Skip to content
This repository has been archived by the owner on Mar 21, 2020. It is now read-only.

SSL_shutdown is incorrectly handled #94

Open
jgrahamc opened this issue Dec 12, 2014 · 3 comments
Open

SSL_shutdown is incorrectly handled #94

jgrahamc opened this issue Dec 12, 2014 · 3 comments

Comments

@jgrahamc
Copy link
Contributor

The return code from SSL_shutdown in kssl_thread.c is not correctly handled. In particular, the WANT_READ/WANT_WRITE return codes are not being handled and this could result in a dirty connection shutdown.

We need to correctly handle those conditions and wait for SSL_shutdown to return 1 before killing the TCP connection.

@jgrahamc
Copy link
Contributor Author

Worth seeing here how this is handled by a different project: https://github.com/droe/sslsplit/blob/master/pxysslshut.c

@jgrahamc
Copy link
Contributor Author

From the OpenSSL documentation:

   If the underlying BIO is non-blocking, SSL_shutdown() will also return
   when the underlying BIO could not satisfy the needs of SSL_shutdown()
   to continue the handshake. In this case a call to SSL_get_error() with
   the return value of SSL_shutdown() will yield SSL_ERROR_WANT_READ or
   SSL_ERROR_WANT_WRITE. The calling process then must repeat the call
   after taking appropriate action to satisfy the needs of SSL_shutdown().
   The action depends on the underlying BIO. When using a non-blocking
   socket, nothing is to be done, but select() can be used to check for
   the required condition. When using a buffering BIO, like a BIO pair,
   data must be written into or retrieved out of the BIO before being able
   to continue.

@jgrahamc
Copy link
Contributor Author

See : #93

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant