Re: [TLS] Sending fatal alerts over TCP

[Florian Weimer <[e-mail]>]

* Bodo Moeller:

> Note that this only implies that Y's TCP needs to process the segment
> containing X's TLS alert before it can process the RST segment. Processing
> the segment with the alert merely means queuing it; the TLS layer would
> have to "RECEIVE" it from the TCP to do something with it.  If the RST
> segment gets processed before the TLS layer has received the TLS alert, the
> receiving queue will be flushed, and the alert will be gone.

Indeed, this is the correct explanation.

This flushing behavior was introduced that when you hit ^C in your FTP
client during a transfer, the transfer actually stops quickly, and does
not continue until the server has transmitted all data.  As a result, it
is impossible to tear down full-duplex connections without potential
data loss, unless the connection teardown is negotiated above the TCP
layer.

-- 
Florian Weimer                <[e-mail]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]