TclTLS: View Ticket

2025-04-06
22:30		• New ticket [6a63c165d8] tcltls-2.0.b1 infinite loop in Tls_WaitForConnect. artifact: 3effdf848f user: anonymous

Ticket Hash:	6a63c165d876c0879e2c05f4826bd931e78d6c13
Title:	tcltls-2.0.b1 infinite loop in Tls_WaitForConnect
Status:	Open	Type:	Code Defect
Severity:	Critical	Priority:
Subsystem:		Resolution:
Last Modified:	2025-04-06 22:30:05 35.4 days ago	Created:	2025-04-06 22:30:05 35.4 days ago
Version Found In:

User Comments:

anonymous added on 2025-04-06 22:30:05:

This code will reproduce the problem:

#!/usr/bin/env tclsh
package require Tcl 8.6-
package require tls
package require http
 
set url "https://pinacnews.com"
set port 443
set protocol "http/1.1"
 
# Register https protocol handler with http package
http::register https 443 [list ::tls::socket -autoservername 1 -require 1 -alpn [list [string tolower $protocol]]]
 
# Get webpage
set token [::http::geturl $url -blocksize 16384]
if {[http::status $token] ne "ok"} {
    puts [format "Error: \"%s\"" [http::status $token]]
    ::http::cleanup $token
    exit
}
 
# Get web page
set data [http::data $token]
 
# Cleanup
::http::cleanup $token
 
# Save data to file
set ch [open "tcl_tk_home.html" wb]
puts $ch $data
close $ch

Although the configure script has the --enable-ssl-fastpath option the source never includes confdefs.h. By hacking

#define TCLTLS_SSL_USE_FASTPATH 1

into generic/tlsBIO.c I was able to get past the bug. The site https://pinacnews.com only responds with RST to the SYN sent. By running

% set sock [tls::socket -autoservername 1 -require 1 -alpn [list [string tolower {http/1.1}]] pinacnews.com 443]
couldn't open socket: connection refused

I could see that it wasn't a problem with the socket but for whatever reason the socket was being passed to tlsIO.c even though it had already failed. The error handling in tlsIO.c thinks the error should have a retry and ends up looping forever getting the same error each time.