The branch master has been updated
via bac6abe18d28373e0d2d0666c411020404197337 (commit)
from 180794c54e98ae467c4ebced3737e1ede03e320a (commit)
- Log -----------------------------------------------------------------
commit bac6abe18d28373e0d2d0666c411020404197337
Author: Matt Caswell <[email protected]>
Date: Mon Sep 4 11:20:27 2017 +0100
Allow an endpoint to read the alert data before closing the socket
If an alert gets sent and then we close the connection immediately with
data still in the input buffer then a TCP-RST gets sent. Some OSs
immediately abandon data in their input buffer if a TCP-RST is received -
meaning the alert data itself gets ditched. Sending a TCP-FIN before the
TCP-RST seems to avoid this.
This was causing test failures in MSYS2 builds.
Reviewed-by: Rich Salz <[email protected]>
Reviewed-by: Ben Kaduk <[email protected]>
(Merged from https://github.com/openssl/openssl/pull/4333)
-----------------------------------------------------------------------
Summary of changes:
apps/s_socket.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/apps/s_socket.c b/apps/s_socket.c
index 3bdb587..2f3e90b 100644
--- a/apps/s_socket.c
+++ b/apps/s_socket.c
@@ -221,6 +221,23 @@ int do_server(int *accept_sock, const char *host, const
char *port,
break;
}
i = (*cb)(sock, type, protocol, context);
+ /*
+ * If we ended with an alert being sent, but still with data in the
+ * network buffer to be read, then calling BIO_closesocket() will
+ * result in a TCP-RST being sent. On some platforms (notably
+ * Windows) then this will result in the peer immediately
abandoning
+ * the connection including any buffered alert data before it has
+ * had a chance to be read. Shutting down the sending side first,
+ * and then closing the socket sends TCP-FIN first followed by
+ * TCP-RST. This seems to allow the peer to read the alert data.
+ */
+#ifdef _WIN32
+# ifdef SD_SEND
+ shutdown(sock, SD_SEND);
+# endif
+#elif defined(SHUT_WR)
+ shutdown(sock, SHUT_WR);
+#endif
BIO_closesocket(sock);
} else {
i = (*cb)(asock, type, protocol, context);
_____
openssl-commits mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
