From a4f3383f217b5c05399ef6dc8292ee9f8900857f Mon Sep 17 00:00:00 2001 From: Vitaliy Filippov Date: Fri, 17 Apr 2026 13:06:43 +0300 Subject: [PATCH] Omit msgr_tls_record_hdr_t for non-tls data --- src/client/msgr_receive.cpp | 96 +++++++++++++------------------------ src/client/msgr_send.cpp | 20 -------- 2 files changed, 33 insertions(+), 83 deletions(-) diff --git a/src/client/msgr_receive.cpp b/src/client/msgr_receive.cpp index 3edbb098..6cd0c5f9 100644 --- a/src/client/msgr_receive.cpp +++ b/src/client/msgr_receive.cpp @@ -107,41 +107,37 @@ public: from = cl->read_op_pos; } - void buffer_encrypted() + bool buffer_encrypted() { - while (done < bufsize) + if (cl->ssl_read_record_size < sizeof(msgr_tls_record_hdr_t)) { - if (cl->ssl_read_record_size < sizeof(msgr_tls_record_hdr_t)) - { - size_t n = bufsize-done; - if (n > sizeof(msgr_tls_record_hdr_t)-cl->ssl_read_record_size) - n = sizeof(msgr_tls_record_hdr_t)-cl->ssl_read_record_size; - memcpy(((uint8_t*)&cl->ssl_read_record) + cl->ssl_read_record_size, curbuf+done, n); - done += n; - cl->ssl_read_record_size += n; - if (done >= bufsize) - return; - } - if (cl->ssl_read_record.encrypted) - { - size_t n = cl->ssl_read_record.size; - if (n > bufsize-done) - n = bufsize-done; - // Buffer all encrypted data - // FIXME Limit the amount of buffered data - int r = BIO_write(cl->write_to_ssl, curbuf+done, n); - assert(r == n); - done += n; - cl->ssl_read_record.size -= n; - if (!cl->ssl_read_record.size) - cl->ssl_read_record_size = 0; - } - else - { - // Unencrypted data - break; - } + size_t n = bufsize-done; + if (n > sizeof(msgr_tls_record_hdr_t)-cl->ssl_read_record_size) + n = sizeof(msgr_tls_record_hdr_t)-cl->ssl_read_record_size; + memcpy(((uint8_t*)&cl->ssl_read_record) + cl->ssl_read_record_size, curbuf+done, n); + done += n; + cl->ssl_read_record_size += n; + if (done >= bufsize) + return true; } + if (cl->ssl_read_record.encrypted != 1) + { + fprintf(stderr, "Client %ju got record with unknown type %u\n", cl->ssl_read_record.encrypted); + cl->io_error = true; + return false; + } + size_t n = cl->ssl_read_record.size; + if (n > bufsize-done) + n = bufsize-done; + // Buffer all encrypted data + // FIXME Limit the amount of buffered data + int r = BIO_write(cl->write_to_ssl, curbuf+done, n); + assert(r == n); + done += n; + cl->ssl_read_record.size -= n; + if (!cl->ssl_read_record.size) + cl->ssl_read_record_size = 0; + return true; } bool read(uint8_t *dst, size_t dst_len, int flags) override @@ -155,21 +151,12 @@ public: size_t n = dst_len-from; if (!(flags & RDR_TLS) || !cl->ssl_cli) { - if (cl->ssl_cli && (cl->ssl_read_record_size < sizeof(msgr_tls_record_hdr_t) || - cl->ssl_read_record.size < n || cl->ssl_read_record.encrypted)) - { - fprintf(stderr, "Client %ju non-TLS data is too short, disconnecting\n", cl->client_id); - cl->io_error = true; - return false; - } if (n > bufsize-done) n = bufsize-done; if (flags & RDR_XTS) { - size_t prev = done; msgr->op_decrypted_copy_buf(cl, curbuf, bufsize, dst, dst_len, from, done); n = 0; - cl->ssl_read_record.size -= (done-prev); } else { @@ -182,16 +169,14 @@ public: if (dst != NULL) memcpy(dst+from, curbuf+done, n); done += n; - cl->ssl_read_record.size -= n; } - if (!cl->ssl_read_record.size) - cl->ssl_read_record_size = 0; } else { // Here, dst == NULL is not allowed assert(dst != NULL); - buffer_encrypted(); + if (!buffer_encrypted()) + return false; if (!cl->ssl_handshake_done) { if (!msgr->ssl_do_handshake(cl)) @@ -318,25 +303,10 @@ public: cl->read_op_pos = cl->read_op_inline_decrypt_in + OSD_PACKET_SIZE + cl->read_op->reply.rw.bitmap_len; from = cl->read_op_inline_decrypt_in; } - if (cl->ssl_cli) - { - if (cl->ssl_read_record_size < sizeof(msgr_tls_record_hdr_t)) - { - return false; - } - if (cl->ssl_read_record.size < dst_len-from || cl->ssl_read_record.encrypted) - { - fprintf(stderr, "Client %ju non-TLS data is too short, disconnecting\n", cl->client_id); - cl->io_error = true; - return false; - } - cl->ssl_read_record.size -= (dst_len-from); - if (!cl->ssl_read_record.size) - cl->ssl_read_record_size = 0; - } - cl->recv_list.push_back((iovec){ dst+from, dst_len-from }); + size_t n = dst_len-from; + cl->recv_list.push_back((iovec){ dst+from, n }); cl->recv_flags.push_back(flags); - cl->read_op_pos += dst_len-from; + cl->read_op_pos += n; from = 0; return true; } diff --git a/src/client/msgr_send.cpp b/src/client/msgr_send.cpp index b149bb50..7d4768a6 100644 --- a/src/client/msgr_send.cpp +++ b/src/client/msgr_send.cpp @@ -166,13 +166,6 @@ public: } if (!(flags & WR_TLS) || !cl->ssl_cli) { - if (cl->ssl_cli && from == 0 && done < bufsize-sizeof(msgr_tls_record_hdr_t)-1) - { - msgr_tls_record_hdr_t *hdr = (msgr_tls_record_hdr_t*)(curbuf+done); - hdr->encrypted = 0; - hdr->size = src_len; - done += sizeof(msgr_tls_record_hdr_t); - } if (flags & WR_XTS) { msgr->op_encrypted_copy_buf(cl, curbuf, bufsize, src, src_len, from, done); @@ -318,19 +311,6 @@ public: from = 0; return true; } - else if (!from) - { - if (cl->send_list.size() >= IOV_MAX-1) - { - return false; - } - ssl_extend_buf(); - msgr_tls_record_hdr_t *hdr = (msgr_tls_record_hdr_t*)(cl->ssl_out_buf+cl->ssl_out_buf_size); - hdr->encrypted = 0; - hdr->size = src_len; - cl->send_list.push_back((iovec){ .iov_base = cl->ssl_out_buf+cl->ssl_out_buf_size, .iov_len = sizeof(msgr_tls_record_hdr_t) }); - cl->ssl_out_buf_size += sizeof(msgr_tls_record_hdr_t); - } } if (flags & WR_XTS) {