ProxySQL .NET client libraries reporting "Received an unexpected EOF or 0 bytes from the transport stream" when attempting to connect about proxysql HOT 1 OPEN

The underlying pathology of this took some digging. All of the following need to be true:

• The .NET client has made a TLS connection to proxysql in the recent past (connstr contains SslMode=Required
• The .NET client needs to make another connection (either the connection pool is full, or connstr contains Pooling=False)
• MS does a bunch of TLS caching (https://learn.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings?tabs=diffie-hellman)

This shows up on the Windows side as a warning in the System event log (se attached):

The remote server has requested TLS client authentication, but no suitable client certificate could be found. An anonymous connection will be attempted. This TLS connection request may succeed or fail, depending on the server's policy settings.

I suspect that this very esoteric bug started when this was merged: 28f09bf

which causes this code branch to execute:

and the MS client-side TLS caching is behaving very badly in the event that something about the TLS has changed (perhaps getting the tmp context insted of the global one or something - it's impossible to tell without looking at the source code)

After several days of soak-testing, I have a one-line fix for this:

--- a/src/proxy_tls.cpp
+++ b/src/proxy_tls.cpp
@@ -477,7 +477,8 @@ int ProxySQL_create_or_load_TLS(bool bootstrap, std::string& msg) {
                }
        }
        if (ret == 0) {
-               SSL_CTX_set_verify(GloVars.global.ssl_ctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, callback_ssl_verify_peer);
+               // https://github.com/sysown/proxysql/issues/4419
+               SSL_CTX_set_verify(GloVars.global.ssl_ctx, SSL_VERIFY_NONE, callback_ssl_verify_peer);
        }
        X509_free(x509);
        EVP_PKEY_free(pkey);

In other words, do not perform any peer verification at all (https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_set_verify.html).

This is benign (currently) because of the current implementation of callback_ssl_verify_peer():

int callback_ssl_verify_peer(int ok, X509_STORE_CTX* ctx) {
        // for now only return 1
        return 1;
}

This fix has withstood 48-hours of soak-testing under significant load (ubuntu 20.04 and ubuntu 22.04).

I'll raise a PR

from proxysql.