[issue30437] SSL_shutdown needs SSL_read() until SSL_ERROR_ZERO_RETURN

Christian Heimes added the comment: The session ticket issue in TLS 1.3 handshake will be fixed by upstream patch https://github.com/openssl/openssl/pull/6340. We still need to drain the SSL socket to remove pending application data before the second SSL_shutdown() call,

[issue30437] SSL_shutdown needs SSL_read() until SSL_ERROR_ZERO_RETURN

Change by Christian Heimes : -- keywords: +patch pull_requests: +6632 stage: -> patch review ___ Python tracker ___

[issue30437] SSL_shutdown needs SSL_read() until SSL_ERROR_ZERO_RETURN

Christian Heimes added the comment: The issue can occur when the peer sends data while processing the close notify alert. The meaningless SSL_ERROR_SYSCALL in SSL_shutdown() is even more severe with OpenSSL 1.1.1 and TLS 1.3. In case the client only writes and never reads,