お世話になっております。 しまでらです。 以下のような環境でHTTP-HTTPSゲートウェイを構築しています。 Delegate 9.5.4 （ちょっと古いです） OpenSSL 0.9.8f Solaris 10 sparc ・設定 -P8080 -vd SERVER=http STLS=fsv,im20 TLSCONF='-vd' MOUNT='/xxx/* https://www.example.com/yyy/*' クライアントはPHPによるWebアプリケーションで、HTTP-HTTPSゲートウェイ経由 で固定のサーバに接続しデータを取得するようになっています。 リクエスト数は1000/日程度です。 概ねうまく動いているように見えるのですが、1日に数回〜数十回程度アクセス に失敗しているようで下記のようなログが出力されています。 対向側のサーバではSSL Handshakeのエラーとして記録されています。 stdout.logを見たところOpenSSL側でエラーが発生しているようなのでOpenSSLを 0.9.7系のものから、比較的新しいバージョン(0.9.8f)にしてみたのですが状況 は変わりませんでした。 可能でしたら原因および対処についてアドバイスいただければと思います。 何卒よろしくお願いいたします。 ・errors.log 12/18 07:48:00 [14867]-P8084 builtin-SSLway: ssl_conn() failed ・stdout.log 14867:error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac:s3_pkt.c:422: ・http.log x.x.x.x - - [18/Dec/2007:07:48:00 +0900] "GET https://www.example.com/yyy/... HTTP/1.1" 500 0 0*0.000+0.000:P:0- ・log 12/18 07:48:00.48 [14866] 841+0: -- Fork(SequentialServer): 21916 -> 14866 12/18 07:48:00.49 [14866] 841+1: (0) accepted [44] -@[x.x.x.x]x.x.x.x: 51809 (0.013s)(1) 12/18 07:48:00.50 [14866] 841+1: Proxy: host=x.x.x.x; User-Agent: My PEAR PROGRAM; DIRECT 12/18 07:48:00.50 [14866] 841+1: HCKA:[0] close; host=x.x.x.x; (User- Agent: My PEAR PROGRAM) 12/18 07:48:00.50 [14866] 841+1: REQUEST - GET /xxx/... HTTP/1.1^M 12/18 07:48:00.50 [14866] 841+1: *** /xxx/... => https://www.example.com/yyy/... *** 12/18 07:48:00.50 [14866] 841+1: REQUEST +M https://www.example.com/yyy/... HTTP/1.1^M 12/18 07:48:00.50 [14866] 841+1: *** /xxx/... => https://www.example.com/yyy/... *** 12/18 07:48:00.50 [14866] 841+1: PATH> https://www.example.com:443!www:8084!x.x.x.x:51809!anonymous@x.x.x.x;1197931680 12/18 07:48:00.50 [14866] 841+1: REQUEST = [https://www.example.com:443/] GET /yyy/... HTTP/1.1^M 12/18 07:48:00.50 [14866] 841+1: XHost: (0,0,1) www.example.com <= xxx. example.com:8084 12/18 07:48:00.51 [14866] 841+1: ConnectToServer connected [5] {x.x.x.x: 443 <- x.x.x.x:46068} [0.002s] 12/18 07:48:00.51 [14867] 841+1: -- Fork(FSV): 14866 -> 14867 12/18 07:48:00.52 [14867] 841+1: ## SSLway CFI_TYPE=FSV: -co is assumed 12/18 07:48:00.52 [14867] 841+1: ## SSLway start 12/18 07:48:00.54 [14867] 841+1: ## SSLway loadSession 0.002532 (1 0) / 32 12/18 07:48:00.54 [14866] 841+1: willSTLS_SV: ServerFlags=330 12/18 07:48:00.54 [14866] 841+1: HTTP => (xxx.example.com:443) GET /yyy /... HTTP/1.1^M 12/18 07:48:00.55 [14867] 841+1: ## SSLway connect failed 12/18 07:48:00.55 [14867] 841+1: builtin-SSLway: ssl_conn() failed 12/18 07:48:00.57 [14866] 841+1: HTTP relay_response: EOF at start 12/18 07:48:00.57 [14866] 841+1: #HT11 EOF from the client (2) 12/18 07:48:00.57 [14866] 841+1: #HT11 close svsokcs[19,24] 12/18 07:48:00.57 [14866] 841+1/1: WaitShutdown 1/0 xpid=14867 errno=0/ 10 0 8 0 0.000 12/18 07:48:00.57 [14866] 841+1/1: disconnected [44] -@[x.x.x.x]x.x.x.x: 51809 (0.093s)(0) 12/18 07:48:00.57 [14866] 841+1/1: CFI process none (0/1) 12/18 07:48:00.57 [14866] 841+1: StickyServer done [nonStickyProtocol (http:https:https)] 1 req / 1 conn / 0 sec -Fverの出力です。 $ ./delegated -Fver -- DeleGate/9.5.4 (March 26, 2007) AIST-Product-ID: 2000-ETL-198715-01, H14PRO-049, H15PRO-165, H18PRO-443 Copyright (c) 1994-2000 Yutaka Sato and ETL,AIST,MITI Copyright (c) 2001-2006 National Institute of Advanced Industrial Science and Technology (AIST) -- FTP: <URL:ftp://ftp.delegate.org/pub/DeleGate/> WWW: <URL:http://www.delegate.org/> Mail:<URL:mailto:pficabdyi.ml@delegate.org> <URL:http://www.delegate.org/feedback/> Config: SunOS/5.10; FileSize-Bits=32/64,32/32,32 ADMIN=example_XATSAIT.ml@delegate.org DGROOT=/var/spool/delegate-nobody --- find dynamic library 'ssl' in DYLIB='dglib*.so,lib*.so.0.9.8,lib*.so, lib*.so.1,lib*.so.0,lib*.so.0.9.7,*' ### find 'dglibssl.so' in LDPATH='/var/spool/delegate-nobody/etc;/var/ spool/delegate-nobody/lib;/opt/local/delegated/.;/opt/local/delegated;$ {HOME}/lib;/usr/local/lib;/usr/lib;/lib' ### [0] 0 "/var/spool/delegate-nobody/etc/dglibssl.so" ### [1] 0 "/var/spool/delegate-nobody/lib/dglibssl.so" ### [2] 0 "/opt/local/delegated/./dglibssl.so" ### [3] 0 "/opt/local/delegated/dglibssl.so" ### [4] 0 "${HOME}/lib/dglibssl.so" ### [5] 0 "/usr/local/lib/dglibssl.so" ### [6] 0 "/usr/lib/dglibssl.so" ### [7] 0 "/lib/dglibssl.so" --- [ssl] 0 dglibssl.so ### find 'libssl.so.0.9.8' in LDPATH='/var/spool/delegate-nobody/etc;/ var/spool/delegate-nobody/lib;/opt/local/delegated/.;/opt/local/ delegated;${HOME}/lib;/usr/local/lib;/usr/lib;/lib' ### [0] 0 "/var/spool/delegate-nobody/etc/libssl.so.0.9.8" ### [1] 0 "/var/spool/delegate-nobody/lib/libssl.so.0.9.8" ### [2] 0 "/opt/local/delegated/./libssl.so.0.9.8" ### [3] 0 "/opt/local/delegated/libssl.so.0.9.8" ### [4] 0 "${HOME}/lib/libssl.so.0.9.8" ### [5] 0 "/usr/local/lib/libssl.so.0.9.8" ### [6] 0 "/usr/lib/libssl.so.0.9.8" ### [7] 0 "/lib/libssl.so.0.9.8" --- [ssl] 0 libssl.so.0.9.8 ### find 'libssl.so' in LDPATH='/var/spool/delegate-nobody/etc;/var/ spool/delegate-nobody/lib;/opt/local/delegated/.;/opt/local/delegated;$ {HOME}/lib;/usr/local/lib;/usr/lib;/lib' ### [0] 0 "/var/spool/delegate-nobody/etc/libssl.so" ### [1] 0 "/var/spool/delegate-nobody/lib/libssl.so" ### [2] 333F78 "/opt/local/delegated/./libssl.so" --- [/opt/local/delegated/./libssl.so] --- [ssl] FF210F30 /opt/local/delegated/./libssl.so +++ loaded OpenSSL 0.9.8f 11 Oct 2007 Loaded: OpenSSL 0.9.8f 11 Oct 2007 Loaded: Zlib 1.1.4 SRCSIGN=9.5.4:20070326170408+0900:00e665258188b96b:Author@DeleGate.ORG: ZbcOE2CVtpaRnMOxRP/LWUCBryXOMD43ldlGOHyb/ op2J8Ek9dT7Lroc4JFRE44kVGJjSFrCjsYobsRowpgze8SsscEOpGUl5964Jd9gvHgtY9KQ6 aPGi6lVBUk1egbmgUn4z6hE3TqccwDpPMdGOWV96xFk5Ss5QUW7UGBDWGU= BLDSIGN=9.5.4:20071010102410+0900:00e665258188b96b:example_XATSAIT.ml@delegate.org:- EXESIGN=9.5.4:20071010102426+0900:1055e46613095bae:example_XATSAIT.ml@delegate.org:- -- _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ From: Katsuaki Shimadera E-mail: pe4aabrv6.ml@delegate.org _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
V