<div dir="ltr"><div>>Ok, so the problem is similar on Linux also? In my case 5.44 works well
without crashes, only 5.45 and 5.46 is broken on Windows. <br></div><div>Yes it appears to be the same on linux. I didnt try 5.44 I just went back to the last version (5.41) I had available. <br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, 22 Jun 2018 at 14:58, Per Salmi <<a href="mailto:per.salmi@gmail.com">per.salmi@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">Ok, so the problem is similar on Linux also? In my case 5.44 works well without crashes, only 5.45 and 5.46 is broken on Windows. </div><br><div class="gmail_quote"><div dir="ltr">Den fre 22 juni 2018 15:55Mark Brookes <<a href="mailto:mark@loadbalancer.org" target="_blank">mark@loadbalancer.org</a>> skrev:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>We have just hit the same problem with 5.45. 5.41 does not appear to exhibit the same issue. <br></div><div><br></div><div>The problem appears to be linked to the client/session. <br></div><div>Using sni if we hit the url with one client the page loads fine, if we hit stunnel with a second connection from another client on a different IP their page reloads fine. But if we reload either of those pages stunnel segfaults with the following message - <br></div><div><br></div><div>Jun 22 11:42:31 lbmaster kernel: stunnel[6510]: segfault at 178 ip 00007fc64fcb5fe0 sp 00007fc6500f5948 error 4 in libssl.so.1.0.0[7fc64fc75000+65000]</div><div><br></div><div>The above was generated with stunnel 5.45 and openssl 1.0.2j-fips. I also tested it with stunnel built against 1.1.0h and had the same issue.</div><div>Below is the config - <br></div><div>pid = /var/run/stunnel/stunnel.pid<br>debug = local1.0<br>socket = a:IP_FREEBIND=yes<br>fips = no<br>sslVersion = all<br><br>[VIP_Name-1]<br> cert = /etc/<a href="http://loadbalancer.org/certs/sslcert1/sslcert1.pem" rel="noreferrer" target="_blank">loadbalancer.org/certs/sslcert1/sslcert1.pem</a><br> ciphers = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES<br> accept = <a href="http://192.168.0.112:443" rel="noreferrer" target="_blank">192.168.0.112:443</a><br> connect = <a href="http://192.168.0.112:80" rel="noreferrer" target="_blank">192.168.0.112:80</a><br> delay = yes<br> options = NO_SSLv3<br> options = NO_TLSv1<br> options = NO_TLSv1.1<br> options = DONT_INSERT_EMPTY_FRAGMENTS<br> renegotiation = no<br> local = 192.168.0.112<br> TIMEOUTclose = 0<br> [fizzygood]<br> sni = VIP_Name-1:<a href="http://lb1.testdomain.co.uk" rel="noreferrer" target="_blank">lb1.testdomain.co.uk</a><br> cert = /etc/<a href="http://loadbalancer.org/certs/sslcert1/sslcert1.pem" rel="noreferrer" target="_blank">loadbalancer.org/certs/sslcert1/sslcert1.pem</a><br> ciphers = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES<br> connect = <a href="http://192.168.0.112:80" rel="noreferrer" target="_blank">192.168.0.112:80</a><br> delay = yes<br> options = NO_SSLv3<br> options = NO_TLSv1<br> options = DONT_INSERT_EMPTY_FRAGMENTS<br> renegotiation = no<br> local = 192.168.0.112<br></div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, 21 Jun 2018 at 20:08, Per Salmi <<a href="mailto:per.salmi@gmail.com" rel="noreferrer" target="_blank">per.salmi@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">I have exactly the same problem with stunnel 5.45 and 5.46 crashing on second request!<div dir="auto"><br><div dir="auto">Running on Windows 10 Pro x64 1803.</div><div dir="auto"><br></div><div dir="auto">I also use https to separate traffic to two different sites on the same server as the stunnel service.</div><div dir="auto"><br></div><div dir="auto">/Per</div></div></div><br><div class="gmail_quote"><div dir="ltr">Den tor 21 juni 2018 19:04Javier <<a href="mailto:jamilist.stn@gmx.es" rel="noreferrer" target="_blank">jamilist.stn@gmx.es</a>> skrev:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
isn't annoying when you are using an old version, 5.44, and all goes<br>
fine, you notice you are outdated and then comes the problems after<br>
update? :-P<br>
<br>
<br>
The thing is that yesterday I needed the HTTPS server so I run<br>
Stunnel 5.44 for my non-SSL app and all was fine. I updated to 5.46<br>
just because I forgot the last time and didn't even run again because<br>
I didn't need it.<br>
<br>
Today I used it and... I had a crash. I tested 5.45 to trace versions<br>
back, and it crashes as well. Back to 5.44 and no crash.<br>
<br>
The crash happens when there is a reload/reconnect/multiconnect<br>
(example, 2 connections html+images) by the browser when connects to<br>
an HTTPS server.<br>
<br>
It only happens when using a SNI service.<br>
<br>
I've been able to trace back the log on those versions and when fails<br>
in 5.45 and 5.46 is at the time when it needs to switch to the SNI<br>
service.<br>
<br>
(log from 5.44)<br>
SNI: requested servername: xxx<br>
SNI: matched pattern: xxx<br>
SNI: switched to service [xxx] <<<<----- BEFORE SWITCH, IT CRASHES on 5.45 and 5.46<br>
<br>
Imagine you load <a href="https://xxx/" rel="noreferrer noreferrer noreferrer" target="_blank">https://xxx/</a>.<br>
<br>
The first time is fine, the second, crashes stunnel. Not happening<br>
with 5.44.<br>
<br>
I haven't seen any change to SNI in manual so... :-?<br>
<br>
These are the configs for the used virtual servers. Nothing has been<br>
changed, anyway:<br>
<br>
<br>
[SSL]<br>
client = no<br>
<br>
accept = y.y.y.1:4747<br>
connect = y.y.y.2:443<br>
<br>
[SSL-xxx-SNI]<br>
client = no<br>
sni = SSL:xxx<br>
<br>
connect = y.y.y.2:443<br>
<br>
cert = pem<br>
key = pem<br>
<br>
<br>
Don't mind the port numbers. They aren't in conflict.<br>
<br>
<br>
Running on Windows 2000.<br>
<br>
Regards.<br>
_______________________________________________<br>
stunnel-users mailing list<br>
<a href="mailto:stunnel-users@stunnel.org" rel="noreferrer noreferrer" target="_blank">stunnel-users@stunnel.org</a><br>
<a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users" rel="noreferrer noreferrer noreferrer" target="_blank">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a><br>
</blockquote></div>
_______________________________________________<br>
stunnel-users mailing list<br>
<a href="mailto:stunnel-users@stunnel.org" rel="noreferrer" target="_blank">stunnel-users@stunnel.org</a><br>
<a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users" rel="noreferrer noreferrer" target="_blank">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="m_4582103016143520933m_1989931849985138920m_7138790446698376404gmail_signature" data-smartmail="gmail_signature"><br>Mark Brookes<br>Loadbalancer.org Ltd.<br><a href="http://www.loadbalancer.org" rel="noreferrer" target="_blank">www.loadbalancer.org</a><br> <br><br>+44 (0)330 380 1064 <br><a href="mailto:mark@loadbalancer.org" rel="noreferrer" target="_blank">mark@loadbalancer.org</a><br></div>
</blockquote></div>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><br>Mark Brookes<br>Loadbalancer.org Ltd.<br><a href="http://www.loadbalancer.org" target="_blank">www.loadbalancer.org</a><br> <br><br>+44 (0)330 380 1064 <br><a href="mailto:mark@loadbalancer.org" target="_blank">mark@loadbalancer.org</a><br></div>