Stunnel-5.55 client close TLS socket before it could read more bytes
Ming Lu <[email protected]> Fri, 13 Dec 2019 09:48:53 +0000
| Newsgroups | gmane.network.stunnel.user |
|---|---|
| Message-ID | <[email protected]> |
--===============0730159174184713400==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_157623053401889655citrixcom_"
--_000_157623053401889655citrixcom_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hello,
May I please have help on this issue? Thanks in advance!
I had a stunnel server and client communicating with TLSv1.2 (both of them =
are stunnel 5.55 and OpenSSL-1.1.1d) on CentOS 7 based Linux (kernel was up=
dated as 4.19.0). The case is that client sends a HTTP request to server, a=
nd then server responds a payload with more than 640KB size. Normally, the =
server will close the connection by sending an alert firstly.
The issue is that sometimes (not 100% reproducible), stunnel client reporte=
d: "TLS socket closed (read hangup)". and then closed the TLS socket. So I =
could find an alert sent from client to server firstly from tcpdump. Conseq=
uently, this caused the application reported "unexpected end of input?" as =
there should be more data to be received.
I added a few debug logic and I indeed found that: there were occurrences t=
hat if stunnel client did not close the TLS socket, it could read more data=
from TLS socket in next poll loop:
--------------------
03:59:46 localhost stunnel: LOG6[0]: MingL: POLLRDHUP: 8192
03:59:46 localhost stunnel: LOG6[0]: MingL: ioctlsocket: 0
03:59:46 localhost stunnel: LOG6[0]: MingL: bytes: 0 <=3D=3D client didn=
't close the sock in my debug version.
03:59:46 localhost stunnel: LOG6[0]: MingL: after checking
03:59:46 localhost stunnel: LOG6[0]: MingL: s_poll_wait: return 1
03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_rd: n
03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_wr: Y
03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_rd: n
03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_wr: n
03:59:46 localhost stunnel: LOG6[0]: MingL: pending: 1
03:59:46 localhost stunnel: LOG6[0]: MingL: write to sock 18432
03:59:46 localhost stunnel: LOG6[0]: MingL: read_wants_read Y
03:59:46 localhost stunnel: LOG6[0]: MingL: write_wants_writen
03:59:46 localhost stunnel: LOG6[0]: MingL: read from TLS 10168 <=3D=3D th=
en I observed the further read from TLS.
--------------------
Any help will be appreciated!
Ming
--_000_157623053401889655citrixcom_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none"><!-- p { margin-top: 0px; m=
argin-bottom: 0px; }--></style>
</head>
<body dir=3D"ltr" style=3D"font-size:12pt;color:#000000;background-color:#F=
FFFFF;font-family:'Courier New',monospace;">
<p>Hello,<br>
</p>
<p><br>
</p>
<p>May I please have help on this issue? Thanks in advance!<br>
</p>
<p><br>
</p>
<p>I had a stunnel server and client communicating with TLSv1.2 (both of th=
em are stunnel 5.55 and OpenSSL-1.1.1d) on CentOS 7 based Linux (kerne=
l was updated as 4.19.0). The case is that client sends a HTTP re=
quest to server, and then server responds a payload
with more than 640KB size. Normally, the server will close the connection =
by sending an alert firstly.<br>
</p>
<p><br>
</p>
<p>The issue is that sometimes (not 100% reproducible), stunnel client repo=
rted: <span style=3D"font-size: 12pt;">"TL</span><span style=3D"f=
ont-size: 12pt;">S socket closed (read hangup)". </span><span sty=
le=3D"font-size: 12pt;">and then closed the TLS socket. So
I could find an alert sent from client to server firstly from tcpdump. Con=
sequently, this caused the application reported "unexpected end of inp=
ut​" as there should be more data to be received.</span></p>
<p><br>
</p>
<p>I added a few debug logic and I indeed found that: <span style=
=3D"font-size: 12pt;">there were occurrences that if stunnel client did not=
close the TLS socket, it could read more data from TLS socket in next poll=
loop:</span></p>
<p><br>
</p>
<p>--------------------<br>
</p>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: POLLRDHUP: 8192 <br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: ioctlsocket: 0 <br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: bytes: 0 <=
=3D=3D client didn't close the sock in my debug version.<br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: after checking <br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: s_poll_wait: return 1=
<br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_rd: n <br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_wr: Y <br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_rd: n </div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_wr: n <br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: pending: 1 <br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: write to sock 18432 <=
br>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: read_wants_read Y </d=
iv>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: write_wants_writen <b=
r>
</div>
<div>03:59:46 localhost stunnel: LOG6[0]: MingL: read from TLS 10168 =
<=3D=3D then I observed the further read from TLS.<br>
</div>
<div><span style=3D"font-family: "Courier New", monospace; font-s=
ize: 16px; background-color: rgb(255, 255, 255);">--------------------</spa=
n><br>
</div>
<div><span style=3D"font-family: "Courier New", monospace; font-s=
ize: 16px; background-color: rgb(255, 255, 255);"><br>
</span></div>
<div><br>
</div>
<div>Any help will be appreciated!<br>
</div>
<div><br>
</div>
<div>Ming<br>
</div>
<p><br>
</p>
</body>
</html>
--_000_157623053401889655citrixcom_--
--===============0730159174184713400==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
stunnel-users mailing list
[email protected]
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
--===============0730159174184713400==--