SSL_shutdown() return value <0

[Jan Prachař]

Hello, I would like to ask about this piece of code from function
ngx_ssl_shutdown:

    n = SSL_shutdown(c->ssl->connection);

    sslerr = 0;

    /* before 0.9.8m SSL_shutdown() returned 0 instead of -1 on errors
*/

    if (n != 1 && ERR_peek_error()) {
        sslerr = SSL_get_error(c->ssl->connection, n);
    }



Why don't you check SSL_get_error always if n < 0, but only if also
ERR_peer_error() returns non-zero value?

According to a documentation of SSL_shutdown, you should check result
of SSL_get_error() and take appropriate action if it returns
SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE,e.g. call SSL_shutdown
again, if SSL_shutdown would block on writing to SSL connection.

If ERR_peek_error() is not zero, which mean some internal OpenSSL error
occured, SSL_get_error will return SSL_ERROR_SSL, won't it?

I have also tried to change the condition to just n < 0, and came to
antoher issue. If client closes connection prematurely, there is
usually SSL_write, that has failed with error WANT_WRITE. If then the
SSL_shutdown is called repeatedly, it causes OpenSSL error (SSL:
error:1409F07F:SSL routines:ssl3_write_pending:bad write retry),
because pending SSL_write should have been called first.

Best regards,
Jan Prachař