Mercurial > hg > nginx

comparison src/event/ngx_event_openssl.c @ 7706:61011bfcdb49

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: workaround for incorrect SSL_write() errors in OpenSSL 1.1.1. OpenSSL 1.1.1 fails to return SSL_ERROR_SYSCALL if an error happens during SSL_write() after close_notify alert from the peer, and returns SSL_ERROR_ZERO_RETURN instead. Broken by this commit, which removes the "i == 0" check around the SSL_RECEIVED_SHUTDOWN one: https://git.openssl.org/?p=openssl.git;a=commitdiff;h=8051ab2 In particular, if a client closed the connection without reading the response but with properly sent close_notify alert, this resulted in unexpected "SSL_write() failed while ..." critical log message instead of correct "SSL_write() failed (32: Broken pipe)" at the info level. Since SSL_ERROR_ZERO_RETURN cannot be legitimately returned after SSL_write(), the fix is to convert all SSL_ERROR_ZERO_RETURN errors after SSL_write() to SSL_ERROR_SYSCALL.
author Maxim Dounin <mdounin@mdounin.ru>
date Wed, 16 Sep 2020 18:26:22 +0300
parents 09fb2135a589
children adaec579a967
comparison
equal deleted inserted replaced
7705:3781de64e747 7706:61011bfcdb49
2570 2570
2571 return n; 2571 return n;
2572 } 2572 }
2573 2573
2574 sslerr = SSL_get_error(c->ssl->connection, n); 2574 sslerr = SSL_get_error(c->ssl->connection, n);
2575
2576 if (sslerr == SSL_ERROR_ZERO_RETURN) {
2577
2578 /*
2579 * OpenSSL 1.1.1 fails to return SSL_ERROR_SYSCALL if an error
2580 * happens during SSL_write() after close_notify alert from the
2581 * peer, and returns SSL_ERROR_ZERO_RETURN instead,
2582 * https://git.openssl.org/?p=openssl.git;a=commitdiff;h=8051ab2
2583 */
2584
2585 sslerr = SSL_ERROR_SYSCALL;
2586 }
2575 2587
2576 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0; 2588 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
2577 2589
2578 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr); 2590 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
2579 2591