SSL core dump in v6.9.1

[rdkgit]

• v6.9.1
• Red Hat Enterprise Linux Server release 7.3
• 3.10.0-514.el7.x86_64

Created simple https server and try to connect to it with various clients. node core dumps w/o any stack trace. GDB output below. Sorry if this is duplicate. I was not find anything related via searching. Code works fine on Fedora system running 4.6.1. Also, system it is core-dumping on is an EC2 instance thus virtual.

#0  0x00007f228053a610 in asn1_enc_restore () from /lib64/libcrypto.so.10
Missing separate debuginfos, use: debuginfo-install glibc-2.17-157.el7.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 krb5-libs-1.14.1-26.el7.x86_64 libcom_err-1.42.9-9.el7.x86_64 libgcc-4.8.5-11.el7.x86_64 libicu-50.1.2-15.el7.x86_64 libselinux-2.5-6.el7.x86_64 libstdc++-4.8.5-11.el7.x86_64 openssl-libs-1.0.1e-60.el7.x86_64 pcre-8.32-15.el7_2.1.x86_64 zlib-1.2.7-17.el7.x86_64
(gdb) where
#0  0x00007f228053a610 in asn1_enc_restore () from /lib64/libcrypto.so.10
#1  0x00007f228053786b in ASN1_item_ex_i2d () from /lib64/libcrypto.so.10
#2  0x00007f2280537d11 in asn1_template_ex_i2d () from /lib64/libcrypto.so.10
#3  0x00007f2280537aeb in ASN1_item_ex_i2d () from /lib64/libcrypto.so.10
#4  0x00007f2280537bef in asn1_item_flags_i2d () from /lib64/libcrypto.so.10
#5  0x00007f22808478cd in ssl3_add_cert_to_buf () from /lib64/libssl.so.10
#6  0x00007f2280847fa3 in ssl3_output_cert_chain () from /lib64/libssl.so.10
#7  0x00007f228083b755 in ssl3_send_server_certificate ()
   from /lib64/libssl.so.10
#8  0x00007f228083cbcd in ssl3_accept () from /lib64/libssl.so.10
#9  0x00007f228084a478 in ssl23_accept () from /lib64/libssl.so.10
#10 0x00007f228084b612 in ssl23_read () from /lib64/libssl.so.10
#11 0x0000000000e668c5 in node::TLSWrap::ClearOut (this=this@entry=0x2b1fc80)
    at ../src/tls_wrap.cc:420
#12 0x0000000000e66b93 in Cycle (this=0x2b1fc80) at ../src/tls_wrap.h:103
#13 node::TLSWrap::DoRead (this=0x2b1fc80, nread=201, buf=<optimized out>, 
    pending=<optimized out>) at ../src/tls_wrap.cc:727
#14 0x0000000000e38c05 in OnRead (pending=UV_UNKNOWN_HANDLE, 
    buf=0x7ffe9b499820, nread=201, this=0x29d4fe8) at ../src/stream_base.h:180
#15 node::StreamWrap::OnReadCommon (handle=<optimized out>, nread=201, 
    buf=0x7ffe9b499820, pending=UV_UNKNOWN_HANDLE) at ../src/stream_wrap.cc:245
#16 0x00007f22812dc774 in uv__read (stream=stream@entry=0x29d5040)
    at src/unix/stream.c:1192
#17 0x00007f22812dcedc in uv__stream_io (loop=<optimized out>, w=0x29d50c8, 
    events=1) at src/unix/stream.c:1259
#18 0x00007f22812e1db8 in uv__io_poll (
    loop=loop@entry=0x7f22814ec900 <default_loop_struct>, timeout=119999)
    at src/unix/linux-core.c:380
#19 0x00007f22812d3998 in uv_run (loop=0x7f22814ec900 <default_loop_struct>, 
    mode=UV_RUN_ONCE) at src/unix/core.c:354
#20 0x0000000000df81d8 in node::Start (argc=2, argv=<optimized out>)
    at ../src/node.cc:4608
#21 0x00007f227db25b35 in __libc_start_main () from /lib64/libc.so.6
#22 0x00000000006f4299 in _start ()

[mscdex]

/cc @indutny

[sam-github]

@rdkgit can you provide a standalone example?

[indutny]

@rdkgit could you please provide a certificate chain that you used?

[rdkgit]

Here is an example I just now tested and it core dumps node when I connect to it using openssl s_client.
Test with: /bin/openssl s_client -connect hostname:8443

// test.js
// test to see if node core dumps

var fs = require('fs');
var constants = require('constants');
var http = require('http');
var https = require('https');
var httpPort = 8080;
var httpsPort = 8443;

var sslOptions = {

  key: fs.readFileSync('/tmp/exterus-key.pem'),
  cert: fs.readFileSync('/tmp/exterus-cert.pem'),
  // startssl sub.class1.server.ca.pem append >> cert pem
  secureProtocol: 'SSLv23_method',
  secureOptions: constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_SSLv2,
};

// set up proxy server and start listening!!
http.createServer().listen(httpPort);
console.log("Test listening on "+httpPort);

https.createServer(sslOptions).listen(httpsPort);
console.log("Test listening on "+httpsPort);

[rdkgit]

The cert I'm using is from startssl. Do you want me to send you the cert itself? Or, what kind of output would you like?

Thanks,

Bobby

[indutny]

@rdkgit may I ask you to put the exterus-cert.pem contents to https://gist.github.com/ ? It seems like it is crashing when it tries to encode the certificate chain, so having the full certificate chain may be a key to understanding the cause of the crash.

[rdkgit]

OK, uploaded. Are you able to reference it? Sorry if thats a dumb question. Havent used this feature of github before.
rdkgit/exterus-cert.pem

[indutny]

Thanks! Here is the link: https://gist.github.com/rdkgit/130b3476d82a61fab9a2ed164ac102ee

[indutny]

@rdkgit have you built node.js from source? Or have you downloaded the binary?

[rdkgit]

I'm using the pre-built platform packages for both Fedora, RHEL, and Centos. It core dumps on my ec2 instance but not my Fedora desktop running older version of node.

[indutny]

Oh wait! I just realized that you are using shared openssl library: /lib64/libssl.so.10. Do you know which version of OpenSSL that EC2 system has?

[rdkgit]

OpenSSL 1.0.1e-fips 11 Feb 2013

On my Fedora system where no core dumps (but older nodejs version), I have 1.0.2h though.

[indutny]

@rdkgit what does node -pe process.versions.openssl say?