SSL_read 无限期阻止

Question

I am trying to read data off an Openssl linked socket using SSL_read. I perform Openssl operations in client mode that sends command and receives data from a real-world server. I used two threads where one thread handles all Openssl operations like connect, write and close. I perform the SSL_read in a separate thread. I am able to read data properly when I issue SSL_read once.

But I ran into problems when I tried to perform multiple connect, write, close sequences. Ideally I should terminate the thread performing the SSL_read in response to close. This is because for the next connect we would get a new ssl pointer and so we do not want to perform read on old ssl pointer. But problem is when I do SSL_read, I am stuck until there is data available in SSL buffer. It gets blocked on the SSL pointer, even when I have closed the SSL connection in the other thread.

while(1) {
    memset(sbuf, 0, sizeof(uint8_t) * TLS_READ_RCVBUF_MAX_LEN);

    read_data_len = SSL_read(con, sbuf, TLS_READ_RCVBUF_MAX_LEN);
    switch (SSL_get_error(con, read)) {
        case SSL_ERROR_NONE:
.
.
.
}

I tried all possible solutions to the problem but non works. Mostly I tried indication for letting me know there might be data in SSL buffer, but none of it returns proper indication.

I tried:

- Doing SSL_pending first to know if there is data in SSL buffer. But this always returns zero

- Doing select on the Openssl socket to see if it returns value bigger than zero. But it always returns zero.

- Making the socket as non-blocking and trying the select, but it doesnt seem to work. I am not sure if I got the code properly.

An example of where I used select for blocking socket is as follows. But select always returns zero.

    while(1) {
    //  The use of Select here is to timeout
    //  while waiting for data to read on SSL. 
    //  The timeout is set to 1 second
    i = select(width, &readfds, NULL,
            NULL, &tv);
    if (i < 0) {
        // Select Error. Take appropriate action for this error
    }

    //  Check if there is data to be read
    if (i > 0) {
        if (FD_ISSET(SSL_get_fd(con), &readfds)) {
            // TODO: We have data in the SSL buffer. But are we
            //       sure that the data is from read buffer? If not,
            //       SSL_read can be stuck indefinitely.
            //       Maybe we can do SSL_read(con, sbuf, 0) followed
            //       by SSL_pending to find out?
            memset(sbuf, 0, sizeof(uint8_t) * TLS_READ_RCVBUF_MAX_LEN);

            read_data_len = SSL_read(con, sbuf, TLS_READ_RCVBUF_MAX_LEN);
            error = SSL_get_error(con, read_data_len);
            switch (error) {
.
.
}

So as you can see I have tried number of ways to get the thread performing SSL_read to terminate in response to close, but I didnt get it to work as I expected. Did anybody get to make SSL_read work properly? Is non-blocking socket only solution to my problem? For blocking socket how do you solve the problem of quitting from SSL_read if you never get a response for command? Can you give an example of working solution for non blocking socket with read?

Answer 1

I can point you to a working example of non-blocking client socket with SSL ... https://github.com/darrenjs/openssl_examples

It uses non-blocking sockets with standard linux IO (based on poll event loop). Raw data is read from the socket and then fed into SSL memory BIO's, which then perform the decryption.

The approach I used was single threaded. A single thread performs the connect, write, and read. This means there cannot be any problems associated with one thread closing a socket, while another thread is trying to use that socket. Also, as noted by the SSL FAQ, "an SSL connection cannot be used concurrently by multiple threads" ( https://www.openssl.org/docs/faq.html#PROG1 ), so single threaded approach avoids problems with concurrent SSL write & read.

The challenge with single threaded approach is that you then need to create some kind of synchronized queue & signalling mechanism for submitting and holding data pending for outbound (eg, the commands that you want to send from client to server), and get the socket event loop to detect when there is data pending for write and pull it from the queue etc. For that I would would look at standard std::list, std::mutex etc, and either pipe2 or eventfd for signalling the event loop.

Answer 2

OpenSSL calls recv() which in turn obeys the SOCKET's timeout, which by default is infinite. You can change the timeout thusly:

void socket_timeout_receive_set(SOCKET handle, dword milliseconds)
{
if(handle==SOCKET_HANDLE_NULL)
    return;

struct timeval tv = { long(milliseconds / 1000), (milliseconds % 1000) * 1000 };
setsockopt(handle, SOL_SOCKET, SO_RCVTIMEO, (char *)&tv, sizeof(tv));
}

Unfortunately, ssl_error_get() returns SSL_ERROR_SYSCALL which it returns in other situations too, so it's not easy to determine that it timed out. But this function will help you determine if the connection is lost:

bool socket_dropped(SOCKET handle)
{
// Special thanks:  "Detecting and terminating aborted TCP/IP connections" by Vinayak Gadkari

if(handle==SOCKET_HANDLE_NULL)
    return true;

// create a socket set containing just this socket
fd_set socket_set;
FD_ZERO(&socket_set);
FD_SET(handle, &socket_set);

// if the connection is unreadable, it is not dropped (strange but true)
static struct timeval timeout = { 0, 0 };
int count = select(0, &socket_set, NULL, NULL, &timeout);
if(count <= 0) {
    // problem: count==0 on a connection that was cut off ungracefully, presumably by a busy router
    // for connections that are open for a long time but may not talk much, call keepalive_set()
    return false;
    }

if(!FD_ISSET(handle, &socket_set))  // creates a dependency on __WSAFDIsSet()
    return false;

// peek at the next character
// recv() returns 0 if the connection was dropped
char dummy;
count = recv(handle, &dummy, 1, MSG_PEEK);

if(count > 0)
    return false;

if(count==0)
    return true;

return sec==WSAECONNRESET || sec==WSAECONNABORTED || sec==WSAENETRESET || sec==WSAEINVAL;
}