On Mon, Nov 27, 2017 at 10:40:33PM +0100, Claudio Jeker wrote:
> Does not happen here. Running
> while make run-regress-args-https-inspect.pl ; do echo -n; done
> for a few minutes now and no failure.
It takes a while. I am running it on
- very old and slow i386 machine, different timing
- relayd runs on remote machine, different network timing
- I have mpi@'s TCP unlock kernel, should not matter
> Very strange. Can you provide me the log files of such a failure?
It seems that we get an fatal error. ca: ca_launch: cert
execute: ssh ot2 perl -I /usr/src/regress/usr.sbin/relayd
/usr/src/regress/usr.sbin/relayd/remote.pl splice 10.188.81.22 10.188.81.21
30722 /usr/src/regress/usr.sbin/relayd/args-https-inspect.pl
execute: relayd -dvv -f /usr/src/regress/usr.sbin/relayd/relayd.conf
startup
relay_load_certfiles: using ca certificate ca.crt
pfe: filter init done
relay_load_certfiles: using ca key ca.key
relay_load_certfiles: using certificate /etc/ssl/10.188.81.22.crt
relay_load_certfiles: using private key /etc/ssl/private/10.188.81.22.key
parent_tls_ticket_rekey: rekeying tickets
relay_privinit: adding relay relay-args-https-inspect.pl
protocol 1: name proto-args-https-inspect.pl
flags: used, relay flags: tls, tls client, tls inspect
tls flags: tlsv1.2, cipher-server-preference
tls session tickets: disabled
type: http
match request header log "foo" value "*"
match response header log "bar" value "*"
socket_rlimit: max open files 1024
socket_rlimit: max open files 1024
ca_engine_init: using RSA privsep engine
ca_engine_init: using RSA privsep engine
relay_tls_ctx_create: loading certificate
ca: ca_launch: cert
hce exiting, pid 62790
relay_tls_ctx_create: loading CA certificate
relay_tls_ctx_create: loading certificate
pfe exiting, pid 66220
relay_launch: running relay relay-args-https-inspect.pl
lost child: pid 35965 exited abnormally
relay exiting, pid 55555
parent terminating, pid 69884
listen sock: 10.188.81.22 39157
stdin closed
Unfortunately there are three places with that log message. So I
use the current code from cvs with this diff applied. I think every
error message should be unique. And I am waiting for my loop to
fail ...
ok for this debugging aid?
bluhm
Index: ca.c
===================================================================
RCS file: /mount/openbsd/cvs/src/usr.sbin/relayd/ca.c,v
retrieving revision 1.29
diff -u -p -r1.29 ca.c
--- ca.c 27 Nov 2017 21:06:25 -0000 1.29
+++ ca.c 27 Nov 2017 21:45:59 -0000
@@ -123,14 +123,14 @@ ca_launch(void)
if (rlay->rl_tls_cert_fd != -1) {
if ((buf = relay_load_fd(rlay->rl_tls_cert_fd,
&len)) == NULL)
- fatalx("ca_launch: cert");
+ fatalx("ca_launch: cert relay_load_fd");
if ((in = BIO_new_mem_buf(buf, len)) == NULL)
- fatalx("ca_launch: cert");
+ fatalx("ca_launch: cert BIO_new_mem_buf");
if ((cert = PEM_read_bio_X509(in, NULL,
NULL, NULL)) == NULL)
- fatalx("ca_launch: cert");
+ fatalx("ca_launch: cert PEM_read_bio_X509");
hash_x509(cert, hash, sizeof(hash));
@@ -160,14 +160,14 @@ ca_launch(void)
if (rlay->rl_tls_cacert_fd != -1) {
if ((buf = relay_load_fd(rlay->rl_tls_cacert_fd,
&len)) == NULL)
- fatalx("ca_launch: cacert");
+ fatalx("ca_launch: cacert relay_load_fd");
if ((in = BIO_new_mem_buf(buf, len)) == NULL)
- fatalx("ca_launch: cacert");
+ fatalx("ca_launch: cacert BIO_new_mem_buf");
if ((cert = PEM_read_bio_X509(in, NULL,
NULL, NULL)) == NULL)
- fatalx("ca_launch: cacert");
+ fatalx("ca_launch: cacert PEM_read_bio_X509");
hash_x509(cert, hash, sizeof(hash));
