apache / apache/brpc

client端SSL相关问题。

Open
#977 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C++
Stars
17.6k
Forks
4.1k
Avg merge
2d 12h
Merged PRs (30d)
69

Description

**Describe the bug (描述bug)**
最近某些服务在使用https过程中发现ssl有时会出现异常,具体表现在 socket.cpp中的DoRead函数(write也会有类似异常)。打印出 Fail to read from ssl_fd=id:Success

代码:

```
ssize_t nr = _read_buf.append_from_SSL_channel(_ssl_session, &ssl_error, size_hint);
switch (ssl_error) {
case SSL_ERROR_NONE: // `nr' > 0
break;

case SSL_ERROR_WANT_READ:
// Regard this error as EAGAIN
errno = EAGAIN;
break;

case SSL_ERROR_WANT_WRITE:
// Disable renegotiation
errno = EPROTO;
return -1;

default: {
const unsigned long e = ERR_get_error();
if (nr == 0) {
// Socket EOF or SSL session EOF
} else if (e != 0) {
LOG(WARNING) << "Fail to read from ssl_fd=" << fd()
<< ": " << SSLError(e);
errno = ESSL;
} else {
// System error with corresponding errno set
PLOG(WARNING) << "Fail to read from ssl_fd=" << fd();
}
break;
}
}
return nr;
```
因为未打印出错误码,无法定位Success是何种错误,此外,代码中似乎认为nr >0 一定对应了SSL_ERROR_NONE。不知道这种判断的依据是?发现ssl出现异常后,nr>0, 且errno = ESSL(),出现这种情况的原因暂时不确定,只能猜测是ssl context出现异常,且该异常出现后,后续ssl皆无法正常工作。因此想知道对这种异常应该如何处理?目前看Read和Write阶段均未判断这种情况,且都出现了类似的异常。
**To Reproduce (复现方法)**
未知。

Contributor guide

Open the contributing guide

Research direction

Start with socket.cpp's DoRead function and the analogous write path, tracing _read_buf.append_from_SSL_channel's nr, ssl_error, errno, and ERR_get_error handling. No reproduction method or test is provided, so first establish the SSL failure; done means the behavior of nr > 0 with an SSL error is understood and verified with a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.