libtls - fragile SSL_read()=0 about openbsd HOT 5 CLOSED

The only time libtls calls ERR_* is if we got a SSL_ERROR_SYSCALL or SSL_ERROR_SSL error code. I would think that calling ERR_* on EOF is actually the wrong thing to be doing.

from openbsd.

Well, thats how SSL_read()=0 is documented:

Call SSL_get_error() with the return value ret to find out, whether an error occurred or the connection was shut down cleanly (SSL_ERROR_ZERO_RETURN).

Either libssl always calls SSLerr() when it return 0, or libtls needs to clear error before calling SSL_read().

Alternative is also not to look at error on '0' return , always assume it's EOF. I suspect this may be quite popular solution.

from openbsd.

It is reproducible with libressl too - just put:

SSLerr(SSL_F_SSL3_CONNECT, SSL_R_COOKIE_MISMATCH);

before calling tls_read() and see what happens.

from openbsd.

I'm laughing at Joel, and he's crying..

we'll clear it..

On Sat, Sep 12, 2015 at 12:04:51PM -0700, Marko Kreen wrote:

It is reproducible with libressl too - just put:

SSLerr(SSL_F_SSL3_CONNECT, SSL_R_COOKIE_MISMATCH);

before calling tls_read() and see what happens.

---

Reply to this email directly or view it on GitHub:
#44 (comment)

from openbsd.

Fixed, thanks.

from openbsd.