thegushi opened a new pull request, #24:
URL: https://github.com/apache/spamassassin/pull/24

   Spamc has several bugs that cause TLS1.3 to not work, which is the default 
version that will be negotiated (spamd listens on TLS1.3 because it just does 
whatever IO:Socket:SSL supports).
   
   I (not the LLM) diagnosed this by finding random disconnects when trying to 
do spamc -K -S connecting to an SSL-enabled spamd.  Spamd would only log:
   
   Apr  2 21:03:17 post spamd[89898]: prefork: child states: II
   Apr  2 21:03:18 post spamc[89911]: SSL write failed (5)
   
   After adding a bunch of debug prints to spamd, and forcing spamd to not do 
TLS1.3, I attempting connect with openssl s_client, which worked, but spamc did 
not.
   
   The three bugs present in the current code are:
   
   Bug 1: ssl_timeout_read retry loop checks wrong error mechanism 
spamc/utils.c — retry loop checked errno == EWOULDBLOCK instead of 
SSL_get_error() == SSL_ERROR_WANT_READ. OpenSSL uses its own error queue, not 
errno, so the retry never fired.
   
   Bug 2: SSL_write not retried on SSL_ERROR_WANT_READ spamc/libspamc.c — In 
TLS 1.3, the server sends post-handshake NewSessionTicket records after the 
handshake completes. SSL_write can return SSL_ERROR_WANT_READ while these are 
pending. The original code treated any rc <= 0 from SSL_write as a fatal error 
with no retry.
   
   Bug 3: SSL_write(ssl, buf, 0) treated as fatal error spamc/libspamc.c — For 
commands with no body (e.g. PING / -K), towrite_len == 0. Calling SSL_write 
with length 0 returns 0, which the rc <= 0 check treated as failure. The 
non-SSL full_write path handles zero-length writes as a no-op.
   
   This code also adds a -D argument to spamc so that future SSL connect issues 
may be debugged (not recommended for normal use), because doing so with 
truss/strace is painful.
   
   Tested via both:
   
   spamc/spamc -S -D -l -d localhost -p 784 < t/data/spam/001 (actual message 
test)
   spamc/spamc -S -D -l -K -d localhost -p 784 (send a test ping)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to