diff options
| author | Bernd Edlinger <bernd.edlinger@hotmail.de> | 2022-05-16 07:06:42 +0200 |
|---|---|---|
| committer | Bernd Edlinger <bernd.edlinger@hotmail.de> | 2022-05-17 13:16:03 +0200 |
| commit | 598bd7741568a1aae678e5472f18aae1ab991e8d (patch) | |
| tree | 275f4a2f20b08cc2441650dfb8f21b69e02015e0 /crypto/bio/bss_conn.c | |
| parent | 524bac570702a79366b85ff1f66e07d3e002370c (diff) | |
Fix KTLS with BIO_new_connect
When a socket connection is done using BIO_new_connect,
the ktls_enable is done too early, and fails with ENOTCONN.
Therefore the KLTS ioctl will fail later with ENOPROTOOPT.
Fix that by doing the ktls_enable after the connection
succeeded, not when the socket is created as that will
always fail.
One example where this happens is doit_localhost in
test/ssl_old_test.c, and therefore, contrary to the expectation
the -client_ktls option did never enable the client KTLS
connection, but this was not noticed, because there was no
diagnostic output, and it was only visible with strace output.
Also enhanced the ssl_old_test -client_ktls/-server_ktls
options together with -v option to print a summary line
if and how KTLS was negotiated in server and client.
While I am already there adjusted the usage info of
the -s_cert, -s_key commands, and allow -time to print the
timings of ktls connections.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18318)
Diffstat (limited to 'crypto/bio/bss_conn.c')
| -rw-r--r-- | crypto/bio/bss_conn.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/crypto/bio/bss_conn.c b/crypto/bio/bss_conn.c index 87238319fb..13ac7f2d95 100644 --- a/crypto/bio/bss_conn.c +++ b/crypto/bio/bss_conn.c @@ -191,6 +191,9 @@ static int conn_state(BIO *b, BIO_CONNECT *c) break; case BIO_CONN_S_BLOCKED_CONNECT: + /* wait for socket being writable, before querying BIO_sock_error */ + if (BIO_socket_wait(b->num, 0, time(NULL)) == 0) + break; i = BIO_sock_error(b->num); if (i != 0) { BIO_clear_retry_flags(b); @@ -208,8 +211,18 @@ static int conn_state(BIO *b, BIO_CONNECT *c) ERR_raise(ERR_LIB_BIO, BIO_R_NBIO_CONNECT_ERROR); ret = 0; goto exit_loop; - } else + } else { c->state = BIO_CONN_S_OK; +# ifndef OPENSSL_NO_KTLS + /* + * The new socket is created successfully regardless of ktls_enable. + * ktls_enable doesn't change any functionality of the socket, except + * changing the setsockopt to enable the processing of ktls_start. + * Thus, it is not a problem to call it for non-TLS sockets. + */ + ktls_enable(b->num); +# endif + } break; case BIO_CONN_S_CONNECT_ERROR: |