RE: SSL thread safe?

[Brook A. Keele]

Here is a rough outline of what I am doing. I am getting random Malloc
errors on ssl_write.

class CListenSocket : public CSocket
{
public:
        CListenSocket(SSADThread* mainThread, bool IsSSL,SSL *ssl);
        virtual ~CListenSocket();
        bool DoAccept(CListenSocket *pNewSocket, SOCKADDR *sockAddr, int
*lpSockAddrLen);
        void DoAttach(SOCKET hSocket);
        SSL *GetSSL(void);
        int Send(const void *lpBuf);

        public:
        virtual void OnAccept(int nErrorCode);
        virtual void OnConnect(int nErrorCode);
        virtual void OnReceive(int nErrorCode);
        virtual void OnClose(int nErrorCode);
        virtual void OnSend(int nErrorCode);
        virtual int Receive(void* lpBuf, int nBufLen, int nFlags = 0);
        virtual int Send(const void* lpBuf, int nBufLen, int nFlags = 0);

        SSADThread* m_MT; // the actual web server class using this class...
        bool m_bSSL;
protected:
        SSL* m_ssl;
};


CListenSocket::DoAccept(CListenSocket *pNewSocket,SOCKADDR *sockaddr, int
*len)
{
        Accept(pNewSocket, sockaddr, len);

        if (m_bSSL) // if using ssl
        {
        if (m_bSSL)
        {
                SSL_set_fd(pNewSocket->m_ssl, pNewSocket->m_hSocket);

                do{
                        ret = SSL_accept(pNewSocket->m_ssl);
                        if (ret == -1)
                        {
                                err = SSL_get_error(pNewSocket->m_ssl,ret);
                                if ((err == SSL_ERROR_WANT_READ) ||
                                        (err == SSL_ERROR_WANT_WRITE))
                                        ret = 0;
                        }
                }while (ret == 0);
                if (ret == -1)
                        return false;
        }

        return true;
}

SSADThread::OnAccept
{
        CListenSocket *pNewSocket = new CListenSocket(this,m_bSSL,SSL_new(ctx));
        if(!m_pServerSocket->DoAccept(pNewSocket, &sockAddr, &lpSockAddrLen))
        {
                if (m_bSSL)
                        delete pNewSocket;
                throw (new WinsockException(TRUE,::WSAGetLastError()));
        }
}

SSADThread::OnReceive(CListenSocket* pSocket)
{
        HandleReceiveData(pSocket);
}

SSADThread::HandleReceiveData(CListenSocket *pSocket)
{
        ThreadStruct *ts = new ThreadStruct; // structure containing information to
pass to the thread

        int bytesRead = pSocket->Receive(buf, bytesToRead);
        if(bytesRead <= 0)
        {
                delete buf;
                return;
        }

        ts->buffer = new char[bytesRead + 1];
        memset(ts->buffer, 0, bytesRead);
        strncpy(ts->buffer, CBuf, bytesRead);

        ts->socketHandle = pSocket->Detach()
        ts->ssl = pSocket->GetSSL(); // get a pointer to the SSL structure
contained in the class

        ts->thisPtr = this;

        unsigned int threadID;
        unsigned long handle = _beginthreadex(NULL, 0,
                                (unsigned int (__stdcall *)(void 
*))ThreadHandleARequest, ts,
                                0, &threadID);



}

static unsigned int ThreadHandleARequest(void *structPtr)
{
        // Create a ThreadStruct pointer so we don't have to repeatedly cast
structPtr
        ThreadStruct *pStruct = (ThreadStruct*)structPtr;

        // I have deleted a lot of error checking and other code for clarity
purposes.
        CListenSocket *pTmpSocket = new CListenSocket(pStruct->thisPtr,
                                                pStruct->thisPtr->m_bSSL,
                                                pStruct->ssl);

        if (pTmpSocket == NULL)
                return;

        pTmpSocket->Attach(pStruct->socketHandle);  // attach the connected socket
to the new CListenSocket.
                                                                  // The detach in 
HandleReceiveData and the attach on the
                                                                  // previous line are 
necessary due to CSocket not being
                                                                  // threadsafe.

        ????? The SSL pointer sent from previous thread no longer is dependable.
        ????? Is there a better way to transport the previously configured SSL
pointer
        ????? to a new instance of the class?
}


Currently the SSL pointer will allow sending and receiving of data, but not
on a dependable basis. Every few connections will result in a SSL_write
failure (returns -1). SSL_get_error returns a '1'. ERR_print_string will not
give me any reason other than '1'. I think this is a ERR_R_MALLOC_FAILURE
(per err.h line 215).

I have traced into the code and found that sometimes the buffers created by
SSL_accept in the ssl3_setup_buffers routine (s->s3->wbuf.buf and
s->s3->rbuf.buf) are no longer allocated after I have reassigned which
CListenSocket Class instance has the SSL pointer.


I don't know if any of this is making any sense to anyone, but if it does,
please help me.

Thank you for your time.


Brook A. Keele
Software Engineer,
Palisade Systems, Inc.
2625 North Loop Drive,
Suite 2120
Ames, IA  50010

Phone(515)296-5479
email: [EMAIL PROTECTED]

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       [EMAIL PROTECTED]
Automated List Manager                           [EMAIL PROTECTED]