On Sat Dec 14 08:41:53 2013, rbar...@yahoo-inc.com wrote: > We are seeing a segfault when TLS 1.2 is enabled with OpenSSL 1.0.1e (also > with 1.0.1a). We are running Apache Traffic Server on RHEL6 and when we > upgraded OpenSSL from 1.0.0 to 1.0.1 we started seeing this issue. I was > able to narrow down the issue to TLS 1.2 by disabling TLS 1.2. The crash > consistently happens in less than 1 hour when receiving production load > (~1000 requests per second) where approx. 15-20% of requests are https. > Some more details can be obtained from the traffic server reported bug > (https://issues.apache.org/jira/browse/TS-2355). I don't know anything > about OpenSSL but did some poking around on the core dump (maybe this will > help): >
Hmm... that's a weird one. The debug info tells me it is a TLS v1.0 connection and that it is attempting to use MD5 when calculating the handshake hash. It caches handshake records in the function ssl3_digest_cached_records() using pretty much the same logic that fails later on. That function wouldn't be called if the handshake buffer was never initialised but it should be initialised when the connection is accepted. So it looks like it's a "this can't happen error",,, There is a way of stopping the crash at that point by checking to see if EVP_MD_CTX_copy returns an error (which is sensible anyway) but that's fixing a symptom rather than the underlying cause. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
