zwoop opened a new pull request, #13979: URL: https://github.com/apache/trafficserver/pull/13979
OpenSSL 4.0 changed `bread_conv()` (crypto/bio/bio_meth.c) to set `BIO_FLAGS_AUTO_EOF` when a legacy `BIO_meth_set_read()` callback returns 0. ATS's origin BIO, `BIO_s_fastopen`, is such a callback, so an origin that closes without close_notify now gets `SSL_ERROR_SSL` (`SSL_R_UNEXPECTED_EOF_WHILE_READING`). On OpenSSL 3.x the same close came back as `SSL_ERROR_SYSCALL`, which `_ssl_read_from_net()` reads as EOS. The error reaches HttpTunnel as `VC_EVENT_ERROR`. For a close-delimited response the tunnel then never finishes the client side: the chunked response to an HTTP/1.1 client gets no terminating chunk and the client waits until it times out. #13763 and #13976 worked around this in the tests by framing the origin responses. This sets `SSL_OP_IGNORE_UNEXPECTED_EOF` on the origin-side contexts, which keeps the behavior ATS has had on every OpenSSL 3.x release. That is lenient by design (RFC 9112 ยง9.8 calls such a response incomplete); length-framed and chunked origin responses still detect truncation in HttpSM. Inbound contexts are unchanged, and BoringSSL, which lacks the option, is unaffected. `tls/test_tls_origin_close_without_notify.py` uses `mock_origin.py`, now able to serve TLS and a close-delimited body. It fails on OpenSSL 4 without the fix. Separately, HttpTunnel still leaves the client waiting when a no-length response ends in a real transport error; that is an older bug and not addressed here. Co-authored-by: Masakazu Kitajo <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
