Skip to content

spice-channel: read all avaiable data from OpenSSL buffer

Michael Scherle requested to merge z0Kng/spice-gtk:SSL_has_pending into master

When TLS is in use, data is received in TLS records. If multiple SPICE messages are merged into a single record—e.g. from a proxy server—it's necessary to check if OpenSSL has still data buffered. Otherwise, any extra SPICE messages would only be processed the next time data arrives on the TCP socket.

On my test setup:

remote-viwer → TLS → proxy server → TCP → spice server

I noticed that the spice server disconnects the client due to the connection being idle. This happens because the spice-gtk client never responds to the second ping message on the main channel. And this happens because the proxy (I have tested different ones) packs the two ping spice messages, sent directly one after the other from the server, into a single TLS record. The client does not process the second ping message because it is already loaded into the OpenSSL buffer when the first one is read and therefore the TCP socket does not contain any data and therefore g_pollable_input_stream_is_readable(G_POLLABLE_INPUT_STREAM(c->in)) is not true. The client would only process the message when there is data on the TCP socket again, and this does not happen in time.

A similar problem was fixed in 80e9c852.

Merge request reports

Loading