Skip to content

Allow setting additional openssl CTX options from client applications (#600)#601

Open
mazer1310 wants to merge 1 commit into
machinezone:masterfrom
mazer1310:fix/expose-ssl-ctx-options
Open

Allow setting additional openssl CTX options from client applications (#600)#601
mazer1310 wants to merge 1 commit into
machinezone:masterfrom
mazer1310:fix/expose-ssl-ctx-options

Conversation

@mazer1310

@mazer1310 mazer1310 commented Jul 20, 2026

Copy link
Copy Markdown

Problem

OpenSSL 3.x behavior with respect to abruptly closed sockets when connecting to the WebSocket server results in spurious error messages. The workaround as described in openssl/openssl#22690 is to call SSL_set_options (or SSL_CTX_set_options with option SSL_OP_IGNORE_UNEXPECTED_EOF. However, IXWebSockets does not expose the ability to do so from client applications. (fixes #600)

Fix

Add int additional_openssl_ctx_options to ix::SocketTLSOptions

  • Defaults to 0, so the behavior is unchanged for existing applications.
  • clients can set it to a desired value to include the options in the SSL_CTX_set_options calls during client and server socket handshakes
  • adds a call to SSL_CTX_set_options during SocketOpenSSL::handleTLSOptions to handle the client handshake
  • appends the options to the existing SSL_CTX_set_options call in SocketOpenSSL::accept to handle the server handshake

Verification

Built the library on Linux RH8 and tested our application with and without setting SocketTLSOptions::additional_openssl_ctx_options to SSL_OP_IGNORE_UNEXPECTED_EOF and confirmed that the application functions in both modes, but with the additional option the spurious error messages are squelched.

… when calling SSL_CTX_set_options() during server or client Openssl handshakes (machinezone#600)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Ability for client applications to set additional OpenSSL CTX options

1 participant