stunnel-users June 2025

stunnel-users@stunnel.org

6 participants
3 discussions

Duplicate Received trusted client CA messages
by Sean Burford 18 Jun '25

18 Jun '25

Hi, While configuring stunnel to connect as a client to a TLS server that requires client certificate auth (known as mutual TLS auth), I noticed that each new connection generates lots (up to hundreds) of duplicate logs like: 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA I expect one log per trusted client CA provided by the server. Openssl s_client -msg shows that the server only sends a small CertificateRequest. Stunnel logs show that only one connection is made. This only happens if the server offers exactly one trusted client CA. If multiple client CA options are offered by the server then a single log entry is recorded for each. What appears to be happening is that OpenSSL’s state machine generates lots of info callbacks (the number depends on latency). This appears to be harmless except for the excessive logging. I’m running stunnel 5.75 against OpenSSL 3.5.0 (compiled with enable-weak-ssl-ciphers, enable-ssl3 and enable-ssl3-method): $ stunnel [ ] Initializing inetd mode configuration [ ] Clients allowed=125 [.] stunnel 5.75 on sparc-sun-solaris2.10 platform [.] Compiled/running with OpenSSL 3.5.0 8 Apr 2025 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*(___errno())) … $ openssl version OpenSSL 3.5.0 8 Apr 2025 (Library: OpenSSL 3.5.0 8 Apr 2025) This is probably NOT caused by an OpenSSL 3.5.0 behaviour change, I also see duplicate messages from the public stunnel build running on Windows: [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.74 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 3.3.2 3 Sep 2024 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) To diagnose this further, I modified stunnel src/ctx.c info_callback() to log the TLS state in callbacks: //#if 0 // s_log(LOG_DEBUG, "state = %x", state); state_string=SSL_state_string_long(ssl); s_log(LOG_DEBUG, "TLS state (where %08X state %08X): %s", where, state, state_string); //#endif This shows that there are many callbacks from where SSL_CB_ACCEPT_EXIT and one final callback from SSL_CB_ACCEPT_LOOP: 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001002 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001002 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001002 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (where 00001001 state 00000008): SSLv3/TLS read server certificate request 2025.06.18 10:23:58 LOG6[0]: Received trusted client CA: CN=Example CA 2025.06.18 10:23:58 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate request Modifying info_callback to look for SSL_CB_LOOP in where suppresses the excess messages: /* log the client certificate request (if received) */ #ifndef SSL3_ST_CR_CERT_REQ_A if(state==TLS_ST_CR_CERT_REQ && *where & SSL_CB_LOOP*) #else if(state==SSL3_ST_CR_CERT_REQ_A && *where & SSL_CB_LOOP*) #endif print_CA_list("Received trusted client CA", SSL_get_client_CA_list(ssl)); Here’s my config: debug=info [outbound-http-to-https-mtls] accept = 127.0.0.1:8447 connect = 127.0.0.1:8445 client = yes ; verify 2 - verify peer certificate chain verify = 2 sni = www.example.com checkHost = www.example.com verifyChain = yes CAfile = /export/home/user/stunnel/trusted-ca-certs.pem ; Authenticate ourselves to peer using a client certificate. cert = /export/home/user/stunnel/user.ecdsa-p256.pem key = /export/home/user/stunnel/user.ecdsa-p256.key -- Thanks, Sean Burford

1 0

[PATCH 0/3] Improve stunnel performance by ~17%
by Edwin Torok 12 Jun '25

12 Jun '25

Hello, Flamegraph profiling on stunnel has shown that most time is NOT spent in encryption/decryption, but in sending/receiving data. Experimental setup: ``` CPU: 2x 18-core Intel Xeon Gold 6354 NIC: Intel E810-XXV, 100 Gbit/s Kernel: 6.14.8-300.fc42.x86_64 x86_64 Mem: 251.32 GiB OS: Fedora Linux 42 openssl version: OpenSSL 3.2.4 11 Feb 2025 (Library: OpenSSL 3.2.4 11 Feb 2025) stunnel: 5.75 from git ``` Network, encryption and memory copy speeds converted into Gbit/s on the above HW: ``` iperf3: 40Gbit/s openssl speed -evp aes-256-gcm: 72Gbit/s perf bench memcpy: 100Gbit/s ``` Under ideal conditions we should be able to achieve at most ~20.5Gbit/s, however I only measured ~7.6Gbit/s. The scripts that I used to perform measurements are included in the attached patch 3. See also related discussion on curl: https://github.com/curl/curl/pull/17548 Enabling readahead, avoiding excessive alloc/free of buffers, increasing buffer sizes, and improving buffer handling can all improve performance. For now I'm sending just the first small patches as proofs of concept, each of them one-liners. I hope you can include these in some form in the next release. Eventually these should probably be exposed as configuration flags in stunnel.conf, I can help implementing that, or I can leave implementing that to you if you prefer. In fact readahead was enabled in previous versions of stunnel, and then disabled again, so I assume you ran into some bugs with it on certain protocols? Increasing the buffer size is not a clear win (as with curl), due to the excessive use of memmove/memset, and that SSL_read/SSL_write only still processes 1 TLS record at a time. I have some further changes that can improve that, but the patches are larger and I haven't finished testing them for correctness yet. Please let me know if you'd want these as patches, or if you'd rather implement them yourself. Edwin Török (3): openssl: enable readahead openssl: disable SSL_MODE_RELEASE_BUFFERS Benchmark scripts src/ctx.c | 5 +- tests/benchmark/benchmark.sh | 120 +++++++++++++++++++++++ tests/benchmark/launch.sh | 185 +++++++++++++++++++++++++++++++++++ 3 files changed, 309 insertions(+), 1 deletion(-) create mode 100644 tests/benchmark/benchmark.sh create mode 100755 tests/benchmark/launch.sh -- 2.43.5

4 6

Is TLS 1.2 supported with stunnel 5.01
by joverton＠vital-soft.com 01 Jun '25

01 Jun '25

I have searched online, but was unable to fine any definitive answer on the minimum version of stunnel required for TLS 1.2. I have a client using stunnel 5.01 with our solution and they want to activate TLS 1.2. Their setup looks like this: 2014.05.15 13:38:22 LOG5[10132]: stunnel 5.01 on x86-pc-msvc-1500 platform 2014.05.15 13:38:22 LOG5[10132]: Compiled/running with OpenSSL 1.0.1g-fips 7 Apr 2014 2014.05.15 13:38:22 LOG5[10132]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2014.05.15 13:38:22 LOG5[10132]: Reading configuration from file stunnel.conf 2014.05.15 13:38:22 LOG5[10132]: FIPS mode disabled 2014.05.15 13:38:22 LOG5[10132]: Configuration successful Everything works fine without requiring TLS 1.2, but when that is required, we get the following error: 2025.05.14 07:04:45 LOG7[3796]: SSL state (connect): before/connect initialization 2025.05.14 07:04:45 LOG7[3796]: SSL state (connect): SSLv3 write client hello A 2025.05.14 07:04:45 LOG7[3796]: SSL alert (read): fatal: protocol version 2025.05.14 07:04:45 LOG3[3796]: SSL_connect: 1409442E: error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version 2025.05.14 07:04:45 LOG5[3796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2025.05.14 07:04:45 LOG7[3796]: Remote socket (FD=840) closed 2025.05.14 07:04:45 LOG7[3796]: Local socket (FD=832) closed - Do we need to change anything in stunnel.conf? - Do we need to upgrade stunnel? Many Thanks, John

4 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users June 2025