mirror of
https://github.com/nginx/nginx.git
synced 2026-10-24 22:57:43 -05:00
Maxim Dounin
381c876ec6
OpenSSL up to 3.0, when a TCP connection is closed by the peer, returns SSL_ERROR_SYSCALL without an error queue and with errno set to 0. Since OpenSSL 3.0 with SSL_OP_IGNORE_UNEXPECTED_EOF, which nginx sets, this is reported as SSL_ERROR_ZERO_RETURN instead. Closing a connection without the close_notify alert is incorrect, yet common enough in the real world to be handled as a non-error condition. Truncation attacks are expected to be prevented at the protocol level; notably, they are not possible for HTTP/1.x requests at all, and only possible for HTTP/1.x responses if neither Content-Length nor chunked transfer encoding is used. Previously, "ERR_peek_error() == 0" was used to detect this, which is too broad: it also matches TCP-level errors, such as ECONNRESET, which are better reported as errors, the way the plain TCP code does it in ngx_unix_recv(). Now only a clean TCP close is treated as a clean connection close. Most notably, connection resets now result in "SSL_read() failed" errors. This change is a modified version of a patch by Maxim Dounin. The modifications include resolved conflicts and the refined commit log. Signed-off-by: Sergey Kandaurov <pluknet@nginx.com> Origin: <https://freenginx.org/hg/nginx/rev/4c0b66b5046f>