libfetch: Apply timeout to SSL handshake

[des]

Summary

When the SSL handshake cannot proceed because the server is slow to
respond, poll() with a timeout instead of spinning.

MFC after: 1 week
PR: 298962
Event: Oslo Hackathon 2026

[markj]

lib/libfetch/common.c

1280

The caller of fetch_ssl() ignores the errno value upon failure, it hard-codes errno = EAUTH. So the error here gets clobbered.

1289

Is this a debug print?

[ngie]

lib/libfetch/common.c

1257–1277

Using clock_gettime(CLOCK_MONOTONIC, ...) avoids issues with daylight savings, etc.

[ngie]

lib/libfetch/common.c

1257–1277

Using clock_gettime(CLOCK_MONOTONIC, ...) avoids issues with daylight savings, etc.

I forgot to use TIMEVAL_TO_TIMESPEC/TIMESPEC_TO_TIMEVAL, so my suggestion will fail to compile. If you do what's needed to convert back and forth, your solution will work where mine didn't.

The basic gist of what I was trying to suggest is that the proposed change is not resilient against ntp-based changes, timezone stepping, etc, so code (if deployed) will not work properly in these scenarios.

[des]

lib/libfetch/common.c

1257–1277

gettimeofday(2) is unaffected by time zones and DST.

1280

Yes. I intend to change that eventually.

1289

No, it's deliberate

[ngie]

lib/libfetch/common.c

1257–1277

gettimeofday(2) is unaffected by time zones and DST.

Ok, fair. You specified tz = NULL, which forces the syscall to use UTC. That being said:

1. gettimeofday(2) is deprecated per POSIX 2024 in favor of clock_gettime (no longer shows up in the latest version of the POSIX spec: https://pubs.opengroup.org/onlinepubs/9799919799/).
2. gettimeofday(2) is not resilient against time jumps, e.g., adjtime being called by the administrator, as shown below:

% cat gettimeofday_is_adjtime_vulnerable.c 
#include <sys/time.h>
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>

int
main(void)
{
        struct timeval tv1, tv2;
        char buf[128]; // XXX: slop
        struct tm *tm1, *tm2;
        time_t t1, t2;

        assert(geteuid() == 0);

        setenv("TZ", "", 1);

        printf("stopping ntpd and setting system time to NTP-provided date using ntpdate\n");
        system("service ntpd stop; sudo ntpdate -b 2.freebsd.pool.ntp.org");

        assert(gettimeofday(&tv1, NULL) == 0);
        t1 = tv1.tv_sec;
        tm1 = gmtime(&t1);
        strftime(buf, sizeof(buf), "%Y-%m-%d %H:%M:%S", tm1);
        printf("old time is %s (UTC)\n", buf);

        // party like it's 1999.
        assert(system("date -f %Y%m%d%H%M 199912312359") == 0);

        assert(gettimeofday(&tv2, NULL) == 0);
        t2 = tv2.tv_sec;
        tm2 = gmtime(&t2);
        strftime(buf, sizeof(buf), "%Y-%m-%d %H:%M:%S", tm2);
        printf("new time is %s (UTC)\n", buf);

        assert(t2 < t1);

        printf("resetting system time to NTP-provided date and restarting ntpd\n");
        system("ntpdate -b 0.freebsd.pool.ntp.org; service ntpd start");

        return (0);
}

% sudo ./gettimeofday_is_adjtime_vulnerable
stopping ntpd and setting system time to NTP-provided date using ntpdate
Stopping ntpd.
Waiting for PIDS: 53772.
30 Oct 10:22:37 ntpdate[53843]: step time server 54.39.104.183 offset +0.023715 sec
old time is 2026-10-30 10:22:37 (UTC)
Fri Dec 31 23:59:37 UTC 1999
new time is 1999-12-31 23:59:37 (UTC)
resetting system time to NTP-provided date and restarting ntpd
30 Oct 10:22:43 ntpdate[53845]: step time server 142.4.192.253 offset +846670980.773019 sec
Starting ntpd.

[des]

lib/libfetch/common.c

1257–1277

Ok, fair. You specified tz = NULL, which forces the syscall to use UTC

The kernel has no notion of timezones and gettimeofday() is entirely unaffected by them. Please stop treating code review as performance art. Your input was not requested.

[markj]

lib/libfetch/common.c

1280

That strikes me as a bug in the patch, http_connect() will report timeout errors as FETCH_AUTH errors. But ok.

1285

I think this can be one line.

1289

Ok, I guess it doesn't matter given that http_connect() forces the error to FETCH_AUTH.