libcurl with SChannel hangs/times-out after FTPS transfer completes #7068
I did this
The download actually works fine, the file is fully downloaded quite quickly. However, once the file is downloaded, the curl command line tool appears wait until it detects that the control connection is disconnected. In our application which uses libcurl, there is a hang until the configured timeout length is reached.
I have only reproduced this issue when libcurl is built with the SChannel TLS backend. When built with the OpenSSL backend, the curl command terminates as soon as the download is complete.
This server is not publicly accessible. However, it is just a stock Ubuntu 18.04 machine running
The server is using more-or-less the default config, except for the port number. It is using the default "snakeoil" certificates, hence the
The file size does not seem to be relevant, this particular size just matches the size of the file used in our customer's issue. I have reproduced this timeout with various file sizes.
Examining the verbose output, I see the following log, starting from when the data transfer begins:
It seems that once the download is compete (decrypted buffer has 12317 bytes...), there are an additional 31 bytes in the encrypted buffer. I believe this is the TLS close_notify alert. Wireshark shows a 31 byte "encrypted alert" (typically this is the close_notify) arriving in the same packet as the final bytes of the file transfer. I think that libcurl is not aware that the close_notify has been sent, and therefore waits for it on the file transfer socket until a timeout is reached.
Although I only experienced this issue with SChannel, I feel like this is at least superficially similar to the problem in #6149, in which TLS messages on the file transfer connection are not processed correctly.
I have a proposed fix for this issue; I will open a pull request shortly.
I expected the following
The file is downloaded and curl terminates once the download is finished.
curl built with the SChannel backend:
The text was updated successfully, but these errors were encountered: