Skip to content

improve error message for TLS Alerts in rust bindings #4877

Open
@jmayclin

Description

@jmayclin

Problem:

When attempting to debug a failed TLS connection (with s2n-tls-hyper) the error message is very unhelpful

2024-11-07T00:37:42.759643Z  INFO internet_http_client: querying https://www.cloudflare.com/ with Policy("test_all_tls12")
2024-11-07T00:37:42.781361Z TRACE hyper_util::client::legacy::pool: checkout waiting for idle connection: ("https", www.cloudflare.com)
2024-11-07T00:37:42.781408Z TRACE hyper_util::client::legacy::connect::http: Http::connect; scheme=Some("https"), host=Some("www.cloudflare.com"), port=None
2024-11-07T00:37:42.783138Z DEBUG hyper_util::client::legacy::connect::http: connecting to 104.16.124.96:443
2024-11-07T00:37:42.791454Z DEBUG hyper_util::client::legacy::connect::http: connected to 104.16.124.96:443
2024-11-07T00:37:42.800514Z TRACE hyper_util::client::legacy::pool: checkout dropped for ("https", www.cloudflare.com)
test http_get ... FAILED

failures:

---- http_get stdout ----
Error: hyper_util::client::legacy::Error(Connect, TlsError(Error { code: 268435456, name: "S2N_ERR_ALERT", message: "TLS alert received", kind: Alert, source: Library, debug: "Error encountered in lib/tls/s2n_alerts.c:245", errno: "Success" }))

Solution:

An obvious improvement would be to include the specific TLS alert code that the peer sent.

Presumably we could accomplish this using

s2n-tls/api/s2n.h

Lines 3325 to 3332 in 53691f9

/**
* Function to get the alert that caused a connection to close. s2n-tls considers all
* TLS alerts fatal and shuts down a connection whenever one is received.
*
* @param conn A pointer to the s2n connection
* @returns The TLS alert code that caused a connection to be shut down
*/
S2N_API extern int s2n_connection_get_alert(struct s2n_connection *conn);

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions