Files
ServerCore/TCPSocket.cpp
T
Brad ArantandClaude Sonnet 5 a51a486560 Fix uninitialized tlsInfo causing random SSL_read/write on plain sockets
TCPSocket's SSL_CTX*-taking constructor - the one every accepted
TCPSession actually goes through (TCPSession(EPoll&, TCPServer*, ...)
passes server->ctx into it) - never initialized the `tlsInfo` member,
and TCPSocket.h gave it no default either. Every session's `tlsInfo`
was uninitialized garbage.

receiveData()/sendData() key their TLS-vs-plain dispatch on
`if(tlsInfo)`. Since that garbage value is non-zero often enough on a
real stack, sessions on a plain, non-TLS server were intermittently
routed through TLS::receiveData()/sendData() (SSL_read()/SSL_write())
against an also-uninitialized SSL*, segfaulting inside libssl. Confirmed
via dmesg: repeated "general protection fault ... in libssl.so.3",
signal 11, non-deterministic timing consistent with depending on
whatever garbage happened to be on the stack for a given session.

Fixed by dispatching on `ctx` instead of `tlsInfo`. `ctx` (TLS.h) now
defaults to NULL (previously also uninitialized) and is the value that
actually gets set for real in TLS::createContext() and correctly
inherited by every session via TLS(SSL_CTX*) - unlike `tlsInfo`, which
is only ever set on the listening TCPServer's own constructor and never
propagated to sessions at all. For the previously-working TLS-enabled
case this is a no-op: ctx and tlsInfo were always both set (or both
unset) together on the listening server, so the observable behavior
there is unchanged - only the previously-undefined session-level
behavior is fixed.

Verified live: restarted the APIServer test instance (a plain, non-TLS
TCPServer - the exact configuration that was crashing), ran 100
sequential requests with no failures, and confirmed no new libssl
segfaults in dmesg since the fix (three separate pre-fix crash
incidents are all still visible in the dmesg history for comparison).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-25 18:56:27 -07:00

105 lines
3.6 KiB
C++

#include "TCPSocket.h"
#include "EPoll.h"
#include "Log.h"
#include "Exception.h"
#include "errno.h"
namespace core {
TCPSocket::TCPSocket(EPoll &ePoll) : Socket(ePoll) {}
TCPSocket::TCPSocket(EPoll &ePoll, std::string text) : Socket(ePoll, text) {}
TCPSocket::TCPSocket(EPoll &ePoll, TLSInfo *tlsInfo, std::string text) : Socket(ePoll, text), TLS(tlsInfo), tlsInfo(tlsInfo) {}
TCPSocket::TCPSocket(EPoll &ePoll, SSL_CTX *ctx, std::string text) : Socket(ePoll, text), TLS(ctx) {}
TCPSocket::~TCPSocket() {}
void TCPSocket::connect(IPAddress &address) {
setDescriptor(socket(AF_INET, SOCK_STREAM, 0));
if(::connect(getDescriptor(), (struct sockaddr *)&address.addr, address.addressLength) == -1)
throw coreutils::Exception("Error on connect to TCP socket." + errno);
coreutils::Log(coreutils::LOG_DEBUG_3) << "Connected to IP..." << address.getClientAddressAndPort();
}
void TCPSocket::output(std::stringstream &out) {
out << "|" << ipAddress.getClientAddressAndPort();
}
void TCPSocket::receiveData(coreutils::ZString &buffer) {
// Dispatch on `ctx`, not `tlsInfo` - the SSL_CTX*-taking constructor
// (used for every accepted TCPSession) never sets `tlsInfo` at all,
// leaving it as uninitialized garbage that intermittently (whenever
// that garbage happened to be non-zero) routed a plain, non-TLS
// session's data through SSL_read()/SSL_write() against an
// uninitialized SSL*, segfaulting inside libssl. `ctx` is the
// reliable signal: real and non-NULL for an actual TLS server/
// session (set in TLS::createContext(), inherited by sessions via
// TLS(SSL_CTX*)), safely NULL by default otherwise (see TLS.h).
if(ctx) {
int len = TLS::receiveData(buffer);
if(len >= 0) {
coreutils::ZString zbuffer(buffer.getData(), len);
onDataReceived(zbuffer);
}
} else {
Socket::receiveData(buffer);
}
}
int TCPSocket::sendData(const char *data, int length) {
if(ctx)
return TLS::sendData(data, length);
else
return Socket::sendData(data, length);
}
void TCPSocket::onDataReceived(coreutils::ZString &data) {
if (data.getLength() > 0) {
lineBuffer = (char *)realloc(lineBuffer, lineBufferSize + data.getLength());
memcpy(lineBuffer + lineBufferSize, data.getData(), data.getLength());
lineBufferSize += data.getLength();
while (lineBufferSize > 0) {
if (blockSize == 0) {
lineLength = strcspn(lineBuffer, "\r\n");
if (lineLength == lineBufferSize)
break;
coreutils::ZString zLine(lineBuffer, lineLength);
onLineReceived(zLine);
if (lineBuffer[lineLength] == '\r')
++lineLength;
if (lineBuffer[lineLength] == '\n')
++lineLength;
lineBufferSize -= lineLength;
if (lineBufferSize > 0)
memmove(lineBuffer, lineBuffer + lineLength, lineBufferSize);
lineBuffer = (char *)realloc(lineBuffer, lineBufferSize);
}
else if (lineBufferSize >= blockLength) {
coreutils::ZString zBlock(lineBuffer, blockLength);
onBlockReceived(zBlock);
lineBufferSize -= blockLength;
if (lineBufferSize > 0)
memmove(lineBuffer, lineBuffer + blockLength, lineBufferSize);
lineBuffer = (char *)realloc(lineBuffer, lineBufferSize);
}
}
}
}
void TCPSocket::onLineReceived(coreutils::ZString &line) {
if (term)
shutdown("termination requested");
}
void TCPSocket::onBlockReceived(coreutils::ZString &block) {}
void TCPSocket::setBlockSize(int blockSize) {
this->blockSize = blockSize;
}
}