litespeedtech / litespeedtech/lsquic

check_ssl_ctx_x509_method failed on the android platform

Open
#119 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
1.9k
Forks
397
Avg merge
2d 22h
Merged PRs (30d)
8

Description

I am working on porting lsquic to Android platform. I have cross-compiled lsquic and dependent libraries successfully by Android ndk. Now I can run lsquic test demo like `echo_server` and `echo_client` on my Android device.

But now I encounter a problem when `echo_client` connects to `echo_server`.
Here are the steps:
1. launch `echo_server` by `adb shell` on the android device
`./echo_server -s 127.0.0.1:4433 -c www.example.com,ca.crt,ca.key -L debug`

`echo_server` seems work well accrording the info log:

16:37:31.486 [DEBUG] tokgen: TOKGEN1 does not exist: generate
16:37:31.490 [INFO] tokgen: inserted TOKGEN1 of size 110
16:37:31.490 [DEBUG] tokgen: initialized
16:37:31.491 [INFO] prq: initialized queue of size 10000
16:37:31.491 [INFO] purga: create purgatory, min life 30000000 usec
16:37:31.491 [INFO] engine: instantiated engine
16:37:31.493 [INFO] socket buffer size: 229376 bytes; max # packets is set to 6
16:37:31.494 [DEBUG] local address: 127.0.0.1:4433
16:37:31.494 [DEBUG] entering event loop

2. launch `echo_client` by another `adb shell` on the same android device:
`./echo_client -s 127.0.0.1:4433`

`echo_server` aborted caused by the following error:

...
16:38:27.876 [DEBUG] [QUIC:48D1324707EDE3C3] mini-conn: read 226 bytes at offset
226 on enc level 0
16:38:27.877 [DEBUG] [QUIC:48D1324707EDE3C3] handshake: cert lookup: server name
is not set
16:38:27.877 [INFO] SNI is not set
16:38:27.877 [DEBUG] [QUIC:48D1324707EDE3C3] handshake: looked up cert for
**/root/lsquic-lib/boringssl/ssl/ssl_x509.cc:170: void bssl::check_ssl_ctx_x509_method(const SSL_CTX \*): assertion "ctx == NULL || ctx->x509_method == &ssl_crypto_x509_method" failed**
Aborted

I have test it works in linux platform with the same steps.

I found `check_ssl_ctx_x509_method` is used by a serise of `SSL_XXX` methods. From the debug log, we can see this assertion passed successfully before `echo_client` connects, such as `SSL_CTX_set_default_verify_paths` in `load_cert` and `prog_init_server`. But when `echo_client` connects to `echo_server`, this assertion failed in `echo_server`.

I have located the error is in line 1060 of lsquic_enc_sess_ietf.c:
```
static int iquic_lookup_cert (SSL *ssl, void *arg)
{
...
if (ssl_ctx)
{
if (SSL_set_SSL_CTX(enc_sess->esi_ssl, ssl_ctx))
{
LSQ_DEBUG("looked up cert for %s", server_name
? server_name : "");
if (enc_sess->esi_enpub->enp_kli)
SSL_CTX_set_keylog_callback(ssl_ctx, keylog_callback);
---> SSL_set_verify(enc_sess->esi_ssl,
SSL_CTX_get_verify_mode(ssl_ctx), NULL);
SSL_set_verify_depth(enc_sess->esi_ssl,
SSL_CTX_get_verify_depth(ssl_ctx));
SSL_clear_options(enc_sess->esi_ssl,
SSL_get_options(enc_sess->esi_ssl));
SSL_set_options(enc_sess->esi_ssl,
SSL_CTX_get_options(ssl_ctx) & ~SSL_OP_NO_TLSv1_3);
return 1;
...
```

I cannot find more information about this assertion of the `check_ssl_ctx_x509_method` in boringssl. And I have no idea how to solve or skip this problem.
Thanks for any help.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure with the Android NDK using echo_server and echo_client, then inspect iquic_lookup_cert in lsquic_enc_sess_ietf.c at the SSL_set_verify call. Compare the Android behavior with the Linux run and trace the BoringSSL assertion in ssl_x509.cc; done means the Android connection no longer aborts while preserving the certificate lookup behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.