Bug fix: Half-closed SSL sessions must not shut down until explicitly…

… closed by the application (protocol) layer
apache · Jan 21, 2025 · 7484129 · 7484129
1 parent 6f19367
commit 7484129
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/httpcore5/src/main/java/org/apache/hc/core5/reactor/ssl/SSLIOSession.java b/httpcore5/src/main/java/org/apache/hc/core5/reactor/ssl/SSLIOSession.java
@@ -101,6 +101,7 @@ enum TLSHandShakeState { READY, INITIALIZED, HANDSHAKING, COMPLETE }
     private volatile Status status = Status.ACTIVE;
     private volatile Timeout socketTimeout;
     private volatile TlsDetails tlsDetails;
+    private volatile boolean appClosed;
 
     /**
      * Creates new instance of {@code SSLIOSession} class.
@@ -477,7 +478,8 @@ private void updateEventMask() {
                     && (handshakeStatus == HandshakeStatus.NOT_HANDSHAKING || handshakeStatus == HandshakeStatus.FINISHED)
                     && !this.outEncrypted.hasData()
                     && this.sslEngine.isOutboundDone()
-                    && (this.endOfStream || this.sslEngine.isInboundDone())) {
+                    && (this.endOfStream || this.sslEngine.isInboundDone())
+                    && appClosed) {
                 this.status = Status.CLOSED;
             }
             // Abnormal session termination
@@ -520,8 +522,6 @@ private void updateEventMask() {
             // Do we have encrypted data ready to be sent?
             if (this.outEncrypted.hasData()) {
                 newMask = newMask | EventMask.WRITE;
-            } else if (this.sslEngine.isOutboundDone()) {
-                newMask = newMask & ~EventMask.WRITE;
             }
 
             // Update the mask if necessary
@@ -648,7 +648,7 @@ private void encryptData(final IOSession protocolSession) throws IOException {
         this.session.getLock().lock();
         try {
             appReady = (this.appEventMask & SelectionKey.OP_WRITE) > 0
-                    && this.status == Status.ACTIVE
+                    && this.status.compareTo(Status.CLOSED) < 0
                     && this.sslEngine.getHandshakeStatus() == HandshakeStatus.NOT_HANDSHAKING;
         } finally {
             this.session.getLock().unlock();
@@ -724,6 +724,7 @@ public void close() {
     public void close(final CloseMode closeMode) {
         this.session.getLock().lock();
         try {
+            appClosed = true;
             if (closeMode == CloseMode.GRACEFUL) {
                 if (this.status.compareTo(Status.CLOSING) >= 0) {
                     return;