Mercurial > hg > nginx-quic
comparison src/event/ngx_event_openssl.c @ 8109:61011bfcdb49
SSL: workaround for incorrect SSL_write() errors in OpenSSL 1.1.1.
OpenSSL 1.1.1 fails to return SSL_ERROR_SYSCALL if an error happens
during SSL_write() after close_notify alert from the peer, and returns
SSL_ERROR_ZERO_RETURN instead. Broken by this commit, which removes
the "i == 0" check around the SSL_RECEIVED_SHUTDOWN one:
https://git.openssl.org/?p=openssl.git;a=commitdiff;h=8051ab2
In particular, if a client closed the connection without reading
the response but with properly sent close_notify alert, this resulted in
unexpected "SSL_write() failed while ..." critical log message instead
of correct "SSL_write() failed (32: Broken pipe)" at the info level.
Since SSL_ERROR_ZERO_RETURN cannot be legitimately returned after
SSL_write(), the fix is to convert all SSL_ERROR_ZERO_RETURN errors
after SSL_write() to SSL_ERROR_SYSCALL.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Wed, 16 Sep 2020 18:26:22 +0300 |
parents | 09fb2135a589 |
children | adaec579a967 |
comparison
equal
deleted
inserted
replaced
8108:3781de64e747 | 8109:61011bfcdb49 |
---|---|
2570 | 2570 |
2571 return n; | 2571 return n; |
2572 } | 2572 } |
2573 | 2573 |
2574 sslerr = SSL_get_error(c->ssl->connection, n); | 2574 sslerr = SSL_get_error(c->ssl->connection, n); |
2575 | |
2576 if (sslerr == SSL_ERROR_ZERO_RETURN) { | |
2577 | |
2578 /* | |
2579 * OpenSSL 1.1.1 fails to return SSL_ERROR_SYSCALL if an error | |
2580 * happens during SSL_write() after close_notify alert from the | |
2581 * peer, and returns SSL_ERROR_ZERO_RETURN instead, | |
2582 * https://git.openssl.org/?p=openssl.git;a=commitdiff;h=8051ab2 | |
2583 */ | |
2584 | |
2585 sslerr = SSL_ERROR_SYSCALL; | |
2586 } | |
2575 | 2587 |
2576 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0; | 2588 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0; |
2577 | 2589 |
2578 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr); | 2590 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr); |
2579 | 2591 |