Repository navigation
Conversation
When the client rejects the server certificate, BCJSSE buffers the fatal alert and stores the failure: the next wrap() throws it, and only the wrap() after that emits the alert. doShutdown gave up after the first wrap() threw, so the alert was never sent. A server whose client kept the TCP socket open then blocked in accept indefinitely. Before 0.19.2 the server did not hang, but only because shutdown re-sent stale output (the ClientHello and zero bytes), which the server rejected. doShutdown now wraps once more after an SSLException while outbound is not done, which flushes the buffered alert; the server fails with certificate_unknown.
toabctl
force-pushed
the
wt-fix-shutdown-alert
branch
from
November 2, 2026 13:43
6fb8358 to
62d1687
Compare
This was referenced Nov 3, 2026
Member
|
thanks included your commit #402 with some further changes, closing as duplicate |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #399.
When the client rejects the server certificate, BCJSSE throws the stored handshake failure on the first
wrap()and emits the buffered alert only on the next one.doShutdownstopped after the first, so the alert was never sent and the server'sacceptblocked while the client kept its socket open.doShutdownnow wraps once more after anSSLException.Adds
test_client_verify_failure_sends_alert_to_server(TLS 1.2 and 1.3). It fails without the change;test/ssl/test_ssl.rband the othertest/sslfiles pass with it (JRuby 10, OpenJDK 21).