Golang中TLS服务器缓冲区数据卡住问题解析

Golang中TLS服务器缓冲区数据卡住问题解析 大家好，

我在为SMTP STARTTLS功能实现测试时遇到了一个问题。具体来说，当TLS握手失败时，我想测试在优雅关闭连接之前是否发送了QUIT命令。

问题：

• QUIT命令似乎卡在了TLS连接处理程序的缓冲区中
• 此行为是间歇性的，似乎取决于命令发送的速度
• 在发送QUIT命令前添加一个小的延迟可以解决此问题

为了隔离问题，我使用简单的纯文本通信（不包含SMTP特定代码）创建了一个最小化的复现案例。

package main

import (
	"bufio"
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"math/big"
	"net"
	"strings"
	"sync"
	"testing"
	"time"
)

func TestTLSHandshake(t *testing.T) {
	ln := newLocalListener(t)
	defer ln.Close()

	wg := sync.WaitGroup{}
	wg.Add(1)

	go func() {
		// Client
		clientConn, _ := net.Dial("tcp", ln.Addr().String())
		defer clientConn.Close()

		_, _ = clientConn.Write([]byte("STARTTLS\r\n"))

		// Wait for readiness
		buf := make([]byte, 1024)
		_, _ = clientConn.Read(buf)
		fmt.Printf("[Client] Received reply: %s", string(buf))

		// Try TLS handshake
		tlsConn := tls.Client(clientConn, &tls.Config{
			ServerName: "localhost",
		})

		// Handshake should fail because client doesn't trust self-signed cert
		err := tlsConn.Handshake()
		if err != nil {
			fmt.Println("[Client] Handshake err: ", err)
		}

		// Delay to prevent QUIT from being consumed into TLS buffer
		time.Sleep(100 * time.Millisecond)

		_, _ = clientConn.Write([]byte("QUIT\r\n"))

		wg.Done()
	}()

	serverConn, _ := ln.Accept()
	defer serverConn.Close()

	quitReceived := false

	scanner := bufio.NewScanner(serverConn)
	for scanner.Scan() {
		input := scanner.Text()

		fmt.Printf("[Server] Received: '%s'\n", input)

		switch input {
		case "STARTTLS":
			// Generate test cert
			cert, privateKey, _ := generateTestCertificatePair()

			// Setup TLS
			keypair, _ := tls.X509KeyPair(cert, privateKey)
			config := &tls.Config{Certificates: []tls.Certificate{keypair}}

			// Reply readiness
			_, _ = serverConn.Write([]byte("Ready for handshake\r\n"))

			tlsConn := tls.Server(serverConn, config)

			handshakeErr := tlsConn.Handshake()
			if handshakeErr != nil {
				fmt.Println("[Server] Handshake error: ", handshakeErr)
				continue
			} else {
				fmt.Println("[Server] Handshake completed")
				t.Fatal("Handshake unexpectedly succeeded")
			}
		case "QUIT":
			quitReceived = true

			fmt.Println("[Server] Quit received")
		}
	}

	wg.Wait()

	if !quitReceived {
		t.Fatal("[Server] Quit not received")
	}
}

// Generate X509 encoded certificate for testing.
func generateTestCertificatePair() ([]byte, []byte, error) {
	organization := "example"
	host := "localhost"

	validFrom := time.Now()
	validTo := validFrom.Add(24 * time.Hour)

	// Generate private key
	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	// Create certificate serial number
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)

	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return nil, nil, err
	}

	template := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			Organization: []string{organization},
			CommonName:   host,
		},
		NotBefore: validFrom,
		NotAfter:  validTo,

		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
	}

	hosts := strings.Split(host, ",")
	template.DNSNames = append(template.DNSNames, hosts...)

	// Create certificate
	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
	if err != nil {
		return nil, nil, err
	}

	// Encode certificate to PEM
	certBuffer := &bytes.Buffer{}
	if err := pem.Encode(certBuffer, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
		return nil, nil, err
	}

	// Encode private key to PEM
	privBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
	if err != nil {
		return nil, nil, err
	}

	keyBuffer := &bytes.Buffer{}
	if err := pem.Encode(keyBuffer, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes}); err != nil {
		return nil, nil, err
	}

	return certBuffer.Bytes(), keyBuffer.Bytes(), nil
}

func newLocalListener(t *testing.T) net.Listener {
	ln, _ := net.Listen("tcp", "localhost:0")
	return ln
}

上述代码也可在此处找到。请注意，如果移除延迟，服务器将不会收到QUIT命令。

我理解TCP是一个连续的流，应用程序应该自行处理消息边界。然而，我使用的是tls.Server()，并且无法控制它将如何处理TCP连接。

有什么方法可以确保服务器能够由主处理程序（而不是TLS处理程序）接收到QUIT命令吗？

感谢您的帮助！