commit a9e3c65d22ad68b994ad7046b243ae459b242ffa
author Maxim Dounin <mdounin@mdounin.ru> Thu Sep 01 13:49:36 2011 +0000
committer Maxim Dounin <mdounin@mdounin.ru> Thu Sep 01 13:49:36 2011 +0000
tree 2f85abde47a6c502afa67a0e8dfe96fc59dbf8f7
parent 09be2f18c55ac403cbc9103f47ea5e5c9e8604fa

Proper SSL shutdown handling.

If connection has unsent alerts, SSL_shutdown() tries to send them even
if SSL_set_shutdown(SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN) was used.
This can be prevented by SSL_set_quiet_shutdown().  SSL_set_shutdown()
is required nevertheless to preserve session.

src/event/ngx_event_openssl.c

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index bb68948..259b1d8 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1205,6 +1205,7 @@
 
     if (c->timedout) {
         mode = SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN;
+        SSL_set_quiet_shutdown(c->ssl->connection, 1);
 
     } else {
         mode = SSL_get_shutdown(c->ssl->connection);
@@ -1216,6 +1217,10 @@
         if (c->ssl->no_send_shutdown) {
             mode |= SSL_SENT_SHUTDOWN;
         }
+
+        if (c->ssl->no_wait_shutdown && c->ssl->no_send_shutdown) {
+            SSL_set_quiet_shutdown(c->ssl->connection, 1);
+        }
     }
 
     SSL_set_shutdown(c->ssl->connection, mode);