SSLDriver can transition to CLOSED in handshake (elastic#41458)

TLS 1.3 changes to the SSLEngine introduced a scenario where a UNWRAP call during a handshake can consume a close notify alerty without throwing an exception. This means that we continue down a codepath where we assert that we are still in handshaking mode. Transitioning to closed from handshaking is a valid scenario. This commit removes this assertion.
original-brownbear · Apr 25, 2019 · 6d7110e · 6d7110e
1 parent 2e255a6
commit 6d7110e
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/...ugin/security/src/main/java/org/elasticsearch/xpack/security/transport/nio/SSLDriver.java b/...ugin/security/src/main/java/org/elasticsearch/xpack/security/transport/nio/SSLDriver.java
@@ -439,8 +439,10 @@ private void maybeFinishHandshake() {
                 // If the engine is partially closed, immediate transition to close mode.
                 if (currentMode.isHandshake()) {
                     currentMode = new CloseMode(true);
-                } else {
-                    String message = "Expected to be in handshaking mode. Instead in non-handshaking mode: " + currentMode;
+                } else if (currentMode.isApplication()) {
+                    // It is possible to be in CLOSED mode if the prior UNWRAP call returned CLOSE_NOTIFY.
+                    // However we should not be in application mode at this point.
+                    String message = "Expected to be in handshaking/closed mode. Instead in application mode.";
                     throw new AssertionError(message);
                 }
             } else if (hasFlushPending() == false) {