SSL errors do not trigger failover?

Hello!

We are using stunnel to work around an SSL issue in another service, and set
stunnel.conf up to do prio failover.  We noticed something unusual.  If the TCP
session connects, but the SSL negotiation fails, it doesn't fail over to the
next server on the list.  I looked at the code for the latest version and this
doesn't seem to be caught anywhere.

What I saw in client.c shows that it only checks failover after trying to
establish the TCP session, but then the SSL session happens later and doesn't
give any info back to the failover code should something go wrong.

Is this expected behavior, or should I look into a bug report / patch?  I was
thinking maybe a configurable option to allow SSL errors to trigger failover
just like TCP errors.

-- 
Richard Monk ([email protected]) - Senior Principal Security Analyst
Red Hat Inc. - Raleigh NC
GPG Key ID: 0x942CDB25

_______________________________________________
stunnel-users mailing list
[email protected]
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJYi1PGAAoJEPIhaVTL6ccqbkAP/1IZd7cCuV89hQLKR8fnnup2
6ziKJ3WKEeob04kOQzL0+U5nBVmyWMry3pQSUs42qj2XCRxEli0BzR6+P5q8TZ5N
uwGVwe7XqrZHnMIi0v6dTwnVPLUV0ReoYmcc2u4VYm7cPFAdf0/+gH9HhsXRvwYB
z6+wBZeGFZ4OZtua0h2/ViIu5ldCLQM/Hs4BvM9pDZFul1LW64/e/ID/ODbMgUaE
9QSegt/Bsc8q4XFJJHooovSgHJ7G8wD5PyARBQonvoweUAdTAusaJN2/7NKxYt7m
FuQPGTnA4I2+lhoixt/Ydz1/LJsIHGBTFFUgIB1p4oR2d1Ig9u+auI8jakEfX2tc
sMBjeQK9YkpDuqiStvkP4P7qU5ElkfvnpZNOinDm2dsV55loGLrO56VDynBXkEOO
22W2TIbhPEAemyUP5SPaKSsVF6l6pMsBoMI8hvtZddwVPnOb01vDEBaN4XmXolEs
iNKasqEdpt0tH8jIG686gNg76lBuyuExy8Dc84+TMVfAaZIwNcqG9PLdo/DvIAcg
4buTej8deJKkZSZ+vIIbqTtFmr/G4yciAYniB6xD9csRbDTPKcDXVKbrz6G4VG+8
ktwYwe5tTGBQn7pjfiAkPrzCe9QPKPgcjf0No3ck/iEB0aMmBkLgqXkYfVqo7uyd
z/tsMy3/ndL0B9ID5dNv
=rI7K
-----END PGP SIGNATURE-----