upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-02-02 19:59:28 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Handle SSL_ERROR_WANT_WRITE on SSL_read for negotiation

Browse source 
- Close connection when receiving overly large frame
This commit is contained in:
Ralph Dolmans 2020-07-15 15:49:42 +02:00
parent c00a5d0723
commit db3ac2335c
2 changed files with 29 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
dnstap/dtstream.c
View file

@ -94,6 +94,8 @@ static int dtio_control_start_send(struct dt_io_thread* dtio);
#ifdef HAVE_SSL #ifdef HAVE_SSL
/** enable briefly waiting for a read event, for SSL negotiation */ /** enable briefly waiting for a read event, for SSL negotiation */
static int dtio_enable_brief_read(struct dt_io_thread* dtio); static int dtio_enable_brief_read(struct dt_io_thread* dtio);
/** enable briefly waiting for a write event, for SSL negotiation */
static int dtio_enable_brief_write(struct dt_io_thread* dtio);
#endif #endif
struct dt_msg_queue* struct dt_msg_queue*
@ -945,7 +947,7 @@ static int ssl_read_bytes(struct dt_io_thread* dtio, void* buf, size_t len)
/* continue later */ /* continue later */
return -1; return -1;
} else if(want == SSL_ERROR_WANT_WRITE) { } else if(want == SSL_ERROR_WANT_WRITE) {
(void)dtio_add_output_event_write(dtio); (void)dtio_enable_brief_write(dtio);
return -1; return -1;
} else if(want == SSL_ERROR_SYSCALL) { } else if(want == SSL_ERROR_SYSCALL) {
#ifdef ECONNRESET #ifdef ECONNRESET
@ -1036,9 +1038,9 @@ static int dtio_read_accept_frame(struct dt_io_thread* dtio)
dtio->read_frame.frame_len = ntohl(dtio->read_frame.frame_len); dtio->read_frame.frame_len = ntohl(dtio->read_frame.frame_len);
if(dtio->read_frame.frame_len > DTIO_RECV_FRAME_MAX_LEN) { if(dtio->read_frame.frame_len > DTIO_RECV_FRAME_MAX_LEN) {
verbose(VERB_OPS, "dnstap: received frame exceeds max " verbose(VERB_OPS, "dnstap: received frame exceeds max "
"length, capped to %d bytes", "length of %d bytes, closing connection",
DTIO_RECV_FRAME_MAX_LEN); DTIO_RECV_FRAME_MAX_LEN);
dtio->read_frame.frame_len = DTIO_RECV_FRAME_MAX_LEN; goto close_connection;
} }
dtio->read_frame.buf = calloc(1, dtio->read_frame.frame_len); dtio->read_frame.buf = calloc(1, dtio->read_frame.frame_len);
dtio->read_frame.buf_cap = dtio->read_frame.frame_len; dtio->read_frame.buf_cap = dtio->read_frame.frame_len;
@ -1207,6 +1209,24 @@ static int dtio_disable_brief_read(struct dt_io_thread* dtio)
} }
#endif /* HAVE_SSL */ #endif /* HAVE_SSL */
#ifdef HAVE_SSL
/** enable the brief write condition */
static int dtio_enable_brief_write(struct dt_io_thread* dtio)
{
dtio->ssl_brief_write = 1;
return dtio_add_output_event_write(dtio);
}
#endif /* HAVE_SSL */
#ifdef HAVE_SSL
/** disable the brief write condition */
static int dtio_disable_brief_write(struct dt_io_thread* dtio)
{
dtio->ssl_brief_write = 0;
return dtio_add_output_event_read(dtio);
}
#endif /* HAVE_SSL */
#ifdef HAVE_SSL #ifdef HAVE_SSL
/** check peer verification after ssl handshake connection, false if closed*/ /** check peer verification after ssl handshake connection, false if closed*/
static int dtio_ssl_check_peer(struct dt_io_thread* dtio) static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
@ -1380,7 +1400,9 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
} }
#endif #endif
if((bits&UB_EV_READ)) { if((bits&UB_EV_READ || dtio->ssl_brief_write)) {
if(dtio->ssl_brief_write)
(void)dtio_disable_brief_write(dtio);
if(dtio->ready_frame_sent && !dtio->accept_frame_received) { if(dtio->ready_frame_sent && !dtio->accept_frame_received) {
if(dtio_read_accept_frame(dtio) <= 0) if(dtio_read_accept_frame(dtio) <= 0)
return; return;

3
dnstap/dtstream.h
View file

@ -151,6 +151,9 @@ struct dt_io_thread {
* This happens during negotiation, we then do not want to write, * This happens during negotiation, we then do not want to write,
* but wait for a read event. */ * but wait for a read event. */
int ssl_brief_read; int ssl_brief_read;
/** true if SSL_read is waiting for a write event. Set back to 0 after
* single write event is handled. */
int ssl_brief_write;
/** the buffer that currently getting written, or NULL if no /** the buffer that currently getting written, or NULL if no
* (partial) message written now */ * (partial) message written now */