Add SSL.shutdown to send close_notify; split SSLPeerClosed off SSLError - #147
Closed
SeanTAllen wants to merge 2 commits into
Closed
Add SSL.shutdown to send close_notify; split SSLPeerClosed off SSLError#147SeanTAllen wants to merge 2 commits into
SeanTAllen wants to merge 2 commits into
Conversation
An SSL session had no way to send a TLS close_notify alert. An OpenSSL peer reading TCP EOF without one reports SSL_R_UNEXPECTED_EOF_WHILE_READING, a truncation. And a peer's own close_notify folded into SSLError alongside decryption and transport failures — a clean end of stream was indistinguishable from any other. SSL.shutdown queues the alert; SSLPeerClosed reports the peer's clean close. Adding a variant to the public SSLState union breaks exhaustive matches — precedent from 3.0.0 (adding SSLDisposed) makes this a major-version bump. SSLConnection recognizes SSLPeerClosed and closes the connection but does not itself send close_notify — its closed hook fires after the transport is gone. A protocol that needs the alert on the wire has to use SSL directly. Wiring close_notify through SSLConnection is deferred. Design: ponylang/lori#348
ponylang-main
added
the
discuss during sync
Docstrings for state primitives were narrating changes and enumerating paths in and out. A reader coming cold to `SSLPeerClosed` doesn't need the story of how the session got there or what `shutdown` from there does on failure; the state primitive documents the state. Release notes were describing the change in terms of the SSL layer's own vocabulary — output BIO, `SSL_shutdown` failure paths — instead of what a caller of the package sees. CHANGELOG entries follow the one-line-per-change format the rest of the file uses.
ponylang-main
removed
the
discuss during sync
Member
Author
|
This was a bad design. Redoing with me giving the design to Opus 4.6. 4.7 just kind of went... well it just wandered away from what we had agreed to. |
ponylang-main
added
the
discuss during sync
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the primitive that ponylang/lori#348 needs — a way to emit
close_notifybefore closing the transport — and separates a clean peer close from a session failure.Parked items
Please weigh in before merge:
Version bump: 3.1.0 vs 4.0.0. Adding a variant to
SSLStatebreaks exhaustive matches. WhenSSLDisposedwas added in 3.0.0 it was labeled a major bump. I've structured the CHANGELOG to warrant the same, but the release-notes wording doesn't yet name a version._shutdown_sent: Boolvs a state variant. The flag blockswriteaftershutdownwas called fromSSLReady. Promoting it to anSSLShutdownSent(or similar) state variant would satisfy design principle Welcome to ssl Discussions! #11 more cleanly, but adds a second exhaustive-match breakage in one release. Kept as a bool for now. Also worth noting: thestate-machine-137WIP branch is doing exactly the "state carries all behavior; no per-state booleans" restructure this bool cuts against — reconciliation with that work will be design work, not a mechanical rebase.SSLConnectionoutboundclose_notifydeferred.SSLConnection.closedfires after the transport is gone, so the wrapper can't sendclose_notifyon either application-initiated close (no hook before close) or peer-initiated close (no reachable state observation from_pollwithout moving the reciprocation into the read loop, which needs an integration test I didn't build here). Documented in the wrapper's class docstring and in the release notes; a follow-up will address it with a test-driven design.