Repository navigation
Close the socket in stop() when the connection is not secure - #35
Merged
Merged
Conversation
6 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SSLClient::stop()returns straight away when_secureis false. In two cases the underlying client is still connected at that point:mConnectSSL()free the TLS buffers withmFreeSSL()but leave_basic_clientconnected._secure_ports, or SSL disabled.In both cases
stop()never closes the socket. The caller believes the connection is closed, while the server keeps it open until it times out, or indefinitely if it is waiting for the client to continue the handshake.Fix
When
_secureis false, stop_basic_clientbefore returning.Testing
ESP32 with Arduino 3.3.12 / IDF 5.5.5, espMqttClient on ESP_SSLClient 3.1.3 (as used by EMS-ESP), connecting to an
openssl s_serverwhose certificate doesn't validate against the configured CA. Packets captured on the server:The plain TCP case takes the same early return but wasn't tested separately.
Found in EMS-ESP: emsesp/EMS-ESP32#3300