Changeset fcad37b in mod_gnutls

Timestamp:

Jan 21, 2020, 3:41:33 PM (7 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

master, proxy-ticket

Children:

f94938c

Parents:

9db4dcd

Message:

Retry gnutls_reauth() on transport interruptions

File:

• src/gnutls_io.c (modified) (1 diff)

src/gnutls_io.c

@@ -456 +456 @@
         return GNUTLS_E_INVALID_REQUEST;
 
-    int rv = gnutls_reauth(ctxt->session, 0);
-    // TODO: Handle remaining non-fatal errors: GNUTLS_E_INTERRUPTED,
-    // GNUTLS_E_AGAIN
-
-    /* GNUTLS_E_GOT_APPLICATION_DATA can (randomly, depending on
-     * timing) happen with a request containing a body. According to
-     * https://tools.ietf.org/html/rfc8446#appendix-E.1.2
-     * post-handshake authentication proves that the authenticated
-     * party is the one that did the handshake, so caching the data
-     * is appropriate. */
-    if (rv == GNUTLS_E_GOT_APPLICATION_DATA)
-    {
-        /* Fill connection input buffer using a speculative read. */
-        apr_size_t len = sizeof(ctxt->input_buffer);
-        ctxt->input_mode = AP_MODE_SPECULATIVE;
-        apr_status_t status =
-            gnutls_io_input_read(ctxt, ctxt->input_buffer, &len);
-        if (status == APR_SUCCESS)
+    /* Initialize to error to avoid false-good return value. */
+    int rv = GNUTLS_E_INTERNAL_ERROR;
+    int tries = 0;
+
+    do
+    {
+        rv = gnutls_reauth(ctxt->session, 0);
+        tries++;
+
+        /* GNUTLS_E_GOT_APPLICATION_DATA can (randomly, depending on
+         * timing) happen with a request containing a body. According to
+         * https://tools.ietf.org/html/rfc8446#appendix-E.1.2
+         * post-handshake authentication proves that the authenticated
+         * party is the one that did the handshake, so caching the data
+         * is appropriate. */
+        if (rv == GNUTLS_E_GOT_APPLICATION_DATA)
         {
-            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, status, r,
-                          "%s: cached %" APR_SIZE_T_FMT " bytes.",
-                          __func__, len);
-            /* If the cache was too small to accept all pending data
-             * we'll get GNUTLS_E_GOT_APPLICATION_DATA again, and the
-             * authz hook will return HTTP_REQUEST_ENTITY_TOO_LARGE to
-             * the client. */
-            rv = gnutls_reauth(ctxt->session, 0);
-        }
-        else
-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
-                          "%s: buffering request data failed!",
-                          __func__);
-    }
+            /* Fill connection input buffer using a speculative read. */
+            apr_size_t len = sizeof(ctxt->input_buffer);
+            ctxt->input_mode = AP_MODE_SPECULATIVE;
+            apr_status_t status =
+                gnutls_io_input_read(ctxt, ctxt->input_buffer, &len);
+            if (status == APR_SUCCESS)
+            {
+                ap_log_rerror(APLOG_MARK, APLOG_DEBUG, status, r,
+                              "%s: cached %" APR_SIZE_T_FMT " bytes.",
+                              __func__, len);
+                /* If the cache was too small to accept all pending data
+                 * we'll get GNUTLS_E_GOT_APPLICATION_DATA again, and the
+                 * authz hook will return HTTP_REQUEST_ENTITY_TOO_LARGE to
+                 * the client. */
+                rv = gnutls_reauth(ctxt->session, 0);
+            }
+            else
+                ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                              "%s: buffering request data failed!",
+                              __func__);
+        }
+        /* Retry on GNUTLS_E_INTERRUPTED or GNUTLS_E_AGAIN, whether
+         * from initial gnutls_reauth() call or after buffering. */
+    } while (tries < HANDSHAKE_MAX_TRIES
+             && (rv == GNUTLS_E_INTERRUPTED || rv == GNUTLS_E_AGAIN));
 
     if (rv != GNUTLS_E_SUCCESS)