunnel-users - stunnel.org

Broadband and stunnel weird behavior
by Javier 04 Jun '16

04 Jun '16

Hi, I was in doubt if post this or not because I couldn't replicate with enough similarities. But as it may be worth, if it is an actual bug, or help others... why not? Here I have to say that it is more noticeable under Windows 2000. That doesn’t mean doesn’t happen on higher OSs, but, from XP, it isn’t as noticeable. So, please, don’t stop reading here. But, hey, I know it is obsolete, and I know this is long and I’ll understand if you don’t want to read this. I tend to make a lot of “speed tests” because ISPs in my country… well, if you have luck, great, if not, brace yourself with the fights. Maybe as other countries :/ About February my download broadband was enhanced from 30Mb to 50Mb. This is important because is when it started all. With only 30Mb I didn’t notice any problem. “Speed tests“ were fine with “only” 30Mb and all matched the contracted speed and even a bit more. But when I had 50Mb I started to see some annoyances that sometimes was over 50Mb and others... if I had the luck to have 30Mb, it was a miracle. It wasn’t the test used. It was any test, with any technology (flash, html5, java, etc). The difference was just a couple of Mb. But all reflected the problems. They were so random, but something in common is that the tests didn’t show the correct speed at the end of my PC usage day. So I thought, something in memory, maybe, was causing it. But, also, it didn’t happen all days. At the end of the day, sometimes, I topped the 50Mb. And here starts the discarding process. I have a humble Pentium 4 and, even it is not powerful, one of the things I do (that I won’t explain why) is to throttle it (decrease speed). It is one of the first things I discarded, because as higher the broadband, the CPU load at full speed is higher as well. I only noticed a little improvement. This wasn’t the problem. Even I uninstalled the filter driver. So, if the CPU wasn’t the problem, programs should be. And I started with everything. And I left Stunnel as one of the latest. And there was the problem. When Stunnel is open, the speed cuts at about 30Mb. Yeah, I couldn’t believe myself either. After several tests, I discovered that Stunnel isn’t either the problem itself. The problem comes from the amount of services in .conf file. The more you have, the more speed problems you’ll have. I discovered this with the second instance of Stunnel I use for servers, which only has 7 services (3 SNI). I mainly use Stunnel as client for non-SSL aware programs and I have set 16 services. The options of .conf file, or services options, seems to don’t have much effect on speed tests. At the end, one way or another, the result is that if I open Stunnel, I can’t top full speed. I close it and voilà!, even during the same speed test. What is causing it? Probably just Windows 2000, or maybe not. Windows 2000 doesn’t have a connection limit as XP, one of the things I thought about. Anyway, I just wanted to shared this with you, just in case helps or anything. Regards. System specifications: Windows 2000 SP4 // XP SP2 (testing purposes) P4 2.8Ghz RAM 2GB RTL8139 Fast Ethernet Full Duplex

1 0

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 31 May '16

31 May '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Hi Michal, > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > why not just start stunnel with config parameter on command line? stunnel %USERPROFILE%/stunnel-config-file (windows) stunnel ${HOME}/stunnel-config-file (*nix)

2 1

Re: [stunnel-users] IPv4 and IPv6
by Konstantin Belousov 31 May '16

31 May '16

On Tue, May 31, 2016 at 08:04:24AM +0200, Micha?? Trojnara wrote: > On 31.05.2016 00:42, Konstantin Belousov wrote: > > I have a following configuration for the outgoing connection > > [XXX-1] > > client = yes > > accept = 127.0.0.1:1564 > > connect = some-server:9999 > > local = some-other-address > [cut] > > The socket was created with INET6 address family, but bind was done for > > INET AF. > > This is pretty much expected if "some-server:9999" is an IPv6 address > and "some-other-address" is an IPv4 address. The "local" option indeed > cannot handle a mix of IPv4 and IPv6 "connect" addresses. Usually some-server is the list of addresses, one of them is IPv4, and another is IPv6. This is the only reasonable way to name dual-stack host. > > What do you think might be a proper solution? I would expect that the code which binds the socket for connect(2), matched the address types before binding. A good implementation needs to iterate over the results of getaddrinfo(3) for remote host to try to connect to each returned address. In the same manner, when one outgoing address is attempted to connect to, the getaddrinfo(3) list for the local address would be iterated over, and first matched compatible address selected for binding. It seems that it is enough to match addrinfo pairs by ai_family/ai_socktype/ai_protocol, but you might also need to e.g. pay some attention to filter out IPv4 mapped to IPv6 entries. I am not sure how much additional plumbing is required to have local getaddrinfo(3) result in the local_bind().

1 0

IPv4 and IPv6
by Konstantin Belousov 30 May '16

30 May '16

Hi. I have a following configuration for the outgoing connection [XXX-1] client = yes accept = 127.0.0.1:1564 connect = some-server:9999 local = some-other-address Sometimes, or rather, quite regular, the connection to localhost port 1564 results in immediate connection close and logging the following: May 30 23:06:58 tom stunnel: LOG5[4]: Service [XXX-1] accepted connection from 127.0.0.1:12848 May 30 23:06:58 tom stunnel: LOG3[4]: local_bind (ephemeral port): Invalid argument (22) I traced the syscalls and see the following: 28196 stunnel CALL socket(PF_INET6,SOCK_STREAM,IPPROTO_IP) 28196 stunnel RET socket 10/0xa 28196 stunnel CALL fcntl(0xa,F_GETFL,0) 28196 stunnel RET fcntl 2 28196 stunnel CALL fcntl(0xa,F_SETFL,0x6<O_RDWR|O_NONBLOCK>) 28196 stunnel RET fcntl 0 28196 stunnel CALL fcntl(0xa,F_SETFD,FD_CLOEXEC) 28196 stunnel RET fcntl 0 28196 stunnel CALL bind(0xa,0x802808a6c,0x10) 28196 stunnel STRU struct sockaddr { AF_INET, 176.36.249.139:0 } 28196 stunnel RET bind -1 errno 22 Invalid argument The socket was created with INET6 address family, but bind was done for INET AF. Indeed, both some-server and some-other-address have both A and AAAA records, corresponding addresses are configured and functional. OS is FreeBSD, I was ensured that this combination (INET6 socket and INET bind) is not correct. It probably works sometime when first resolved addresses for names happen to come from the same address family, but when resolvers return different order, the situation above occurs. Disabling ipv6 support makes the connection work reliably, which confirms my observations. I am using stunnel 5.31. Would be nice to have this fixed. Thanks.

1 0

Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 28 May '16

28 May '16

the problem frequently occurs on the client side: admin need to configure stunnel for multiple users. every user has own key, certificate, own permissions on file system (for log-files, etc) this patch allow to write flexible config. some examples: cert = %USERPROFILE%\.config\my.pem (windows) cert = ${HOME}/.config/my.pem (other) output = %APPDATA%\stunnel.log (windows) output = ${HOME}/stunnel.log (other) CAfile = %ALLUSERSPROFILE%\ourCAbundle.crt (windows) CAfile = /etc/ssl/certs/ourCAbundle.crt (other, not using variables) "secure" :) random port example: ... [srv1] accept = 127.0.0.1:%SRV1_PORT% (windows) accept = 127.0.0.1:${SRV1_PORT} (other) ... start stunnel (batch-file or shell-script): set SRV1_PORT=%RANDOM% (windows) limitations: 1. don't support unicode on windows (localized usernames, files, etc) 2. only ${NAME} syntax supported on *nix (not $NAME).

2 1

Potential performance degradation moving from Stunnel 5.06 to 5.32
by Mark Brookes 24 May '16

24 May '16

There might be a throughput degradation in the more recent versions of stunnel. I have recently been testing the 5.32 version of stunnel and have noticed that the tps drop quite significantly when moving from 5.06 to 5.32. Im willing to admit it could be something to do with my config or testing. But if anyone could offer some suggestions it would be much appreciated. The config is setup as follows - Stunnel VIP -> Haproxy. (I have configured haproxy to return a simple page). I am using a self signed 1024 bit certificate and the cipher I am using is ECDHE-RSA-AES256-GCM-SHA384 (I also tested with aNull:eNULL:MD5:LOW:HIGH and noticed a similar drop in performance) My Stunnel config is - setuid = stunnel pid = /var/run/stunnel/stunnel.pid debug = local1.0 socket = a:IP_FREEBIND=yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [VIP_Name-1] cert = /root/server1024.pem ciphers = ECDHE-RSA-AES256-GCM-SHA384 accept = 192.168.80.131:443 connect = 127.0.0.1:80 connect = 127.0.0.2:80 delay = no options = CIPHER_SERVER_PREFERENCE options = DONT_INSERT_EMPTY_FRAGMENTS renegotiation = no TIMEOUTclose = 0 My HAProxy config is - global daemon stats socket /var/run/haproxy.stat mode 600 level admin pidfile /var/run/haproxy.pid maxconn 100000 tune.maxrewrite 1024 nbproc 3 defaults #mode http #balance roundrobin timeout connect 4000 timeout client 42000 timeout server 43000 peers loadbalancer_replication peer lbmaster localhost:7778 peer lbslave localhost:7778 listen VIP_Name bind 127.0.0.1:80 transparent #bind 192.168.80.121:80 transparent monitor-uri / mode http errorfile 200 /etc/haproxy/200.http listen VIP_Name_2 monitor-uri / mode http bind 127.0.0.2:80 transparent errorfile 200 /etc/haproxy/200.http All the versions of stunnel mentioned here have been built against Openssl1.0.1s I am using siege to generate the load and issuing the following command - siege https://192.168.80.131 -t1M -c 15 -b The test is stop stunnel service, replace stunnel binary with different version, restart service, run test. The results im seeing are as follows (All results are quoted in transactions per second as reported by siege). v5.06 - 2233 v5.07 - 2229 v5.25 - 2171 v5.30 - 2092 v5.32 - 302 In my results you can see roughly a 200 tps drop from version 5.06 to v5.30 then when we get to v5.32 it drops further. To reiterate the only thing I am changing in my configuration is the stunnel binary. Everything else is remaining the same. Does anyone have any ideas what could be happening? Thankyou Mark

1 0

stunnel on AIX 7
by Randall LeJeune 19 May '16

19 May '16

Does anyone here have any experience in installing and/or running stunnel on AIX? I have version 4.56 installed on my AIX v.7 box, but I checked when this was released and it was over three years ago. I found a version 5.17-2 binary available on Perzl.org but nothing more recent (this version is slightly over a year old). I did try a compile of the newest version but got some errors when I tried to run make (1254-004 error on collect2). Does anyone have any ideas on what would be the best way to proceed here? Thanks in advance.

2 1

PKCS12 support patch
by Dmitry Bakshaev 19 May '16

19 May '16

googling internet about using certificate and keys from PKCS12 file lead to convert it to PEM. it requires some additional utilities (openssl not default windows application) and manual steps to convert. this patch allow using PKCS12 directly from stunnel. example configuration: cert = /home/dab/.certs/my.p12 PKCS12-files detected by file extension (.p12 or .pfx, no case sensetive) and load specially. password prompted if needed, empty password also supported. code based on examples from: https://groups.google.com/forum/#!topic/mailing.openssl.users/iuBmSqwsIG4 http://openssl-users.openssl.narkive.com/J0bR3cMA/ssl-ctx-use-privatekey-fi… patch tested on stunnel working on linux (gentoo: from our overlay http://bbgentoo.ilb.ru/repos/bbgentoo/bbgentoo_overlay/branches/drafts/net-… ) and windows.

1 1

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 18 May '16

18 May '16

On Wed, 2016-05-18 07:24:52 +0000, David Faizulaev wrote: > Do you concatenate the self-signed certificate to the current CA? This self-signed certificate /is/ the current CA certificate, as it is the root of the peer's certificate chain and you trust it. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

SSL Labs: Session resumption IDs assigned but not accepted
by Brandon Jackson 17 May '16

17 May '16

Trying to find out why SSL Labs is giving this message Session resumption (caching): No (IDs assigned but not accepted) I have this in the config. sessionCacheSize = 1000 sessionCacheTimeout = 86400 ---------------------------------- Brandon Jackson bojack1437(a)gmail.com

1 0