- Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option

  to ignore the unexpected eof while reading in openssl >= 3.

diff --git a/doc/Changelog b/doc/Changelog
index 62d2b4c8419af3b10c954ffa090a18c93a68e565..25b63ce76ceda9401b933370efdba516ec1fda6d 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+17 March 2023: George
+       - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option
+         to ignore the unexpected eof while reading in openssl >= 3.
+
 16 March 2023: Wouter
        - Fix ssl.h include brackets, instead of quotes.
 

diff --git a/util/net_help.c b/util/net_help.c
index 54fad6986f3c6b2213761f91163abd6f15d5db29..de2d771bdc4ddb53c8b8ada345104a2962edc123 100644 (file)
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -1005,6 +1005,16 @@ listen_sslctx_setup(void* ctxt)
                        log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
        }
 #endif
+#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
+       /* ignore errors when peers do not send the mandatory close_notify
+        * alert on shutdown.
+        * Relevant for openssl >= 3 */
+       if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
+               SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
+               log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
+               return 0;
+       }
+#endif
 
        if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) &
                SSL_OP_CIPHER_SERVER_PREFERENCE) !=
@@ -1233,6 +1243,17 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert)
                SSL_CTX_free(ctx);
                return 0;
        }
+#endif
+#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
+       /* ignore errors when peers do not send the mandatory close_notify
+        * alert on shutdown.
+        * Relevant for openssl >= 3 */
+       if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
+               SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
+               log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
+               SSL_CTX_free(ctx);
+               return 0;
+       }
 #endif
        if(key && key[0]) {
                if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) {