From 5ee06776ee91bacd4f37b54653787ccc14a4831c Mon Sep 17 00:00:00 2001
From: "Hoenig Mark (TT/EIS3-Lol)" <Mark.Hoenig@de.bosch.com>
Date: Mon, 1 Jul 2019 14:04:35 +0200
Subject: [PATCH] tls/openssl: don't call SSL_shutdown() after a fatal error

According to SSL_shutdown(3), the function must not be called
if previous fatal error occurred.
---
 src/tls_openssl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/tls_openssl.c b/src/tls_openssl.c
index d75d206..9d55e36 100644
--- a/src/tls_openssl.c
+++ b/src/tls_openssl.c
@@ -201,6 +201,11 @@ int tls_stop(tls_t *tls)
     int error;
     int ret;
 
+    /* According to OpenSSL.org, we must not call SSL_shutdown(3)
+       if a previous fatal error has occurred on a connection. */
+    if (tls->lasterror == SSL_ERROR_SYSCALL || tls->lasterror == SSL_ERROR_SSL)
+        return 1;
+
     while (1) {
         ++retries;
         ret = SSL_shutdown(tls->ssl);