-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Philip,
I didn't use the patch itself, but I implemented a similar functionality in stunnel 5.25b2: https://www.stunnel.org/downloads.html Best regards, Mike On 14.10.2015 10:41, Philip Craig wrote: > POSIX requires that multi-threaded processes only use > async-signal-safe functions after calling fork(). For more info on > the problems this avoids, see the rationale at: > http://pubs.opengroup.org/onlinepubs/9699919799/functions/pthread_atfo rk.html > > The specific problem this patch solves is that, when there are > multiple simultaneous requests, stunnel is often hanging on a futex > syscall when a child process calls free as a result of > tls_alloc(). > > This problem is experienced when using uClibc. I haven't tested, > but I believe the malloc implementation in glibc does not have this > problem. > > > --- stunnel-5.24.orig/src/client.c +++ stunnel-5.24/src/client.c @@ > -1100,6 +1100,8 @@ NOEXPORT SOCKET connect_local(CLI *c) { > > NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */ > char *name, host[40], port[6]; + char *env[10]; + int i, > envc; int fd[2], pid; X509 *peer_cert; #ifdef HAVE_PTHREAD_SIGMASK > @@ -1115,19 +1117,55 @@ NOEXPORT SOCKET connect_local(CLI *c) { } > else if(make_sockets(fd)) longjmp(c->err, 1); + > set_nonblock(fd[1], 0); /* switch back to blocking mode */ + + > envc = 0; + + if(!getnameinfo(&c->peer_addr.sa, > c->peer_addr_len, + host, 40, port, 6, > NI_NUMERICHOST|NI_NUMERICSERV)) { + /* just don't set these > variables if getnameinfo() fails */ + env[envc++] = > str_printf("REMOTE_HOST=%s", host); + env[envc++] = > str_printf("REMOTE_PORT=%s", port); + > if(c->opt->option.transparent_src) { +#ifndef LIBDIR +#define > LIBDIR "." +#endif +#ifdef MACH64 + env[envc++] = > str_dup("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); + > env[envc++] = str_dup("LD_PRELOAD_64=" LIBDIR "/" MACH64 > "/libstunnel.so"); +#elif __osf /* for Tru64 _RLD_LIST is used > instead */ + env[envc++] = str_dup("_RLD_LIST=" LIBDIR > "/libstunnel.so:DEFAULT"); +#else + env[envc++] = > str_dup("LD_PRELOAD=" LIBDIR "/libstunnel.so"); +#endif + } > + } + + if(c->ssl) { + > peer_cert=SSL_get_peer_certificate(c->ssl); + if(peer_cert) > { + > name=X509_NAME2text(X509_get_subject_name(peer_cert)); + > env[envc++] = str_printf("SSL_CLIENT_DN=%s", name); + > name=X509_NAME2text(X509_get_issuer_name(peer_cert)); + > env[envc++] = str_printf("SSL_CLIENT_I_DN=%s", name); + > X509_free(peer_cert); + } + } + + env[envc] = NULL; > > pid=fork(); c->pid=(unsigned long)pid; switch(pid) { case -1: /* > error */ + for (i = 0; i < envc; i++) + > str_free(env[i]); closesocket(fd[0]); closesocket(fd[1]); > ioerror("fork"); longjmp(c->err, 1); case 0: /* child */ - > tls_alloc(NULL, c->tls, NULL); /* reuse thread-local storage */ > closesocket(fd[0]); - set_nonblock(fd[1], 0); /* switch back > to blocking mode */ /* dup2() does not copy FD_CLOEXEC flag */ > dup2(fd[1], 0); dup2(fd[1], 1); @@ -1135,36 +1173,6 @@ NOEXPORT > SOCKET connect_local(CLI *c) { dup2(fd[1], 2); closesocket(fd[1]); > /* not really needed due to FD_CLOEXEC */ > > - if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len, - > host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { - > /* just don't set these variables if getnameinfo() fails */ - > putenv(str_printf("REMOTE_HOST=%s", host)); - > putenv(str_printf("REMOTE_PORT=%s", port)); - > if(c->opt->option.transparent_src) { -#ifndef LIBDIR -#define > LIBDIR "." -#endif -#ifdef MACH64 - > putenv("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); - > putenv("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); -#elif > __osf /* for Tru64 _RLD_LIST is used instead */ - > putenv("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); -#else - > putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); -#endif - > } - } - - if(c->ssl) { - > peer_cert=SSL_get_peer_certificate(c->ssl); - > if(peer_cert) { - > name=X509_NAME2text(X509_get_subject_name(peer_cert)); - > putenv(str_printf("SSL_CLIENT_DN=%s", name)); - > name=X509_NAME2text(X509_get_issuer_name(peer_cert)); - > putenv(str_printf("SSL_CLIENT_I_DN=%s", name)); - > X509_free(peer_cert); - } - } #ifdef > HAVE_PTHREAD_SIGMASK sigemptyset(&newmask); > sigprocmask(SIG_SETMASK, &newmask, NULL); @@ -1176,11 +1184,13 @@ > NOEXPORT SOCKET connect_local(CLI *c) { signal(SIGTERM, SIG_DFL); > signal(SIGQUIT, SIG_DFL); signal(SIGINT, SIG_DFL); - > execvp(c->opt->exec_name, c->opt->exec_args); + > execve(c->opt->exec_name, c->opt->exec_args, env); > ioerror(c->opt->exec_name); /* execvp failed */ _exit(1); default: > /* parent */ s_log(LOG_INFO, "Local mode child started (PID=%lu)", > c->pid); + for (i = 0; i < envc; i++) + > str_free(env[i]); closesocket(fd[1]); return fd[0]; } > _______________________________________________ stunnel-users > mailing list [email protected] > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWHopMAAoJEC78f/DUFuAUJnwQAKkbfZhC5ctCfJstNQli2syF oEVo1o0LADUmUGrDYyvmlKI9zZPFshZI0nYSYqPsy8HShSgPFtFn5eP37tl52/6n ydZ2GtzJS08gVtltB1Rt7TbvX1aAYjwT7YIE1yQi6VzOQNgUYciWJqslB7u4AEuO dtkx7wPf5vMiOkAJOShR3GVLkjnM9cRDQHo2aAGTMlj2w00NEzOjbkrsU9Ui1IS7 CfS9kYRx75RYuvoDlXwS3S9ri1ZtwmWM2LsF6Au5pfsY6SDHcPrE7wIjzciYskOR IaA00xWeVbWStVBcGkUAu+a5zcHorgqEPBAPBxrofv45PEiRS311O+Tmlyo+lxrf NHiSdmHin+4Ggdmg2g5by57YXI7vMJlN6hLuTgZV1SLeoX9nWf5VhfU2eI3EZXG1 g4DIsdtUOkZoOis85pvYTQ7B/bwj5rk+hqFrI3tBQw11NzARjD6mQzBTCyiKSuZI pB9vrNlPFb1nXfciym/u5p3CVHjSK3pj+2ehQ/B/4szA9iClYrNQhAoldDQvheQc jthRCEFKXF6obw+PVo/iKTOdGz3c0YKLYrwiiuBN3RvUtnIqDe3WPIyO/Kj+R7wJ PZIjIuUPElQBkskB4RIpkglDE5dn5O1qAGSMWGQs3zFVfvBTu3uso9mqm6hTX1qG Ij8h8K+Il9JtwftizDJW =5GkW -----END PGP SIGNATURE----- _______________________________________________ stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
