Skip to content

Close the socket in stop() when the connection is not secure - #35

Merged
mobizt merged 1 commit into
mobizt:mainfrom
csutcliff:fix/stop-closes-plain-socket
Oct 20, 2026
Merged

mobizt merged 1 commit into
mobizt:mainfrom
csutcliff:fix/stop-closes-plain-socket

Conversation

@csutcliff

Copy link
Copy Markdown
Contributor

Problem

SSLClient::stop() returns straight away when _secure is false. In two cases the underlying client is still connected at that point:

  • After a TLS handshake that failed, for example a server certificate that doesn't validate. The failure paths in mConnectSSL() free the TLS buffers with mFreeSSL() but leave _basic_client connected.
  • On a plain TCP connection: a port that isn't in _secure_ports, or SSL disabled.

In both cases stop() never closes the socket. The caller believes the connection is closed, while the server keeps it open until it times out, or indefinitely if it is waiting for the client to continue the handshake.

Fix

When _secure is false, stop _basic_client before returning.

Testing

ESP32 with Arduino 3.3.12 / IDF 5.5.5, espMqttClient on ESP_SSLClient 3.1.3 (as used by EMS-ESP), connecting to an openssl s_server whose certificate doesn't validate against the configured CA. Packets captured on the server:

Result
Before After the failed handshake the ESP32 sent no FIN or RST. The connection was still established 5 min 21 s later, and the MQTT client never retried
After The ESP32 closes the connection about 50 ms after connecting and retries every 2 s

The plain TCP case takes the same early return but wasn't tested separately.

Found in EMS-ESP: emsesp/EMS-ESP32#3300

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants