Better treatment of SSL short reads:

fix #38

This improves the behavior when encountering a short read:

* Any stream error encountered during a read is converting into
  `http::error::partial_message` if some data was received but
  the message is incomplete.

* Examples squelch SSL short read errors from the logs.
This commit is contained in:
Vinnie Falco
2019-02-23 06:34:52 -08:00
parent d4dddec1c0
commit 094f5ec5cb
11 changed files with 124 additions and 5 deletions

View File

@@ -218,6 +218,26 @@ handle_request(
void
fail(beast::error_code ec, char const* what)
{
// ssl::error::stream_truncated, also known as an SSL "short read",
// indicates the peer closed the connection without performing the
// required closing handshake (for example, Google does this to
// improve performance). Generally this can be a security issue,
// but if your communication protocol is self-terminated (as
// it is with both HTTP and WebSocket) then you may simply
// ignore the lack of close_notify.
//
// https://github.com/boostorg/beast/issues/38
//
// https://security.stackexchange.com/questions/91435/how-to-handle-a-malicious-ssl-tls-shutdown
//
// When a short read would cut off the end of an HTTP message,
// Beast returns the error beast::http::error::partial_message.
// Therefore, if we see a short read here, it has occurred
// after the message has been completed, so it is safe to ignore it.
if(ec == net::ssl::error::stream_truncated)
return;
std::cerr << what << ": " << ec.message() << "\n";
}