Close notify

CHANGES.md

@@ -12,6 +12,7 @@ Unreleased
   than just RSA).
 - Fix a segmentation fault in the ALPN selection callback under OCaml 5 (#89).
 - Audit the C FFI and add `CAMLparamX` and `CAMLreturn` calls (#90).
+- Add `Ssl.close_notify` to perform a one-way shutdown (#63, #96).
 
 0.5.11 (2022-07-24)
 =====

src/ssl.ml

@@ -282,7 +282,7 @@ external accept : socket -> unit = "ocaml_ssl_accept"
 
 external flush : socket -> unit = "ocaml_ssl_flush"
 
-external shutdown : socket -> unit = "ocaml_ssl_shutdown"
+external ssl_shutdown : socket -> bool = "ocaml_ssl_shutdown"
 
 let open_connection_with_context context sockaddr =
   let domain = Unix.domain_of_sockaddr sockaddr in
@@ -298,6 +298,12 @@ let open_connection_with_context context sockaddr =
 let open_connection ssl_method sockaddr =
   open_connection_with_context (create_context ssl_method Client_context) sockaddr
 
+let close_notify = ssl_shutdown
+
+let shutdown sock =
+  if not (close_notify sock)
+  then ignore (close_notify sock : bool)
+
 let shutdown_connection = shutdown
 
 let output_string ssl s =

src/ssl.mli

@@ -432,7 +432,13 @@ val accept : socket -> unit
 (** Flush an SSL connection. *)
 val flush : socket -> unit
 
-(** Close an SSL connection. *)
+(** Send close notify to the peer. This is SSL_shutdown(3).
+ *  returns [true] if shutdown is finished, [false] in case [close_notify]
+ *  needs to be called a second time. *)
+val close_notify : socket -> bool
+
+(** Close a SSL connection.
+  * Send close notify to the peer and wait for close notify from peer. *)
 val shutdown : socket -> unit
 
 

src/ssl_stubs.c

@@ -1767,12 +1767,16 @@ CAMLprim value ocaml_ssl_shutdown(value socket)
 
   caml_release_runtime_system();
   ret = SSL_shutdown(ssl);
-  if (!ret)
-    SSL_shutdown(ssl);
   caml_acquire_runtime_system();
-  /* close(SSL_get_fd(SSL_val(socket))); */
-
-  CAMLreturn(Val_unit);
+  switch (ret) {
+    case 0:
+    case 1:
+      /* close(SSL_get_fd(SSL_val(socket))); */
+      CAMLreturn(Val_int(ret));
+    default:
+      ret = SSL_get_error(ssl, ret);
+      caml_raise_with_arg(*caml_named_value("ssl_exn_connection_error"), Val_int(ret));
+  }
 }
 
 /* ======================================================== */