untrusted comment: verify with openbsd-67-base.pub
RWRmkIA877Io3t3C9zPg6TJv4WdWT7Fcn1ZJOpVtHz1rozkORegnJLSrpeqeJM2xzSvOUXEEbBGGLbRKocaXRLrybs/fRsZkTQA=
OpenBSD 6.7 errata 020, August 18, 2020:
The previous errata patch 019 broke bidirectional SSL_shutdown.
Apply by doing:
signify -Vep /etc/signify/openbsd-67-base.pub -x 020_libssl.patch.sig \
-m - | (cd /usr/src && patch -p0)
And then rebuild and install libssl and unwind:
cd /usr/src/lib/libssl
make obj
make
make install
cd /usr/src/sbin/unwind
make obj
make
make install
Index: lib/libssl/tls13_legacy.c
===================================================================
RCS file: /cvs/src/lib/libssl/tls13_legacy.c,v
retrieving revision 1.3.4.2
diff -u -p -r1.3.4.2 tls13_legacy.c
--- lib/libssl/tls13_legacy.c 10 Aug 2020 18:59:47 -0000 1.3.4.2
+++ lib/libssl/tls13_legacy.c 12 Aug 2020 18:46:12 -0000
@@ -497,6 +497,7 @@ tls13_legacy_shutdown(SSL *ssl)
if ((ret = tls13_record_layer_send_pending(ctx->rl)) !=
TLS13_IO_SUCCESS)
return tls13_legacy_return_code(ssl, ret);
+ ctx->close_notify_sent = 1;
} else if (!ctx->close_notify_recv) {
/*
* If there is no application data pending, attempt to read more
