tls: config option for sending close notify alerts

Added a new config option for enabling or disabling the sending of
close notify alerts prior to closing the corresponding tcp
connection. Sending the close notify prior to tcp shutdown is
nicer from a TLS point of view, but it has a measurable
performance impact and it's not a must (3-4% when using 50% cpu,
 with a debug build and 300cps  => 6-8% from the cpu is spent on
 close notify alerts).
By default it's off (change from older versions where it was
hardwired-on).
It can be changed via modparam (
e.g. modparam("tls", "send_close_notify", 1) )
or at runtime
(e.g. sercmd cfg.set_now_int tls send_close_notify 1 ).

modules/tls/tls_cfg.c

@@ -61,7 +61,8 @@ struct cfg_group_tls default_tls_cfg = {
 	-1, /* low_mem_threshold2 */
 	10*1024*1024, /* ct_wq_max: 10 Mb by default */
 	64*1024, /* con_ct_wq_max: 64Kb by default */
-	4096 /* ct_wq_blk_size */
+	4096, /* ct_wq_blk_size */
+	0 /* send_close_notify (off by default)*/
 };
 
 void* tls_cfg = &default_tls_cfg;
@@ -191,6 +192,10 @@ cfg_def_t	tls_cfg_def[] = {
 	{"ct_wq_blk_size", CFG_VAR_INT | CFG_ATOMIC, 1, 65536, 0, 0,
 		"internal TLS pre-write (clear-text) queue minimum block size"
 		" (advanced tunning or debugging for now)"},
+	{"send_close_notify", CFG_VAR_INT | CFG_ATOMIC, 0, 1, 0, 0,
+		"enable/disable sending a close notify TLS shutdown alert"
+			" before closing the corresponding TCP connection."
+			"Note that having it enabled has a performance impact."},
 	{0, 0, 0, 0, 0, 0}
 };
 

modules/tls/tls_cfg.h

@@ -90,6 +90,8 @@ struct cfg_group_tls {
 	int ct_wq_max; /* maximum overall tls write clear text queued bytes */
 	int con_ct_wq_max; /* maximum clear text write queued bytes per con */
 	int ct_wq_blk_size; /* minimum block size for the clear text write queue */
+	int send_close_notify; /* if set try to be nice and send a shutdown alert
+						    before closing the tcp connection */
 };
 
 

modules/tls/tls_mod.c

@@ -205,6 +205,7 @@ static param_export_t params[] = {
 	{"ssl_max_send_fragment", PARAM_INT,
 									   &default_tls_cfg.ssl_max_send_fragment},
 	{"ssl_read_ahead",        PARAM_INT,    &default_tls_cfg.ssl_read_ahead},
+	{"send_close_notify",   PARAM_INT,    &default_tls_cfg.send_close_notify},
 	{"tls_force_run",       PARAM_INT,    &default_tls_cfg.force_run},
 	{"low_mem_threshold1",  PARAM_INT,    &default_tls_cfg.low_mem_threshold1},
 	{"low_mem_threshold2",  PARAM_INT,    &default_tls_cfg.low_mem_threshold2},

modules/tls/tls_server.c

@@ -502,7 +502,7 @@ void tls_h_close(struct tcp_connection *c, int fd)
 	 * still be in a writer, so in this case locking is needed.
 	 */
 	DBG("Closing SSL connection %p\n", c->extra_data);
-	if (likely(c->extra_data)) {
+	if (unlikely(cfg_get(tls, tls_cfg, send_close_notify) && c->extra_data)) {
 		lock_get(&c->write_lock);
 			if (unlikely(c->extra_data == 0)) {
 				/* changed in the meanwhile */