OpenSSL 1.1.1 blocking on a non-blocking socket

[david-mohr]

Hi Alan,

We recently moved to OpenSSL 1.1.1 from 1.1.0 and found some issue with amqp_basic_publish blocking under certain conditions, even though we are using a non-blocking socket.

After many days of frustration, we found one little comment in the OpenSSL docs:

All modes are off by default except for SSL_MODE_AUTO_RETRY which is on by default since 1.1.1

https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_mode.html

SSL_MODE_AUTO_RETRY attempts to renegotiate a broken SSL connection (which in our testing is simply pulling out the network cable) and blocks the whole time.

To revert back to the original, fully non-blocking behaviour we disabled AUTO_RETRY and enabled PARTIAL_WRITE:

SSL_CTX_set_mode(amqp_socket->ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
SSL_CTX_clear_mode(amqp_socket->ctx, SSL_MODE_AUTO_RETRY);

And now we are back to expected non-blocking behaviour.

Would you be comfortable adding this into the code base when the SSL CTX is created? Alternatively, would you be able to declare the amqp_socket struct in the header so we can access the CTX to set these modes from our application code?

Thanks.

[alanxz]

Seems like a reasonable thing to fix. Fix is in #587