mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-16 13:33:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix an s_server infinite loop

Browse Source 
Commit c4666bfa changed s_server so that it asked libssl rather than the
underlying socket whether an error is retryable or not on the basis that
libssl has more information. That is true unfortunately the method used
was wrong - it only checks libssl's own internal state rather than both
libssl and the BIO. Should use SSL_get_error() instead.

This issue can cause an infinite loop because some errors could appear as
retryable when in fact they are not.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3317)
This commit is contained in:
Matt Caswell 2017-04-26 14:00:35 +01:00
parent fa3ed5b2c2
commit 068e3d73ce
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
apps/s_server.c
View File

@ -2609,6 +2609,16 @@ static void close_accept_socket(void)
} }
} }
static int is_retryable(SSL *con, int i)
{
int err = SSL_get_error(con, i);
/* If it's not a fatal error, it must be retryable */
return (err != SSL_ERROR_SSL)
&& (err != SSL_ERROR_SYSCALL)
&& (err != SSL_ERROR_ZERO_RETURN);
}
static int init_ssl_connection(SSL *con) static int init_ssl_connection(SSL *con)
{ {
int i; int i;
@ -2651,7 +2661,7 @@ static int init_ssl_connection(SSL *con)
i = SSL_accept(con); i = SSL_accept(con);
if (i <= 0) if (i <= 0)
retry = !SSL_want_nothing(con); retry = is_retryable(con, i);
#ifdef CERT_CB_TEST_RETRY #ifdef CERT_CB_TEST_RETRY
{ {
while (i <= 0 while (i <= 0
@ -2661,7 +2671,7 @@ static int init_ssl_connection(SSL *con)
"LOOKUP from certificate callback during accept\n"); "LOOKUP from certificate callback during accept\n");
i = SSL_accept(con); i = SSL_accept(con);
if (i <= 0) if (i <= 0)
retry = !SSL_want_nothing(con); retry = is_retryable(con, i);
} }
} }
#endif #endif
@ -2682,7 +2692,7 @@ static int init_ssl_connection(SSL *con)
BIO_printf(bio_s_out, "LOOKUP not successful\n"); BIO_printf(bio_s_out, "LOOKUP not successful\n");
i = SSL_accept(con); i = SSL_accept(con);
if (i <= 0) if (i <= 0)
retry = !SSL_want_nothing(con); retry = is_retryable(con, i);
} }
#endif #endif
} while (i < 0 && SSL_waiting_for_async(con)); } while (i < 0 && SSL_waiting_for_async(con));