romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-23 20:17:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

openssl: fix the data race when sharing an SSL session between threads

Browse source 
The SSL_Session object is mutated during connection inside openssl,
and it might not be thread-safe. Besides, according to documentation
of openssl:

```
SSL_SESSION objects keep internal link information about the session
cache list, when being inserted into one SSL_CTX object's session
cache. One SSL_SESSION object, regardless of its reference count,
must therefore only be used with one SSL_CTX object (and the SSL
objects created from this SSL_CTX object).
```
If I understand correctly, it is not safe to share it even in a
single thread.

Instead, serialize the SSL_SESSION before adding it to the cache,
and deserialize it after retrieving it from the cache, so that no
concurrent write to the same object is infeasible.

Also
 - add a ci test for thread sanitizer
 - add a test for sharing ssl sessions concurrently
 - avoid redefining memory functions when not building libcurl, but
   including the soruce in libtest
 - increase the concurrent connections limit in sws

Notice that there are fix for a global data race for openssl which
is not yet release. The fix is cherry pick for the ci test with
thread sanitizer.
d8def79838

Closes #14751
This commit is contained in:
Aki 2024-08-31 11:48:18 +08:00 • committed by Daniel Stenberg
parent 2c2292ecaf
commit a2bcec0ee0
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
9 changed files with 499 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -268,6 +268,6 @@ test3024 test3025 test3026 test3027 test3028 test3029 test3030 \
\
test3100 test3101 test3102 test3103 \
test3200 \
test3201 test3202 test3203 test3204 test3205
test3201 test3202 test3203 test3204 test3205 test3207
EXTRA_DIST = $(TESTCASES) DISABLED

175
tests/data/test3207 Normal file
View file

@ -0,0 +1,175 @@
<testcase>
<info>
<keywords>
HTTPS
</keywords>
</info>
# Server-side
<reply>
<data>
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Content-Type: text/html
Content-Length: 29
run 1: foobar and so on fun!
</data>
<datacheck>
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
run 1: foobar and so on fun!
</datacheck>
</reply>
# Client-side
<client>
<features>
SSL
OpenSSL
</features>
<server>
https
</server>
<name>
concurrent HTTPS GET using shared ssl session cache
</name>
<tool>
lib%TESTNUMBER
</tool>
# provide URL and ca-cert
<command>
https://localhost:%HTTPSPORT/%TESTNUMBER %SRCDIR/certs/EdelCurlRoot-ca.crt
</command>
</client>
# Verify data after the test has been "shot"
<verify>
</verify>
</testcase>