Merge pull request ClickHouse#80229 from ClickHouse/revert-79383-poco-backport-openssl-buf-fix

Revert "Backport Poco fix for concurrent SecureStreamSocket access"

Author: thevar1able

base/poco/NetSSL_OpenSSL/include/Poco/Net/SecureSocketImpl.h

@@ -236,21 +236,16 @@ namespace Net
         /// to be able to re-use it again.
 
     private:
-        using MutexT = Poco::FastMutex;
-        using LockT = MutexT::ScopedLock;
-        using UnLockT = Poco::ScopedLockWithUnlock<MutexT>;
-
         SecureSocketImpl(const SecureSocketImpl &);
         SecureSocketImpl & operator=(const SecureSocketImpl &);
 
         mutable std::recursive_mutex _mutex;
-        std::atomic<SSL *> _pSSL;
+        SSL * _pSSL; // GUARDED_BY _mutex
         Poco::AutoPtr<SocketImpl> _pSocket;
         Context::Ptr _pContext;
         bool _needHandshake;
         std::string _peerHostName;
         Session::Ptr _pSession;
-        mutable MutexT _ssl_mutex;
 
         friend class SecureStreamSocketImpl;
 

base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp

@@ -103,8 +103,6 @@ void SecureSocketImpl::acceptSSL()
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	poco_assert (!_pSSL);
 
-	LockT l(_ssl_mutex);
-
 	BIO* pBIO = BIO_new(BIO_s_socket());
 	if (!pBIO) throw SSLException("Cannot create BIO object");
 	BIO_set_fd(pBIO, static_cast<int>(_pSocket->sockfd()), BIO_NOCLOSE);
@@ -171,8 +169,6 @@ void SecureSocketImpl::connectSSL(bool performHandshake)
 	poco_assert (!_pSSL);
 	poco_assert (_pSocket->initialized());
 
-	LockT l(_ssl_mutex);
-
 	BIO* pBIO = BIO_new(BIO_s_socket());
 	if (!pBIO) throw SSLException("Cannot create SSL BIO object");
 	BIO_set_fd(pBIO, static_cast<int>(_pSocket->sockfd()), BIO_NOCLOSE);
@@ -250,8 +246,6 @@ void SecureSocketImpl::shutdown()
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	if (_pSSL)
 	{
-        UnLockT l(_ssl_mutex);
-
         // Don't shut down the socket more than once.
         int shutdownState = SSL_get_shutdown(_pSSL);
         bool shutdownSent = (shutdownState & SSL_SENT_SHUTDOWN) == SSL_SENT_SHUTDOWN;
@@ -266,7 +260,6 @@ void SecureSocketImpl::shutdown()
 			// done with it.
 			int rc = SSL_shutdown(_pSSL);
 			if (rc < 0) handleError(rc);
-			l.unlock();
 			if (_pSocket->getBlocking())
 			{
 				_pSocket->shutdown();
@@ -297,9 +290,6 @@ int SecureSocketImpl::sendBytes(const void* buffer, int length, int flags)
 	poco_check_ptr (_pSSL);
 
 	int rc;
-
-	LockT l(_ssl_mutex);
-
 	if (_needHandshake)
 	{
 		rc = completeHandshake();
@@ -341,8 +331,6 @@ int SecureSocketImpl::receiveBytes(void* buffer, int length, int flags)
 	poco_assert (_pSocket->initialized());
 	poco_check_ptr (_pSSL);
 
-	LockT l(_ssl_mutex);
-
 	/// Special case: just check that we can read from socket
 	if ((flags & MSG_DONTWAIT) && (flags & MSG_PEEK))
 		return _pSocket->receiveBytes(buffer, length, flags);
@@ -380,8 +368,6 @@ int SecureSocketImpl::available() const
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	poco_check_ptr (_pSSL);
 
-	LockT l(_ssl_mutex);
-
 	return SSL_pending(_pSSL);
 }
 
@@ -478,20 +464,10 @@ bool SecureSocketImpl::isLocalHost(const std::string& hostName)
 X509* SecureSocketImpl::peerCertificate() const
 {
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
-    LockT l(_ssl_mutex);
-
-	X509* pCert = nullptr;
-
 	if (_pSSL)
-	{
-		pCert = ::SSL_get_peer_certificate(_pSSL);
-
-		if (X509_V_OK != SSL_get_verify_result(_pSSL))
-			throw CertificateValidationException("SecureSocketImpl::peerCertificate(): "
-				"Certificate verification error " + Utility::getLastError());
-	}
-
-	return pCert;
+		return SSL_get1_peer_certificate(_pSSL);
+	else
+		return 0;
 }
 
 Poco::Timespan SecureSocketImpl::getMaxTimeoutOrLimit()
@@ -632,8 +608,6 @@ void SecureSocketImpl::reset()
 	close();
 	if (_pSSL)
 	{
-		LockT l(_ssl_mutex);
-
 		SSL_free(_pSSL);
 		_pSSL = nullptr;
 	}
@@ -678,12 +652,9 @@ bool SecureSocketImpl::sessionWasReused()
 {
 	std::lock_guard<std::recursive_mutex> lock(_mutex);
 	if (_pSSL)
-	{
-		LockT l(_ssl_mutex);
-		return ::SSL_session_reused(_pSSL) != 0;
-	}
-
-	return false;
+		return SSL_session_reused(_pSSL) != 0;
+	else
+		return false;
 }
 
 void SecureSocketImpl::setBlocking(bool flag)