[TLS] Sending fatal alerts over TCP

[Florian Weimer <[e-mail]>]

TCP has the property that connection shutdowns can overtake application
data if connections are used in full-duplex mode.

Here's an example:

  X sends a fatal TLS alert to Y
  X shuts down the connection
  Y sends data to X
  X receives from Y, sends RST to signal data loss to Y
  Y receives RST

At this point, when Y tries to send further data, it will receive EPIPE
from the sockets API.  When it tries to read data, it will receive
ECONNRESET.  According to the socket API sepcification, there is no way
to access the initial TLS alert.  Note that this behavior is not related
to the SO_LINGER socket option.

(I see this with an OpenJDK server and a GNUTLS client, when the server
sends a certificate_unknown alert immediately after receiving the
Certificate message.  The client never receives it.)

What is the best way to deal with this?  I plan to avoid closing the
connection immediately after sending the alert, essentially waiting for
the client to close the connection.  (There will be a short timeout, but
denial-of-service issues have to be dealt with out-of-band anyway.)

Are there any better options?

--
Florian Weimer                <[e-mail]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]