Misc SSL improvements (#14317)
* set web client to poll when ssl error want read or write * turn to function
Emmanuel Vasilakis committed
Jan 25, 2023 at 14:19 UTC
f4d017ccf7385df3e152eeb5ea1259702ab01043
3 files changed
+78
-68
libnetdata/socket/socket.c
+5
-22
@@ -923,53 +923,36 @@ int connect_to_one_of_urls(const char *destination, int default_port, struct tim
923
ssize_t netdata_ssl_read(SSL *ssl, void *buf, size_t num) {
924
error_limit_static_thread_var(erl, 1, 0);
925
926
- int bytes, err, retries = 0;
926
+ int bytes, err;
927
928
- //do {
928
bytes = SSL_read(ssl, buf, (int)num);
929
err = SSL_get_error(ssl, bytes);
931
- retries++;
932
- //} while (bytes <= 0 && err == SSL_ERROR_WANT_READ);
930
931
if(unlikely(bytes <= 0)) {
932
if (err == SSL_ERROR_WANT_WRITE || err == SSL_ERROR_WANT_READ) {
933
bytes = 0;
934
} else
938
- error("SSL_write() returned %d bytes, SSL error %d", bytes, err);
935
+ error_limit(&erl, "SSL_write() returned %d bytes, SSL error %d", bytes, err);
936
}
937
941
- if(retries > 1)
942
- error_limit(&erl, "SSL_read() retried %d times", retries);
943
-
938
return bytes;
939
}
940
941
ssize_t netdata_ssl_write(SSL *ssl, const void *buf, size_t num) {
942
error_limit_static_thread_var(erl, 1, 0);
943
950
- int bytes, err, retries = 0;
951
- size_t total = 0;
944
+ int bytes, err;
945
953
- //do {
954
- bytes = SSL_write(ssl, (uint8_t *)buf + total, (int)(num - total));
946
+ bytes = SSL_write(ssl, (uint8_t *)buf, (int)num);
947
err = SSL_get_error(ssl, bytes);
956
- retries++;
957
-
958
- if(bytes > 0)
959
- total += bytes;
960
-
961
- //} while ((bytes <= 0 && (err == SSL_ERROR_WANT_WRITE)) || (bytes > 0 && total < num));
948
949
if(unlikely(bytes <= 0)) {
950
if (err == SSL_ERROR_WANT_WRITE || err == SSL_ERROR_WANT_READ) {
951
bytes = 0;
952
} else
967
- error("SSL_write() returned %d bytes, SSL error %d", bytes, err);
953
+ error_limit(&erl, "SSL_write() returned %d bytes, SSL error %d", bytes, err);
954
}
955
970
- if(retries > 1)
971
- error_limit(&erl, "SSL_write() retried %d times", retries);
972
-
956
return bytes;
957
}
958
#endif
web/server/static/static-threaded.c
+56
-45
@@ -293,61 +293,72 @@ static int web_server_rcv_callback(POLLINFO *pi, short int *events) {
293
struct web_client *w = (struct web_client *)pi->data;
294
int fd = pi->fd;
295
296
- if(unlikely(web_client_receive(w) < 0)) {
297
- ret = -1;
298
- goto cleanup;
299
- }
296
+ ssize_t bytes;
297
+ bytes = web_client_receive(w);
298
301
- debug(D_WEB_CLIENT, "%llu: processing received data on fd %d.", w->id, fd);
302
- worker_is_idle();
303
- worker_is_busy(WORKER_JOB_PROCESS);
304
- web_client_process_request(w);
299
+ if (likely(bytes > 0)) {
300
+ debug(D_WEB_CLIENT, "%llu: processing received data on fd %d.", w->id, fd);
301
+ worker_is_idle();
302
+ worker_is_busy(WORKER_JOB_PROCESS);
303
+ web_client_process_request(w);
304
306
- if (unlikely(w->mode == WEB_CLIENT_MODE_STREAM)) {
307
- web_client_send(w);
308
- }
305
+ if (unlikely(w->mode == WEB_CLIENT_MODE_STREAM)) {
306
+ web_client_send(w);
307
+ }
308
310
- else if(unlikely(w->mode == WEB_CLIENT_MODE_FILECOPY)) {
311
- if(w->pollinfo_filecopy_slot == 0) {
312
- debug(D_WEB_CLIENT, "%llu: FILECOPY DETECTED ON FD %d", w->id, pi->fd);
313
-
314
- if (unlikely(w->ifd != -1 && w->ifd != w->ofd && w->ifd != fd)) {
315
- // add a new socket to poll_events, with the same
316
- debug(D_WEB_CLIENT, "%llu: CREATING FILECOPY SLOT ON FD %d", w->id, pi->fd);
317
-
318
- POLLINFO *fpi = poll_add_fd(
319
- pi->p
320
- , w->ifd
321
- , pi->port_acl
322
- , 0
323
- , POLLINFO_FLAG_CLIENT_SOCKET
324
- , "FILENAME"
325
- , ""
326
- , ""
327
- , web_server_file_add_callback
328
- , web_server_file_del_callback
329
- , web_server_file_read_callback
330
- , web_server_file_write_callback
331
- , (void *) w
332
- );
333
-
334
- if(fpi)
335
- w->pollinfo_filecopy_slot = fpi->slot;
336
- else {
337
- error("Failed to add filecopy fd. Closing client.");
338
- ret = -1;
339
- goto cleanup;
309
+ else if(unlikely(w->mode == WEB_CLIENT_MODE_FILECOPY)) {
310
+ if(w->pollinfo_filecopy_slot == 0) {
311
+ debug(D_WEB_CLIENT, "%llu: FILECOPY DETECTED ON FD %d", w->id, pi->fd);
312
+
313
+ if (unlikely(w->ifd != -1 && w->ifd != w->ofd && w->ifd != fd)) {
314
+ // add a new socket to poll_events, with the same
315
+ debug(D_WEB_CLIENT, "%llu: CREATING FILECOPY SLOT ON FD %d", w->id, pi->fd);
316
+
317
+ POLLINFO *fpi = poll_add_fd(
318
+ pi->p
319
+ , w->ifd
320
+ , pi->port_acl
321
+ , 0
322
+ , POLLINFO_FLAG_CLIENT_SOCKET
323
+ , "FILENAME"
324
+ , ""
325
+ , ""
326
+ , web_server_file_add_callback
327
+ , web_server_file_del_callback
328
+ , web_server_file_read_callback
329
+ , web_server_file_write_callback
330
+ , (void *) w
331
+ );
332
+
333
+ if(fpi)
334
+ w->pollinfo_filecopy_slot = fpi->slot;
335
+ else {
336
+ error("Failed to add filecopy fd. Closing client.");
337
+ ret = -1;
338
+ goto cleanup;
339
+ }
340
}
341
}
342
}
343
+ else {
344
+ if(unlikely(w->ifd == fd && web_client_has_wait_receive(w)))
345
+ *events |= POLLIN;
346
+ }
347
+
348
+ if(unlikely(w->ofd == fd && web_client_has_wait_send(w)))
349
+ *events |= POLLOUT;
350
}
344
- else {
351
+ else if(unlikely(bytes < 0)) {
352
+ ret = -1;
353
+ goto cleanup;
354
+ }
355
+ else if (unlikely(bytes == 0)) {
356
if(unlikely(w->ifd == fd && web_client_has_wait_receive(w)))
357
*events |= POLLIN;
347
- }
358
349
- if(unlikely(w->ofd == fd && web_client_has_wait_send(w)))
350
- *events |= POLLOUT;
359
+ if(unlikely(w->ofd == fd && web_client_has_wait_send(w)))
360
+ *events |= POLLOUT;
361
+ }
362
363
ret = web_server_check_client_status(w);
364
web/server/web_client.c
+17
-1
@@ -38,6 +38,18 @@ static inline int web_client_crock_socket(struct web_client *w) {
38
return 0;
39
}
40
41
+static inline void web_client_enable_wait_from_ssl(struct web_client *w, int bytes) {
42
+ int ssl_err = SSL_get_error(w->ssl.conn, bytes);
43
+ if (ssl_err == SSL_ERROR_WANT_READ)
44
+ web_client_enable_wait_receive(w);
45
+ else if (ssl_err == SSL_ERROR_WANT_WRITE)
46
+ web_client_enable_wait_send(w);
47
+ else if (ssl_err) {
48
+ web_client_disable_wait_receive(w);
49
+ web_client_disable_wait_send(w);
50
+ }
51
+}
52
+
53
static inline int web_client_uncrock_socket(struct web_client *w) {
54
#ifdef TCP_CORK
55
if(likely(w->tcp_cork && w->ofd != -1)) {
@@ -1057,6 +1069,7 @@ static inline ssize_t web_client_send_data(struct web_client *w,const void *buf,
1069
if ( (!web_client_check_unix(w)) && (netdata_ssl_srv_ctx) ) {
1070
if ( ( w->ssl.conn ) && ( !w->ssl.flags ) ){
1071
bytes = netdata_ssl_write(w->ssl.conn, buf, len) ;
1072
+ web_client_enable_wait_from_ssl(w, bytes);
1073
} else {
1074
bytes = send(w->ofd,buf, len , flags);
1075
}
@@ -1212,8 +1225,10 @@ static inline void web_client_send_http_header(struct web_client *w) {
1225
ssize_t bytes;
1226
#ifdef ENABLE_HTTPS
1227
if ( (!web_client_check_unix(w)) && (netdata_ssl_srv_ctx) ) {
1215
- if ( ( w->ssl.conn ) && ( w->ssl.flags == NETDATA_SSL_HANDSHAKE_COMPLETE ) )
1228
+ if ( ( w->ssl.conn ) && ( w->ssl.flags == NETDATA_SSL_HANDSHAKE_COMPLETE ) ) {
1229
bytes = netdata_ssl_write(w->ssl.conn, buffer_tostring(w->response.header_output), buffer_strlen(w->response.header_output));
1230
+ web_client_enable_wait_from_ssl(w, bytes);
1231
+ }
1232
else {
1233
while((bytes = send(w->ofd, buffer_tostring(w->response.header_output), buffer_strlen(w->response.header_output), 0)) == -1) {
1234
count++;
@@ -1906,6 +1921,7 @@ ssize_t web_client_receive(struct web_client *w)
1921
if ( (!web_client_check_unix(w)) && (netdata_ssl_srv_ctx) ) {
1922
if ( ( w->ssl.conn ) && (!w->ssl.flags)) {
1923
bytes = netdata_ssl_read(w->ssl.conn, &w->response.data->buffer[w->response.data->len], (size_t) (left - 1));
1924
+ web_client_enable_wait_from_ssl(w, bytes);
1925
}else {
1926
bytes = recv(w->ifd, &w->response.data->buffer[w->response.data->len], (size_t) (left - 1), MSG_DONTWAIT);
1927
}