# Logging $ssl\_session\_id can crash Nginx 1.5.9 worker

**URL:** <https://www.ruby-forum.com/t/logging-ssl-session-id-can-crash-nginx-1-5-9-worker/238664>\
**Category:** NGINX\
**Created:** [January 22, 2014, 8:03pm UTC](https://www.ruby-forum.com/t/logging-ssl-session-id-can-crash-nginx-1-5-9-worker/238664 "2014-01-22T20:03:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![musicdenotation](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea666f/32.png) [@musicdenotation](https://www.ruby-forum.com/u/musicdenotation)\
**Post date:** [January 22, 2014, 8:03pm UTC](https://www.ruby-forum.com/t/logging-ssl-session-id-can-crash-nginx-1-5-9-worker/238664/1 "2014-01-22T20:03:34Z")

</div>

I run the [nginx.org](http://nginx.org) mainline packages on Ubuntu 12.04, 32- and 64-bit. I  
use  
a wacky custom log format, and after 1.5.9 was released today, I enabled  
logging the $ssl\_session\_id variable. I later ran an SSL Labs SSL Server  
Test, [0] which makes numerous HTTPS requests of various sorts, and lo  
and  
behold, one of my worker processes core dumped. I fooled around with my  
configuration and determined that the problem was logging  
$ssl\_session\_id.  
If I don’t log it, it’s fine. If I enable a log that contains  
$ssl\_session\_id – even only $ssl\_session\_id – it crashes.

Normal HTTPS requests – well, I just tried curl and Firefox – work  
fine. I  
notice that curl does log a session ID, but for Firefox that field is  
just a  
“-”. I have no idea if that’s an(other) Nginx bug or just a difference  
between the two clients, but it smells funny to me. I briefly enabled  
$ssl\_session\_id logging on 2013-12-17 with 1.5.7 or 1.5.8 and whatever  
Firefox version was current at the time and it did log he session data.  
(I  
never tried curl or SSL Labs then.)

nginx.conf: [https://mn9.us/tmp/nginx.conf](https://mn9.us/tmp/nginx.conf) (my logging nonsense is at  
the  
end)

Good and bad log snippets at [https://mn9.us/tmp/nginx.log](https://mn9.us/tmp/nginx.log) and pasted  
below.

Bad:

## ==\> /var/log/nginx/access13.log \<== 173.203.79.216 36823 “[www.mn9.us](http://www.mn9.us)” 192.155.93.101 443 “[mn9.us](http://mn9.us)” 586 1 on TLSv1.2 - “-” [2014-01-22T18:05:54+00:00] “GET / HTTP/1.0” 200 975 612 - “-” “SSL Labs ([https://www.ssllabs.com/about/assessment.html](https://www.ssllabs.com/about/assessment.html))” “-” “ECDHE-RSA-AES128-SHA” “-” 173.203.79.216 36876 “-” 192.155.93.101 443 “[mn9.us](http://mn9.us)” 594 1 on TLSv1 - “-” [2014-01-22T18:06:06+00:00] “HEAD /?SSL\_Labs\_Renegotiation\_Test=User\_Agent\_May\_Not\_Show HTTP/1.0” 400 0 0

“-” “SSL Labs ([https://www.ssllabs.com/about/assessment.html](https://www.ssllabs.com/about/assessment.html))” “-”  
“DHE-RSA-AES128-SHA” “-”

==\> /var/log/nginx/error.log \<==  
2014/01/22 18:06:06 [notice] 24848#0: \*595 SSL renegotiation disabled  
while  
reading client request headers, client: 173.203.79.216, server: [mn9.us](http://mn9.us),  
request: “HEAD /?SSL\_Labs\_Renegotiation\_Test=User\_Agent\_May\_Not\_Show  
HTTP/1.0”  
2014/01/22 18:06:07 [notice] 24681#0: signal 17 (SIGCHLD) received  
2014/01/22 18:06:07 [alert] 24681#0: worker process 24848 exited on  
signal  
11 (core dumped)  
2014/01/22 18:06:07 [notice] 24681#0: start worker process 26865  
2014/01/22 18:06:07 [notice] 24681#0: signal 29 (SIGIO) received

Good:

## ==\> /var/log/nginx/access11.log \<== 173.203.79.216 60618 “[www.mn9.us](http://www.mn9.us)” 192.155.93.101 443 “[mn9.us](http://mn9.us)” 1003 1 on TLSv1.2 - “-” [2014-01-22T18:27:09+00:00] “GET / HTTP/1.0” 200 975 612 - “-” “SSL Labs ([https://www.ssllabs.com/about/assessment.html](https://www.ssllabs.com/about/assessment.html))” “-” “ECDHE-RSA-AES128-SHA” 173.203.79.216 60701 “-” 192.155.93.101 443 “[mn9.us](http://mn9.us)” 1008 1 on TLSv1 - “-” [2014-01-22T18:27:22+00:00] “HEAD /?SSL\_Labs\_Renegotiation\_Test=User\_Agent\_May\_Not\_Show HTTP/1.0” 400 0 0

“-” “SSL Labs ([https://www.ssllabs.com/about/assessment.html](https://www.ssllabs.com/about/assessment.html))” “-”  
“DHE-RSA-AES128-SHA”

==\> /var/log/nginx/error.log \<==  
2014/01/22 18:27:22 [notice] 27156#0: \*1009 SSL renegotiation disabled  
while  
reading client request headers, client: 173.203.79.216, server: [mn9.us](http://mn9.us),  
request: “HEAD /?SSL\_Labs\_Renegotiation\_Test=User\_Agent\_May\_Not\_Show  
HTTP/1.0”

## ==\> /var/log/nginx/access11.log \<== 173.203.79.216 60948 “-” 192.155.93.101 443 “[mn9.us](http://mn9.us)” 1009 1 on TLSv1.2 - “-” [2014-01-22T18:27:22+00:00] “HEAD /?SSL\_Labs\_Renegotiation\_Test=User\_Agent\_May\_Not\_Show HTTP/1.0” 400 0 0

“-” “SSL Labs ([https://www.ssllabs.com/about/assessment.html](https://www.ssllabs.com/about/assessment.html))” “-”  
“(NONE)”

[0] [https://www.ssllabs.com/ssltest/index.html](https://www.ssllabs.com/ssltest/index.html)

## Cheers

Posted at Nginx Forum:

> **[Logging $ssl\_session\_id can crash Nginx 1.5.9 worker](https://forum.nginx.org/read.php?2,246716,246716#msg-246716)**
>
> I run the nginx.org mainline packages on Ubuntu 12.04, 32- and 64-bit. I use a wacky custom log format, and after 1.5.9 was released today, I enabled logging the $ssl\_session\_id variable. I later ran an SSL Labs SSL Server Test, \[0\] which makes...

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/d2c977/32.png) [@mnordhoff](https://www.ruby-forum.com/u/mnordhoff)\
**Post date:** [January 22, 2014, 9:07pm UTC](https://www.ruby-forum.com/t/logging-ssl-session-id-can-crash-nginx-1-5-9-worker/238664/2 "2014-01-22T21:07:20Z")

</div>

On Wed, Jan 22, 2014 at 02:02:51PM -0500, mnordhoff wrote:

> I run the [nginx.org](http://nginx.org) mainline packages on Ubuntu 12.04, 32- and 64-bit. I use  
> a wacky custom log format, and after 1.5.9 was released today, I enabled  
> logging the $ssl\_session\_id variable. I later ran an SSL Labs SSL Server  
> Test, [0] which makes numerous HTTPS requests of various sorts, and lo and  
> behold, one of my worker processes core dumped. I fooled around with my  
> configuration and determined that the problem was logging $ssl\_session\_id.  
> If I don’t log it, it’s fine. If I enable a log that contains  
> $ssl\_session\_id – even only $ssl\_session\_id – it crashes.

The following patch fixes this:

diff --git a/src/event/ngx\_event\_openssl.c  
b/src/event/ngx\_event\_openssl.c  
— a/src/event/ngx\_event\_openssl.c  
+++ b/src/event/ngx\_event\_openssl.c  
@@ -2509,6 +2509,10 @@ ngx\_ssl\_get\_session\_id(ngx\_connection\_t

```
 sess = SSL_get0_session(c->ssl->connection);

```

- if (sess == NULL) {
- 

```
   return NGX_ERROR;

```

- }
- buf = sess-\>session\_id;  
len = sess-\>session\_id\_length;

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/d2c977/32.png) [@mnordhoff](https://www.ruby-forum.com/u/mnordhoff)\
**Post date:** [January 22, 2014, 10:35pm UTC](https://www.ruby-forum.com/t/logging-ssl-session-id-can-crash-nginx-1-5-9-worker/238664/3 "2014-01-22T22:35:13Z")

</div>

Hello!

On Wed, Jan 22, 2014 at 02:02:51PM -0500, mnordhoff wrote:

> I run the [nginx.org](http://nginx.org) mainline packages on Ubuntu 12.04, 32- and 64-bit. I use  
> a wacky custom log format, and after 1.5.9 was released today, I enabled  
> logging the $ssl\_session\_id variable. I later ran an SSL Labs SSL Server  
> Test, [0] which makes numerous HTTPS requests of various sorts, and lo and  
> behold, one of my worker processes core dumped. I fooled around with my  
> configuration and determined that the problem was logging $ssl\_session\_id.  
> If I don’t log it, it’s fine. If I enable a log that contains  
> $ssl\_session\_id – even only $ssl\_session\_id – it crashes.

Thanks for the report, the following patch should fix it:

— a/src/event/ngx\_event\_openssl.c  
+++ b/src/event/ngx\_event\_openssl.c  
@@ -2508,6 +2508,10 @@ ngx\_ssl\_get\_session\_id(ngx\_connection\_t  
SSL\_SESSION \*sess;

```
 sess = SSL_get0_session(c->ssl->connection);

```

- if (sess == NULL) {

- 

```
   s->len = 0;

```

- 

```
   return NGX_OK;

```

- }

> Normal HTTPS requests – well, I just tried curl and Firefox – work fine. I  
> notice that curl does log a session ID, but for Firefox that field is just a  
> “-”. I have no idea if that’s an(other) Nginx bug or just a difference  
> between the two clients, but it smells funny to me. I briefly enabled

That’s normal, session id is expected to be empty, e.g., if session  
tickets are  
used.

–  
Maxim D.  
[http://nginx.org/](http://nginx.org/)

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/d2c977/32.png) [@mnordhoff](https://www.ruby-forum.com/u/mnordhoff)\
**Post date:** [January 23, 2014, 11:54am UTC](https://www.ruby-forum.com/t/logging-ssl-session-id-can-crash-nginx-1-5-9-worker/238664/4 "2014-01-23T11:54:44Z")

</div>

On Thu, Jan 23, 2014 at 01:48:58AM +0400, Maxim D. wrote:

> > > $ssl\_session\_id – even only $ssl\_session\_id – it crashes.
> > 
> > - if (sess == NULL) {
> > - 
> > 
> > ```
> > return NGX_ERROR;
> > 
> > ```
> > 
> > - }
> > - buf = sess-\>session\_id;  
> > len = sess-\>session\_id\_length;
> 
> You were faster. 🙂  
> I think that len = 0 + NGX\_OK is better than NGX\_ERROR here  
> though, and also in line with other similar functions like  
> ngx\_ssl\_get\_[raw\_]certificate().

It’s also consistent with the previous behavior, so I agree.

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/d2c977/32.png) [@mnordhoff](https://www.ruby-forum.com/u/mnordhoff)\
**Post date:** [January 22, 2014, 10:49pm UTC](https://www.ruby-forum.com/t/logging-ssl-session-id-can-crash-nginx-1-5-9-worker/238664/5 "2014-01-22T22:49:27Z")

</div>

Hello!

On Thu, Jan 23, 2014 at 12:06:55AM +0400, Ruslan E. wrote:

> The following patch fixes this:
> 
> - }
> - buf = sess-\>session\_id;  
> len = sess-\>session\_id\_length;

You were faster. 🙂  
I think that len = 0 + NGX\_OK is better than NGX\_ERROR here  
though, and also in line with other similar functions like  
ngx\_ssl\_get\_[raw\_]certificate().

–  
Maxim D.  
[http://nginx.org/](http://nginx.org/)