mirror of
https://github.com/boostorg/beast.git
synced 2025-08-03 06:44:39 +02:00
Better treatment of SSL short reads:
fix #38 This improves the behavior when encountering a short read: * Any stream error encountered during a read is converting into `http::error::partial_message` if some data was received but the message is incomplete. * Examples squelch SSL short read errors from the logs.
This commit is contained in:
@@ -218,6 +218,26 @@ handle_request(
|
||||
void
|
||||
fail(beast::error_code ec, char const* what)
|
||||
{
|
||||
// ssl::error::stream_truncated, also known as an SSL "short read",
|
||||
// indicates the peer closed the connection without performing the
|
||||
// required closing handshake (for example, Google does this to
|
||||
// improve performance). Generally this can be a security issue,
|
||||
// but if your communication protocol is self-terminated (as
|
||||
// it is with both HTTP and WebSocket) then you may simply
|
||||
// ignore the lack of close_notify.
|
||||
//
|
||||
// https://github.com/boostorg/beast/issues/38
|
||||
//
|
||||
// https://security.stackexchange.com/questions/91435/how-to-handle-a-malicious-ssl-tls-shutdown
|
||||
//
|
||||
// When a short read would cut off the end of an HTTP message,
|
||||
// Beast returns the error beast::http::error::partial_message.
|
||||
// Therefore, if we see a short read here, it has occurred
|
||||
// after the message has been completed, so it is safe to ignore it.
|
||||
|
||||
if(ec == net::ssl::error::stream_truncated)
|
||||
return;
|
||||
|
||||
std::cerr << what << ": " << ec.message() << "\n";
|
||||
}
|
||||
|
||||
|
Reference in New Issue
Block a user