<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="ET">We are using openssl for client-side HTTP connections. Sometimes they get randomly hanging during SSL handshake. It looks like there are some network or server-side problems, earlier the same server was responding with an
error like:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="ET">SSL_write() failed with error code: SSL_ERROR_SYSCALL<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="ET">According to google this means: The SSL_ERROR_SYSCALL with errno value of 0 indicates unexpected EOF from the peer.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="ET">Later another request is made to the same server, which hangs indefinitely. Stack backtrace in gdb:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="ET">#0 0x00007ff999c54ab4 in read ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#1 0x00007ff97c9f91b6 in sock_read ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#2 0x00007ff97c9f7b70 in bread_conv ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#3 0x00007ff97c9f67d1 in bio_read_intern ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#4 0x00007ff97c9f68be in BIO_read ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#5 0x00007ff97c983ff9 in ssl3_read_n ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#6 0x00007ff97c9887fb in ssl3_get_record ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#7 0x00007ff97c986aa1 in ssl3_read_bytes ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#8 0x00007ff97c9c62c6 in tls_get_message_header ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#9 0x00007ff97c9b7135 in read_state_machine ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#10 0x00007ff97c9b6dec in state_machine ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#11 0x00007ff97c9b68f2 in ossl_statem_connect ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#12 0x00007ff97c9a14eb in SSL_do_handshake ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">#13 0x00007ff97c99d54c in SSL_connect ()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="ET">My question is, what I can do on the client side to debug the problem, or at least to avoid such hanging? I guess I can set socket read timeout beforehand, and reset it after handshake, or is there a better way? This is
openssl 1.1, would it make sense to switch over to openssl 3.0? Or maybe I have missed some client-side configuration? Currently I’m using just these calls to add SSL capability to an open TCP socket (error handling left out from here for brevity):<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="ET">SSL_library_init();<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">OpenSSL_add_all_algorithms();<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">SSL_load_error_strings();<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="ET">const SSL_METHOD *method = TLS_client_method();<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">auto context_ = SSL_CTX_new(method);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">SSL_CTX_set_default_verify_paths(context_);<br>
SSL_CTX_set_verify(context_, SSL_VERIFY_PEER, MySSLVerifyCallback);<br>
auto ssl_ = SSL_new(context_);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">SSL_set_tlsext_host_name(ssl_, host.c_str());<br>
SSL_set_fd(ssl_, socketHandle);<br>
SSL_connect(ssl_);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="ET">Any advice?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">TIA<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET">Paavo<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="ET"><o:p> </o:p></span></p>
</div>
</body>
</html>