poem icon indicating copy to clipboard operation
poem copied to clipboard

Rustls integration causes livelock and request connections to hang.

Open Gaboose opened this issue 1 year ago • 0 comments

Expected Behavior

If a rustls is used with a tls pem bundle where the first entry is not the private key, the server should be able to serve https requests and not get stuck in a 100% cpu usage livelock.

Actual Behavior

Server get stuck in a 100% cpu usage livelock and makes all requests hang indefinitely.

Steps to Reproduce the Problem

  1. Create the server certificate server.crt and key server.key files with openssl.
  2. Create a pem bundle tls.pem file with cat server.crt server.key > tls.pem (note that catting the other way around cat server.key server.crt > tls.pem does not reproduce the bug).
  3. Use the tls.pem file as both key and cert:
#[handler]
fn index() -> &'static str {
    "hello world"
}

#[tokio::main]
async fn main() -> Result<(), std::io::Error> {
    if std::env::var_os("RUST_LOG").is_none() {
        std::env::set_var("RUST_LOG", "poem=debug");
    }
    tracing_subscriber::fmt::init();

    let app = Route::new().at("/", get(index));

    let listener = TcpListener::bind("127.0.0.1:3000")
        .rustls(RustlsConfig::new().fallback( RustlsCertificate::new()
            .cert(std::fs::read("tls.pem")?)
            .key(std::fs::read("tls.pem")?),
    ));
    Server::new(listener).run(app).await
}
  1. Go to https://127.0.0.1:3000 and watch the connection hang.

I suspect this commit introduced the bug: https://github.com/poem-web/poem/commit/7ada5b69c94c0a98ddff64172703ed61c3386fdf

Specifications

  • Version: poem = { version = "1.3.58", features = ["rustls"] }
  • Platform: Linux / Ubuntu
  • Subsystem: cargo/rust 1.71.1

Gaboose avatar Sep 15 '23 11:09 Gaboose