RFC 8446 6.2 / RFC 5246 7.2.2 - no writes after fatal alert

Author: twcook86

src/internal.c

@@ -16005,6 +16005,7 @@ void DoCertFatalAlert(WOLFSSL* ssl, int ret)
     (void)alertWhy;
 #endif
     ssl->options.isClosed = 1;
+    ssl->options.sentOrRcvdFatalAlert = 1;
 }
 
 int SetupStoreCtxCallback(WOLFSSL_X509_STORE_CTX** store_pt,
@@ -24115,12 +24116,14 @@ static int DoAlert(WOLFSSL* ssl, byte* input, word32* inOutIdx, int* type)
         if (level == alert_fatal &&
                 !AlertIsExemptUserCanceled(ssl, code)) {
             ssl->options.isClosed = 1;  /* Don't send close_notify */
+            ssl->options.sentOrRcvdFatalAlert = 1;
         }
         /* RFC 9846 Section 6.2: In TLS 1.3, all error alerts are implicitly
          * fatal regardless of the AlertLevel byte. */
         if (IsAtLeastTLSv1_3(ssl->version) &&
                 code != close_notify && code != user_canceled) {
             ssl->options.isClosed = 1;
+            ssl->options.sentOrRcvdFatalAlert = 1;
         }
     }
 
@@ -29020,6 +29023,13 @@ int SendData(WOLFSSL* ssl, const void* data, size_t sz)
         return WOLFSSL_FATAL_ERROR;
     }
 
+    /* after fatal alert, no more data writes (RFC 8446 section 6.2) */
+    if (ssl->options.sentOrRcvdFatalAlert) {
+        WOLFSSL_MSG("fatal alert already sent/received, no more writes");
+        ssl->error = SOCKET_PEER_CLOSED_E;
+        return WOLFSSL_FATAL_ERROR;
+    }
+
 #ifdef WOLFSSL_THREADED_CRYPT
     ret = SendAsyncData(ssl);
     if (ret != 0) {
@@ -29591,7 +29601,10 @@ static int SendAlert_ex(WOLFSSL* ssl, int severity, int type)
         /* Mark as closed in dtls only once we enter stateful mode. */
         if (!ssl->options.dtls || ssl->options.dtlsStateful)
 #endif
+        {
             ssl->options.isClosed = 1;  /* Don't send close_notify */
+            ssl->options.sentOrRcvdFatalAlert = 1;
+        }
     }
 
     /* send encrypted alert if encryption is on - can be a rehandshake over

tests/api/test_ssl_rw.c

@@ -1062,6 +1062,55 @@ int test_wolfSSL_SendUserCanceled_paths(void)
     return EXPECT_RESULT();
 }
 
+/* Test that a fatal alert closure stops later application writes.
+ *
+ * RFC 8446 section 6.2 / RFC 5246 7.2.2:  Once a fatal alert has been sent or
+ * received, no further application data may be sent.  This is flagged by
+ * sentOrRcvdFatalAlert.  Subsequent writes should fail to queue.
+ *
+ * @return  TEST_SUCCESS on success.
+ */
+int test_wolfSSL_write_after_fatal_alert(void)
+{
+    EXPECT_DECLS;
+#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && !defined(NO_TLS) && \
+    !defined(WOLFSSL_NO_TLS12)
+    WOLFSSL_CTX* ctx_c = NULL;
+    WOLFSSL_CTX* ctx_s = NULL;
+    WOLFSSL* ssl_c = NULL;
+    WOLFSSL* ssl_s = NULL;
+    struct test_memio_ctx test_ctx;
+    const char msg[] = "must not be sent";
+
+    XMEMSET(&test_ctx, 0, sizeof(test_ctx));
+    ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c, &ssl_s,
+        wolfTLSv1_2_client_method, wolfTLSv1_2_server_method), 0);
+    ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
+
+    /* A fatal alert was sent (or received); no close_notify follows a fatal
+     * alert. */
+    if (ssl_c != NULL) {
+        ssl_c->options.isClosed = 1;
+        ssl_c->options.sentOrRcvdFatalAlert = 1;
+        ssl_c->error = WOLFSSL_ERROR_NONE;
+
+        ExpectIntEQ(wolfSSL_write(ssl_c, msg, (int)sizeof(msg)),
+            WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
+        /* Check the recorded error rather than the value reported, which
+         * wolfSSL_get_error() translates for OpenSSL compatibility. */
+        ExpectIntEQ(ssl_c->error, WC_NO_ERR_TRACE(SOCKET_PEER_CLOSED_E));
+        /* No record was queued for the peer. */
+        ExpectIntEQ(ssl_c->buffers.outputBuffer.length, 0);
+    }
+
+    wolfSSL_free(ssl_c);
+    wolfSSL_free(ssl_s);
+    wolfSSL_CTX_free(ctx_c);
+    wolfSSL_CTX_free(ctx_s);
+#endif
+    return EXPECT_RESULT();
+}
+
 /* Test that an error the read side recorded is the one the write reports.
  *
  * With a write duplicate in use the read side hands errors over through

tests/api/test_ssl_rw.h

@@ -38,6 +38,7 @@ int test_wolfSSL_shutdown_repeat_after_done(void);
 int test_wolfSSL_shutdown_flush_no_notify(void);
 int test_wolfSSL_shutdown_quic_alert_refused(void);
 int test_wolfSSL_SendUserCanceled_paths(void);
+int test_wolfSSL_write_after_fatal_alert(void);
 int test_wolfSSL_write_dup_err(void);
 
 #define TEST_SSL_RW_DECLS                                                      \
@@ -56,6 +57,7 @@ int test_wolfSSL_write_dup_err(void);
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_shutdown_flush_no_notify),      \
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_shutdown_quic_alert_refused),   \
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_SendUserCanceled_paths),        \
+        TEST_DECL_GROUP("ssl_rw", test_wolfSSL_write_after_fatal_alert),       \
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_write_dup_err)
 
 #endif /* TESTS_API_SSL_RW_H */

wolfssl/internal.h

@@ -5461,6 +5461,7 @@ struct Options {
     word16            isClosed:1;         /* if we consider conn closed */
     word16            closeNotify:1;      /* we've received a close notify */
     word16            sentNotify:1;       /* we've sent a close notify */
+    word16            sentOrRcvdFatalAlert:1; /* a fatal alert occurred */
     word16            usingCompression:1; /* are we using compression */
     word16            haveRSA:1;          /* RSA available */
     word16            haveECC:1;          /* ECC available */