<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=KOI8-R" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Igor Sysoev пишет:
<blockquote cite="mid:20110201125804.GW24370@rambler-co.ru" type="cite">
<pre wrap="">On Tue, Feb 01, 2011 at 03:32:25PM +0300, Andrey Y. Ostanovsky wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Обновился из портов с nginx-0.7.67 на nginx-0.8.54 - сломался ssl с
диагностикой
2011/02/01 15:17:52 [alert] 90164#0: worker process 90171 exited on
signal 10
Откатился обратно на 7-ю ветку.
</pre>
</blockquote>
<pre wrap=""><!---->
nginx -V
</pre>
</blockquote>
nginx version: nginx/0.8.54<br>
TLS SNI support disabled<br>
configure arguments: --prefix=/usr/local/etc/nginx --with-cc-opt='-I
/usr/local/include' --with-ld-opt='-L /usr/local/lib'
--conf-path=/usr/local/etc/nginx/nginx.conf
--sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid
--error-log-path=/var/log/nginx-error.log --user=www --group=www
--http-client-body-temp-path=/var/tmp/nginx/client_body_temp
--http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp
--http-proxy-temp-path=/var/tmp/nginx/proxy_temp
--http-scgi-temp-path=/var/tmp/nginx/scgi_temp
--http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp
--http-log-path=/var/log/nginx-access.log
--with-http_gzip_static_module --with-http_realip_module
--with-http_ssl_module --with-http_stub_status_module --with-pcre<br>
<br>
<blockquote cite="mid:20110201125804.GW24370@rambler-co.ru" type="cite">
<pre wrap="">и корки</pre>
</blockquote>
<br>
Собрано без отладочных символов, поэтому корка фактически пустая:<br>
<br>
GNU gdb 6.1.1 [FreeBSD]<br>
Copyright 2004 Free Software Foundation, Inc.<br>
GDB is free software, covered by the GNU General Public License, and
you are<br>
welcome to change it and/or distribute copies of it under certain
conditions.<br>
Type "show copying" to see the conditions.<br>
There is absolutely no warranty for GDB. Type "show warranty" for
details.<br>
This GDB was configured as "amd64-marcel-freebsd"...(no debugging
symbols found)...<br>
Core was generated by `nginx-0.8.54'.<br>
Program terminated with signal 10, Bus error.<br>
Reading symbols from /lib/libcrypt.so.4...(no debugging symbols
found)...done.<br>
Loaded symbols for /lib/libcrypt.so.4<br>
Reading symbols from /usr/local/lib/libpcre.so.0...(no debugging
symbols found)...done.<br>
Loaded symbols for /usr/local/lib/libpcre.so.0<br>
Reading symbols from /usr/lib/libssl.so.5...(no debugging symbols
found)...done.<br>
Loaded symbols for /usr/lib/libssl.so.5<br>
Reading symbols from /lib/libcrypto.so.5...(no debugging symbols
found)...done.<br>
Loaded symbols for /lib/libcrypto.so.5<br>
Reading symbols from /lib/libz.so.4...(no debugging symbols
found)...done.<br>
Loaded symbols for /lib/libz.so.4<br>
Reading symbols from /lib/libc.so.7...(no debugging symbols
found)...done.<br>
Loaded symbols for /lib/libc.so.7<br>
Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols
found)...done.<br>
Loaded symbols for /libexec/ld-elf.so.1<br>
#0 0x0000000800ecf416 in memcpy () from /lib/libc.so.7<br>
(gdb) bt<br>
#0 0x0000000800ecf416 in memcpy () from /lib/libc.so.7<br>
#1 0x00000000004231d0 in ?? ()<br>
#2 0x00000000004339ae in ?? ()<br>
<br>
<br>
<br>
Ломается не весь протокол SSL, а редирект по коду ошибки в случае, <br>
если клиентский сертификат нам не подошел:<br>
<br>
...<br>
ssl_verify_client on;<br>
ssl_verify_depth 1;<br>
<br>
ssl_session_timeout 5m;<br>
<br>
ssl_protocols SSLv2 SSLv3 TLSv1;<br>
ssl_ciphers
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;<br>
ssl_prefer_server_ciphers on;<br>
...<br>
error_page 496 <a class="moz-txt-link-freetext" href="https://stat2.some...host.ru/location1/">https://stat2.some...host.ru/location1/</a>;<br>
error_page 497 <a class="moz-txt-link-freetext" href="https://stat2.some...host.ru/location1/">https://stat2.some...host.ru/location1/</a>;<br>
<br>
В логах - код ошибки 400 и пустая странца в браузере.<br>
<br>
Этот же конфиг при смене бинаря на 0.7.67 работает<br>
<br>
nginx version: nginx/0.7.67<br>
TLS SNI support disabled<br>
configure arguments: --prefix=/usr/local/etc/nginx --with-cc-opt='-I
/usr/local/include' --with-ld-opt='-L /usr/local/lib'
--conf-path=/usr/local/etc/nginx/nginx.conf
--sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid
--error-log-path=/var/log/nginx-error.log --user=www --group=www
--http-client-body-temp-path=/var/tmp/nginx/client_body_temp
--http-proxy-temp-path=/var/tmp/nginx/proxy_temp
--http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp
--http-log-path=/var/log/nginx-access.log --with-http_flv_module
--with-http_gzip_static_module --with-http_realip_module
--with-http_ssl_module --with-http_stub_status_module --with-pcre<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Best regards, Andrey Y. Ostanovsky
xmpp: <a class="moz-txt-link-abbreviated" href="mailto:aost@jabber.spb.ru">aost@jabber.spb.ru</a>
phone: +7 911 7006295
St.Petersburg, Russia
</pre>
</body>
</html>