SSL_Read / SSL_Write中的重新协商应该调用什么

Question

I'm trying to add OpenSSL into epoll, and the socket is in non-blocking mode. A question confusing me is that: SSL_read might yield SSL_ERROR_WANT_WRITE and SSL_write might yield SSL_ERROR_WANT_READ because of SSL renegotiation.

So, my questions are:

1. If SSL_read yield SSL_ERROR_WANT_WRITE , and I modify socket event to EPOLLOUT . Then, when the socket become writable later, what should I call, SSL_read or SSL_write ? (the API doc said the same operation has to be repeated)

2. Similar to question (1), and the case is SSL_write yield SSL_ERROR_WANT_READ .

3. If SSL_read yields SSL_ERROR_WANT_WRITE , can I call SSL_send to send data next? (TCP is full duplex, but it seems OpenSSL can't read and write Independently...)

4. Similar to question (3), and the case is SSL_write yield SSL_ERROR_WANT_READ .

Thanks a lot!

Answer 1

You should restart the API you were attempting.

Thus, if SSL_read issues WANT_WRITE , call SSL_read again when the socket becomes ready for write. Similarly for SSL_write .

The OpenSSL documentation only states that you need to repeat the call with the same arguments that were given when the blocking notification is given.

WARNING

When an SSL_read() operation has to be repeated because of SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE, it must be repeated with the same arguments.

Even though you want full-duplex operation, if the current operation is blocked pending a status, then you should queue up any new operations until the the blocked operation completes. This way you will avoid potential problems entering the SSL stack with a different operation than the one that triggered the blocking notification.