You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2009/11/22 15:04:23 UTC

DO NOT REPLY [Bug 48260] New: Firefox 3.6 causes SIGSEGV in ssl3_finish_mac()

https://issues.apache.org/bugzilla/show_bug.cgi?id=48260

           Summary: Firefox 3.6 causes SIGSEGV in ssl3_finish_mac()
           Product: Apache httpd-2
           Version: 2.2.14
          Platform: All
        OS/Version: NetBSD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_ssl
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: manu@netbsd.org


The server is running NetBSD-5.0 with SSL-enabled Apache-2.2.14 (older Apache
exhibit the same problem). From time to time, httpd gets a SIGSEGV in
ssl3_finish_mac(). That behavior seems common, and other NetBSD users report
experiencing it.

That happens with a plain config (no additonnal module), serving static pages. 

Starting with Firefox 3.6, the crash can occur on each request: at once,
Firefox can load a page normally. If I make a burst of a dozen page reloads,
httpd will crash in ssl3_finish_mac(), and Firefox will give me a "The
connexion was Reset". Any attempt to load a page by this Firefox instance on
this server will then fail, until Apache is restarted. 

Once I get into this state, other client can load pages from Apache, so the
problem is with a shared state between Apache and Firefox.

I have a workaround: in Firefox, setting security.enable_tls_session_tickets to
false will fix the problem. As Firefox 3.6 ussage will increase, I'd be quite
interested by a similar server-side workaround.

I am not sure if there is a bug in Firefox 3.6, but since a sgmentation fault
is always the sign of some illness, I suspect the situation is worth an Apache
bug report.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 48260] Firefox 3.6 causes SIGSEGV in ssl3_finish_mac()

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=48260

Kaspar Brand <as...@velox.ch> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEEDINFO                    |RESOLVED
         Resolution|                            |INVALID

--- Comment #4 from Kaspar Brand <as...@velox.ch> 2011-09-28 07:30:49 UTC ---
This was due to a bug in that (snapshot version of) OpenSSL, I assume. Seems
like it was fixed by the following patch to s3_enc.c:

http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/openssl/ssl/Attic/s3_enc.c?only_with_tag=netbsd-5

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 48260] Firefox 3.6 causes SIGSEGV in ssl3_finish_mac()

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=48260

--- Comment #3 from manu@netbsd.org 2009-11-22 21:12:47 UTC ---
It's netbsd-5 branch built-in OpenSSL: "OpenSSL 0.9.9-dev 09 May 2008"
without any doubt older than 0.9.8k. I will rebuild with 0.9.8k and
test.

In the meantime, someone proposed a server-side workaround:
http://mail-index.netbsd.org/netbsd-users/2009/11/22/msg004923.html
    SSLProtocol all -TLSv1

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 48260] Firefox 3.6 causes SIGSEGV in ssl3_finish_mac()

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=48260

Rainer Jung <ra...@kippdata.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |NEEDINFO

--- Comment #2 from Rainer Jung <ra...@kippdata.de> 2009-11-22 10:14:52 UTC ---
Which OpenSSL version are you using? Can you test with mod_ssl linked against
OpenSSL 0.9.8k or 0.9.8l? The OpenSSL patch mentioned in the Mozilla ticket
should have gone into 0.9.8g already.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 48260] Firefox 3.6 causes SIGSEGV in ssl3_finish_mac()

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=48260

--- Comment #1 from manu@netbsd.org 2009-11-22 06:12:07 UTC ---
According to this problem report at Mozilla, the problem would be in OpenSSL:
https://bugzilla.mozilla.org/show_bug.cgi?id=430703

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org