tls: fix bugs of double TLS by ywave620 · Pull Request #48796 · nodejs/node

ywave620 · 2023-07-16T03:16:35Z

Fixs two issues in TLSWrap, one of them is reported in #30896 (a 3 years log bug ...).

TLSWrap has exactly one StreamListener, however, that StreamListener can be replaced. We have not been rigorous enough here: if an active write has not been finished before the transition, the finish callback of it will be wrongly fired the successor StreamListener.
A TLSWrap does not allow more than one active write, as checked in the assertion about current_write in TLSWrap::DoWrite().

However, when users make use of an existing tls.TLSSocket to establish double TLS, by
either

tls.connect({socket: tlssock})

or

tlsServer.emit('connection',tlssock)

we have both of the user provided tls.TLSSocket, tlssock and a brand new created TLSWrap writing to the TLSWrap bound to tlssock, which easily violates the constranint because two writers have no idea of each other.

The design of the fix is:
when a TLSWrap is created on top of a user provided socket, do not send any data to the socket until all existing writes of the socket are done and ensure registered callbacks of those writes can be fired.

Fixs two issues in `TLSWrap`, one of them is reported in nodejs#30896. 1. `TLSWrap` has exactly one `StreamListener`, however, that `StreamListener` can be replaced. We have not been rigorous enough here: if an active write has not been finished before the transition, the finish callback of it will be wrongly fired the successor `StreamListener`. 2. A `TLSWrap` does not allow more than one active write, as checked in the assertion about current_write in `TLSWrap::DoWrite()`. However, when users make use of an existing `tls.TLSSocket` to establish double TLS, by either tls.connect({socket: tlssock}) or tlsServer.emit('connection', tlssock) we have both of the user provided `tls.TLSSocket`, tlssock and a brand new created `TLSWrap` writing to the `TLSWrap` bound to tlssock, which easily violates the constranint because two writers have no idea of each other. The design of the fix is: when a `TLSWrap` is created on top of a user provided socket, do not send any data to the socket until all existing writes of the socket are done and ensure registered callbacks of those writes can be fired.

nodejs-github-bot · 2023-07-16T03:16:39Z

Review requested:

@nodejs/crypto

Format code.

nodejs-github-bot · 2023-07-16T12:13:08Z

CI: https://ci.nodejs.org/job/node-test-pull-request/52787/

Remove unnecessary saving of `this` for arrow function.

Fix typo

ywave620 · 2023-07-18T08:55:10Z

leftover processes found in the github hooked CI Test ASan / test-asan

ps awwx | grep Release/node | grep -v grep | cat
105758 ? tl 0:00 /home/runner/work/node/node/out/Release/node /home/runner/work/node/node/test/parallel/test-cluster-primary-error.js cluster
105791 ? S 0:00 /home/runner/work/node/node/out/Release/node /home/runner/work/node/node/test/parallel/test-cluster-primary-error.js cluster
make[1]: *** [Makefile:554: test-ci] Error 1
make: *** [Makefile:579: run-ci] Error 2
Error: Process completed with exit code 2.

But it seems like these failures have nothing to do with this PR. Could somebody rerun the CI?

ywave620 · 2023-07-20T11:49:00Z

cc @nodejs/crypto

nodejs-github-bot · 2023-07-20T19:56:38Z

CI: https://ci.nodejs.org/job/node-test-pull-request/52877/

nodejs-github-bot · 2023-07-21T18:11:35Z

CI: https://ci.nodejs.org/job/node-test-pull-request/52893/

nodejs-github-bot · 2023-07-23T10:15:01Z

CI: https://ci.nodejs.org/job/node-test-pull-request/52903/

nodejs-github-bot · 2023-07-25T22:09:55Z

CI: https://ci.nodejs.org/job/node-test-pull-request/52930/

jasnell · 2023-07-28T19:21:51Z

 StreamBase* stream,
- SecureContext* sc);
+ SecureContext* sc,
+ bool stream_has_active_write);


Non-blocking nit: I'm generally not a fan of bool arguments to methods, largely because just seeing the true or false a the callsite tends not to be descriptive enough to let folks know what the impact is. I certainly won't block this change because of it, but I'd prefer a enum arg here instead.

mhdawson · 2023-07-28T19:27:09Z

Landed in 662fe0be9d8e

mhdawson · 2023-07-28T19:28:22Z

arg, just noticed there was a suggestion on the PR after I landed it. @jasnell sorry about that.

@ywave620 any chance you could open a new PR to address that.

ywave620 · 2023-07-29T01:08:00Z

arg, just noticed there was a suggestion on the PR after I landed it. @jasnell sorry about that.
@ywave620 any chance you could open a new PR to address that.

Totally ok

ywave620 · 2023-07-30T11:17:21Z

@ywave620 any chance you could open a new PR to address that.

#48969. @mhdawson PTAL

mhdawson · 2023-08-02T20:06:04Z

@ywave620 many thanks

mhdawson · 2023-08-02T20:06:51Z

@ywave620 I had landed your original version in this PR. What I'd hope for was a PR that just addressed the remaining suggestion from @jasnell

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Jul 16, 2023

tls: fix bugs of double TLS
7e2ec19
Format code.

lpinca added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 16, 2023

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 16, 2023

mscdex reviewed Jul 16, 2023
View reviewed changes

Comment threadlib/_tls_wrap.js Outdated

github-actionsBot mentioned this pull request Jul 17, 2023
CI Reliability 2023-07-17 nodejs/reliability#615
Open
25 tasks

tls: fix bugs of double TLS
8ce31c6
Remove unnecessary saving of `this` for arrow function.

mscdex reviewed Jul 17, 2023
View reviewed changes

Comment threadtest/parallel/test-socket-writes-before-paased-to-tls-socket.js

tls: fix bugs of double TLS
29aade9
Fix typo

github-actionsBot mentioned this pull request Jul 18, 2023
CI Reliability 2023-07-18 nodejs/reliability#616
Open
26 tasks

github-actionsBot mentioned this pull request Jul 19, 2023
CI Reliability 2023-07-19 nodejs/reliability#617
Open
25 tasks

lpinca added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 20, 2023

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 20, 2023

mhdawson added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 21, 2023

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 21, 2023

This was referenced Jul 22, 2023
CI Reliability 2023-07-22 nodejs/reliability#620
Open
CI Reliability 2023-07-23 nodejs/reliability#621
Open

This was referenced Jul 24, 2023
CI Reliability 2023-07-24 nodejs/reliability#622
Open
CI Reliability 2023-07-25 nodejs/reliability#623
Open

This was referenced Jul 26, 2023
CI Reliability 2023-07-26 nodejs/reliability#624
Open
CI Reliability 2023-07-27 nodejs/reliability#625
Open

ShogunPanda approved these changes Jul 27, 2023
View reviewed changes

github-actionsBot mentioned this pull request Jul 28, 2023
CI Reliability 2023-07-28 nodejs/reliability#626
Open
19 tasks

jasnell reviewed Jul 28, 2023
View reviewed changes

jasnell approved these changes Jul 28, 2023
View reviewed changes

mhdawson closed this Jul 28, 2023

github-actionsBot mentioned this pull request Jul 29, 2023
CI Reliability 2023-07-29 nodejs/reliability#627
Open
23 tasks

github-actionsBot mentioned this pull request Jul 30, 2023
CI Reliability 2023-07-30 nodejs/reliability#628
Open
21 tasks

ywave620 mentioned this pull request Jul 30, 2023
tls: fix bugs of double TLS #48969
Closed

Uh oh!

Uh oh!

Conversation

ywave620 commented Jul 16, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 16, 2023

Uh oh!

nodejs-github-bot commented Jul 16, 2023

Uh oh!

Uh oh!

Uh oh!

ywave620 commented Jul 18, 2023

Uh oh!

ywave620 commented Jul 20, 2023

Uh oh!

nodejs-github-bot commented Jul 20, 2023

Uh oh!

nodejs-github-bot commented Jul 21, 2023

Uh oh!

nodejs-github-bot commented Jul 23, 2023

Uh oh!

nodejs-github-bot commented Jul 25, 2023

Uh oh!

jasnellJul 28, 2023

Choose a reason for hiding this comment

Uh oh!

mhdawson commented Jul 28, 2023

Uh oh!

mhdawson commented Jul 28, 2023

Uh oh!

ywave620 commented Jul 29, 2023

Uh oh!

ywave620 commented Jul 30, 2023

Uh oh!

mhdawson commented Aug 2, 2023

Uh oh!

mhdawson commented Aug 2, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

ywave620 commented Jul 16, 2023•
edited
Loading