From: Michael Brown <mcb30@ipxe.org>
Date: Mon, 6 Jul 2026 11:14:34 +0000 (+0100)
Subject: [tls] Send closure alert only when we are initiating the closure
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2476e43bcf304f61704bb41bfde67dfd862cd091;p=thirdparty%2Fipxe.git

[tls] Send closure alert only when we are initiating the closure

When the TLS connection is closed by the underlying socket, the
closure alert will not be able to be sent.  This currently results in
a harmless but mildly irritating error message when debugging is
enabled.

Fix by sending the closure alert only when we are actively choosing to
close the connection.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---

diff --git a/src/net/tls.c b/src/net/tls.c
index b37dce75a..a53f8c871 100644
--- a/src/net/tls.c
+++ b/src/net/tls.c
@@ -360,9 +360,6 @@ static void free_tls ( struct refcnt *refcnt ) {
  */
 static void tls_close ( struct tls_connection *tls, int rc ) {
 
-	/* Send closure alert */
-	tls_send_alert ( tls, TLS_ALERT_WARNING, TLS_ALERT_CLOSE_NOTIFY );
-
 	/* Remove pending operations, if applicable */
 	pending_put ( &tls->client.negotiation );
 	pending_put ( &tls->server.negotiation );
@@ -387,6 +384,21 @@ static void tls_close ( struct tls_connection *tls, int rc ) {
 	tls_tx_resume_all ( tls->session );
 }
 
+/**
+ * Send closure alert and finish with TLS connection
+ *
+ * @v tls		TLS connection
+ * @v rc		Status code
+ */
+static void tls_close_alert ( struct tls_connection *tls, int rc ) {
+
+	/* Send closure alert */
+	tls_send_alert ( tls, TLS_ALERT_WARNING, TLS_ALERT_CLOSE_NOTIFY );
+
+	/* Close connection */
+	tls_close ( tls, rc );
+}
+
 /******************************************************************************
  *
  * Key schedule
@@ -3722,7 +3734,7 @@ static struct interface_operation tls_plainstream_ops[] = {
 	INTF_OP ( xfer_window, struct tls_connection *,
 		  tls_plainstream_window ),
 	INTF_OP ( job_progress, struct tls_connection *, tls_progress ),
-	INTF_OP ( intf_close, struct tls_connection *, tls_close ),
+	INTF_OP ( intf_close, struct tls_connection *, tls_close_alert ),
 };
 
 /** TLS plaintext stream interface descriptor */
@@ -3917,7 +3929,7 @@ static int tls_cipherstream_deliver ( struct tls_connection *tls,
 		/* Process data if buffer is now full */
 		if ( iob_tailroom ( dest ) == 0 ) {
 			if ( ( rc = process ( tls ) ) != 0 ) {
-				tls_close ( tls, rc );
+				tls_close_alert ( tls, rc );
 				goto done;
 			}
 		}
@@ -4006,7 +4018,7 @@ static void tls_validator_done ( struct tls_connection *tls, int rc ) {
 	return;
 
  err:
-	tls_close ( tls, rc );
+	tls_close_alert ( tls, rc );
 	return;
 }
 
@@ -4135,7 +4147,7 @@ static void tls_tx_step ( struct tls_connection *tls ) {
 	return;
 
  err:
-	tls_close ( tls, rc );
+	tls_close_alert ( tls, rc );
 }
 
 /** TLS TX process descriptor */