1.\" $OpenBSD: SSL_shutdown.3,v 1.5 2018/03/27 17:35:50 schwarze Exp $ 2.\" OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100 3.\" 4.\" This file was written by Lutz Jaenicke <jaenicke@openssl.org>. 5.\" Copyright (c) 2000, 2001, 2004, 2014 The OpenSSL Project. 6.\" All rights reserved. 7.\" 8.\" Redistribution and use in source and binary forms, with or without 9.\" modification, are permitted provided that the following conditions 10.\" are met: 11.\" 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in 17.\" the documentation and/or other materials provided with the 18.\" distribution. 19.\" 20.\" 3. All advertising materials mentioning features or use of this 21.\" software must display the following acknowledgment: 22.\" "This product includes software developed by the OpenSSL Project 23.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 24.\" 25.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26.\" endorse or promote products derived from this software without 27.\" prior written permission. For written permission, please contact 28.\" openssl-core@openssl.org. 29.\" 30.\" 5. Products derived from this software may not be called "OpenSSL" 31.\" nor may "OpenSSL" appear in their names without prior written 32.\" permission of the OpenSSL Project. 33.\" 34.\" 6. Redistributions of any form whatsoever must retain the following 35.\" acknowledgment: 36.\" "This product includes software developed by the OpenSSL Project 37.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)" 38.\" 39.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50.\" OF THE POSSIBILITY OF SUCH DAMAGE. 51.\" 52.Dd $Mdocdate: March 27 2018 $ 53.Dt SSL_SHUTDOWN 3 54.Os 55.Sh NAME 56.Nm SSL_shutdown 57.Nd shut down a TLS/SSL connection 58.Sh SYNOPSIS 59.In openssl/ssl.h 60.Ft int 61.Fn SSL_shutdown "SSL *ssl" 62.Sh DESCRIPTION 63.Fn SSL_shutdown 64shuts down an active TLS/SSL connection. 65It sends the 66.Dq close notify 67shutdown alert to the peer. 68.Pp 69.Fn SSL_shutdown 70tries to send the 71.Dq close notify 72shutdown alert to the peer. 73Whether the operation succeeds or not, the 74.Dv SSL_SENT_SHUTDOWN 75flag is set and a currently open session is considered closed and good and will 76be kept in the session cache for further reuse. 77.Pp 78The shutdown procedure consists of 2 steps: the sending of the 79.Dq close notify 80shutdown alert and the reception of the peer's 81.Dq close notify 82shutdown alert. 83According to the TLS standard, it is acceptable for an application to only send 84its shutdown alert and then close the underlying connection without waiting for 85the peer's response (this way resources can be saved, as the process can 86already terminate or serve another connection). 87When the underlying connection shall be used for more communications, 88the complete shutdown procedure (bidirectional 89.Dq close notify 90alerts) must be performed, so that the peers stay synchronized. 91.Pp 92.Fn SSL_shutdown 93supports both uni- and bidirectional shutdown by its 2 step behavior. 94.Pp 95When the application is the first party to send the 96.Dq close notify 97alert, 98.Fn SSL_shutdown 99will only send the alert and then set the 100.Dv SSL_SENT_SHUTDOWN 101flag (so that the session is considered good and will be kept in cache). 102.Fn SSL_shutdown 103will then return 0. 104If a unidirectional shutdown is enough 105(the underlying connection shall be closed anyway), this first call to 106.Fn SSL_shutdown 107is sufficient. 108In order to complete the bidirectional shutdown handshake, 109.Fn SSL_shutdown 110must be called again. 111The second call will make 112.Fn SSL_shutdown 113wait for the peer's 114.Dq close notify 115shutdown alert. 116On success, the second call to 117.Fn SSL_shutdown 118will return 1. 119.Pp 120If the peer already sent the 121.Dq close notify 122alert and it was already processed implicitly inside another function 123.Pq Xr SSL_read 3 , 124the 125.Dv SSL_RECEIVED_SHUTDOWN 126flag is set. 127.Fn SSL_shutdown 128will send the 129.Dq close notify 130alert, set the 131.Dv SSL_SENT_SHUTDOWN 132flag and will immediately return with 1. 133Whether 134.Dv SSL_RECEIVED_SHUTDOWN 135is already set can be checked using the 136.Fn SSL_get_shutdown 137(see also the 138.Xr SSL_set_shutdown 3 139call). 140.Pp 141It is therefore recommended to check the return value of 142.Fn SSL_shutdown 143and call 144.Fn SSL_shutdown 145again, if the bidirectional shutdown is not yet complete (return value of the 146first call is 0). 147.Pp 148The behaviour of 149.Fn SSL_shutdown 150additionally depends on the underlying 151.Vt BIO . 152.Pp 153If the underlying 154.Vt BIO 155is 156.Em blocking , 157.Fn SSL_shutdown 158will only return once the 159handshake step has been finished or an error occurred. 160.Pp 161If the underlying 162.Vt BIO 163is 164.Em non-blocking , 165.Fn SSL_shutdown 166will also return when the underlying 167.Vt BIO 168could not satisfy the needs of 169.Fn SSL_shutdown 170to continue the handshake. 171In this case a call to 172.Xr SSL_get_error 3 173with the 174return value of 175.Fn SSL_shutdown 176will yield 177.Dv SSL_ERROR_WANT_READ 178or 179.Dv SSL_ERROR_WANT_WRITE . 180The calling process then must repeat the call after taking appropriate action 181to satisfy the needs of 182.Fn SSL_shutdown . 183The action depends on the underlying 184.Vt BIO . 185When using a non-blocking socket, nothing is to be done, but 186.Xr select 2 187can be used to check for the required condition. 188When using a buffering 189.Vt BIO , 190like a 191.Vt BIO 192pair, data must be written into or retrieved out of the 193.Vt BIO 194before being able to continue. 195.Pp 196.Fn SSL_shutdown 197can be modified to only set the connection to 198.Dq shutdown 199state but not actually send the 200.Dq close notify 201alert messages; see 202.Xr SSL_CTX_set_quiet_shutdown 3 . 203When 204.Dq quiet shutdown 205is enabled, 206.Fn SSL_shutdown 207will always succeed and return 1. 208.Sh RETURN VALUES 209The following return values can occur: 210.Bl -tag -width Ds 211.It 0 212The shutdown is not yet finished. 213Call 214.Fn SSL_shutdown 215for a second time, if a bidirectional shutdown shall be performed. 216The output of 217.Xr SSL_get_error 3 218may be misleading, as an erroneous 219.Dv SSL_ERROR_SYSCALL 220may be flagged even though no error occurred. 221.It 1 222The shutdown was successfully completed. 223The 224.Dq close notify 225alert was sent and the peer's 226.Dq close notify 227alert was received. 228.It \(mi1 229The shutdown was not successful because a fatal error occurred either 230at the protocol level or a connection failure occurred. 231It can also occur if action is need to continue the operation for non-blocking 232.Vt BIO Ns 233s. 234Call 235.Xr SSL_get_error 3 236with the return value 237.Fa ret 238to find out the reason. 239.El 240.Sh SEE ALSO 241.Xr BIO_new 3 , 242.Xr ssl 3 , 243.Xr SSL_accept 3 , 244.Xr SSL_clear 3 , 245.Xr SSL_connect 3 , 246.Xr SSL_CTX_set_quiet_shutdown 3 , 247.Xr SSL_free 3 , 248.Xr SSL_get_error 3 , 249.Xr SSL_set_shutdown 3 250.Sh HISTORY 251.Fn SSL_shutdown 252first appeared in SSLeay 0.8.0 and has been available since 253.Ox 2.4 . 254