RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-18 11:40:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: ssl: Don't always treat SSL_ERROR_SYSCALL as unrecovarable.

Browse Source 
Bart Geesink reported some random errors appearing under the form of
termination flags SD in the logs for connections involving SSL traffic
to reach the servers.

Tomek Gacek and Mateusz Malek finally narrowed down the problem to commit
c2aae74 ("MEDIUM: ssl: Handle early data with OpenSSL 1.1.1"). It happens
that the special case of SSL_ERROR_SYSCALL isn't handled anymore since
this commit.

SSL_read() might return <= 0, and SSL_get_erro() return SSL_ERROR_SYSCALL,
without meaning the connection is gone. Before flagging the connection
as in error, check the errno value.

This should be backported to 1.8.
This commit is contained in:
Olivier Houchard 2018-02-13 15:17:23 +01:00 committed by Willy Tarreau
parent 41ccb194d1
commit 7e2e505006
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/ssl_sock.c
View File

@ -5434,6 +5434,12 @@ static int ssl_sock_to_buf(struct connection *conn, struct buffer *buf, int coun
break;
} else if (ret == SSL_ERROR_ZERO_RETURN)
goto read0;
/* For SSL_ERROR_SYSCALL, make sure the error is
* unrecoverable before flagging the connection as
* in error.
*/
if (ret == SSL_ERROR_SYSCALL && (!errno || errno == EAGAIN))
goto clear_ssl_error;
/* otherwise it's a real error */
goto out_error;
}
@ -5448,11 +5454,12 @@ static int ssl_sock_to_buf(struct connection *conn, struct buffer *buf, int coun
conn_sock_read0(conn);
goto leave;
out_error:
conn->flags |= CO_FL_ERROR;
clear_ssl_error:
/* Clear openssl global errors stack */
ssl_sock_dump_errors(conn);
ERR_clear_error();
conn->flags |= CO_FL_ERROR;
goto leave;
}