diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2020-09-16 18:26:22 +0300 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2020-09-16 18:26:22 +0300 |
| commit | 82cf625ab51dbed91bc38bdbc21ba192df2dd4d4 (patch) | |
| tree | fa1e3d50fd8275d53fb98120e913946184571973 /src/http/ngx_http_request.c | |
| parent | dc1b14126e0a7a45018d95b149ebdb29985f18f1 (diff) | |
| download | nginx-82cf625ab51dbed91bc38bdbc21ba192df2dd4d4.tar.gz nginx-82cf625ab51dbed91bc38bdbc21ba192df2dd4d4.zip | |
SSL: workaround for incorrect SSL_write() errors in OpenSSL 1.1.1.
OpenSSL 1.1.1 fails to return SSL_ERROR_SYSCALL if an error happens
during SSL_write() after close_notify alert from the peer, and returns
SSL_ERROR_ZERO_RETURN instead. Broken by this commit, which removes
the "i == 0" check around the SSL_RECEIVED_SHUTDOWN one:
https://git.openssl.org/?p=openssl.git;a=commitdiff;h=8051ab2
In particular, if a client closed the connection without reading
the response but with properly sent close_notify alert, this resulted in
unexpected "SSL_write() failed while ..." critical log message instead
of correct "SSL_write() failed (32: Broken pipe)" at the info level.
Since SSL_ERROR_ZERO_RETURN cannot be legitimately returned after
SSL_write(), the fix is to convert all SSL_ERROR_ZERO_RETURN errors
after SSL_write() to SSL_ERROR_SYSCALL.
Diffstat (limited to 'src/http/ngx_http_request.c')
0 files changed, 0 insertions, 0 deletions