Handle TLS Alert.USER_CANCELED then deferred Alert.CLOSE_NOTIFY (#1411)

aklivity · Feb 24, 2025 · bb9436e · bb9436e
1 parent 4771c67
commit bb9436e
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 5 deletions.
diff --git a/...src/main/java/io/aklivity/zilla/runtime/binding/tls/internal/stream/TlsClientFactory.java b/...src/main/java/io/aklivity/zilla/runtime/binding/tls/internal/stream/TlsClientFactory.java
@@ -1911,7 +1911,8 @@ private void encodeNet(
                 {
                     cleanupEncodeSlot();
 
-                    if (TlsState.initialClosing(state))
+                    if (TlsState.initialClosing(state) &&
+                        tlsEngine.isOutboundDone())
                     {
                         doNetEnd(traceId);
                     }
@@ -1964,7 +1965,11 @@ private void decodeNet(
                         if (!stream.isPresent())
                         {
                             doEncodeCloseOutbound(traceId, budgetId);
-                            doNetEnd(traceId);
+
+                            if (tlsEngine.isOutboundDone())
+                            {
+                                doNetEnd(traceId);
+                            }
                         }
 
                         decoder = decodeIgnoreAll;
@@ -2107,7 +2112,7 @@ private void doEncodeWrap(
                             case CLOSED:
                                 assert bytesProduced > 0;
                                 doAppReset(traceId);
-                                state = TlsState.closingReply(state);
+                                state = TlsState.closingInitial(state);
                                 break loop;
                             case OK:
                                 assert bytesProduced > 0 || tlsEngine.isInboundDone();

diff --git a/...src/main/java/io/aklivity/zilla/runtime/binding/tls/internal/stream/TlsServerFactory.java b/...src/main/java/io/aklivity/zilla/runtime/binding/tls/internal/stream/TlsServerFactory.java
@@ -1565,7 +1565,8 @@ private void encodeNet(
             {
                 cleanupEncodeSlot();
 
-                if (TlsState.replyClosing(state))
+                if (TlsState.replyClosing(state) &&
+                    tlsEngine.isOutboundDone())
                 {
                     doNetEnd(traceId);
                 }
@@ -1618,7 +1619,11 @@ private void decodeNet(
                     if (!stream.isPresent())
                     {
                         doEncodeCloseOutbound(traceId, budgetId);
-                        doNetEnd(traceId);
+
+                        if (tlsEngine.isOutboundDone())
+                        {
+                            doNetEnd(traceId);
+                        }
                     }
 
                     decoder = decodeIgnoreAll;