Skip to content

Commit c7d491e

Browse files
committed
SSL connection shutdown should be quiet.
Server doesn't do the complete SSL shutdown, so we shoulld behave the same. This Fix the SIGABRT issue found on FreeBSD. (cherry picked from commit 0e799530caf759f104e6c3e233d4b306d6e14d7e)
1 parent c7f1373 commit c7d491e

File tree

2 files changed

+16
-2
lines changed

2 files changed

+16
-2
lines changed

cdk/foundation/connection_openssl.cc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,15 @@ class connection_TLS_impl
272272
{
273273
if (m_tls)
274274
{
275+
/*
276+
THE SSL standard says that SSL sockets must send and receive a close_notify
277+
alert on socket shutdown to avoid truncation attacks. However, this can
278+
cause problems since we often hold a lock during shutdown and this IO can
279+
take an unbounded amount of time to complete. Since our packets are self
280+
describing with length, we aren't vunerable to these attacks. Therefore,
281+
we just shutdown by closing the socket (quiet shutdown).
282+
*/
283+
SSL_set_quiet_shutdown(m_tls, 1);
275284
SSL_shutdown(m_tls);
276285
SSL_free(m_tls);
277286
}

cdk/foundation/connection_tcpip_base.h

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,13 @@ class Socket_base::Impl
7676
catch (...)
7777
{
7878
}
79-
80-
detail::close(m_sock);
79+
try
80+
{
81+
detail::close(m_sock);
82+
}
83+
catch (...)
84+
{
85+
}
8186
m_sock = detail::NULL_SOCKET;
8287
}
8388
}

0 commit comments

Comments
 (0)