If we send the close notify alert, don't reset the reader because the

counterparty might want to send us a matching close notify under the
currently existing key state. New logic is if we send the alert our
writer is reset (we will send nothing more), but leave the reader as
is. The reader will then be reset if and when we get a close notify,
or if the counterparty doesn't send one, we'll just end the connection
normally. This will also deal with the case where there is some
application data queued still in the recv buffer.

Don't close in ~TLS_Channel: applications should do this explicitly
when the application-level protocol is ended.  Otherwise we'd send a
close_notify upon, for instance, an uncaught exception unwinding the
stack.

Add an enum for the maximum size of any TLS ciphertext packet
including header. Handy for apps.

If we get a bad alert size report size we got.

1 files changed, 9 insertions, 8 deletions

diff --git a/src/tls/tls_channel.h b/src/tls/tls_channel.h
index af56e8fed..0306d1a74 100644
--- a/src/tls/tls_channel.h
+++ b/src/tls/tls_channel.h
@@ -40,14 +40,6 @@ class BOTAN_DLL TLS_Channel
       void close() { alert(WARNING, CLOSE_NOTIFY); }
 
       /**
-      * Send a TLS alert message. If the alert is fatal, the
-      * internal state (keys, etc) will be reset
-      * @param level is warning or fatal
-      * @param type is the type of alert
-      */
-      void alert(Alert_Level level, Alert_Type type);
-
-      /**
       * @return true iff the connection is active for sending application data
       */
       bool is_active() const { return handshake_completed && !is_closed(); }
@@ -73,6 +65,15 @@ class BOTAN_DLL TLS_Channel
 
       virtual ~TLS_Channel();
    protected:
+
+      /**
+      * Send a TLS alert message. If the alert is fatal, the
+      * internal state (keys, etc) will be reset
+      * @param level is warning or fatal
+      * @param type is the type of alert
+      */
+      void alert(Alert_Level level, Alert_Type type);
+
       virtual void read_handshake(byte rec_type,
                                   const MemoryRegion<byte>& rec_buf);