uncleanShutdown error

[abeazam]

when I run this curl:

curl -X "POST" "https://www.googleapis.com/oauth2/v4/token" \
               -H 'Content-Type: application/x-www-form-urlencoded; charset=utf-8' \
               --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" \
               --data-urlencode "assertion=ddd"

I get this JSON response:

{
  "error": "invalid_request",
  "error_description": "Bad Request"
}

when I run this swift bellow expecting a similar response instead I get "NIOSSL.NIOSSLError.uncleanShutdown"

let bodyStr = "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=ddd"
        
        let httpClient = HTTPClient(eventLoopGroupProvider: .createNew)
        defer {
            try? httpClient.syncShutdown()
        }
        
        
        var request = try HTTPClient.Request(url: "https://www.googleapis.com/oauth2/v4/token", method: .POST)
        request.headers.add(name: "Content-Type", value: "application/x-www-form-urlencoded")
        request.body = .string(bodyStr)

        httpClient.execute(request: request).whenComplete { result in
            switch result {
            case .failure(let error):
                print("error: \(error)")
                //promise.fail(error)
            case .success(let response):
                promise.succeed("success")
                if response.status == .ok {
                    // handle response
                    
                    
                } else {
                    // handle remote error
                }
            }
        }

[t089]

In your example you are not waiting on the future, therefore you immediately close the connection again in the defer block. Try to use .wait() instead of the whenComplete callback.

The uncleanShutdown is a known behavior. If I remember correctly some Webservers don’t close the ssl context correctly, and this bubbles up in NIO as this error which can be safely ignored. See below :)

[Lukasa]

You cannot ignore uncleanShutdown from this library: this library throws away NIO's uncleanShutdown in cases where it can safely be ignored, meaning any time you see it here it has meaning. In this case it's likely related to the early client shutdown.

[abeazam]

first thing I took away from your feedback is the " try? self.httpClient!.syncShutdown()" is happening too soon so I moved it into the response. While removing the defer.

httpClient!.execute(request: request).whenComplete { result in
            
            switch result {
            case .failure(let error):
                print("error: \(error)")
                try? self.httpClient!.syncShutdown()
                //promise.fail(error)
            case .success(let response):
                promise.succeed("success")
                try? self.httpClient!.syncShutdown()
                if response.status == .ok {
                    // handle response
                    
                    
                } else {
                    // handle remote error
                }
            }
        }

When that did not work I re-read your messages and it seems the whenComplete is the problem so I tried a promise approach.

I rejiggered the call to use promises but the map is not call as there is no print

 ```
let response = try! reequestTest()
     let processedResult  = response.map({ (clientResponse: HTTPClient.Response) -> String in
        print("clientResponse: \(clientResponse)")
        try? self.httpClient!.syncShutdown()
        return "proccesed text"
    })
    


func reequestTest() throws -> EventLoopFuture<HTTPClient.Response> {
    let bodyStr = "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=ddd"
    
     httpClient = HTTPClient(eventLoopGroupProvider: .createNew)
    
    
    
    var request = try HTTPClient.Request(url: "https://www.googleapis.com/oauth2/v4/token", method: .POST)
    request.headers.add(name: "Content-Type", value: "application/x-www-form-urlencoded")
    request.body = .string(bodyStr)

    return httpClient!.execute(request: request)
}

I feel like I am probably doing something really obviously wrong but for the life of me I can't see it.

[Lukasa]

Can you confirm what version of async-http-client you're using?

[abeazam]

Can you confirm what version of async-http-client you're using?

"version": "1.0.1"

[t089]

Hm, I don't have enough time to dig deeper, but this is the code I would have expected to work for sure. But I also get the unclean shutdown error. I will try again later.

import AsyncHTTPClient

let httpClient = HTTPClient(eventLoopGroupProvider: .createNew)

let bodyStr = "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=ddd"

var request = try HTTPClient.Request(url: "https://www.googleapis.com/oauth2/v4/token", method: .POST)
request.headers.add(name: "Content-Type", value: "application/x-www-form-urlencoded")
request.body = .string(bodyStr)

do {
    let response = try httpClient.execute(request: request).wait()
    if response.status == .ok {
        // handle response
        print("Request was successfull")
    } else {
        // handle remote error
        print("Request was not successfull")
    }
    
    let bodyAsString = response.body
        .map { String(decoding: $0.readableBytesView, as: UTF8.self) }
    print("Body: \(bodyAsString ?? "null")")
} catch {
    print("An error occured: \(error)")
}

try httpClient.syncShutdown()

[Lukasa]

This is relevant:

(lldb) p head.headers
(NIOHTTP1.HTTPHeaders) $R0 = {
  headers = 13 values {
    [0] = (0 = "Content-Type", 1 = "application/json; charset=utf-8")
    [1] = (0 = "Vary", 1 = "X-Origin")
    [2] = (0 = "Vary", 1 = "Referer")
    [3] = (0 = "Date", 1 = "Tue, 17 Dec 2019 14:01:39 GMT")
    [4] = (0 = "Server", 1 = "scaffolding on HTTPServer2")
    [5] = (0 = "Cache-Control", 1 = "private")
    [6] = (0 = "X-XSS-Protection", 1 = "0")
    [7] = (0 = "X-Frame-Options", 1 = "SAMEORIGIN")
    [8] = (0 = "X-Content-Type-Options", 1 = "nosniff")
    [9] = (0 = "Alt-Svc", 1 = "quic=\":443\"; ma=2592000; v=\"46,43\",h3-Q050=\":443\"; ma=2592000,h3-Q049=\":443\"; ma=2592000,h3-Q048=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000")
    [10] = (0 = "Accept-Ranges", 1 = "none")
    [11] = (0 = "Vary", 1 = "Origin,Accept-Encoding")
    [12] = (0 = "Connection", 1 = "close")
  }
  keepAliveState = close
}

This HTTP response does not contain either a Content-Length or a Transfer-Encoding header, so it is framed on EOF only. That means we only get .end when we get EOF. This, combined with the absence of close-notify, is a really nasty combo: we really can't tell when we have a length truncation attack or not here.

[Lukasa]

This is also visible in curl if you use -v and --http1.1.

[weissi]

We should actually add a test case with a potential length truncation attack here. It's good to see we handle it correctly but I don't think we test for that.

[Lukasa]

In the meantime, to work around this you can add ignoreUncleanShutdown to your config.

[weissi]

and file a bug at Google :)

[abeazam]

That makes sense I have it working now. Thanks for every ones help.

Will raise a ticket. Stating that since there is no Content-Length or a Transfer-Encoding header the request is open to "length truncation attack" which is some what insecure. Causing me to weaken my server security to authenticate their security.

Thanks again every one.