dlundquist / sniproxy

Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session.
BSD 2-Clause "Simplified" License
2.56k stars 397 forks source link

fallback option is broken, second call to fallback crashes the SNIProxy with sniproxy SIGABRT, first call goes fine. #160

Closed balyanrobin closed 9 years ago

balyanrobin commented 9 years ago

Hi,

Thanks for providing a great software to the community. I just downloaded the latest Sniproxy code and installed it. I noticed when the request goes to fallback domain it crashes in the second call. First call goes fine. Do you have any Idea?

Thanks i advance for your efforts and time.

Robin

balyanrobin commented 9 years ago

When request does not include sin-extension/hostname, i see below errors in error.log first time and second time for the same call SniProxy crashes -

2015-04-02 07:53:05 Request from [::ffff:xx.xxx.xx.xx]:53536 did not include a hostname 2015-04-02 07:53:05 Invalid hostname (null) in client request

My configuration is below, listen 443 { protocol tls table https_hosts fallback localhost:8080 access_log {

Same options as error_log

    filename /logs/sni_https.log
    priority debug
}

}

dlundquist commented 9 years ago

Could you try it with fallback 127.0.0.1:8080 instead of fallback localhost:8080?

dlundquist commented 9 years ago

I've added a test in 93af73a3c and have been been able to reproduce this behavior.

balyanrobin commented 9 years ago

Ok great, Do you still want me to test 127.0.0.1 or you got the handle on the issue?

dlundquist commented 9 years ago

@balyanrobin I can't reproduce your crash. Using an IP literal rather than a hostname will allow the fallback server to to be used even if there is a problem resolving DNS queries. I've added a warning in the 0.4.0 release to discourage this configuration, although I could see certain applications where this could be useful so its only a warning. In the case of localhost, using ::1 or 127.0.0.1 is a good idea.

balyanrobin commented 9 years ago

for me it is crashing even if i use IP literal also like : fallback 127.0.0.1:8080

balyanrobin commented 9 years ago

below line in connection.c under resolve_server_address is destroying the fallback memory, and hurting the next connection falling back on the same fallback server. Could you please review it once

free(server_address);