poco icon indicating copy to clipboard operation
poco copied to clipboard

SecureStreamSocket is not thread-safe

Open obiltschnig opened this issue 1 year ago • 0 comments

Plain sockets are thread-safe with regards to different threads calling sendBytes() and receiveBytes() simultaneously. This is not the case with SecureStreamSocket. While it seems to work most of the time, there are situations (e.g., if a TLS renegotiation takes place) where an error:0A00010F:SSL routines::bad length error is seen, indicating that there are mismatched calls to SSL_write() and/or SSL_read() in case SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE was returned previously.

A fix would be to protect SecureSocketImpl::sendBytes() and SecureSocketImpl::receiveBytes() (and probably other methods as well) with a mutex. The OpenSSL documentation states that operations on SSL objects are not thread-safe, so these should be protected.

obiltschnig avatar Feb 01 '24 12:02 obiltschnig