OpenSSL server on OpenWRT router fails handshakes after time and requires a reboot to work again

问题

Okay, I admit this is the weirdest openssl question I have ever seen - but what could be causing a problem that only a REBOOT fixes for OpenSSL?

The basics are that we have a MITM style SSL proxy on an OpenWRT router. The code works great for hours, and then for some unknown reason (nothing in dmesg or logread) we start getting client handshake failures where openssl just hangs on SSL_ERROR_WANT_READ.

We do use edge triggered epoll but as I said, the code works for HOURS without issue. Then all of sudden we start getting the SSL_ERROR_WANT_READ condition and when we do, we never get any further information from the client.

From the client, we can run openssl s_client and we get the following:

$ openssl s_client -state -CAfile ~/Documents/kdz.pem -servername www.apple.com -connect www.apple.com:443
CONNECTED(00000003)
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
depth=1 /C=US/ST=Montana/L=Kalispell/O=kdz/OU=tech/CN=kdzcom/emailAddress=support@kdzcom
verify return:1
depth=0 /1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=California/businessCategory=Private Organization/serialNumber=C0806592/C=US/postalCode=95014/ST=California/L=Cupertino/street=1 Infinite Loop/O=Apple Inc./OU=Internet Services for Akamai
verify return:1
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server certificate request A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client certificate A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:error in SSLv3 read finished A
SSL_connect:error in SSLv3 read finished A
write:errno=60

There is a similar problem mentioned here: Openssl Handshake failures after thousands of successful connections

For each connections, we first create a context like this: ctx = SSL_CTX_new(method) (method == SSLv23_server_method())

Then we set these flags: SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TICKET | SSL_OP_NO_COMPRESSION

Next we create a random session id: RAND_bytes(sess_id, IV_SIZE) and some additional flags:

SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_SERVER);
SSL_CTX_set_session_id_context(ctx, sess_id, IV_SIZE);
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, NULL);

After each connection we clean up with:

SSL_set_shutdown(req->conn.ssl, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
SSL_free(req->conn.ssl);
SSL_CTX_free(conn->ctx);

I am out of ideas and we have spent over a month trying to solve this, please help!!

来源：https://stackoverflow.com/questions/40638696/openssl-server-on-openwrt-router-fails-handshakes-after-time-and-requires-a-rebo

标签

ssl

OpenSSL

openwrt

handshake