|
|
fe5622 |
From 36a8bdbc8417506513207daf4f36533a3d6632f3 Mon Sep 17 00:00:00 2001
|
|
|
fe5622 |
From: Timur Pocheptsov <timur.pocheptsov@qt.io>
|
|
|
fe5622 |
Date: Mon, 13 Apr 2020 20:31:34 +0200
|
|
|
fe5622 |
Subject: [PATCH] OpenSSL: handle SSL_shutdown's errors properly
|
|
|
fe5622 |
|
|
|
fe5622 |
Do not call SSL_shutdown on a session that is in handshake state (SSL_in_init(s)
|
|
|
fe5622 |
returns 1). Also, do not call SSL_shutdown if a session encountered a fatal
|
|
|
fe5622 |
error (SSL_ERROR_SYSCALL or SSL_ERROR_SSL was found before). If SSL_shutdown
|
|
|
fe5622 |
was unsuccessful (returned code != 1), we have to clear the error(s) it queued.
|
|
|
fe5622 |
Unfortunately, SSL_in_init was a macro in OpenSSL 1.0.x. We have to
|
|
|
fe5622 |
resolve SSL_state to implement SSL_in_init.
|
|
|
fe5622 |
|
|
|
fe5622 |
Fixes: QTBUG-83450
|
|
|
fe5622 |
Change-Id: I6326119f4e79605429263045ac20605c30dccca3
|
|
|
fe5622 |
Reviewed-by: MÃ¥rten Nordheim <marten.nordheim@qt.io>
|
|
|
fe5622 |
(cherry picked from commit 8907635da59c2ae0e8db01f27b24a841b830e655)
|
|
|
fe5622 |
(cherry picked from commit 8ddffc6ba4f38bb8dbeb0cf61b6b10ee73505bbb)
|
|
|
fe5622 |
---
|
|
|
fe5622 |
|
|
|
fe5622 |
diff --git a/src/network/ssl/qsslsocket.cpp b/src/network/ssl/qsslsocket.cpp
|
|
|
fe5622 |
index 4f49a71..9f9eaf3 100644
|
|
|
fe5622 |
--- a/src/network/ssl/qsslsocket.cpp
|
|
|
fe5622 |
+++ b/src/network/ssl/qsslsocket.cpp
|
|
|
fe5622 |
@@ -2108,7 +2108,7 @@
|
|
|
fe5622 |
shutdown = false;
|
|
|
fe5622 |
pendingClose = false;
|
|
|
fe5622 |
flushTriggered = false;
|
|
|
fe5622 |
-
|
|
|
fe5622 |
+ systemOrSslErrorDetected = false;
|
|
|
fe5622 |
// we don't want to clear the ignoreErrorsList, so
|
|
|
fe5622 |
// that it is possible setting it before connecting
|
|
|
fe5622 |
// ignoreErrorsList.clear();
|
|
|
fe5622 |
diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp
|
|
|
fe5622 |
index ec772dd..c4abc1e 100644
|
|
|
fe5622 |
--- a/src/network/ssl/qsslsocket_openssl.cpp
|
|
|
fe5622 |
+++ b/src/network/ssl/qsslsocket_openssl.cpp
|
|
|
fe5622 |
@@ -471,10 +471,16 @@
|
|
|
fe5622 |
void QSslSocketBackendPrivate::destroySslContext()
|
|
|
fe5622 |
{
|
|
|
fe5622 |
if (ssl) {
|
|
|
fe5622 |
- // We do not send a shutdown alert here. Just mark the session as
|
|
|
fe5622 |
- // resumable for qhttpnetworkconnection's "optimization", otherwise
|
|
|
fe5622 |
- // OpenSSL won't start a session resumption.
|
|
|
fe5622 |
- q_SSL_shutdown(ssl);
|
|
|
fe5622 |
+ if (!q_SSL_in_init(ssl) && !systemOrSslErrorDetected) {
|
|
|
fe5622 |
+ // We do not send a shutdown alert here. Just mark the session as
|
|
|
fe5622 |
+ // resumable for qhttpnetworkconnection's "optimization", otherwise
|
|
|
fe5622 |
+ // OpenSSL won't start a session resumption.
|
|
|
fe5622 |
+ if (q_SSL_shutdown(ssl) != 1) {
|
|
|
fe5622 |
+ // Some error may be queued, clear it.
|
|
|
fe5622 |
+ const auto errors = getErrorsFromOpenSsl();
|
|
|
fe5622 |
+ Q_UNUSED(errors);
|
|
|
fe5622 |
+ }
|
|
|
fe5622 |
+ }
|
|
|
fe5622 |
q_SSL_free(ssl);
|
|
|
fe5622 |
ssl = nullptr;
|
|
|
fe5622 |
}
|
|
|
fe5622 |
@@ -909,6 +915,7 @@
|
|
|
fe5622 |
case SSL_ERROR_SSL: // error in the SSL library
|
|
|
fe5622 |
// we do not know exactly what the error is, nor whether we can recover from it,
|
|
|
fe5622 |
// so just return to prevent an endless loop in the outer "while" statement
|
|
|
fe5622 |
+ systemOrSslErrorDetected = true;
|
|
|
fe5622 |
{
|
|
|
fe5622 |
const ScopedBool bg(inSetAndEmitError, true);
|
|
|
fe5622 |
setErrorAndEmit(QAbstractSocket::SslInternalError,
|
|
|
fe5622 |
@@ -1309,8 +1316,12 @@
|
|
|
fe5622 |
void QSslSocketBackendPrivate::disconnectFromHost()
|
|
|
fe5622 |
{
|
|
|
fe5622 |
if (ssl) {
|
|
|
fe5622 |
- if (!shutdown) {
|
|
|
fe5622 |
- q_SSL_shutdown(ssl);
|
|
|
fe5622 |
+ if (!shutdown && !q_SSL_in_init(ssl) && !systemOrSslErrorDetected) {
|
|
|
fe5622 |
+ if (q_SSL_shutdown(ssl) != 1) {
|
|
|
fe5622 |
+ // Some error may be queued, clear it.
|
|
|
fe5622 |
+ const auto errors = getErrorsFromOpenSsl();
|
|
|
fe5622 |
+ Q_UNUSED(errors);
|
|
|
fe5622 |
+ }
|
|
|
fe5622 |
shutdown = true;
|
|
|
fe5622 |
transmit();
|
|
|
fe5622 |
}
|
|
|
fe5622 |
diff --git a/src/network/ssl/qsslsocket_openssl11_symbols_p.h b/src/network/ssl/qsslsocket_openssl11_symbols_p.h
|
|
|
fe5622 |
index 0c32b0a..c80baa2 100644
|
|
|
fe5622 |
--- a/src/network/ssl/qsslsocket_openssl11_symbols_p.h
|
|
|
fe5622 |
+++ b/src/network/ssl/qsslsocket_openssl11_symbols_p.h
|
|
|
fe5622 |
@@ -186,4 +186,11 @@
|
|
|
fe5622 |
}
|
|
|
fe5622 |
void q_SSL_set_psk_use_session_callback(SSL *s, q_SSL_psk_use_session_cb_func_t);
|
|
|
fe5622 |
|
|
|
fe5622 |
+#if OPENSSL_VERSION_NUMBER < 0x10101000L
|
|
|
fe5622 |
+// What a mess!
|
|
|
fe5622 |
+int q_SSL_in_init(SSL *s);
|
|
|
fe5622 |
+#else
|
|
|
fe5622 |
+int q_SSL_in_init(const SSL *s);
|
|
|
fe5622 |
+#endif // 1.1.1 or 1.1.0
|
|
|
fe5622 |
+
|
|
|
fe5622 |
#endif
|
|
|
fe5622 |
diff --git a/src/network/ssl/qsslsocket_openssl_symbols.cpp b/src/network/ssl/qsslsocket_openssl_symbols.cpp
|
|
|
fe5622 |
index 62ac228..60ba3a0 100644
|
|
|
fe5622 |
--- a/src/network/ssl/qsslsocket_openssl_symbols.cpp
|
|
|
fe5622 |
+++ b/src/network/ssl/qsslsocket_openssl_symbols.cpp
|
|
|
fe5622 |
@@ -161,6 +161,11 @@
|
|
|
fe5622 |
DEFINEFUNC2(void *, OPENSSL_sk_value, OPENSSL_STACK *a, a, int b, b, return nullptr, return)
|
|
|
fe5622 |
DEFINEFUNC(int, SSL_session_reused, SSL *a, a, return 0, return)
|
|
|
fe5622 |
DEFINEFUNC2(unsigned long, SSL_CTX_set_options, SSL_CTX *ctx, ctx, unsigned long op, op, return 0, return)
|
|
|
fe5622 |
+#if OPENSSL_VERSION_NUMBER < 0x10101000L
|
|
|
fe5622 |
+DEFINEFUNC(int, SSL_in_init, SSL *a, a, return 0, return)
|
|
|
fe5622 |
+#else
|
|
|
fe5622 |
+DEFINEFUNC(int, SSL_in_init, const SSL *a, a, return 0, return)
|
|
|
fe5622 |
+#endif
|
|
|
fe5622 |
#ifdef TLS1_3_VERSION
|
|
|
fe5622 |
DEFINEFUNC2(int, SSL_CTX_set_ciphersuites, SSL_CTX *ctx, ctx, const char *str, str, return 0, return)
|
|
|
fe5622 |
DEFINEFUNC2(void, SSL_set_psk_use_session_callback, SSL *ssl, ssl, q_SSL_psk_use_session_cb_func_t callback, callback, return, DUMMYARG)
|
|
|
fe5622 |
@@ -213,6 +218,7 @@
|
|
|
fe5622 |
// Functions below are either deprecated or removed in OpenSSL >= 1.1:
|
|
|
fe5622 |
|
|
|
fe5622 |
DEFINEFUNC(unsigned char *, ASN1_STRING_data, ASN1_STRING *a, a, return nullptr, return)
|
|
|
fe5622 |
+DEFINEFUNC(int, SSL_state, const SSL *a, a, return 0, return)
|
|
|
fe5622 |
|
|
|
fe5622 |
#ifdef SSLEAY_MACROS
|
|
|
fe5622 |
DEFINEFUNC3(void *, ASN1_dup, i2d_of_void *a, a, d2i_of_void *b, b, char *c, c, return nullptr, return)
|
|
|
fe5622 |
@@ -988,6 +994,7 @@
|
|
|
fe5622 |
#if QT_CONFIG(opensslv11)
|
|
|
fe5622 |
|
|
|
fe5622 |
RESOLVEFUNC(OPENSSL_init_ssl)
|
|
|
fe5622 |
+ RESOLVEFUNC(SSL_in_init)
|
|
|
fe5622 |
RESOLVEFUNC(OPENSSL_init_crypto)
|
|
|
fe5622 |
RESOLVEFUNC(ASN1_STRING_get0_data)
|
|
|
fe5622 |
RESOLVEFUNC(EVP_CIPHER_CTX_reset)
|
|
|
fe5622 |
@@ -1060,6 +1067,7 @@
|
|
|
fe5622 |
#else // !opensslv11
|
|
|
fe5622 |
|
|
|
fe5622 |
RESOLVEFUNC(ASN1_STRING_data)
|
|
|
fe5622 |
+ RESOLVEFUNC(SSL_state)
|
|
|
fe5622 |
|
|
|
fe5622 |
#ifdef SSLEAY_MACROS
|
|
|
fe5622 |
RESOLVEFUNC(ASN1_dup)
|
|
|
fe5622 |
diff --git a/src/network/ssl/qsslsocket_opensslpre11_symbols_p.h b/src/network/ssl/qsslsocket_opensslpre11_symbols_p.h
|
|
|
fe5622 |
index 48364ce..c139ecb 100644
|
|
|
fe5622 |
--- a/src/network/ssl/qsslsocket_opensslpre11_symbols_p.h
|
|
|
fe5622 |
+++ b/src/network/ssl/qsslsocket_opensslpre11_symbols_p.h
|
|
|
fe5622 |
@@ -132,6 +132,8 @@
|
|
|
fe5622 |
|
|
|
fe5622 |
int q_SSL_library_init();
|
|
|
fe5622 |
void q_SSL_load_error_strings();
|
|
|
fe5622 |
+int q_SSL_state(const SSL *a);
|
|
|
fe5622 |
+#define q_SSL_in_init(a) (q_SSL_state(a) & SSL_ST_INIT)
|
|
|
fe5622 |
|
|
|
fe5622 |
#if OPENSSL_VERSION_NUMBER >= 0x10001000L
|
|
|
fe5622 |
int q_SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
|
|
|
fe5622 |
diff --git a/src/network/ssl/qsslsocket_p.h b/src/network/ssl/qsslsocket_p.h
|
|
|
fe5622 |
index 6f34c6c..e657987 100644
|
|
|
fe5622 |
--- a/src/network/ssl/qsslsocket_p.h
|
|
|
fe5622 |
+++ b/src/network/ssl/qsslsocket_p.h
|
|
|
fe5622 |
@@ -220,6 +220,7 @@
|
|
|
fe5622 |
bool verifyErrorsHaveBeenIgnored();
|
|
|
fe5622 |
bool paused;
|
|
|
fe5622 |
bool flushTriggered;
|
|
|
fe5622 |
+ bool systemOrSslErrorDetected = false;
|
|
|
fe5622 |
};
|
|
|
fe5622 |
|
|
|
fe5622 |
QT_END_NAMESPACE
|