openssl: fix the data race when sharing an SSL session between threads #14751
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The SSL_Session object is mutated during connection inside openssl, and it might not be thread-safe. Besides, according to documentation of openssl: ``` SSL_SESSION objects keep internal link information about the session cache list, when being inserted into one SSL_CTX object's session cache. One SSL_SESSION object, regardless of its reference count, must therefore only be used with one SSL_CTX object (and the SSL objects created from this SSL_CTX object). ``` If I understand correctly, it is not safe to share it even in a single thread. Instead, serialize the SSL_SESSION before adding it to the cache, and deserialize it after retrieving it from the cache, so that no concurrent write to the same object is infeasible. Also - add a ci test for thread sanitizer - add a test for sharing ssl sessions concurrently - avoid redefining memory functions when not building libcurl, but including the soruce in libtest - increase the concurrent connections limit in sws Notice that there are fix for a global data race for openssl which is not yet release. The fix is cherry pick for the ci test with thread sanitizer. openssl/openssl@d8def79
vszakats
reviewed
Sep 1, 2024
bagder
reviewed
Sep 1, 2024
vszakats
reviewed
Sep 1, 2024
Co-authored-by: Viktor Szakats <vszakats@users.noreply.github.com>
bagder
reviewed
Sep 2, 2024
|
I believe this PR makes a necessary change. Well done. |
|
Thanks! |
vszakats
added a commit
that referenced
this pull request
Oct 23, 2024
The patch is now part of the 3.4.0 stable release. (Turns out it was part of 3.3.2 already.) Also: - rename this local build to match the scheme used with wolfssl. - drop '3' from local openssl build name. - sync job name with others. - quote step names where missing. Follow-up to a2bcec0 #14751 Closes #15379
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The SSL_Session object is mutated during connection inside openssl, and it might not be thread-safe. Besides, according to documentation of openssl:
If I understand correctly, it is not safe to share it even in a single thread.
Instead, serialize the SSL_SESSION before adding it to the cache, and deserialize it after retrieving it from the cache, so that concurrent write to the same object is infeasible.
Also
Notice that there are fix for a global data race for openssl which is not yet release. The fix is cherry pick for the ci test with thread sanitizer.
openssl/openssl@d8def79