fix(ssl): eliminate coredump under HTTPS + multi-thread, harden server

Repros (kMultiThread + InitSSL + concurrent ab):
- HttpServer::ssl_sockets_map_ was an unordered_map mutated concurrently
  by Accept/Read/Leave workers, causing rehash-time UAF on the bucket
  array. macOS libmalloc trapped (SIGTRAP) inside the freelist; lldb's
  unordered_map pretty-printer reliably segfaulted while inspecting the
  corrupted map, confirming the data structure itself was torn.

Root causes addressed:
- ssl_sockets_map_ has no synchronization. Add a std::mutex; critical
  sections only touch the map (shared_ptr is copied out and used outside
  the lock so SSL_read/write never run under the map lock).
- SSLSocket ctor checked the member mode_ before assigning it, so
  pmutex_ was never created and the kSafely lock was silently disabled
  even when explicitly requested. Move the assignment before the check.
- HandleAccept now passes SSLSocket::Mode::kSafely so the per-SSL* mutex
  actually serializes future concurrent SSL_read/write on the same
  session, in addition to the map lock.

Additional robustness (orthogonal but surfaced by the same stress test):
- SIGPIPE killed the entire server when a peer hung up mid-write. Ignore
  it once in TcpServer::Init via std::call_once, but only if the user
  has not installed their own handler (probe with sigaction + SIG_DFL),
  so the library does not stomp user signal policy.
- SSL_accept blocked workers (and the single event loop in
  kIOMultiplexing mode) indefinitely on silent/stalled clients. Apply a
  bounded read timeout (default 10s, configurable via
  SetSSLHandshakeTimeout) before SSL_accept and restore the user's
  read_timeout_ for the actual request afterwards.

Verified on macOS arm64:
- Before: ab -n 2000 -c 100 -> SIGTRAP at ~15 requests.
- After:  3000 concurrent curls -> 2996/2999 200 OK, server alive.
          10 stalled TCP-only connections no longer starve workers;
          a legitimate curl is served within ~1.5s (handshake timeout
          reclaims a worker), instead of hanging forever.

Author: chenxuan520

src/cppnet/http/server/http_server.cpp

@@ -259,26 +259,49 @@ void HttpServer::HandleAccept(TcpServer &server, Socket &event_soc) {
   logger_->Debug("accept from " + recv_addr.ToString() +
                  " soc: " + std::to_string(event_soc.fd()));
 
-  if (read_timeout_.first != 0 || read_timeout_.second != 0) {
-    event_soc.SetReadTimeout(read_timeout_.first, read_timeout_.second);
-  }
   if (write_timeout_.first != 0 || write_timeout_.second != 0) {
     event_soc.SetWriteTimeout(write_timeout_.first, write_timeout_.second);
   }
 
 #ifdef CPPNET_OPENSSL
   if (ssl_context_) {
-    auto ssl_socket = ssl_context_->AcceptSSL(event_soc);
+    // Apply a bounded read timeout BEFORE SSL_accept so a silent client
+    // cannot block this worker (or the single event loop) indefinitely.
+    if (ssl_handshake_timeout_sec_ > 0) {
+      event_soc.SetReadTimeout(ssl_handshake_timeout_sec_, 0);
+    }
+    // kSafely so concurrent SSL_read/write on the same SSL* is serialized
+    // (needed in any multi-threaded layout above us).
+    auto ssl_socket =
+        ssl_context_->AcceptSSL(event_soc, SSLSocket::Mode::kSafely);
     if (ssl_socket == nullptr) {
       logger_->Error("[ssl_context.AcceptSSL]:" + ssl_context_->err_msg() +
                      " soc:" + std::to_string(event_soc.fd()));
       server.RemoveSoc(event_soc);
       event_soc.Close();
       return;
     }
-    ssl_sockets_map_[event_soc.fd()] = ssl_socket;
+    {
+      std::lock_guard<std::mutex> g(ssl_sockets_map_mtx_);
+      ssl_sockets_map_[event_soc.fd()] = ssl_socket;
+    }
+    // Restore the user-configured read timeout for the actual HTTP request
+    // reading (0/0 means "no timeout", matching the original default).
+    if (ssl_handshake_timeout_sec_ > 0) {
+      event_soc.SetReadTimeout(read_timeout_.first, read_timeout_.second);
+    }
   }
 #endif
+
+  // For non-SSL path the read timeout has not been set above; do it now so
+  // both code paths end up with the same socket configuration.
+  if (
+#ifdef CPPNET_OPENSSL
+      !ssl_context_ &&
+#endif
+      (read_timeout_.first != 0 || read_timeout_.second != 0)) {
+    event_soc.SetReadTimeout(read_timeout_.first, read_timeout_.second);
+  }
 }
 
 void HttpServer::HandleLeave(TcpServer &server, Socket &event_soc) {
@@ -287,10 +310,19 @@ void HttpServer::HandleLeave(TcpServer &server, Socket &event_soc) {
   logger_->Debug("leave from " + recv_addr.ToString() +
                  " soc: " + std::to_string(event_soc.fd()));
 #ifdef CPPNET_OPENSSL
-  if (ssl_context_ &&
-      ssl_sockets_map_.find(event_soc.fd()) != ssl_sockets_map_.end()) {
-    ssl_sockets_map_[event_soc.fd()]->CloseSSL();
-    ssl_sockets_map_.erase(event_soc.fd());
+  if (ssl_context_) {
+    std::shared_ptr<SSLSocket> ssl_soc;
+    {
+      std::lock_guard<std::mutex> g(ssl_sockets_map_mtx_);
+      auto it = ssl_sockets_map_.find(event_soc.fd());
+      if (it != ssl_sockets_map_.end()) {
+        ssl_soc = it->second;
+        ssl_sockets_map_.erase(it);
+      }
+    }
+    if (ssl_soc) {
+      ssl_soc->CloseSSL();
+    }
   }
 #endif
 }
@@ -302,14 +334,15 @@ void HttpServer::HandleRead(TcpServer &server, Socket &event_soc) {
 
 #ifdef CPPNET_OPENSSL
   if (ssl_context_) {
-    if (ssl_sockets_map_.find(event_soc.fd()) != ssl_sockets_map_.end()) {
-      soc = ssl_sockets_map_[event_soc.fd()];
-    } else {
+    std::lock_guard<std::mutex> g(ssl_sockets_map_mtx_);
+    auto it = ssl_sockets_map_.find(event_soc.fd());
+    if (it == ssl_sockets_map_.end()) {
       logger_->Error("[logicerr]:ssl socket not found");
       server.RemoveSoc(event_soc);
       event_soc.Close();
       return;
     }
+    soc = it->second;
   } else {
     soc = std::make_shared<Socket>(event_soc);
   }
@@ -463,6 +496,10 @@ void HttpServer::SetWriteTimeout(unsigned timeout_sec, unsigned timeout_usec) {
   write_timeout_ = std::make_pair(timeout_sec, timeout_usec);
 }
 
+void HttpServer::SetSSLHandshakeTimeout(unsigned timeout_sec) {
+  ssl_handshake_timeout_sec_ = timeout_sec;
+}
+
 #ifdef CPPNET_OPENSSL
 int HttpServer::InitSSL(const Address &addr,
                         std::shared_ptr<SSLContext> ssl_context) {

src/cppnet/http/server/http_server.hpp

@@ -12,6 +12,7 @@
 
 #ifdef CPPNET_OPENSSL
 #include "../../ssl/ssl_context.hpp"
+#include <mutex>
 #include <unordered_map>
 #endif
 
@@ -228,6 +229,14 @@ class HttpServer : public HttpGroup {
    * @param: 0 stand for block until end
    */
   void SetWriteTimeout(unsigned timeout_sec, unsigned timeout_usec);
+  /**
+   * @brief: set bounded SSL handshake read timeout (seconds).
+   *         A slow or silent client must not be allowed to block the worker
+   *         thread (or the single event loop) forever during SSL_accept.
+   *         Pass 0 to disable (NOT recommended for production).
+   *         Default: 10 seconds. Only effective in SSL mode.
+   */
+  void SetSSLHandshakeTimeout(unsigned timeout_sec);
 
 #ifdef CPPNET_OPENSSL
 public:
@@ -242,6 +251,11 @@ class HttpServer : public HttpGroup {
 
 private:
   std::shared_ptr<SSLContext> ssl_context_ = nullptr;
+  // Map of fd -> SSLSocket. Accessed concurrently by worker threads in
+  // kMultiThread mode (Accept/Read/Leave each touch the map); the mutex
+  // serializes those accesses. Critical sections only touch the map itself:
+  // the shared_ptr is copied out and used outside the lock.
+  std::mutex ssl_sockets_map_mtx_;
   std::unordered_map<int, std::shared_ptr<SSLSocket>> ssl_sockets_map_;
 #endif
 
@@ -259,6 +273,8 @@ class HttpServer : public HttpGroup {
   bool is_continue_ = false;
   std::pair<int, int> read_timeout_{0, 0};
   std::pair<int, int> write_timeout_{0, 0};
+  // Sane default so a stalled SSL handshake cannot pin a worker forever.
+  unsigned ssl_handshake_timeout_sec_ = 10;
 };
 
 } // namespace cppnet

src/cppnet/server/tcp_server.cpp

@@ -2,11 +2,37 @@
 #include "../utils/const.hpp"
 #include "io_multiplexing/io_multiplexing_factory.hpp"
 
+#include <mutex>
 #include <string.h>
 #include <unistd.h>
 
+#ifndef _WIN32
+#include <signal.h>
+#endif
+
 namespace cppnet {
 
+namespace {
+// Ignore SIGPIPE once, process-wide. Without this, writing to a peer that has
+// closed the connection raises SIGPIPE and kills the entire server. Be polite:
+// if the user has already installed their own handler we leave it alone.
+void EnsureSigPipeIgnored() {
+#ifndef _WIN32
+  static std::once_flag once;
+  std::call_once(once, []() {
+    struct sigaction old_action;
+    if (sigaction(SIGPIPE, nullptr, &old_action) == 0 &&
+        old_action.sa_handler == SIG_DFL) {
+      struct sigaction action{};
+      action.sa_handler = SIG_IGN;
+      sigemptyset(&action.sa_mask);
+      sigaction(SIGPIPE, &action, nullptr);
+    }
+  });
+#endif
+}
+} // namespace
+
 TcpServer::TcpServer(const std::string &ip, uint16_t port) : addr_(ip, port) {}
 
 TcpServer::TcpServer(Address &addr) : addr_(addr) {}
@@ -258,6 +284,7 @@ int TcpServer::WakeUp() {
 }
 
 int TcpServer::Init() {
+  EnsureSigPipeIgnored();
   loop_flag_ = true;
   listenfd_ = CreateSocket();
   if (listenfd_.status() != Socket::kInit) {

src/cppnet/ssl/ssl_socket.cpp

@@ -23,10 +23,13 @@ SSLSocket::SSLSocket(SSL *ssl, const Socket &soc, Mode mode) {
   SSL_set_fd(ssl_, fd_);
   status_ = kInit;
 
+  // NOTE: assign mode_ BEFORE checking it; previously the check used the
+  // default-initialized mode_ (kQuickly) and pmutex_ was never created,
+  // silently disabling the SSL serialization lock.
+  mode_ = mode;
   if (mode_ == Mode::kSafely) {
     pmutex_ = std::make_unique<std::mutex>();
   }
-  mode_ = mode;
 }
 
 int SSLSocket::Close() {