<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: 0.875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px;
}
body {
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #666;">
<a href="https://gitlab.com/cwwanner1967" style="color: #1068bf;">Chuck Wanner</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1413" style="color: #1068bf;">#1413</a>
</p>
<div class="md" style="color: #303030; word-wrap: break-word;">
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: 0.3em; border-bottom-width: 1px; border-bottom-color: #eaeaea; border-bottom-style: solid; color: #303030; margin: 0 0 16px;" align="initial">
<a id="user-content-description-of-problem" class="anchor" href="#description-of-problem" aria-hidden="true" style="color: #1068bf; margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Description of problem:</h2>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">We are currently using the GNUTLS Library for a DTLS Server and Client. Our design requires the GNUTLS_NONBLOCK flag to be set. We wrote our DTLS Software back in 2018 and 2019. We were using GNUTLS version 3.3.26 without any issues. We are stepping up to Redhat 8 which is using GNUTLS Version 3.6.16.</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">We configure the DTLS Client and Server to be non-blocking, but our GNUTLS Pull Timeout function is never invoked. Only the GNUTLS Pull Function is invoked.</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">I believe the issue that we are encountering is a logic error in gnutls-3.6.16/lib/record.c in function _gnutls_recv_in_buffers at lines 1307 and 1322.</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">For example at line 1307:
ret = recv_headers(session, record_params, type, htype, &record, (!(session->internals.flags & GNUTLS_NONBLOCK))?&ms:0);
When the GNUTLS_NONBLOCK flag is set, the recv_headers will expect the pointer to the timeout value to be set. But this line will always pass NULL when the GNUTLS_NONBLOCK flag is set. I believe the solution to the problem should be remove the not logic.</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">The fix for line 1307:
ret = recv_headers(session, record_params, type, htype, &record, (session->internals.flags & GNUTLS_NONBLOCK)?&ms:0);</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">The same issue exists at line 1322:
/* Read the packet data and insert it to record_recv_buffer.
<em style="margin-top: 0;">/
ret =
_gnutls_io_read_buffered(session, record.packet_size,
record.type, (!(session->internals.flags & GNUTLS_NONBLOCK))?&ms:0);
The fix for line 1322:
/</em> Read the packet data and insert it to record_recv_buffer.
*/
ret =
_gnutls_io_read_buffered(session, record.packet_size,
record.type, (session->internals.flags & GNUTLS_NONBLOCK)?&ms:0);</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">Note: There are a number of locations where the GNUTLS_NONBLOCK flag is used. I did not review the other locations to determine if there is an issue.</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">Note: I did verify the same logic still exists in GNUTLS Version 3.7.8.</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">Below is some of our code sections initializing the GNUTLS Library.</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">At the start we invoke the following:</p>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre class="code highlight js-syntax-highlight language-plaintext" lang="plaintext" data-canonical-lang="" v-pre="true" style='display: block; font-size: 13px; color: #303030; line-height: 1.6em; overflow-x: auto; border-radius: 4px; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; margin: 0 0 16px; padding: 12px; border: 1px solid #dbdbdb;'><code style='font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: 4px; white-space: pre; margin-top: 0; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; overflow-wrap: normal; padding: unset;'><span id="LC1" class="line" lang="plaintext" style="margin-top: 0;">/*</span>
<span id="LC2" class="line" lang="plaintext">** Initialize the GNU TLS DTLS Session</span>
<span id="LC3" class="line" lang="plaintext">*/</span>
<span id="LC4" class="line" lang="plaintext">gnutls_ret_code = gnutls_init(&mpGnuTlsSession, GNUTLS_SERVER | GNUTLS_DATAGRAM | GNUTLS_NONBLOCK);</span></code></pre>
<copy-code></copy-code>
</div>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">We setup private data, pull functions, and push functions:
/*
** Provide the UDP Socket to the GNU TLS DTLS Server
**
** Note: No return value
*/
gnutls_transport_set_ptr(this->mpGnuTlsSession, &this->mPrivateData);
gnutls_transport_set_push_function(this->mpGnuTlsSession, gnutlsPushFunction);
gnutls_transport_set_pull_function(this->mpGnuTlsSession, gnutlsPullFunction);
gnutls_transport_set_pull_timeout_function(this->mpGnuTlsSession,
gnutlsPullTimeoutFunction);</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">After the Handshake is complete, we invoke the following to configure the Timeout:
/*
** Set the Receive Timeout for the Application Data
**
** Note: No return value
*/
gnutls_record_set_timeout(this->mpGnuTlsSession, cDtlsTimeoutMs);</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">We invoke the following to process the application data sent from the DTLS Client or Server:</p>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre class="code highlight js-syntax-highlight language-plaintext" lang="plaintext" data-canonical-lang="" v-pre="true" style='display: block; font-size: 13px; color: #303030; line-height: 1.6em; overflow-x: auto; border-radius: 4px; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; margin: 0 0 16px; padding: 12px; border: 1px solid #dbdbdb;'><code style='font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: 4px; white-space: pre; margin-top: 0; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; overflow-wrap: normal; padding: unset;'><span id="LC1" class="line" lang="plaintext" style="margin-top: 0;">/*</span>
<span id="LC2" class="line" lang="plaintext">** Check to see if message is available</span>
<span id="LC3" class="line" lang="plaintext">*/</span>
<span id="LC4" class="line" lang="plaintext">gnutls_recv_status = gnutls_record_recv_seq(this->mpGnuTlsSession, (void *)mRcvBuffer, cDtlsRecvMaxBufferSize, sequence);</span></code></pre>
<copy-code></copy-code>
</div>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">We verified that the GNUTLS Pull Timeout function is never invoked. Only the GNUTLS Pull function is invoked.</p>
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: 0.3em; border-bottom-width: 1px; border-bottom-color: #eaeaea; border-bottom-style: solid; color: #303030; margin: 24px 0 16px;" align="initial">
<a id="user-content-version-of-gnutls-used" class="anchor" href="#version-of-gnutls-used" aria-hidden="true" style="color: #1068bf; margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Version of gnutls used:</h2>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">Version 3.3.16</p>
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: 0.3em; border-bottom-width: 1px; border-bottom-color: #eaeaea; border-bottom-style: solid; color: #303030; margin: 24px 0 16px;" align="initial">
<a id="user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" class="anchor" href="#distributor-of-gnutls-eg-ubuntu-fedora-rhel" aria-hidden="true" style="color: #1068bf; margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)</h2>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">RHEL 8</p>
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: 0.3em; border-bottom-width: 1px; border-bottom-color: #eaeaea; border-bottom-style: solid; color: #303030; margin: 24px 0 16px;" align="initial">
<a id="user-content-how-reproducible" class="anchor" href="#how-reproducible" aria-hidden="true" style="color: #1068bf; margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>How reproducible:</h2>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">Configure the DTLS Server or Client with the GNUTLS_NONBLOCK flag.
Configure the DTLS Server or Client with the pull and pull timeout functions with log statements to verify when they are called.
Set the timeout with function gnutls_record_set_timeout.
After the handshake is complete between the server and client, invoke gnutls_record_recv_seq.</p>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">Steps to Reproduce:</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 16px; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">one</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">two</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">three</li>
</ul>
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: 0.3em; border-bottom-width: 1px; border-bottom-color: #eaeaea; border-bottom-style: solid; color: #303030; margin: 24px 0 16px;" align="initial">
<a id="user-content-actual-results" class="anchor" href="#actual-results" aria-hidden="true" style="color: #1068bf; margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Actual results:</h2>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">With the logging in the Pull functions, you will only see the GNUTLS Pull function invoked. The GNUTLS Pull Timeout function is never invoked.</p>
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: 0.3em; border-bottom-width: 1px; border-bottom-color: #eaeaea; border-bottom-style: solid; color: #303030; margin: 24px 0 16px;" align="initial">
<a id="user-content-expected-results" class="anchor" href="#expected-results" aria-hidden="true" style="color: #1068bf; margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Expected results:</h2>
<p dir="auto" style="color: #303030; margin: 0;" align="initial">With the logging in the Pull functions, you should see the GNUTLS Pull Timeout function invoked. The GNUTLS Pull function should be invoked if the GNUTLS Pull Timeout has determine data is available.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1413" style="color: #1068bf;">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com" style="color: #1068bf;">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/69dec3dcbf5ab7f49920e2fe3c215bf3/unsubscribe" target="_blank" rel="noopener noreferrer" style="color: #1068bf;">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link" style="color: #1068bf;">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link" style="color: #1068bf;">Help</a>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1413"}}</script>
</p>
</div>
</body>
</html>