litespeedtech / litespeedtech/lsquic
check_ssl_ctx_x509_method failed on the android platform
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.9k
- Forks
- 397
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 8
Description
I am working on porting lsquic to Android platform. I have cross-compiled lsquic and dependent libraries successfully by Android ndk. Now I can run lsquic test demo like `echo_server` and `echo_client` on my Android device.
But now I encounter a problem when `echo_client` connects to `echo_server`.
Here are the steps:
1. launch `echo_server` by `adb shell` on the android device
`./echo_server -s 127.0.0.1:4433 -c www.example.com,ca.crt,ca.key -L debug`
`echo_server` seems work well accrording the info log:
16:37:31.486 [DEBUG] tokgen: TOKGEN1 does not exist: generate
16:37:31.490 [INFO] tokgen: inserted TOKGEN1 of size 110
16:37:31.490 [DEBUG] tokgen: initialized
16:37:31.491 [INFO] prq: initialized queue of size 10000
16:37:31.491 [INFO] purga: create purgatory, min life 30000000 usec
16:37:31.491 [INFO] engine: instantiated engine
16:37:31.493 [INFO] socket buffer size: 229376 bytes; max # packets is set to 6
16:37:31.494 [DEBUG] local address: 127.0.0.1:4433
16:37:31.494 [DEBUG] entering event loop
2. launch `echo_client` by another `adb shell` on the same android device:
`./echo_client -s 127.0.0.1:4433`
`echo_server` aborted caused by the following error:
...
16:38:27.876 [DEBUG] [QUIC:48D1324707EDE3C3] mini-conn: read 226 bytes at offset
226 on enc level 0
16:38:27.877 [DEBUG] [QUIC:48D1324707EDE3C3] handshake: cert lookup: server name
is not set
16:38:27.877 [INFO] SNI is not set
16:38:27.877 [DEBUG] [QUIC:48D1324707EDE3C3] handshake: looked up cert for
**/root/lsquic-lib/boringssl/ssl/ssl_x509.cc:170: void bssl::check_ssl_ctx_x509_method(const SSL_CTX \*): assertion "ctx == NULL || ctx->x509_method == &ssl_crypto_x509_method" failed**
Aborted
I have test it works in linux platform with the same steps.
I found `check_ssl_ctx_x509_method` is used by a serise of `SSL_XXX` methods. From the debug log, we can see this assertion passed successfully before `echo_client` connects, such as `SSL_CTX_set_default_verify_paths` in `load_cert` and `prog_init_server`. But when `echo_client` connects to `echo_server`, this assertion failed in `echo_server`.
I have located the error is in line 1060 of lsquic_enc_sess_ietf.c:
```
static int iquic_lookup_cert (SSL *ssl, void *arg)
{
...
if (ssl_ctx)
{
if (SSL_set_SSL_CTX(enc_sess->esi_ssl, ssl_ctx))
{
LSQ_DEBUG("looked up cert for %s", server_name
? server_name : "");
if (enc_sess->esi_enpub->enp_kli)
SSL_CTX_set_keylog_callback(ssl_ctx, keylog_callback);
---> SSL_set_verify(enc_sess->esi_ssl,
SSL_CTX_get_verify_mode(ssl_ctx), NULL);
SSL_set_verify_depth(enc_sess->esi_ssl,
SSL_CTX_get_verify_depth(ssl_ctx));
SSL_clear_options(enc_sess->esi_ssl,
SSL_get_options(enc_sess->esi_ssl));
SSL_set_options(enc_sess->esi_ssl,
SSL_CTX_get_options(ssl_ctx) & ~SSL_OP_NO_TLSv1_3);
return 1;
...
```
I cannot find more information about this assertion of the `check_ssl_ctx_x509_method` in boringssl. And I have no idea how to solve or skip this problem.
Thanks for any help.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with the Android NDK using echo_server and echo_client, then inspect iquic_lookup_cert in lsquic_enc_sess_ietf.c at the SSL_set_verify call. Compare the Android behavior with the Linux run and trace the BoringSSL assertion in ssl_x509.cc; done means the Android connection no longer aborts while preserving the certificate lookup behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, c
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100