From f7e676abdc799fcee5138807447b5e91ab05508f Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Mon, 7 Dec 2020 12:53:54 +0000 Subject: Change -K semantics: timeout *during handshake*, not afterwards - the TLS tunnel itself should be transparent so it has no business shutting down the connection no matter how long the app takes - there's still an undetectable situation on some kernels where EOF doesn't get transmitted from the network, and the engine is in the handshake, and it can't do anything but wait forever. A timeout is useful here: dawg, your peer is never going to send any more data, you should just give up. - if the situation happens after the handshake, the *app* should have a timeout and die. The tunnel will follow suit. - libtls has a blocking tls_handshake() blackbox, we cannot give it a timeout. Too bad, use bearssl. --- src/include/s6-networking/stls.h | 3 +-- src/sbearssl/sbearssl_run.c | 10 +++++++--- src/stls/stls_run.c | 8 ++------ src/tls/s6-tlsc-io.c | 3 ++- src/tls/s6-tlsd-io.c | 3 ++- 5 files changed, 14 insertions(+), 13 deletions(-) (limited to 'src') diff --git a/src/include/s6-networking/stls.h b/src/include/s6-networking/stls.h index e4ef28a..65bb950 100644 --- a/src/include/s6-networking/stls.h +++ b/src/include/s6-networking/stls.h @@ -8,7 +8,6 @@ #include #include -#include #define STLS_BUFSIZE (16384 + 325 + 1) @@ -16,7 +15,7 @@ /* Engine */ extern int stls_send_environment (struct tls *, int) ; -extern void stls_run (struct tls *, int *, tain_t const *, uint32_t, unsigned int) gccattr_noreturn ; +extern void stls_run (struct tls *, int *, uint32_t, unsigned int) gccattr_noreturn ; /* s6-tlsc-io and s6-tlsd-io */ diff --git a/src/sbearssl/sbearssl_run.c b/src/sbearssl/sbearssl_run.c index 6a350a9..e097698 100644 --- a/src/sbearssl/sbearssl_run.c +++ b/src/sbearssl/sbearssl_run.c @@ -29,7 +29,7 @@ void sbearssl_run (br_ssl_engine_context *ctx, int *fds, tain_t const *tto, uint for (;;) { - tain_t deadline ; + tain_t deadline = tain_infinite_relative ; unsigned int j = 0 ; unsigned int state = br_ssl_engine_current_state(ctx) ; int r ; @@ -76,9 +76,13 @@ void sbearssl_run (br_ssl_engine_context *ctx, int *fds, tain_t const *tto, uint } else xindex[3] = 4 ; - if ((xindex[0] == 4 && xindex[1] == 4 && xindex[3] == 4 && handshake_done) || !j) break ; + if (xindex[0] == 4 && xindex[1] == 4 && xindex[3] == 4) + { + if (!j || handshake_done) break ; + deadline = *tto ; + } - tain_add_g(&deadline, fds[0] >= 0 && fds[2] >= 0 && state & (BR_SSL_SENDAPP | BR_SSL_RECVREC) ? tto : &tain_infinite_relative) ; + tain_add_g(&deadline, &deadline) ; r = iopause_g(x, j, &deadline) ; if (r < 0) strerr_diefu1sys(111, "iopause") ; else if (!r) break ; diff --git a/src/stls/stls_run.c b/src/stls/stls_run.c index e8305bf..559ebe9 100644 --- a/src/stls/stls_run.c +++ b/src/stls/stls_run.c @@ -9,7 +9,6 @@ #include #include #include -#include #include #include @@ -112,7 +111,7 @@ static void closeit (struct tls *ctx, int *fds, int brutal) fd_close(fds[3]) ; fds[3] = -1 ; } -void stls_run (struct tls *ctx, int *fds, tain_t const *tto, uint32_t options, unsigned int verbosity) +void stls_run (struct tls *ctx, int *fds, uint32_t options, unsigned int verbosity) { tlsbuf_t b[2] = { { .blockedonother = 0 }, { .blockedonother = 0 } } ; iopause_fd x[4] ; @@ -129,12 +128,9 @@ void stls_run (struct tls *ctx, int *fds, tain_t const *tto, uint32_t options, u for (;;) { - tain_t deadline ; unsigned int j = 0 ; int r ; - tain_add_g(&deadline, fds[0] >= 0 && fds[2] >= 0 && buffer_isempty(&b[0].b) && buffer_isempty(&b[1].b) ? tto : &tain_infinite_relative) ; - /* poll() preparation */ @@ -175,7 +171,7 @@ void stls_run (struct tls *ctx, int *fds, tain_t const *tto, uint32_t options, u /* poll() */ - r = iopause_g(x, j, &deadline) ; + r = iopause_g(x, j, 0) ; if (r < 0) strerr_diefu1sys(111, "iopause") ; else if (!r) break ; diff --git a/src/tls/s6-tlsc-io.c b/src/tls/s6-tlsc-io.c index f6a0210..8629a8d 100644 --- a/src/tls/s6-tlsc-io.c +++ b/src/tls/s6-tlsc-io.c @@ -31,7 +31,8 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 strerr_diefu1sys(111, "write post-handshake data") ; fd_close(notif) ; } - stls_run(ctx, fds, tto, options, verbosity) ; + (void)tto ; + stls_run(ctx, fds, options, verbosity) ; } #else diff --git a/src/tls/s6-tlsd-io.c b/src/tls/s6-tlsd-io.c index 75bd1e4..b6621dd 100644 --- a/src/tls/s6-tlsd-io.c +++ b/src/tls/s6-tlsd-io.c @@ -31,7 +31,8 @@ static inline void doit (int *fds, tain_t const *tto, uint32_t preoptions, uint3 strerr_diefu1sys(111, "write post-handshake data") ; fd_close(notif) ; } - stls_run(ctx, fds, tto, options, verbosity) ; + (void)tto ; + stls_run(ctx, fds, options, verbosity) ; } #else -- cgit v1.2.3