{"action":"closed","issue":{"url":"https://api.github.com/repos/eclipse/mosquitto/issues/716","repository_url":"https://api.github.com/repos/eclipse/mosquitto","labels_url":"https://api.github.com/repos/eclipse/mosquitto/issues/716/labels{/name}","comments_url":"https://api.github.com/repos/eclipse/mosquitto/issues/716/comments","events_url":"https://api.github.com/repos/eclipse/mosquitto/issues/716/events","html_url":"https://github.com/eclipse/mosquitto/issues/716","id":302420482,"number":716,"title":"v1.4.15 breaks TLS on Windows","user":{"login":"vertecx","id":1240549,"avatar_url":"https://avatars2.githubusercontent.com/u/1240549?v=4","gravatar_id":"","url":"https://api.github.com/users/vertecx","html_url":"https://github.com/vertecx","followers_url":"https://api.github.com/users/vertecx/followers","following_url":"https://api.github.com/users/vertecx/following{/other_user}","gists_url":"https://api.github.com/users/vertecx/gists{/gist_id}","starred_url":"https://api.github.com/users/vertecx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vertecx/subscriptions","organizations_url":"https://api.github.com/users/vertecx/orgs","repos_url":"https://api.github.com/users/vertecx/repos","events_url":"https://api.github.com/users/vertecx/events{/privacy}","received_events_url":"https://api.github.com/users/vertecx/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-03-05T18:59:52Z","updated_at":"2018-03-26T14:36:15Z","closed_at":"2018-03-26T14:36:15Z","author_association":"NONE","body":"Hello,\r\n\r\nAfter upgrading from Mosquitto 1.4.14 to 1.4.15 on Windows (Native, not Cygwin), my TLS enabled clients are no longer able to connect. The following error is displayed in Mosquitto when a client tries to connect:\r\n\r\n```\r\n1520272062: New connection from 192.168.0.152 on port 8883.\r\n1520272062: Socket error on client <unknown>, disconnecting.\r\n```\r\n\r\nI've noticed the switch from OpenSSL 1.0 to 1.1 and I've replaced the old DLL:s (libeay32.dll, libssl32.dll, ssleay32.dll) with the new (libcrypto-1_1.dll, libssl-1_1.dll) from Win32 OpenSSL v1.1.0g Light.\r\n\r\nI’ve done some testing and found the following:\r\n\r\n- Compiling 4f838e51611b9a71f2e3e98e6fddd02a5c1b4c03 (Tag v1.4.15) against Win32 OpenSSL v1.0.2n make the problem go away.\r\n- There is a difference in behavior when handling the first packet received depending on which OpenSSL version Mosquitto is compiled against. In the file lib/net_mosq.c, function _mosquitto_packet_read, starting at line 1033 the following code exists:\r\n\r\n```c\r\n#ifdef WIN32\r\n   errno = WSAGetLastError();\r\n#endif\r\n   if(errno == EAGAIN || errno == COMPAT_EWOULDBLOCK){\r\n      return MOSQ_ERR_SUCCESS;\r\n   }else{\r\n      switch(errno){\r\n         case COMPAT_ECONNRESET:\r\n            return MOSQ_ERR_CONN_LOST;\r\n         default:\r\n            return MOSQ_ERR_ERRNO;\r\n      }\r\n   }\r\n```\r\n\r\n- Some lines before this code, errno is set in a call to _mosquitto_net_read where SSL_read returns -1 and SSL_get_error returns SSL_ERROR_WANT_READ for the first packed, independent of OpenSSL version.\r\n\r\n- When running 1.0.2n, errno has a value of 11 (EAGAIN) before the call to WSAGetLastError. After the call, errno holds the value 10035 (COMPAT_EWOULDBLOCK). This causes the function to return MOSQ_ERR_SUCCESS.\r\n\r\n- When running 1.1.0g, errno has a value of 11 (EAGAIN) before the call to WSAGetLastError. After the call, errno holds the value 0. This causes the function to return MOSQ_ERR_ERRNO.\r\n\r\n- When MOSQ_ERR_SUCCESS is returned, _mosquitto_packet_read  is eventually recalled and SSL_read \r\nstarts returning decrypted data. When MOSQ_ERR_ERRNO is returned, the client is immediately disconnected.\r\n\r\n- By ignoring the value of errno and instead always return MOSQ_ERR_SUCCESS, it is possible to trick TLS into working when compiling against OpenSSL 1.1.0g. The first or first few calls to SSL_read will fail but eventually start working as they are retired instead of the client being disconnected.\r\n\r\n- I've not looked in to what is causing WSAGetLastError to return different values."}}
{"actor":{"display_login":"vertecx"}}