.\"
.\"	$OpenBSD: SSL_set_shutdown.3,v 1.2 2014/12/02 14:11:01 jmc Exp $
.\"
.Dd $Mdocdate: December 2 2014 $
.Dt SSL_SET_SHUTDOWN 3
.Os
.Sh NAME
.Nm SSL_set_shutdown ,
.Nm SSL_get_shutdown
.Nd manipulate shutdown state of an SSL connection
.Sh SYNOPSIS
.In openssl/ssl.h
.Ft void
.Fn SSL_set_shutdown "SSL *ssl" "int mode"
.Ft int
.Fn SSL_get_shutdown "const SSL *ssl"
.Sh DESCRIPTION
.Fn SSL_set_shutdown
sets the shutdown state of
.Fa ssl
to
.Fa mode .
.Pp
.Fn SSL_get_shutdown
returns the shutdown mode of
.Fa ssl .
.Sh NOTES
The shutdown state of an ssl connection is a bitmask of:
.Bl -tag -width Ds
.It 0
No shutdown setting, yet.
.It Dv SSL_SENT_SHUTDOWN
A
.Dq close notify
shutdown alert was sent to the peer; the connection is being considered closed
and the session is closed and correct.
.It Dv SSL_RECEIVED_SHUTDOWN
A shutdown alert was received form the peer, either a normal
.Dq close notify
or a fatal error.
.El
.Pp
.Dv SSL_SENT_SHUTDOWN
and
.Dv SSL_RECEIVED_SHUTDOWN
can be set at the same time.
.Pp
The shutdown state of the connection is used to determine the state of the
.Fa ssl
session.
If the session is still open when
.Xr SSL_clear 3
or
.Xr SSL_free 3
is called, it is considered bad and removed according to RFC2246.
The actual condition for a correctly closed session is
.Dv SSL_SENT_SHUTDOWN
(according to the TLS RFC, it is acceptable to only send the
.Dq close notify
alert but to not wait for the peer's answer when the underlying connection is
closed).
.Fn SSL_set_shutdown
can be used to set this state without sending a close alert to the peer (see
.Xr SSL_shutdown 3 ) .
.Pp
If a
.Dq close notify
was received,
.Dv SSL_RECEIVED_SHUTDOWN
will be set, but to set
.Dv SSL_SENT_SHUTDOWN
the application must still call
.Xr SSL_shutdown 3
or
.Fn SSL_set_shutdown
itself.
.Sh RETURN VALUES
.Fn SSL_set_shutdown
does not return diagnostic information.
.Pp
.Fn SSL_get_shutdown
returns the current setting.
.Sh SEE ALSO
.Xr ssl 3 ,
.Xr SSL_clear 3 ,
.Xr SSL_CTX_set_quiet_shutdown 3 ,
.Xr SSL_free 3 ,
.Xr SSL_shutdown 3