pyca / pyca/pyopenssl

Connection.shutdown docs and test don't quite match OpenSSL

Open
#472 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
944
Forks
440
Avg merge
1d 6h
Merged PRs (30d)
6

Description

The docs for shutdown say:

        :return: True if the shutdown completed successfully (i.e. both sides
                 have sent closure alerts), false otherwise (i.e. you have to
                 wait for a ZeroReturnError on a recv() method call

The test_shutdown test behaves accordingly.

This isn't quite how OpenSSL expects you to call SSL_shutdown. If you care about sending AND receiving close_notify, and the first successful SSL_shutdown returned 0, you call SSL_shutdown twice. The second success will return 1. (Or the first success may return 1 if you got a close_notify already. Then you only need to call it once.)
https://www.openssl.org/docs/manmaster/ssl/SSL_shutdown.html

The documentation also suggests that you always should drive the shutdown to fully complete, but most applications do not care. It's just for reusing the transport, which no one does. (Think inverse of STARTTLS.) The spec says:

It is not required for the initiator of the close to wait for the responding close_notify alert before closing the read side of the connection.

If the application protocol using TLS provides that any data may be carried over the underlying transport after the TLS connection is closed, the TLS implementation must receive the responding close_notify alert before indicating to the application layer that the TLS connection has ended. If the application protocol will not transfer any additional data, but will only close the underlying transport connection, then the implementation MAY choose to close the transport without waiting for the responding close_notify. No part of this standard should be taken to dictate the manner in which a usage profile for TLS manages its data transport, including when connections are opened or closed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Connection.shutdown documentation and the test_shutdown test, then compare their stated behavior with the linked OpenSSL SSL_shutdown reference. Update the documentation and test expectations so they accurately describe the one- or two-call shutdown behavior and when waiting for the peer close_notify is optional.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.