SSL_Connect call gives SSL_ERROR_WANT_READ for non blocking sockets

[Arjun SM]

Hi all,

   I am newbie to openssl any help is greatly appreciated.

I have a requirement of fetching the Common name (domin name )  from the certificate that I request from any HTTPS websites. I followed the regular method of 

1. establish a connection with the ip address using connect() system call.

2. Use SSL_connect() system call to perform handshake.

3. Use SSL_get_peer_certificate() to get the certificate.

The problem I faced was that, the connect() call would at times return a errno 4 (EINTR) error . So i changed code from blocking to non-blocking sockets and used select() call to have a valid connection and return an appropriate file descriptor.

Now the ssl_connect() call returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE error. I am unable to make my code work by adding a select() even on ssl_connect() call.

If any one can please help as to how I need to use the  ssl_connect() by polling that would be of great help. preferred language would be C/C++

thanks,

~Arjun

[Huaqing Wang]

Hi, Arjun,

For non-blocking case, you have to handle SSL_ERROR_WANT_READ  and SSL_ERROR_WANT_WRITE 

In that case you need to redo SSL_connect.

Huaqing

--
Thank you.
Best Regards,
Michael(Huaqing) Wang

[Arjun SM]

Hi,
    Thanks for the reply.
I have called the ssl_connect() function again after checking for SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE. But I wanted to know if I can optimize my code. Below is my code

int counter = 6;
        while (status < 0 && --counter >0 )
        {                       
            if(status < 0)
            {
                error=SSL_get_error(ssl,status);
                if(error == SSL_ERROR_WANT_READ || error == SSL_ERROR_WANT_WRITE)
                {
                    MessageLog.Write("****SSL 1st Connect error ", error);
                    usleep(2000000);
                    status = SSL_connect(ssl);
                    error=SSL_get_error(ssl,status);
                    MessageLog.Write("****SSL 2nd Connect error ", error);
                }
                else
                {
                    break;
                }
            }
        } // end of while

I would try for some time and break out saying unable to connect. I am sure I can optimize this code by using select() but I am unable to make it work. If there is a better approach please do share.

~Arjun

[Michael S. Zick]

On Thu November 17 2011, Arjun SM wrote:
> Hi,
> Thanks for the reply.
> I have called the ssl_connect() function again after checking for
> SSL_ERROR_WANT_READ
> and SSL_ERROR_WANT_WRITE. But I wanted to know if I can optimize my code.
> Below is my code
>
> int counter = 6;
> while (status < 0 && --counter >0 )
> {
> if(status < 0)
> {
> error=SSL_get_error(ssl,status);
> if(error == SSL_ERROR_WANT_READ || error ==
> SSL_ERROR_WANT_WRITE)
> {
> MessageLog.Write("****SSL 1st Connect error ", error);
>

But these two cases are __not__ errors,
you just need to 'read' or 'write' as indicated so the protocol can advance.

Mike

> usleep(2000000);
> status = SSL_connect(ssl);
> error=SSL_get_error(ssl,status);
> MessageLog.Write("****SSL 2nd Connect error ", error);
> }
> else
> {
> break;
> }
> }
> } // end of while
>
> I would try for some time and break out saying unable to connect. I am sure
> I can optimize this code by using select() but I am unable to make it work.
> If there is a better approach please do share.
>
> ~Arjun
>
> On Tue, Nov 15, 2011 at 9:04 PM, Huaqing Wang <whua...@gmail.com> wrote:
>
> > Hi, Arjun,
> >
> > For non-blocking case, you have to handle SSL_ERROR_WANT_READ and
> > SSL_ERROR_WANT_WRITE

> > In that case you need to redo *SSL_connect.*
> > *
> > *

> > Huaqing
> >
> > On Tue, Nov 15, 2011 at 5:51 AM, Arjun SM <arju...@gmail.com> wrote:
> >
> >> Hi all,
> >> I am newbie to openssl any help is greatly appreciated.
> >>
> >> I have a requirement of fetching the Common name (domin name ) from the
> >> certificate that I request from any HTTPS websites. I followed the regular
> >> method of
> >>

> >> 1. establish a connection with the ip address using *connect() *system
> >> call.
> >> 2. Use *SSL_connect()* system call to perform handshake.
> >> 3. Use *SSL_get_peer_certificate()* to get the certificate.

> >>
> >> The problem I faced was that, the connect() call would at times return a
> >> errno 4 (EINTR) error . So i changed code from blocking to non-blocking
> >> sockets and used select() call to have a valid connection and return an
> >> appropriate file descriptor.
> >> Now the ssl_connect() call returns SSL_ERROR_WANT_READ
> >> or SSL_ERROR_WANT_WRITE error. I am unable to make my code work by adding a
> >> select() even on ssl_connect() call.
> >>
> >> If any one can please help as to how I need to use the ssl_connect() by
> >> polling that would be of great help. preferred language would be C/C++
> >>
> >> thanks,
> >> ~Arjun
> >>
> >>
> >>
> >>
> >>
> >
> >
> > --
> > Thank you.
> > Best Regards,
> > Michael(Huaqing) Wang
> >
> >
>

______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openss...@openssl.org
Automated List Manager majo...@openssl.org

[Arjun SM]

Well yes, these are not errors. My bad for naming the variable as 'error'. 

~Arjun

[Michael S. Zick]

On Mon November 21 2011, Arjun SM wrote:
> Well yes, these are not errors. My bad for naming the variable as 'error'.
>

Not my point -

Your logic shows that you think the connection has failed when it has
simple not yet finished with its protocol.

Not finished because you didn't respond to the want-write and/or want-read.
Something which your code must do when using non-blocking sockets.

Mike

[Arjun SM]

Ohh .. ok. But I just want the SSL_connect to succeed because I want to fetch the certificate of an HTTPS website. So after the success of SSL_connect() function, I would call SSL_get_peer_certificate(). 

Since I wait until the SSL_connect() function succeeds I wanted to know if there is a better approach. 

Hope I am able to convey my understandings for these functions. If you feel that I dont, please help in understanding the same.

~Arjun

[Steffen DETTMER]

> Since I wait until the SSL_connect() function succeeds I
> wanted to know if there is a better approach.

Yes, there is a better approach, for example the one mentioned
in the manual:

* http://www.openssl.org/docs/ssl/SSL_connect.html
> If the underlying BIO is non-blocking, SSL_connect() will also return
> when the underlying BIO could not satisfy the needs of SSL_connect()
> to continue the handshake, indicating the problem by the return value
> -1. In this case a call to SSL_get_error() with the return value of
> SSL_connect() will yield SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE.
> The calling process then must repeat the call after taking appropriate
> action to satisfy the needs of SSL_connect(). The action depends on
> the underlying BIO. When using a non-blocking socket, nothing is to be
> done, but select() can be used to check for the required condition.
> When using a buffering BIO, like a BIO pair, data must be written into
> or retrieved out of the BIO before being able to continue.

So it tells you should call SSL_connect again. If you just call it again
directly, you end up calling it thousand times for nothing but wasting
resources until data arives on the socket. Thus you shall wait for data
arriving on the socket and then call SSL_connect. To wait until data
arrived, you may use select(). So you could:

while(ret == READ || ret==WRITE) {
if (ret = WANTREAD) {
select(fd+1, fd, NULL, NULL, &tv);
} else {
select(fd+1, NULL, fd, NULL, &tv);
}
ret = SSL_connect(...);
}

Needed improvements include timeout management, handling select timeout
and handling of errors.

oki,

Steffen












































End of message.
--


About Ingenico: Ingenico is a leading provider of payment, transaction and business solutions, with over 15 million terminals deployed in more than 125 countries. Over 3,000 employees worldwide support merchants, banks and service providers to optimize and secure their electronic payments solutions, develop their offer of services and increase their point of sales revenue.
http://www.ingenico.com/.
This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation.
P Please consider the environment before printing this e-mail

[ro...@cryptomove.com]

I have a similar question and would appreciate any help -
when the client calls connect() and successfully connects to the server host, should I issue the SSL_connect() right after it to Initiate the handshake ? The client then tries to write some bytes to the socket using SSL_write().

On the other hand, the server uses pselect() to monitor any read fds ready for read and issues the accept() call successfully for the incoming connection. Should I issue the SSL_accept() call right after the accept() returns to complete the handshake ?

I have noticed that the SSL_connect() returns SSL_ERROR_WANT_READ (this is when the SSL_connect() is issued after a select() call to monitor the write fd set and returns and as per the Openssl documentation).

What is the right procedure here on issuing the calls and in what order ?