c++ - 处理 SSL 客户端不读取所有数据

Question

我正在努力实现，当客户端未收集所有数据时，我的 ssl 服务器不会崩溃。 (修复了一个小错误)
当数据太长时。

基本上我想做的是以非阻塞方式编写。 为此我找到了两种不同的方法:

第一种方法
使用此代码

int flags = fcntl(ret.fdsock, F_GETFL, 0);
fcntl(ret.fdsock, F_SETFL, flags | O_NONBLOCK);

并用它创建ssl连接

第二种方法:
在使用 SSL_new(ctx)

创建 SSL 对象后直接执行此操作

BIO *sock = BIO_new_socket(ret.fdsock, BIO_NOCLOSE);
BIO_set_nbio(sock, 1);
SSL_set_bio(client, sock, sock);

两者都有缺点，但都无助于解决问题。
第一种方法似乎以一种无阻塞的方式读取就好了，但是当我写入的数据多于客户端读取的数据时，我的服务器就会崩溃。
第二种方法似乎没有做任何事情，所以我的猜测是，我做错了什么或者不明白 BIO 实际上做了什么。

这里的更多信息是服务器如何写入客户端:

int SSLConnection::send(char* msg, const int size){
    int rest_size = size;
    int bytes_sent = 0;
    char* begin = msg;
    std::cout << "expected bytes to send: " << size << std::endl;
    while(rest_size > 0) {
        int tmp_bytes_sent = SSL_write(connection, begin, rest_size);
        std::cout << "any error     : " << ERR_get_error()<< std::endl;
        std::cout << "tmp_bytes_sent: " << tmp_bytes_sent << std::endl;
        if (tmp_bytes_sent < 0){
            std::cout << tmp_bytes_sent << std::endl;
            std::cout << "ssl error     : " << SSL_get_error(this->connection, tmp_bytes_sent)<< std::endl;
        } else {
            bytes_sent += tmp_bytes_sent;
            rest_size -= tmp_bytes_sent;
            begin = msg+bytes_sent;
        }
    }
    return bytes_sent;
}

输出:

expected bytes to send: 78888890
Betätigen Sie die <RETURN> Taste, um das Fenster zu schließen...
(means: hit <return> to close window)

编辑: 在人们说我需要适当缓存错误之后，这是我的新代码:

设置:

connection = SSL_new(ctx);
if (connection){
    BIO * sbio = BIO_new_socket(ret.fdsock, BIO_NOCLOSE);
    if (sbio) {
        BIO_set_nbio(sbio, false);
        SSL_set_bio(connection, sbio, sbio);
        SSL_set_accept_state(connection);
    } else {
        std::cout << "Bio is null" << std::endl;
    }
} else {
    std::cout << "client is null" << std::endl;
}

发送:

int SSLConnection::send(char* msg, const int size){
    if(connection == NULL) {
        std::cout << "ERR: Connection is NULL" << std::endl;
        return -1;
    }
    int rest_size = size;
    int bytes_sent = 0;
    char* begin = msg;
    std::cout << "expected bytes to send: " << size << std::endl;
    while(rest_size > 0) {
        int tmp_bytes_sent = SSL_write(connection, begin, rest_size);
        std::cout << "any error     : " << ERR_get_error()<< std::endl;
        std::cout << "tmp_bytes_sent: " << tmp_bytes_sent << std::endl;
        if (tmp_bytes_sent < 0){
            std::cout << tmp_bytes_sent << std::endl;
            std::cout << "ssl error     : " << SSL_get_error(this->connection, tmp_bytes_sent)<< std::endl;
            break;
        } else if (tmp_bytes_sent == 0){
            std::cout << "tmp_bytes are 0" << std::endl;
            break;
        } else {
            bytes_sent += tmp_bytes_sent;
            rest_size -= tmp_bytes_sent;
            begin = msg+bytes_sent;
        }
    }

    return bytes_sent;
}

使用客户端获取 60 个字节，输出如下:

输出写入 1,000,000 字节:

expected bytes to send: 1000000
any error     : 0
tmp_bytes_sent: 16384
any error     : 0
tmp_bytes_sent: 16384
Betätigen Sie die <RETURN> Taste, um das Fenster zu schließen...
(translates to: hit <RETURN> to close window)

输出写入 1,000 字节:

expected bytes to send: 1000
any error     : 0
tmp_bytes_sent: 1000
connection closed  <- expected output

Answer 1

首先，警告:基于 SSL 的非阻塞 I/O 是一个相当古怪的 API，很难正确使用。特别是，SSL 层有时需要在写入用户数据之前读取内部数据(反之亦然)，并且调用者的代码应该能够根据从 SSL 调用它的 SSL 获得的错误代码反馈来处理这个问题使。它可以正常工作，但这并不容易或显而易见 - 您事实上需要在您的代码中实现一个状态机，该状态机与 SSL 库中的状态机相呼应。

下面是所需逻辑的简化版本(它是从 this file 中的 Write() 方法中提取的，它是 this library 的一部分，以防您希望看到一个完整的、有效的实现)

enum {
   SSL_STATE_READ_WANTS_READABLE_SOCKET   = 0x01,
   SSL_STATE_READ_WANTS_WRITEABLE_SOCKET  = 0x02,
   SSL_STATE_WRITE_WANTS_READABLE_SOCKET  = 0x04,
   SSL_STATE_WRITE_WANTS_WRITEABLE_SOCKET = 0x08
};

// a bit-chord of SSL_STATE_* bits to keep track of what 
// the SSL layer needs us to do next before it can make more progress
uint32_t _sslState = 0;

// Note that this method returns the number of bytes sent, or -1
// if there was a fatal error.  So if this method returns 0 that just
// means that this function was not able to send any bytes at this time.
int32_t SSLSocketDataIO :: Write(const void *buffer, uint32 size)
{
   int32_t bytes = SSL_write(_ssl, buffer, size);
   if (bytes > 0) 
   {
      // SSL was able to send some bytes, so clear the relevant SSL-state-flags
      _sslState &= ~(SSL_STATE_WRITE_WANTS_READABLE_SOCKET | SSL_STATE_WRITE_WANTS_WRITEABLE_SOCKET);
   }
   else if (bytes == 0) 
   {
      return -1;  // the SSL connection was closed, so return failure
   }
   else
   {
      // The SSL layer's internal needs aren't being met, so we now have to
      // ask it what its problem is, then give it what it wants.  :P
      int err = SSL_get_error(_ssl, bytes);
      if (err == SSL_ERROR_WANT_READ)
      {
         // SSL can't write anything more until the socket becomes readable,
         // so we need to go back to our event loop, wait until the
         // socket select()'s as readable, and then call SSL_Write() again.
         _sslState |=  SSL_STATE_WRITE_WANTS_READABLE_SOCKET;
         _sslState &= ~SSL_STATE_WRITE_WANTS_WRITEABLE_SOCKET;
         bytes = 0;  // Tell the caller we weren't able to send anything yet
      }
      else if (err == SSL_ERROR_WANT_WRITE)
      {
         // SSL can't write anything more until the socket becomes writable,
         // so we need to go back to our event loop, wait until the
         // socket select()'s as writeable, and then call SSL_Write() again.
         _sslState &= ~SSL_STATE_WRITE_WANTS_READABLE_SOCKET;
         _sslState |=  SSL_STATE_WRITE_WANTS_WRITEABLE_SOCKET;
         bytes = 0;  // Tell the caller we weren't able to send anything yet
      }
      else
      {
         // SSL had some other problem I don't know how to deal with,
         // so just print some debug output and then return failure.
         fprintf(stderr,"SSL_write() ERROR!");
         ERR_print_errors_fp(stderr);
      }
   }
   return bytes;  // Returns the number of bytes we actually sent
}