处理 SSL 客户端未读取所有数据

Question

我正在努力实现，我的 ssl 服务器不会崩溃，当客户端没有收集所有数据时。 （修复了一个小错误）
当数据太长时。

基本上我要做的是以非阻塞方式编写。 为此，我找到了两种不同的方法：

第一种方法
使用此代码

int flags = fcntl(ret.fdsock, F_GETFL, 0);
fcntl(ret.fdsock, F_SETFL, flags | O_NONBLOCK);

并用它创建 ssl 连接

第二种方法：
使用SSL_new(ctx)创建 SSL 对象后直接执行此操作

BIO *sock = BIO_new_socket(ret.fdsock, BIO_NOCLOSE);
BIO_set_nbio(sock, 1);
SSL_set_bio(client, sock, sock);

两者都有其缺点，但都无助于解决问题。
第一种方法似乎以畅通无阻的方式读取就好了，但是当我写入的数据多于客户端读取的数据时，我的服务器崩溃了。
第二种方法似乎没有做任何事情，所以我的猜测是，我做错了什么或者不明白 BIO 实际做了什么。

有关更多信息，这里是服务器如何写入客户端：

int SSLConnection::send(char* msg, const int size){
    int rest_size = size;
    int bytes_sent = 0;
    char* begin = msg;
    std::cout << "expected bytes to send: " << size << std::endl;
    while(rest_size > 0) {
        int tmp_bytes_sent = SSL_write(connection, begin, rest_size);
        std::cout << "any error     : " << ERR_get_error()<< std::endl;
        std::cout << "tmp_bytes_sent: " << tmp_bytes_sent << std::endl;
        if (tmp_bytes_sent < 0){
            std::cout << tmp_bytes_sent << std::endl;
            std::cout << "ssl error     : " << SSL_get_error(this->connection, tmp_bytes_sent)<< std::endl;
        } else {
            bytes_sent += tmp_bytes_sent;
            rest_size -= tmp_bytes_sent;
            begin = msg+bytes_sent;
        }
    }
    return bytes_sent;
}

输出：

expected bytes to send: 78888890
Betätigen Sie die <RETURN> Taste, um das Fenster zu schließen...
(means: hit <return> to close window)

编辑： 在人们说我需要适当缓存错误之后，这是我的新代码：

设置：

connection = SSL_new(ctx);
if (connection){
    BIO * sbio = BIO_new_socket(ret.fdsock, BIO_NOCLOSE);
    if (sbio) {
        BIO_set_nbio(sbio, false);
        SSL_set_bio(connection, sbio, sbio);
        SSL_set_accept_state(connection);
    } else {
        std::cout << "Bio is null" << std::endl;
    }
} else {
    std::cout << "client is null" << std::endl;
}

发送：

int SSLConnection::send(char* msg, const int size){
    if(connection == NULL) {
        std::cout << "ERR: Connection is NULL" << std::endl;
        return -1;
    }
    int rest_size = size;
    int bytes_sent = 0;
    char* begin = msg;
    std::cout << "expected bytes to send: " << size << std::endl;
    while(rest_size > 0) {
        int tmp_bytes_sent = SSL_write(connection, begin, rest_size);
        std::cout << "any error     : " << ERR_get_error()<< std::endl;
        std::cout << "tmp_bytes_sent: " << tmp_bytes_sent << std::endl;
        if (tmp_bytes_sent < 0){
            std::cout << tmp_bytes_sent << std::endl;
            std::cout << "ssl error     : " << SSL_get_error(this->connection, tmp_bytes_sent)<< std::endl;
            break;
        } else if (tmp_bytes_sent == 0){
            std::cout << "tmp_bytes are 0" << std::endl;
            break;
        } else {
            bytes_sent += tmp_bytes_sent;
            rest_size -= tmp_bytes_sent;
            begin = msg+bytes_sent;
        }
    }

    return bytes_sent;
}

使用获取 60 字节的客户端，输出如下：

输出写入 1,000,000 字节：

expected bytes to send: 1000000
any error     : 0
tmp_bytes_sent: 16384
any error     : 0
tmp_bytes_sent: 16384
Betätigen Sie die <RETURN> Taste, um das Fenster zu schließen...
(translates to: hit <RETURN> to close window)

输出写入 1000 字节：

expected bytes to send: 1000
any error     : 0
tmp_bytes_sent: 1000
connection closed  <- expected output

Answer 1

首先，警告：基于 SSL 的非阻塞 I/O 是一个相当巴洛克式的 API，很难正确使用。特别是，SSL 层有时需要在写入用户数据之前读取内部数据（反之亦然），并且调用者的代码应该能够根据它从 SSL 调用它得到的错误代码反馈来处理它使。它可以正常工作，但这并不容易或显而易见——事实上需要您在代码中实现与 SSL 库中的状态机相呼应的状态机。

下面是所需逻辑的简化版本（它是从 this file 中的 Write() 方法中提取的，它是 this library 的一部分，以防您想看到一个完整的工作实现）

enum {
   SSL_STATE_READ_WANTS_READABLE_SOCKET   = 0x01,
   SSL_STATE_READ_WANTS_WRITEABLE_SOCKET  = 0x02,
   SSL_STATE_WRITE_WANTS_READABLE_SOCKET  = 0x04,
   SSL_STATE_WRITE_WANTS_WRITEABLE_SOCKET = 0x08
};

// a bit-chord of SSL_STATE_* bits to keep track of what 
// the SSL layer needs us to do next before it can make more progress
uint32_t _sslState = 0;

// Note that this method returns the number of bytes sent, or -1
// if there was a fatal error.  So if this method returns 0 that just
// means that this function was not able to send any bytes at this time.
int32_t SSLSocketDataIO :: Write(const void *buffer, uint32 size)
{
   int32_t bytes = SSL_write(_ssl, buffer, size);
   if (bytes > 0) 
   {
      // SSL was able to send some bytes, so clear the relevant SSL-state-flags
      _sslState &= ~(SSL_STATE_WRITE_WANTS_READABLE_SOCKET | SSL_STATE_WRITE_WANTS_WRITEABLE_SOCKET);
   }
   else if (bytes == 0) 
   {
      return -1;  // the SSL connection was closed, so return failure
   }
   else
   {
      // The SSL layer's internal needs aren't being met, so we now have to
      // ask it what its problem is, then give it what it wants.  :P
      int err = SSL_get_error(_ssl, bytes);
      if (err == SSL_ERROR_WANT_READ)
      {
         // SSL can't write anything more until the socket becomes readable,
         // so we need to go back to our event loop, wait until the
         // socket select()'s as readable, and then call SSL_Write() again.
         _sslState |=  SSL_STATE_WRITE_WANTS_READABLE_SOCKET;
         _sslState &= ~SSL_STATE_WRITE_WANTS_WRITEABLE_SOCKET;
         bytes = 0;  // Tell the caller we weren't able to send anything yet
      }
      else if (err == SSL_ERROR_WANT_WRITE)
      {
         // SSL can't write anything more until the socket becomes writable,
         // so we need to go back to our event loop, wait until the
         // socket select()'s as writeable, and then call SSL_Write() again.
         _sslState &= ~SSL_STATE_WRITE_WANTS_READABLE_SOCKET;
         _sslState |=  SSL_STATE_WRITE_WANTS_WRITEABLE_SOCKET;
         bytes = 0;  // Tell the caller we weren't able to send anything yet
      }
      else
      {
         // SSL had some other problem I don't know how to deal with,
         // so just print some debug output and then return failure.
         fprintf(stderr,"SSL_write() ERROR!");
         ERR_print_errors_fp(stderr);
      }
   }
   return bytes;  // Returns the number of bytes we actually sent
}

Answer 2

我认为你的问题是

rest_size -= bytes_sent;

你应该做 rest_size -= tmp_bytes_sent;

还有

if (tmp_bytes_sent < 0){
            std::cout << tmp_bytes_sent << std::endl;
           //its an error condition
          return bytes_sent;
        }

我不知道这是否能解决问题，但您粘贴的代码存在上述问题

Answer 3

当我写入的数据多于客户端读取的数据时，我的服务器就会崩溃。

不，它不会，除非您严重错误编码了您未在此处发布的其他内容。它要么永远循环，要么出错：可能是ECONNRESET，这意味着客户端的行为与您描述的一样，并且您已经检测到它，因此您应该关闭连接并忘记他。取而代之的是，您只是永远循环，试图将数据发送到断开的连接，而这永远不会发生。

当您遇到错误时，仅打印 -1 并没有多大用处。您应该使用perror() 或errno 或strerror() 打印错误。

说到永远循环，不要这样循环。 SSL_write() 可以返回 0，您根本没有处理：这将导致无限循环。另请参阅下面的 David Schwartz 的 cmets。

注意，您绝对应该使用第二种方法。 OpenSSL 需要知道套接字处于非阻塞模式。

两者都有缺点

比如？

如另一个答案所述，

rest_size -= bytes_sent;

应该是

rest_size -= tmp_bytes_sent;