linux MBEDTLS_ERR_NET_INVALID_CONTEXT mbedtls中的错误,当没有数据可供TLS读取时，Epoll会发出EPOLLIN事件通知

vxf3dgd4  于 2024-01-06  发布在  Linux
关注(0)|答案(2)|浏览(284)

我用mbedtls做了一个epoll HTTPS服务器。它监听两个端口：一个用于HTTP，另一个用于HTTPS。HTTP端口工作得很好。但是对于HTTPS，当没有数据可供mbedtls_ssl_read()读取时，我似乎会收到EPOLLIN通知。
可能数据是可用的，但问题出在SSL上下文上，因为mbedtls_ssl_read()返回MBEDTLS_ERR_NET_INVALID_CONTEXT。但我看不出问题出在哪里。我已经正确地初始化了上下文，甚至与它进行了TLS握手。
下面是代码的重要部分：请注意，我知道这段代码在很多情况下会失败。我只是做了一个例子来重现错误。这段代码只是描述了当我接受我的单一客户端时发生的一切，然后，在接收EPOLLIN后，尝试从它读取数据。

  1. #define REQUEST_SIZE 8192
  3. struct HTTP_server
  4. {
  5.     mbedtls_net_context https_context;
  6.     mbedtls_entropy_context entropy;
  7.     mbedtls_ctr_drbg_context ctr_drbg;
  8.     mbedtls_ssl_config conf;
  9.     mbedtls_x509_crt srvcert;
  10.     mbedtls_pk_context pkey;
  11.     const char *pers;
  12. };
  14. typedef struct client_data 
  15. {
  16.     char *request;
  17.     proto_t protocol;
  18.     union
  19.     {
  20.         int client_fd;
  21.         mbedtls_net_context https_context;
  22.     };
  23.     mbedtls_ssl_context ssl;
  25. } client_data_t;
  27. struct HTTP_server server;
  29. server->pers = "ssl_server";
  31. mbedtls_net_init(&server->https_context);
  32. mbedtls_ssl_config_init(&server->conf);
  34. mbedtls_x509_crt_init(&server->srvcert);
  35. mbedtls_pk_init(&server->pkey);
  36. mbedtls_entropy_init(&server->entropy);
  37. mbedtls_ctr_drbg_init(&server->ctr_drbg);
  39. if (mbedtls_ctr_drbg_seed(&server->ctr_drbg, mbedtls_entropy_func, &server->entropy,
  40.         (const unsigned char *) server->pers, strlen(server->pers)) != 0) {
  41.     return 0;
  42. }
  44. if (mbedtls_x509_crt_parse_file(&server->srvcert, "server.crt") != 0)
  45. {
  46.     return 0;
  47. }
  49. if (mbedtls_pk_parse_keyfile(&server->pkey, "server.key", "pass_phrase", mbedtls_ctr_drbg_random, &server->ctr_drbg) != 0)
  50. {
  51.     return 0;
  52. }
  54. if (mbedtls_net_bind(&server->https_context, NULL, "8000", MBEDTLS_NET_PROTO_TCP) != 0)
  55. {
  56.     return 0;
  57. }
  59. mbedtls_net_set_nonblock(&server->https_context);
  61. if (mbedtls_ssl_config_defaults(&server->conf, MBEDTLS_SSL_IS_SERVER, MBEDTLS_SSL_TRANSPORT_STREAM, 
  62.     MBEDTLS_SSL_PRESET_DEFAULT) != 0)
  63. {
  64.     return 0;
  65. }
  67. mbedtls_ssl_conf_rng(&server->conf, mbedtls_ctr_drbg_random, &server->ctr_drbg);
  69. if (mbedtls_ssl_conf_own_cert(&server->conf, &server->srvcert, &server->pkey) != 0)
  70. {
  71.     return 0;
  72. }
  74. int epoll_fd = epoll_create1(0);
  75.     
  76. if (epoll_fd == -1) 
  77. {
  78.     return;
  79. }
  81. event.data.fd = server->https_context.fd;
  82. event.events = EPOLLIN;
  84. if (epoll_ctl(epoll_fd, EPOLL_CTL_ADD, server->https_context.fd, &event) == -1) 
  85. {
  86.     goto epoll_close;
  87. }
  89. while (1)
  90. {
  91.     int nevents = epoll_wait(epoll_fd, events, 128, -1);
  92.     if (nevents == -1) 
  93.     {
  94.         goto epoll_close;
  95.     }
  96.     else if (errno == EINTR)
  97.     {
  98.         goto epoll_close;
  99.     }
  100.     for (int i = 0; i < nevents; ++i) 
  101.     {
  102.          if ((events[i].events & (EPOLLERR | EPOLLHUP))) 
  103.          {
  104.              continue;
  105.          } 
  106.          else if (events[i].data.fd == server->https_context.fd)
  107.          {
  108.               client_data_t client_status = malloc(sizeof(client_data_t));
  110.               mbedtls_net_context client_socket;
  111.               mbedtls_net_accept(&server->https_context, &client_socket, NULL, 0, NULL);
  113.               client_status->https_context = client_socket;
  114.               mbedtls_ssl_init(&client_status->ssl);
  116.               if (mbedtls_ssl_setup(&client_status->ssl, &server->conf) != 0)
  117.               {
  118.                   return 0;
  119.               }
  121.               mbedtls_ssl_set_bio(&client_status->ssl, &client_socket, mbedtls_net_send, mbedtls_net_recv, NULL);
  123.               int ret;
  124.               while (!program_interrupted && ((ret = mbedtls_ssl_handshake(&client_status->ssl)) != 0)) 
  125.               {
  126.                    if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) 
  127.                    {
  128.                         mbedtls_printf(" failed\n  ! mbedtls_ssl_handshake returned %d\n\n", ret);
  129.                         return 0;
  130.                     }
  131.                 }
  133.                 client_status->request = malloc(REQUEST_SIZE + 1);
  135.                 event.data.fd = client_socket.fd;
  136.                 event.data.ptr = client_status;
  137.                 event.events = EPOLLIN | EPOLLET;
  138.                 if (epoll_ctl(epoll_fd, EPOLL_CTL_ADD, client_socket.fd, &event) == -1) 
  139.                 {
  140.                      continue;
  141.                 }
  142.                    
  143.           }
  144.           else 
  145.           {
  146.                 client_data_t *client_status = events[i].data.ptr;
  147.                         
  148.                 // Every function call until this was successful, I checked, here nbytes == -69 or nbytes == -76
  149.                 // mbedtls_ssl_get_bytes_avail(&client_status->ssl) gives 0
  150.                 ssize_t nbytes = mbedtls_ssl_read(&client_status->ssl, (unsigned char *)(client_status->request), REQUEST_SIZE);  
  151.                 // other stuff
  152.                
  153.           }
  154.     }
  155. }
  157. epoll_close:
  159.     close(epoll_fd);

字符串
mbedtls调试错误消息如下所示：

  1. ssl_msg.c:5662: => read
  2. ssl_msg.c:4110: => read record
  3. ssl_msg.c:2155: => fetch input
  4. ssl_msg.c:2295: in_left: 0, nb_want: 5
  5. ssl_msg.c:2315: in_left: 0, nb_want: 5
  6. ssl_msg.c:2318: ssl->f_recv(_timeout)() returned -69 (-0x0045)
  7. ssl_msg.c:4782: mbedtls_ssl_fetch_input() returned -69 (-0x0045)
  8. ssl_msg.c:4141: ssl_get_next_record() returned -69 (-0x0045)
  9. ssl_msg.c:5722: mbedtls_ssl_read_record() returned -69 (-0x0045)

型
编辑：注意，我在从浏览器发送请求后得到EPOLLIN，并且我在边缘触发模式下使用epoll()，所以我使用mbedtls_ssl_read()直到套接字每次都会阻塞，也就是说，直到我得到MBEDTLS_ERR_SSL_WANT_READ。
我是这样读这封信的：

  1. while (1)
  2. {
  3.     nbytes = mbedtls_ssl_read(&client_status->ssl, (unsigned char *)(request + client_status->request_bytes_read), server_properties->max_request - client_status->request_bytes_read);
  4.             
  5.             if (nbytes < 0) 
  6.             { 
  7.            
  8.                 if (errno == EAGAIN || errno == EWOULDBLOCK || nbytes == MBEDTLS_ERR_SSL_WANT_READ) 
  9.                 {
  10.                     // no application data to read, wait for another epoll_wait() notification
  11.                     break;
  12.                 } 
  13.                 else 
  14.                 {
  15.                     // print error
  16.                     break;
  17.                 }
  19.                 // I also tried to replace the code above with this, but mbedtls_ssl_read() returns -69, which doesn't compare equal to MBEDTLS_ERR_SSL_WANT_READ and so there must be some sort of error
  20.                 // In case there is control data pending, but no application data, so that epoll_wait() wouldn't hang
  22.                 /* if (nbytes == MBEDTLS_ERR_SSL_WANT_READ)
  23.                 {
  24.                     continue;
  25.                 }
  26.                 else if (errno == EAGAIN || errno == EWOULDBLOCK) 
  27.                 {
  28.                     *blocked = 1;
  29.                     break;
  30.                 } 
  31.                 else 
  32.                 {
  33.                     ERROR_LOG("read() failed");
  34.                     break;
  35.                 } */
  37.             } 
  38.             else if (nbytes == 0) 
  39.             {
  40.                 break;
  41.             }
  42.             else 
  43.             {
  44.                 client_status->request_bytes_read += nbytes;
  45.                 client_status->request[client_status->request_bytes_read] = '\0';
  46.                 char *CRLF = strstr(client_status->request + client_status->request_bytes_read - nbytes, "\r\n\r\n");
  47.                 if (CRLF)
  48.                 {
  49.                     // parse the headers, get Content-Length and move to reading body
  50.                     // body is read in a similar manner
  51.                     break;
  52.                 }
  53.             }
  54. }

型

linux

2条答案

按热度按时间
omhiaaxx

omhiaaxx1#

TLS在TCP之上添加了一个层，它有自己的记录帧，也有没有应用程序有效负载的记录（握手，会话票证）。mbedtls_ssl_read将只在接收到包含应用程序数据的完整记录后返回数据，因为只有这样数据才能被解密。
EPOLL仅在TCP套接字级别工作。这意味着只要套接字上的内容可以读取，它就会发出活动信号，无论这是部分TLS记录还是完整的TLS记录，无论这些是应用程序数据还是只是控制信息。
这意味着你不能确定你可以mbedtls_ssl_read每当EPOLL返回套接字可读.甚至，你可能能够mbedtls_ssl_read即使EPOLL没有说套接字可读，因为最后一个套接字读取了多个TLS记录与应用程序数据.不确定Mbed-TLS，但是使用OpenSSL时，SSL_read只包含来自单个TLS记录的数据，需要使用SSL_pending检查是否有更多数据可用。Mbed-TLS具有类似的功能mbedtls_ssl_check_pending。

赞(0）分享  回复(0）举报  2024-01-06
ergxz8rk

ergxz8rk2#

问题是mbedtls_ssl_set_bio(&client_status->ssl, &client_socket, mbedtls_net_send, mbedtls_net_recv, NULL);中的client_socket超出了作用域，在此之后，read/write函数中的后续BIO回调无法使用该共享上下文。
应该是mbedtls_ssl_set_bio(&client_status->ssl, &client_status->https_context, mbedtls_net_send, mbedtls_net_recv, NULL);

赞(0）分享  回复(0）举报  2024-01-06
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com