search

nanomsg / nng

nanomsg-next-generation -- light-weight brokerless messaging
https://nng.nanomsg.org
MIT License
3.84k stars 491 forks source link

HTTPS client hangs when required client certificates are not supplied #925

Open KemTM opened 5 years ago

KemTM commented 5 years ago

I am writing a small, curl-like http/https client library. If the remote server requires client authentication over TLS and I do not supply the certificates in my configuration, the application hangs. Possibly related to #848?

NNG & Platform details.

nng: release with tag v1.1.1 Linux: Alpine 3.7 gcc: 6.4.0

Expected Behavior

nng_http_conn_write_req and subsequent nng_aio_wait should fail.

Actual Behavior

Application is stuck, waiting on nng_http_conn_write_req AIO operation to finish.

Steps to Reproduce

  1. Setup an HTTP server with TLS and enforce client authentication
  2. Setup a simple connection and request (similar to the httpclient demo).
  3. Configure TLS only with nng_tls_config_ca_chain
gdamore commented 5 years ago

I don't think this has anything to do with #848 which is related specifically the SP layer protocol handshakes (and does not apply for generic HTTP.)

My guess is that we have to be more aggressive about driving the TLS handshake, and reacting to errors. The server should actually disconnect the pipe, and TLS should probably get either an authentication failure, or NNG_ECLOSED.