-
Notifications
You must be signed in to change notification settings - Fork 327
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Segfault with OpenSSL version mismatch #11
Comments
This is most likely connected to sslsplit being built against OpenSSL 1.0.1e but run with 1.0.1c. There is a bug in 1.0.1e which requires sslsplit to use a workaround hack in order to load certificates. The use of the hack is indicated by the notice "Using direct access workaround when loading certs". Running with a different version of OpenSSL than building against may or may not work, depending on how much OpenSSL has changed between versions. Try to run sslsplit with the same version of OpenSSL it was built against. I will close this ticket since there is nothing I can do about it; if you have the same problem also when running under the same version of OpenSSL as built against then please reopen and attach a stack trace. |
Is there something I need to do in order to use the "direct access workaround"? I'm now both compiling and running using 1.0.1e.... sslsplit -D -l connections.log -k ca.key -c ca.crt ssl 0.0.0.0 8443
|
I think this issue needs to be re-opened. The recommended solution of using the same version of openssl didn't work. |
I agree, it is due to lack of time that I did not reopen yet, not due to disagreement :) |
I can second this issue. Running Debian 7/Wheezy. root@p:/# openssl version -a root@p:/# sslsplit -V |
Comment by @exvance moved from #10 to new issue:
I don't know if my issue is the same as this one. It doesn't seem to matter whether or not I use the -j option.
sslsplit -D -l connections.log -k ca.key -c ca.crt ssl 0.0.0.0 8443
Generated RSA key for leaf certs.
SSLsplit (built 2013-11-29)
Copyright (c) 2009-2013, Daniel Roethlisberger daniel@roe.ch
http://www.roe.ch/SSLsplit
Features: -DDISABLE_SSLV2_SESSION_CACHE -DHAVE_NETFILTER
NAT engines: netfilter*
netfilter: !IP_TRANSPARENT SOL_IPV6 !IPV6_ORIGINAL_DST
compiled against OpenSSL 1.0.1e 11 Feb 2013 (1000105f)
rtlinked against OpenSSL 1.0.1c 10 May 2012 (1000103f)
TLS Server Name Indication (SNI) supported
OpenSSL is not thread-safe
Using direct access workaround when loading certs
SSL/TLS algorithm availability: RSA DSA !ECDSA DH !ECDH !EC
OpenSSL option availability: SSL_OP_NO_COMPRESSION SSL_OP_NO_TICKET SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION SSL_OP_TLS_ROLLBACK_BUG
compiled against libevent 2.0.19-stable
rtlinked against libevent 2.0.19-stable
1 CPU cores detected
proxyspecs:
But then if I go back to version 0.4.6-1 it starts fine....but then I get the segmentation fault when I try to connect to port 8443 with telnet.
The text was updated successfully, but these errors were encountered: