Re: [TLS] Sending fatal alerts over TCP

[Marsh Ray <[e-mail]>]

On 12/20/2011 07:15 AM, Florian Weimer wrote:
> TCP has the property that connection shutdowns can overtake application
> data if connections are used in full-duplex mode.
>
> Here's an example:
>
>    X sends a fatal TLS alert to Y
>    X shuts down the connection
>    Y sends data to X
>    X receives from Y, sends RST to signal data loss to Y

This would seem to be against the spirit of
http://tools.ietf.org/html/rfc793 (section 3.5. Closing a Connection) 
which says "Users must keep reading connections they close for sending 
until the TCP says no more data."

>    Y receives RST
>
> At this point, when Y tries to send further data, it will receive EPIPE
> from the sockets API.  When it tries to read data, it will receive
> ECONNRESET.  According to the socket API sepcification, there is no way
> to access the initial TLS alert.

My interpretation is that RSTs are generally to be avoided by 
properly-coded applications and a fatal TLS alert should not prevent the 
graceful close of the TCP socket.

I have heard of client apps that crash badly upon receiving an RST. 
(Alternatively this could be used to argue that they should be sent much 
more frequently, but that's another discussion :-)

- Marsh