0

I followed the answers given in Turn a simple socket into an SSL socket to write a simple web server in C with SSL. This works fine when I use SSL_write(). But when I use the sendfile() systemcall in my server and use firefox to access a page, firefox shows the following error

Secure Connection Failed
An error occurred during a connection to localhost:16000. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

When I send the content of an html page with SSL_write() the content is displayed in the browser without any problem. But the problem occurs when I use sendfile(). So from what I understand, sendfile() is causing this error.

I want to send the content of a file to the socket directly (Ex. HTML page, image etc.). Can someone please tell me what I can do to correct this error and use sendfile()? Or else is there an alternative for sendfile() that I can use with SSL?

1
  • Error states the size of data is big. Try splitting it down?
    – Vinay P
    Jun 11, 2018 at 9:13

2 Answers 2

3

With OpenSSL the SSL state is kept in user space and a SSL_write will encrypt the data based on this state and update the state, put the encrypted data into a SSL record and then write this SSL record to the file descriptor. Using sendfile just bypasses all of this and writes the plain unencrypted data directly to the file descriptor, same as also a simple write instead of SSL_write would do. This results in the peer receiving the plain data without any SSL record container. The peert will try to interpret these data as SSL record and fail with strange errors like the one you see.

2

You have a way out to use sendfile with openssl.. compile openSSL with ktls support (provide enable-ktls option to ./config). This should work on any of the linux kernels post 4.13.

Then compile your application with the openssl you just built. You should be able to use sendfile with SSL and it should work like a charm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.