Merge pull request ClickHouse#79383 from ClickHouse/poco-backport-openssl-buf-fix

Backport Poco fix for concurrent SecureStreamSocket access

Author: thevar1able

base/poco/NetSSL_OpenSSL/include/Poco/Net/SecureSocketImpl.h

@@ -236,16 +236,21 @@ namespace Net
         /// to be able to re-use it again.
 
     private:
+        using MutexT = Poco::FastMutex;
+        using LockT = MutexT::ScopedLock;
+        using UnLockT = Poco::ScopedLockWithUnlock<MutexT>;
+
         SecureSocketImpl(const SecureSocketImpl &);
         SecureSocketImpl & operator=(const SecureSocketImpl &);
 
         mutable std::recursive_mutex _mutex;
-        SSL * _pSSL; // GUARDED_BY _mutex
+        std::atomic<SSL *> _pSSL;
         Poco::AutoPtr<SocketImpl> _pSocket;
         Context::Ptr _pContext;
         bool _needHandshake;
         std::string _peerHostName;
         Session::Ptr _pSession;
+        mutable MutexT _ssl_mutex;
 
         friend class SecureStreamSocketImpl;
 

base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp

@@ -103,6 +103,8 @@ void SecureSocketImpl::acceptSSL()
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	poco_assert (!_pSSL);
 
+	LockT l(_ssl_mutex);
+
 	BIO* pBIO = BIO_new(BIO_s_socket());
 	if (!pBIO) throw SSLException("Cannot create BIO object");
 	BIO_set_fd(pBIO, static_cast<int>(_pSocket->sockfd()), BIO_NOCLOSE);
@@ -169,6 +171,8 @@ void SecureSocketImpl::connectSSL(bool performHandshake)
 	poco_assert (!_pSSL);
 	poco_assert (_pSocket->initialized());
 
+	LockT l(_ssl_mutex);
+
 	BIO* pBIO = BIO_new(BIO_s_socket());
 	if (!pBIO) throw SSLException("Cannot create SSL BIO object");
 	BIO_set_fd(pBIO, static_cast<int>(_pSocket->sockfd()), BIO_NOCLOSE);
@@ -246,6 +250,8 @@ void SecureSocketImpl::shutdown()
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	if (_pSSL)
 	{
+        UnLockT l(_ssl_mutex);
+
         // Don't shut down the socket more than once.
         int shutdownState = SSL_get_shutdown(_pSSL);
         bool shutdownSent = (shutdownState & SSL_SENT_SHUTDOWN) == SSL_SENT_SHUTDOWN;
@@ -260,6 +266,7 @@ void SecureSocketImpl::shutdown()
 			// done with it.
 			int rc = SSL_shutdown(_pSSL);
 			if (rc < 0) handleError(rc);
+			l.unlock();
 			if (_pSocket->getBlocking())
 			{
 				_pSocket->shutdown();
@@ -290,6 +297,9 @@ int SecureSocketImpl::sendBytes(const void* buffer, int length, int flags)
 	poco_check_ptr (_pSSL);
 
 	int rc;
+
+	LockT l(_ssl_mutex);
+
 	if (_needHandshake)
 	{
 		rc = completeHandshake();
@@ -331,6 +341,8 @@ int SecureSocketImpl::receiveBytes(void* buffer, int length, int flags)
 	poco_assert (_pSocket->initialized());
 	poco_check_ptr (_pSSL);
 
+	LockT l(_ssl_mutex);
+
 	/// Special case: just check that we can read from socket
 	if ((flags & MSG_DONTWAIT) && (flags & MSG_PEEK))
 		return _pSocket->receiveBytes(buffer, length, flags);
@@ -368,6 +380,8 @@ int SecureSocketImpl::available() const
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	poco_check_ptr (_pSSL);
 
+	LockT l(_ssl_mutex);
+
 	return SSL_pending(_pSSL);
 }
 
@@ -464,10 +478,20 @@ bool SecureSocketImpl::isLocalHost(const std::string& hostName)
 X509* SecureSocketImpl::peerCertificate() const
 {
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
+    LockT l(_ssl_mutex);
+
+	X509* pCert = nullptr;
+
 	if (_pSSL)
-		return SSL_get1_peer_certificate(_pSSL);
-	else
-		return 0;
+	{
+		pCert = ::SSL_get_peer_certificate(_pSSL);
+
+		if (X509_V_OK != SSL_get_verify_result(_pSSL))
+			throw CertificateValidationException("SecureSocketImpl::peerCertificate(): "
+				"Certificate verification error " + Utility::getLastError());
+	}
+
+	return pCert;
 }
 
 Poco::Timespan SecureSocketImpl::getMaxTimeoutOrLimit()
@@ -608,6 +632,8 @@ void SecureSocketImpl::reset()
 	close();
 	if (_pSSL)
 	{
+		LockT l(_ssl_mutex);
+
 		SSL_free(_pSSL);
 		_pSSL = nullptr;
 	}
@@ -652,9 +678,12 @@ bool SecureSocketImpl::sessionWasReused()
 {
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	if (_pSSL)
-		return SSL_session_reused(_pSSL) != 0;
-	else
-		return false;
+	{
+		LockT l(_ssl_mutex);
+		return ::SSL_session_reused(_pSSL) != 0;
+	}
+
+	return false;
 }
 
 void SecureSocketImpl::setBlocking(bool flag)