Handle SSL_shutdown while in init more appropriately
Calling SSL_shutdown while in init previously gave a "1" response, meaning everything was successfully closed down (even though it wasn't). Better is to send our close_notify, but fail when trying to receive one. The problem with doing a shutdown while in the middle of a handshake is that once our close_notify is sent we shouldn't really do anything else (including process handshake/CCS messages) until we've received a close_notify back from the peer. However the peer might send a CCS before acting on our close_notify - so we won't be able to read it because we're not acting on CCS messages! Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
This commit is contained in:
@@ -1564,10 +1564,7 @@ int SSL_shutdown(SSL *s)
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!SSL_in_init(s))
|
||||
return (s->method->ssl_shutdown(s));
|
||||
else
|
||||
return (1);
|
||||
return s->method->ssl_shutdown(s);
|
||||
}
|
||||
|
||||
int SSL_renegotiate(SSL *s)
|
||||
|
Reference in New Issue
Block a user