Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

improve error message for TLS Alerts in rust bindings #4877

Open
jmayclin opened this issue Nov 7, 2024 · 0 comments
Open

improve error message for TLS Alerts in rust bindings #4877

jmayclin opened this issue Nov 7, 2024 · 0 comments

Comments

@jmayclin
Copy link
Contributor

jmayclin commented Nov 7, 2024

Problem:

When attempting to debug a failed TLS connection (with s2n-tls-hyper) the error message is very unhelpful

2024-11-07T00:37:42.759643Z  INFO internet_http_client: querying https://www.cloudflare.com/ with Policy("test_all_tls12")
2024-11-07T00:37:42.781361Z TRACE hyper_util::client::legacy::pool: checkout waiting for idle connection: ("https", www.cloudflare.com)
2024-11-07T00:37:42.781408Z TRACE hyper_util::client::legacy::connect::http: Http::connect; scheme=Some("https"), host=Some("www.cloudflare.com"), port=None
2024-11-07T00:37:42.783138Z DEBUG hyper_util::client::legacy::connect::http: connecting to 104.16.124.96:443
2024-11-07T00:37:42.791454Z DEBUG hyper_util::client::legacy::connect::http: connected to 104.16.124.96:443
2024-11-07T00:37:42.800514Z TRACE hyper_util::client::legacy::pool: checkout dropped for ("https", www.cloudflare.com)
test http_get ... FAILED

failures:

---- http_get stdout ----
Error: hyper_util::client::legacy::Error(Connect, TlsError(Error { code: 268435456, name: "S2N_ERR_ALERT", message: "TLS alert received", kind: Alert, source: Library, debug: "Error encountered in lib/tls/s2n_alerts.c:245", errno: "Success" }))

Solution:

An obvious improvement would be to include the specific TLS alert code that the peer sent.

Presumably we could accomplish this using

s2n-tls/api/s2n.h

Lines 3325 to 3332 in 53691f9

/**
* Function to get the alert that caused a connection to close. s2n-tls considers all
* TLS alerts fatal and shuts down a connection whenever one is received.
*
* @param conn A pointer to the s2n connection
* @returns The TLS alert code that caused a connection to be shut down
*/
S2N_API extern int s2n_connection_get_alert(struct s2n_connection *conn);

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants