Re: NSS: Unable to verify close_notify in client code?

See SSL_AlertReceivedCallback().

On 20 Dec. 2017 6:22 am, "Johann 'Myrkraverk' Oskarsson"
<[email protected]> wrote:

> Hi,
>
> Is it really impossible to verify if the server sent close_notify in a
> normal NSS client application?
>
> In both cases, PR_Read() returns zero with no error messages or status
> difference of any kind.
>
> I have tentatively verified that ssl3_HandleAlert() is called with
> AlertDescription zero == close_notify, using dtrace, when my server
> properly terminates the connection with PR_Close().  No such probe
> (in the client) fires if I just kill the server (naturally).
>
> My problem is that in the client code *I cannot distinguish the two*
> (with or without close_notify) in normal PR_Read() loop.  There appears
> to be no publicly available API to retrieve the status of the
> recvCloseNotify flag.
>
> And the ssl3_HandleAlert code does not propagate the condition, instead
> the internal error = SSL_ERROR_CLOSE_NOTIFY_ALERT variable is simply
> ignored, and it returns with SECSuccess.
>
> This is situation is current as of changeset 14194:04fc9a90997b,
> Mon Dec 18 11:05:28 2017 +0100.
>
> How is NSS client code supposed to detect proper termination by the
> other party?
>
> I would call this a serious breach of security in the NSS public API.
>
>
> --
> Johann | email: invalid -> com | www.myrkraverk.com/blog/
> I'm not from the Internet, I just work there. | twitter: @myrkraverk
> --
> dev-tech-crypto mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-tech-crypto
>
-- 
dev-tech-crypto mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-tech-crypto