Unnecessary _tls_ssl_private_send_pending in SSL_read about tlse HOT 6 CLOSED

...to be clear. Of course, SSL_read and SSl_write should be called within synchronized blocks. But using the same synchronized block for both logically impossible.

from tlse.

I'm not sure this is unnecessary. Just think at an alert condition or handshake data pending. If you think this is a problem, just comment the line. I think that in case of an error, your client/server will not send the pending alert message. Also, it is possible to affect the fast start option. Anyway, you should avoid using SSL_* functions. Those are there for testing, You should use the tls_* function which are more flexible.

from tlse.

Of course I commented the line, but it took me 2 days to find this :) tls_* functions won't solve the issue. The problem is SSL_read writes to the same buffer as SSL_write, and the same will happen with tls_* functions. This will never work with two threads, no matter how you will synchronize them.

Just a suggestion. You should not fix it.

from tlse.

Can you please post a minimal source illustrating your problem? I think I don't understand what the problem is.

These lines:

            if (tls_consume_stream(context, client_message, read_size, ssl_data->certificate_verify) > 0) {
                _tls_ssl_private_send_pending(ssl_data->fd, context);
                break;
            }

Are important, because when consuming a stream, an alert condition may be encountered, so this should be here. Also, the tls-layer connection status may change.

from tlse.

Simple as this:

Thread 1:

{  
   SSL_read(ctx,buf, len);
}

Thread 2:

{  
   SSL_write(ctx,buf, len);
}

You can not use e.g a mutex to avoid simultaneous calls, because SSL_read leads to a blocked "recv". Now think about what will happen if SSL_write will be writing to the buffer, when SSL_read will suddenly receive data.

The same thing will happen any time when you will try to send data in a receiving method. It does not matter which functions you will use SSL_* or tls_*

from tlse.

Removing _tls_ssl_private_send_pending may cause unexpected behavior in handshake, so for now, it should be kept.

from tlse.