From 4087cdbe2aff627cb1f583c3ba846f7fce550dac Mon Sep 17 00:00:00 2001 From: Dmitrii Kuvaiskii Date: Thu, 30 Apr 2020 17:51:01 +0000 Subject: [PATCH] [Pal/lib] Return PAL_ERROR_TRYAGAIN on try-again read/write errors in mbedTLS Previously, lib_SSLRead() and lib_SSLWrite() returned PAL_ERROR_DENIED on any error, even on benign try-again errors from mbedTLS. This led to LibOS returning EACCES to the application which doesn't expect such error code. This commit converts benign try-again errors into corresponding PAL_ERROR_TRYAGAIN errors. --- Pal/lib/crypto/adapters/mbedtls_adapter.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/Pal/lib/crypto/adapters/mbedtls_adapter.c b/Pal/lib/crypto/adapters/mbedtls_adapter.c index 4c6ec677..d72e9ecf 100644 --- a/Pal/lib/crypto/adapters/mbedtls_adapter.c +++ b/Pal/lib/crypto/adapters/mbedtls_adapter.c @@ -105,6 +105,12 @@ int mbedtls_to_pal_error(int error) case MBEDTLS_ERR_RSA_RNG_FAILED: return -PAL_ERROR_CRYPTO_RNG_FAILED; + case MBEDTLS_ERR_SSL_WANT_READ: + case MBEDTLS_ERR_SSL_WANT_WRITE: + case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: + case MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS: + return -PAL_ERROR_TRYAGAIN; + default: return -PAL_ERROR_DENIED; } @@ -456,15 +462,15 @@ int lib_SSLHandshake(LIB_SSL_CONTEXT* ssl_ctx) { int lib_SSLRead(LIB_SSL_CONTEXT* ssl_ctx, uint8_t* buf, size_t len) { int ret = mbedtls_ssl_read(&ssl_ctx->ssl, buf, len); - if (ret <= 0) - return -PAL_ERROR_DENIED; + if (ret < 0) + return mbedtls_to_pal_error(ret); return ret; } int lib_SSLWrite(LIB_SSL_CONTEXT* ssl_ctx, const uint8_t* buf, size_t len) { int ret = mbedtls_ssl_write(&ssl_ctx->ssl, buf, len); - if (ret <= 0) - return -PAL_ERROR_DENIED; + if (ret < 0) + return mbedtls_to_pal_error(ret); return ret; }