Skip to content

Allow connection teardown even when cert selection is not yet complete - #46676

Draft
etruong42 wants to merge 1 commit into
envoyproxy:mainfrom
etruong42:ssltsan
Draft

Allow connection teardown even when cert selection is not yet complete#46676
etruong42 wants to merge 1 commit into
envoyproxy:mainfrom
etruong42:ssltsan

Conversation

@etruong42

@etruong42 etruong42 commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

#45755 allowed the socket state to transition to ShutdownSent before cert selection is complete (as intended). However, this could cause ENVOY_BUG to be thrown when SslSocket::onAsynchronousCertificateSelectionComplete() is invoked. This patch updates SslSocket::onAsynchronousCertificateSelectionComplete to allow this socket state which is consistent with the implementation of SslSocket::onAsynchronousCertValidationComplete and avoids the ENVOY_BUG in the case of valid states such as ShutdownSent.

Change-Id: I155b874accd54affa65bfa0b744ff99154060570

Commit Message:
Additional Description:
Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

@repokitteh-read-only

Copy link
Copy Markdown

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #46676 was opened by etruong42.

see: more, trace.

@etruong42

Copy link
Copy Markdown
Contributor Author

See

2026-08-11T21:28:42.6137899Z [ RUN      ] IpVersions/SslIntegrationTest.AsyncSleepCertSelectionAfterTearDown/IPv4
2026-08-11T21:28:42.6139093Z [2026-08-11 21:28:38.469][2905][error][envoy_bug] [source/common/tls/ssl_socket.cc:470] envoy bug failure: false. Details: unexpected handshake state: 3
2026-08-11T21:28:42.6140314Z [2026-08-11 21:28:38.469][2905][error][envoy_bug] [./source/common/common/assert.h:55] stacktrace for envoy bug
2026-08-11T21:28:42.6141949Z [2026-08-11 21:28:38.559][2905][error][envoy_bug] [./source/common/common/assert.h:59] #0 Envoy::Extensions::TransportSockets::Tls::SslSocket::onAsynchronousCertificateSelectionComplete() [0x55c26cbdb6c3]
2026-08-11T21:28:42.6143941Z [2026-08-11 21:28:38.630][2905][error][envoy_bug] [./source/common/common/assert.h:59] #1 Envoy::Extensions::TransportSockets::Tls::SslSocket::onAsynchronousCertificateSelectionComplete() [0x55c26cbdbe2a]
2026-08-11T21:28:42.6145345Z [2026-08-11 21:28:38.696][2905][error][envoy_bug] [./source/common/common/assert.h:59] #2 Envoy::Extensions::TransportSockets::Tls::SslExtendedSocketInfoImpl::onCertificateSelectionCompleted() [0x55c26cc20eca]
2026-08-11T21:28:42.6146618Z [2026-08-11 21:28:38.755][2905][error][envoy_bug] [./source/common/common/assert.h:59] #3 Envoy::Extensions::TransportSockets::Tls::CertificateSelectionCallbackImpl::onCertificateSelectionResult() [0x55c26cc1f864]
2026-08-11T21:28:42.6148000Z [2026-08-11 21:28:38.823][2905][error][envoy_bug] [./source/common/common/assert.h:59] #4 Envoy::Extensions::TransportSockets::Tls::AsyncTlsCertificateSelector::selectTlsContextAsync() [0x55c26cc99e6b]
2026-08-11T21:28:42.6149251Z [2026-08-11 21:28:38.884][2905][error][envoy_bug] [./source/common/common/assert.h:59] #5 Envoy::Extensions::TransportSockets::Tls::AsyncTlsCertificateSelector::selectTlsContext()::$_1::operator()() [0x55c26cc9ab2a]
2026-08-11T21:28:42.6150414Z [2026-08-11 21:28:38.948][2905][error][envoy_bug] [./source/common/common/assert.h:59] #6 std::__1::__invoke[abi:nqe220108]<>() [0x55c26cc9aac6]
2026-08-11T21:28:42.6151281Z [2026-08-11 21:28:39.016][2905][error][envoy_bug] [./source/common/common/assert.h:59] #7 std::__1::__invoke_void_return_wrapper<>::__call[abi:nqe220108]<>() [0x55c26cc9aa76]
2026-08-11T21:28:42.6152142Z [2026-08-11 21:28:39.079][2905][error][envoy_bug] [./source/common/common/assert.h:59] #8 std::__1::__invoke_r[abi:nqe220108]<>() [0x55c26cc9aa26]
2026-08-11T21:28:42.6153268Z [2026-08-11 21:28:39.154][2905][error][envoy_bug] [./source/common/common/assert.h:59] #9 std::__1::__function::__func<>::operator()() [0x55c26cc9a8ba]
2026-08-11T21:28:42.6154153Z [2026-08-11 21:28:39.215][2905][error][envoy_bug] [./source/common/common/assert.h:59] #10 std::__1::__function::__value_func<>::operator()[abi:nqe220108]() [0x55c2679d186b]
2026-08-11T21:28:42.6155020Z [2026-08-11 21:28:39.275][2905][error][envoy_bug] [./source/common/common/assert.h:59] #11 std::__1::function<>::operator()() [0x55c2679d1796]
2026-08-11T21:28:42.6155906Z [2026-08-11 21:28:39.335][2905][error][envoy_bug] [./source/common/common/assert.h:59] #12 Envoy::Event::DispatcherImpl::createTimerInternal()::$_0::operator()() [0x55c26d2a3715]
2026-08-11T21:28:42.6156812Z [2026-08-11 21:28:39.396][2905][error][envoy_bug] [./source/common/common/assert.h:59] #13 std::__1::__invoke[abi:nqe220108]<>() [0x55c26d2a36a6]
2026-08-11T21:28:42.6157676Z [2026-08-11 21:28:39.456][2905][error][envoy_bug] [./source/common/common/assert.h:59] #14 std::__1::__invoke_void_return_wrapper<>::__call[abi:nqe220108]<>() [0x55c26d2a3656]
2026-08-11T21:28:42.6158544Z [2026-08-11 21:28:39.518][2905][error][envoy_bug] [./source/common/common/assert.h:59] #15 std::__1::__invoke_r[abi:nqe220108]<>() [0x55c26d2a3606]
2026-08-11T21:28:42.6159074Z ==================
2026-08-11T21:28:42.6159415Z WARNING: ThreadSanitizer: signal-unsafe call inside of a signal (pid=2432)
2026-08-11T21:28:42.6159990Z     #0 <null> <null> (ssl_integration_test+0x3233760) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6160553Z     #1 <null> <null> (libc.so.6+0x39f23) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
2026-08-11T21:28:42.6161087Z     #2 <null> <null> (ssl_integration_test+0x323dcb8) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6161626Z     #3 <null> <null> (ssl_integration_test+0x86006d7) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6162152Z     #4 <null> <null> (ssl_integration_test+0x8600e29) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6162945Z     #5 <null> <null> (ssl_integration_test+0x8645ec9) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6163488Z     #6 <null> <null> (ssl_integration_test+0x8644863) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6164183Z     #7 <null> <null> (ssl_integration_test+0x86bee6a) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6164738Z     #8 <null> <null> (ssl_integration_test+0x86bfb29) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6165282Z     #9 <null> <null> (ssl_integration_test+0x86bfac5) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6165829Z     #10 <null> <null> (ssl_integration_test+0x86bfa75) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6166395Z     #11 <null> <null> (ssl_integration_test+0x86bfa25) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6166934Z     #12 <null> <null> (ssl_integration_test+0x86bf8b9) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6167584Z     #13 <null> <null> (ssl_integration_test+0x33f686a) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6168123Z     #14 <null> <null> (ssl_integration_test+0x33f6795) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6168656Z     #15 <null> <null> (ssl_integration_test+0x8cc8714) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6169191Z     #16 <null> <null> (ssl_integration_test+0x8cc86a5) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6169716Z     #17 <null> <null> (ssl_integration_test+0x8cc8655) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6170247Z     #18 <null> <null> (ssl_integration_test+0x8cc8605) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6170776Z     #19 <null> <null> (ssl_integration_test+0x8cc83e9) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6171308Z     #20 <null> <null> (ssl_integration_test+0x33f686a) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6171845Z     #21 <null> <null> (ssl_integration_test+0x33f6795) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6172484Z     #22 <null> <null> (ssl_integration_test+0x9333fee) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6173028Z     #23 <null> <null> (ssl_integration_test+0x9333f58) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6173556Z     #24 <null> <null> (ssl_integration_test+0xa0dbf82) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6174085Z     #25 <null> <null> (ssl_integration_test+0xa0d28cf) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6174620Z     #26 <null> <null> (ssl_integration_test+0xa0d0727) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6175148Z     #27 <null> <null> (ssl_integration_test+0x9327c9f) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6175682Z     #28 <null> <null> (ssl_integration_test+0x8cbe0d3) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6176218Z     #29 <null> <null> (ssl_integration_test+0x50b7a95) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6176744Z     #30 <null> <null> (ssl_integration_test+0x50bc5fb) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6177279Z     #31 <null> <null> (ssl_integration_test+0x50bc575) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6177810Z     #32 <null> <null> (ssl_integration_test+0x50bc525) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6178337Z     #33 <null> <null> (ssl_integration_test+0x50bc4d5) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6178866Z     #34 <null> <null> (ssl_integration_test+0x50bc2c9) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6179394Z     #35 <null> <null> (ssl_integration_test+0x33f686a) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6179927Z     #36 <null> <null> (ssl_integration_test+0x33f6795) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6180461Z     #37 <null> <null> (ssl_integration_test+0xa093c4a) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6180991Z     #38 <null> <null> (ssl_integration_test+0xa093b09) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6181665Z     #39 <null> <null> (ssl_integration_test+0x3235a07) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f)
2026-08-11T21:28:42.6181981Z 
2026-08-11T21:28:42.6183039Z SUMMARY: ThreadSanitizer: signal-unsafe call inside of a signal (/mnt/engflow/worker/work/3/exec/bazel-out/k8-fastbuild/bin/test/common/tls/integration/ssl_integration_test.runfiles/envoy/test/common/tls/integration/ssl_integration_test+0x3233760) (BuildId: f19ca16d6160e85b2f14e0109d7fd46f) 
2026-08-11T21:28:42.6184147Z ==================

at https://github.com/envoyproxy/envoy/actions/runs/31535461828/job/93925722829

Change-Id: I155b874accd54affa65bfa0b744ff99154060570
Signed-off-by: Ethan Truong <ethantruong@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant