<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 29.08.2017 16:15, Salz, Rich via openssl-dev wrote:<br>
<blockquote type="cite"
cite="mid:B4E37377-CBF6-4E28-88CC-517C435D0C9E@akamai.com">
<pre wrap=""><blockquote type="cite"><pre wrap=""> Getting the client connect right appears surprisingly messy when one
needs to cope with all kinds of network error situations including
domain name resolution issues and temporarily unreachable servers.
Both indefinitely blocking and non-blocking behavior (i.e., connection
attempts with and without a timeout) should be supported.
</pre></blockquote>It is a complicated issue and hard to get right for all definitions of right for all applications ☺</pre>
</blockquote>
Hmm - on the one hand, good to get confirmation that I did not just
miss a simple way of out the maze, ...<br>
<blockquote type="cite"
cite="mid:B4E37377-CBF6-4E28-88CC-517C435D0C9E@akamai.com">
<pre wrap="">A set of API’s that set up all the TLS “metadata”, and took a connected socket might be a way through the maze. For example:
SSL *SSL_connection(int socket, const char *servername, …whatever…)
</pre>
</blockquote>
... on the other hand, it's a pity that such a high-level API does
not (yet) exist, at least not in OpenSSL.<br>
<br>
How about adding at least some clearly useful abstractions like the
below <tt>socket_wait()</tt> function, <br>
which would reduce code duplication in the OpenSSL crypto lib and
apps and help application developers?<br>
<br>
Maybe other OpenSSL users have specific experience on error and
timeout handling for <tt>BIO_do_connect()</tt> etc.<br>
and can comment in more detail on the (approximate) solution, <tt>bio_connect()</tt>,
that I gave below?<br>
<br>
<div class="moz-cite-prefix">On 28.08.2017 13:46, David von Oheimb
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:69d6c8c3-c3ba-44f5-fad0-4b2294e210d3@siemens.com">
<pre wrap="">Hi all,
I'm currently enhancing HTTP(S) clients based on OpenSSL in several
flavors, in particular a CMP client, which in turn uses simple HTTP
clients for contacting CRL distribution points or OCSP responders.
Getting the client connect right appears surprisingly messy when one
needs to cope with all kinds of network error situations including
domain name resolution issues and temporarily unreachable servers.
Both indefinitely blocking and non-blocking behavior (i.e., connection
attempts with and without a timeout) should be supported.
Since these are pretty general problems I wonder why there there is
rather limited support via generic higher-level OpenSSL or C library
functions, or at least I was unable to find it. Instead, the OpenSSL
apps contain code that calls BIO_do_connect directly (or the equivalent
BIO_do_handshake), in particular query_responder() in apps/ocsp.c.
(The situation is similar for the subsequent exchange of data via the
BIO, optionally with a timeout).
So I constructed my own abstraction, called bio_connect, which took
quite some effort testing network error situations. Please see below its
code including comments on some strange behavior I experienced and my
workarounds for that. Does this code make sense, or do I miss anything?
How about adding such a function for instance to crypto/bio/bio_lib.c?
BTW, my code uses a handy generic helper function, socket_wait, for
waiting for read/write form/to a socket, with a given timeout. Since
several instances of that pretty common code pattern using select() are
spread over the OpenSSL apps (and crypto lib), I suggest adding this
function to the library. Where would be a good place to put it?
Thanks,
David
</pre>
<blockquote type="cite">
<pre wrap="">/* returns -1 on error, 0 on timeout, 1 on success */
int bio_connect(BIO *bio, int timeout) {
int blocking;
time_t max_time;
int rv;
blocking = timeout == 0;
max_time = timeout != 0 ? time(NULL) + timeout : 0;
if (!blocking)
BIO_set_nbio(bio, 1);
retry:
rv = BIO_do_connect(bio);
if (rv <= 0 && (errno == ETIMEDOUT /* in blocking case,
despite blocking BIO, BIO_do_connect() timed out */ ||
ERR_GET_REASON(ERR_peek_error()) == ETIMEDOUT/* when non-blocking,
BIO_do_connect() timed out early with rv == -1 and errno == 0 */)) {
ERR_clear_error();
(void)BIO_reset(bio); /* otherwise, blocking next connect() may crash
and non-blocking next BIO_do_connect() will fail */
goto retry;
}
if (!blocking && rv <= 0 && BIO_should_retry(bio)) {
int fd;
if (BIO_get_fd(bio, &fd) <= 0)
return -1;
rv = socket_wait(fd, 1, max_time - time(NULL));
if (rv > 0)
/* for some reason, select() may wrongly have returned success */
goto retry;
}
return rv;
}
</pre>
</blockquote>
<blockquote type="cite">
<pre wrap="">/* returns < 0 on error, 0 on timeout, >0 on success */
int socket_wait(int fd, int for_read, int timeout)
{
fd_set confds;
struct timeval tv;
if (timeout <= 0)
return 0;
FD_ZERO(&confds);
openssl_fdset(fd, &confds);
tv.tv_usec = 0;
tv.tv_sec = timeout;
return select(fd + 1, for_read ? &confds : NULL,
for_read ? NULL : &confds, NULL, &tv);
}
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
</body>
</html>