Skip to content

improve error message for TLS Alerts in rust bindings #4877

Open
@jmayclin

Description

Problem:

When attempting to debug a failed TLS connection (with s2n-tls-hyper) the error message is very unhelpful

2024-11-07T00:37:42.759643Z  INFO internet_http_client: querying https://www.cloudflare.com/ with Policy("test_all_tls12")
2024-11-07T00:37:42.781361Z TRACE hyper_util::client::legacy::pool: checkout waiting for idle connection: ("https", www.cloudflare.com)
2024-11-07T00:37:42.781408Z TRACE hyper_util::client::legacy::connect::http: Http::connect; scheme=Some("https"), host=Some("www.cloudflare.com"), port=None
2024-11-07T00:37:42.783138Z DEBUG hyper_util::client::legacy::connect::http: connecting to 104.16.124.96:443
2024-11-07T00:37:42.791454Z DEBUG hyper_util::client::legacy::connect::http: connected to 104.16.124.96:443
2024-11-07T00:37:42.800514Z TRACE hyper_util::client::legacy::pool: checkout dropped for ("https", www.cloudflare.com)
test http_get ... FAILED

failures:

---- http_get stdout ----
Error: hyper_util::client::legacy::Error(Connect, TlsError(Error { code: 268435456, name: "S2N_ERR_ALERT", message: "TLS alert received", kind: Alert, source: Library, debug: "Error encountered in lib/tls/s2n_alerts.c:245", errno: "Success" }))

Solution:

An obvious improvement would be to include the specific TLS alert code that the peer sent.

Presumably we could accomplish this using

s2n-tls/api/s2n.h

Lines 3325 to 3332 in 53691f9

/**
* Function to get the alert that caused a connection to close. s2n-tls considers all
* TLS alerts fatal and shuts down a connection whenever one is received.
*
* @param conn A pointer to the s2n connection
* @returns The TLS alert code that caused a connection to be shut down
*/
S2N_API extern int s2n_connection_get_alert(struct s2n_connection *conn);

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions