Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Correct error handling for SSL_ERROR_SSL #42

Merged
merged 2 commits into from
Oct 13, 2017
Merged

Correct error handling for SSL_ERROR_SSL #42

merged 2 commits into from
Oct 13, 2017

Conversation

djones6
Copy link
Contributor

@djones6 djones6 commented Oct 13, 2017

Description

This PR fixes two things in the Linux (openssl) implementation:

  • Inserts missing calls to ERR_clear_error prior to functions that may require SSL_get_error to be called
  • Corrects the logic for obtaining the detailed error description for the SSL_ERROR_SSL case.

Motivation and Context

This resolves an intermittent failure exposed by a test added to Kitura-net (Kitura/Kitura-net#219), where the test can cause an SSL protocol error (SSL_ERROR_SSL).

When this occurs, an error is placed onto that thread's error queue, however the throwLastError function did not call ERR_get_error in this case, instead reporting "Could not determine error reason." and leaving the error on the queue.

The next SSL call with a non-zero return on that thread would then trigger a call to SSL_get_error, which would incorrectly pick up the error on the queue, incorrectly reporting another SSL_ERROR_SSL.

Part of the contract of SSL_get_error is that the error queue must have been cleared before a call to SSL_read, SSL_accept, etc. is made. To ensure we obey this contract, I have added ERR_clear_error before each such call.

How Has This Been Tested?

I have run the Kitura-net tests and they pass.

Since we do not have a test that deliberately or reliably causes an SSL protocol error, to test the output of the error reporting, I modified a test locally to remove the SSL delegate from the client-side socket and then send some erroneous data. This results in the following output:

[ERROR] [IncomingSocketHandler.swift:153 handleRead()] Read from socket (file descriptor 15) failed. Error = Error code: 336130315(0x1408F10B), ERROR: SSL_read, code: 336130315, reason: SSL3_GET_RECORD:wrong version number.

Checklist:

  • I have submitted a CLA form
  • If applicable, I have updated the documentation accordingly.
  • If applicable, I have added tests to cover my changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants