mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-13 18:46:57 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: ssl: Shutdown the connection for reading on SSL_ERROR_SYSCALL

Browse Source 
When SSL_read returns SSL_ERROR_SYSCALL and errno is unset or set to EAGAIN, the
connection must be shut down for reading. Else, the connection loops infinitly,
consuming all the CPU.

The bug was introduced in the commit 7e2e50500 ("BUG/MEDIUM: ssl: Don't always
treat SSL_ERROR_SYSCALL as unrecovarable."). This patch must be backported in
1.8 too.
This commit is contained in:
Christopher Faulet 2018-02-19 14:25:15 +01:00 committed by Willy Tarreau
parent 280f42b99e
commit 4ac77a98cd
1 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/ssl_sock.c
View File

@ -5449,10 +5449,9 @@ static int ssl_sock_to_buf(struct connection *conn, struct buffer *buf, int coun
break; break;
} else if (ret == SSL_ERROR_ZERO_RETURN) } else if (ret == SSL_ERROR_ZERO_RETURN)
goto read0; goto read0;
/* For SSL_ERROR_SYSCALL, make sure the error is /* For SSL_ERROR_SYSCALL, make sure to clear the error
* unrecoverable before flagging the connection as * stack before shutting down the connection for
* in error. * reading. */
*/
if (ret == SSL_ERROR_SYSCALL && (!errno || errno == EAGAIN)) if (ret == SSL_ERROR_SYSCALL && (!errno || errno == EAGAIN))
goto clear_ssl_error; goto clear_ssl_error;
/* otherwise it's a real error */ /* otherwise it's a real error */
@ -5465,16 +5464,19 @@ static int ssl_sock_to_buf(struct connection *conn, struct buffer *buf, int coun
conn_cond_update_sock_polling(conn); conn_cond_update_sock_polling(conn);
return done; return done;
read0:
conn_sock_read0(conn);
goto leave;
out_error:
conn->flags |= CO_FL_ERROR;
clear_ssl_error: clear_ssl_error:
/* Clear openssl global errors stack */ /* Clear openssl global errors stack */
ssl_sock_dump_errors(conn); ssl_sock_dump_errors(conn);
ERR_clear_error(); ERR_clear_error();
read0:
conn_sock_read0(conn);
goto leave;
out_error:
conn->flags |= CO_FL_ERROR;
/* Clear openssl global errors stack */
ssl_sock_dump_errors(conn);
ERR_clear_error();
goto leave; goto leave;
} }