mirror/mongoose
1
0
Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2025-06-13 13:29:03 +08:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

Securely close SSL conection

Browse Source 
For SSL in close_connection, current implementation use close_socket_gracefully to close socket firstly, then SSL_free. In my
testing, this approach may cause some pending write data missing. I'd suggest use standard SSL_shutdown in SSL conection. It
need call twice according to openSSL manual - one call sends the close_notify alert and one call receives the response from
the peer
This commit is contained in:
jwang 2013-05-17 09:11:54 +08:00
parent add079a949
commit 063b26fece
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
mongoose.c
View File

@ -341,6 +341,7 @@ struct ssl_func {
#define SSLv23_client_method (* (SSL_METHOD * (*)(void)) ssl_sw[17].ptr) #define SSLv23_client_method (* (SSL_METHOD * (*)(void)) ssl_sw[17].ptr)
#define SSL_pending (* (int (*)(SSL *)) ssl_sw[18].ptr) #define SSL_pending (* (int (*)(SSL *)) ssl_sw[18].ptr)
#define SSL_CTX_set_verify (* (void (*)(SSL_CTX *, int, int)) ssl_sw[19].ptr) #define SSL_CTX_set_verify (* (void (*)(SSL_CTX *, int, int)) ssl_sw[19].ptr)
#define SSL_shutdown (* (int (*)(SSL *)) ssl_sw[20].ptr)
#define CRYPTO_num_locks (* (int (*)(void)) crypto_sw[0].ptr) #define CRYPTO_num_locks (* (int (*)(void)) crypto_sw[0].ptr)
#define CRYPTO_set_locking_callback \ #define CRYPTO_set_locking_callback \
@ -375,6 +376,7 @@ static struct ssl_func ssl_sw[] = {
{"SSLv23_client_method", NULL}, {"SSLv23_client_method", NULL},
{"SSL_pending", NULL}, {"SSL_pending", NULL},
{"SSL_CTX_set_verify", NULL}, {"SSL_CTX_set_verify", NULL},
{"SSL_shutdown", NULL},
{NULL, NULL} {NULL, NULL}
}; };
@ -4646,17 +4648,20 @@ static void close_socket_gracefully(struct mg_connection *conn) {
static void close_connection(struct mg_connection *conn) { static void close_connection(struct mg_connection *conn) {
conn->must_close = 1; conn->must_close = 1;
if (conn->client.sock != INVALID_SOCKET) {
close_socket_gracefully(conn);
conn->client.sock = INVALID_SOCKET;
}
#ifndef NO_SSL #ifndef NO_SSL
// Must be done AFTER socket is closed
if (conn->ssl != NULL) { if (conn->ssl != NULL) {
// Run SSL_shutdown twice to ensure completly close SSL connection
SSL_shutdown(conn->ssl);
SSL_shutdown(conn->ssl);
SSL_free(conn->ssl); SSL_free(conn->ssl);
conn->ssl = NULL; conn->ssl = NULL;
} }
#endif #endif
if (conn->client.sock != INVALID_SOCKET) {
close_socket_gracefully(conn);
conn->client.sock = INVALID_SOCKET;
}
} }
void mg_close_connection(struct mg_connection *conn) { void mg_close_connection(struct mg_connection *conn) {