<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<i>[ Further below I quote my first two messages including my
original questions and tentative code,</i><i><br>
</i><i> since Cc'ing to <tt>openssl-users</tt> did not work when I
tried first. In this way I hope to get further, </i><i><br>
</i><i> more detailed responses by people with specific experience
on the issues I mentioned,</i><i><br>
</i><i> possibly even concrete feedback how to enhance my code or
where to find a better solution. ]</i><br>
<br>
<br>
On 09/01/2017 06:32 PM, Salz, Rich via openssl-users wrote:<br>
<blockquote type="cite"
cite="mid:BD9160CE-1312-4876-8E2A-CD33A3B9F08E@akamai.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Courier New";
panose-1:2 7 3 9 2 2 5 2 4 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Courier;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:Calibri">FWIW, there’s a
‘libtls’ library from the libre folks that might be worth
looking at.</span></p>
</div>
</blockquote>
This looks very nice. Yet is this of any practical benefit when
using OpenSSL?<br>
<br>
<blockquote type="cite"
cite="mid:BD9160CE-1312-4876-8E2A-CD33A3B9F08E@akamai.com">
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:Calibri"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:Calibri">If you come up
with useful snippets we can start by posting them to the
wiki, for example<o:p></o:p></span></p>
</div>
</blockquote>
Which wiki do you mean? I could not find anything related on <a
moz-do-not-send="true" href="https://wiki.openssl.org/">https://wiki.openssl.org/</a><br>
<br>
Anyway, most people (including me) would not search through wikis
for finding useful code,<br>
and it would be much more useful if code like the <tt>bio_connect()</tt>
function I mentioned below <br>
was readily available within the OpenSSL libraries, in an official
high-level API.<br>
<i>
[ Since this is worth a topic of its own, I'll write more on this
in my next email. ]</i><br>
<br>
More low-level code that is already used by the crypto lib itself
(e.g., using <tt>select()</tt> in <tt>rand_unix.c</tt>)<br>
would be better packaged into abstractions within that library, for
instance the <tt>socket_wait()</tt> function<br>
for waiting on a socket with a timeout that I proposed below. I'd
contribute pull requests for those I'm aware of.<br>
<br>
<br>
On 29.08.2017 16:15, Salz, Rich via openssl-dev wrote:<br>
<blockquote type="cite"
cite="mid:B4E37377-CBF6-4E28-88CC-517C435D0C9E@akamai.com">
<pre wrap=""><blockquote type="cite"><pre wrap=""> Getting the client connect right appears surprisingly messy when one
needs to cope with all kinds of network error situations including
domain name resolution issues and temporarily unreachable servers.
Both indefinitely blocking and non-blocking behavior (i.e., connection
attempts with and without a timeout) should be supported.
</pre></blockquote>It is a complicated issue and hard to get right for all definitions of right for all applications ☺</pre>
</blockquote>
Hmm - on the one hand, good to get confirmation that I did not just
miss a simple way of out the maze, ...<br>
<blockquote type="cite"
cite="mid:B4E37377-CBF6-4E28-88CC-517C435D0C9E@akamai.com">
<pre wrap="">A set of API’s that set up all the TLS “metadata”, and took a connected socket might be a way through the maze. For example:
SSL *SSL_connection(int socket, const char *servername, …whatever…)
</pre>
</blockquote>
... on the other hand, it's a pity that such a high-level API does
not (yet) exist, at least not in OpenSSL.<br>
<br>
How about adding at least some clearly useful abstractions like the
below <tt>socket_wait()</tt> function, <br>
which would reduce code duplication in the OpenSSL crypto lib and
apps and help application developers?<br>
<br>
Maybe other OpenSSL users have specific experience on error and
timeout handling for <tt>BIO_do_connect()</tt> etc.<br>
and can comment in more detail on the (approximate) solution, <tt>bio_connect()</tt>,
that I gave below?<br>
<br>
<div class="moz-cite-prefix">On 28.08.2017 13:46, David von Oheimb
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:69d6c8c3-c3ba-44f5-fad0-4b2294e210d3@siemens.com">
<pre wrap="">Hi all,
I'm currently enhancing HTTP(S) clients based on OpenSSL in several
flavors, in particular a CMP client, which in turn uses simple HTTP
clients for contacting CRL distribution points or OCSP responders.
Getting the client connect right appears surprisingly messy when one
needs to cope with all kinds of network error situations including
domain name resolution issues and temporarily unreachable servers.
Both indefinitely blocking and non-blocking behavior (i.e., connection
attempts with and without a timeout) should be supported.
Since these are pretty general problems I wonder why there there is
rather limited support via generic higher-level OpenSSL or C library
functions, or at least I was unable to find it. Instead, the OpenSSL
apps contain code that calls BIO_do_connect directly (or the equivalent
BIO_do_handshake), in particular query_responder() in apps/ocsp.c.
(The situation is similar for the subsequent exchange of data via the
BIO, optionally with a timeout).
So I constructed my own abstraction, called bio_connect, which took
quite some effort testing network error situations. Please see below its
code including comments on some strange behavior I experienced and my
workarounds for that. Does this code make sense, or do I miss anything?
How about adding such a function for instance to crypto/bio/bio_lib.c?
BTW, my code uses a handy generic helper function, socket_wait, for
waiting for read/write form/to a socket, with a given timeout. Since
several instances of that pretty common code pattern using select() are
spread over the OpenSSL apps (and crypto lib), I suggest adding this
function to the library. Where would be a good place to put it?
Thanks,
David
</pre>
<blockquote type="cite">
<pre wrap="">/* returns -1 on error, 0 on timeout, 1 on success */
int bio_connect(BIO *bio, int timeout) {
int blocking;
time_t max_time;
int rv;
blocking = timeout == 0;
max_time = timeout != 0 ? time(NULL) + timeout : 0;
if (!blocking)
BIO_set_nbio(bio, 1);
retry:
rv = BIO_do_connect(bio);
if (rv <= 0 && (errno == ETIMEDOUT /* in blocking case,
despite blocking BIO, BIO_do_connect() timed out */ ||
ERR_GET_REASON(ERR_peek_error()) == ETIMEDOUT/* when non-blocking,
BIO_do_connect() timed out early with rv == -1 and errno == 0 */)) {
ERR_clear_error();
(void)BIO_reset(bio); /* otherwise, blocking next connect() may crash
and non-blocking next BIO_do_connect() will fail */
goto retry;
}
if (!blocking && rv <= 0 && BIO_should_retry(bio)) {
int fd;
if (BIO_get_fd(bio, &fd) <= 0)
return -1;
rv = socket_wait(fd, 1, max_time - time(NULL));
if (rv > 0)
/* for some reason, select() may wrongly have returned success */
goto retry;
}
return rv;
}
</pre>
</blockquote>
<blockquote type="cite">
<pre wrap="">/* returns < 0 on error, 0 on timeout, >0 on success */
int socket_wait(int fd, int for_read, int timeout)
{
fd_set confds;
struct timeval tv;
if (timeout <= 0)
return 0;
FD_ZERO(&confds);
openssl_fdset(fd, &confds);
tv.tv_usec = 0;
tv.tv_sec = timeout;
return select(fd + 1, for_read ? &confds : NULL,
for_read ? NULL : &confds, NULL, &tv);
}
</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>