Uh oh!
There was an error while loading. Please reload this page.
Improve TlsSession error diagnostics - #131943
Conversation
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones |
There was a problem hiding this comment.
Pull request overview
This PR refines OpenSSL/TlsSession error diagnostics by preserving errno across SSL_get_error in the native shims and switching TlsSession to build exceptions using the same inner-exception logic as SslStream (distinguishing EOF vs I/O error for SSL_ERROR_SYSCALL based on the raw SSL_* return value).
Changes:
- Preserve
errnoacrossSSL_get_errorforSSL_write,SSL_read, andSSL_do_handshakesoSSL_ERROR_SYSCALLdiagnostics remain accurate. - Make socket-replay BIO failures set deterministic
errnovalues (and treatsend() == 0as retryable) to avoid surfacing staleerrno. - Update
TlsSession.OpenSslto useInterop.OpenSsl.GetSslError(result, error)and pass rawSSL_*results; exposeGetSslErrorasinternaland enableSetLastErroronSslDoHandshake.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/native/libs/System.Security.Cryptography.Native/pal_ssl.c | Preserve errno across SSL_get_error for read/write/handshake paths. |
| src/native/libs/System.Security.Cryptography.Native/pal_bio.c | Set deterministic errno for socket-replay BIO error cases; handle send() == 0 as retry. |
| src/libraries/System.Net.Security/src/System/Net/Security/TlsSession.OpenSsl.cs | Align exception creation with SslStream by using raw SSL_* result + GetSslError. |
| src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Ssl.cs | Enable SetLastError for SslDoHandshake so errno is observable from managed code. |
| src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs | Make GetSslErrorinternal for reuse by TlsSession. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
rzikm
commented
Aug 7, 2026
/ba-g QUIC test failure is unrelated |
Uh oh!
There was an error while loading. Please reload this page.
This makes TlsSession use the same code for creating exceptions as in SslStream, so that it correctly reports all cases.
This makes TlsSession use the same code for creating exceptions as in SslStream, so that it correctly reports all cases.