title: SSL_write() seems to close connection
body: <p>I try to implement a multithreaded Client-Server Application in C. Here is my connection specific code:</p>
  
  <p>Server:</p>
  
  <pre><code>SSL_load_error_strings();
  SSL_library_init();
  OpenSSL_add_all_ciphers();
  if((ctx-&gt;ssl_ctx = SSL_CTX_new(TLSv1_server_method())) == NULL) {
    tproxy_error_die("unable to initialize SSLv3 methods", 1);
  }
  SSL_CTX_set_options(ctx-&gt;ssl_ctx, SSL_OP_ALL);
  SSL_CTX_set_timeout(ctx-&gt;ssl_ctx, 300);
  if(!SSL_CTX_use_certificate_chain_file(ctx-&gt;ssl_ctx, ctx-&gt;cert_bundle)) {
    tproxy_error_die("unable to read certificate bundle file", 1);
  }
  if(strlen(ctx-&gt;key_file_pw)) {
    SSL_CTX_set_default_passwd_cb(ctx-&gt;ssl_ctx, private_key_pass_callback);
    SSL_CTX_set_default_passwd_cb_userdata(ctx-&gt;ssl_ctx, (void *)ctx);
  }
  if(!SSL_CTX_use_RSAPrivateKey_file(ctx-&gt;ssl_ctx, ctx-&gt;key_file, SSL_FILETYPE_PEM)) {
    tproxy_error_die("unable to read key file", 1);
  }
  SSL_CTX_set_verify(ctx-&gt;ssl_ctx, SSL_VERIFY_NONE, NULL);
  SSL_CTX_set_info_callback(ctx-&gt;ssl_ctx, apps_ssl_info_callback);
  [...]
  con-&gt;sock = accept(ctx-&gt;socket[i], (struct sockaddr *)&amp;in_socket, &amp;s_size);
  /* make the accepted socket non-blocking */
  if(ioctl(con-&gt;sock, FIONBIO, (char *)&amp;enable) &lt; 0) {
    tproxy_error_die("cannot set socket flags", 1);
  }
  /* create a new SSL context to handle the connection with the peer */
  con-&gt;ssl = SSL_new(ctx-&gt;ssl_ctx);
  SSL_set_mode(con-&gt;ssl, SSL_MODE_AUTO_RETRY | SSL_MODE_ENABLE_PARTIAL_WRITE);
  
  /* complete ssl connection */
  con-&gt;sbio = BIO_new_socket(con-&gt;sock, BIO_NOCLOSE);
  SSL_set_bio(con-&gt;ssl, con-&gt;sbio, con-&gt;sbio);
  /* set chipher */
  if (SSL_set_cipher_list(con-&gt;ssl,"AES128-SHA") &lt;= 0) {
    tproxy_error_die("unable to set chipher", 1);
  }
  /* do not require a valid client certificate */
  SSL_set_verify(con-&gt;ssl, SSL_VERIFY_NONE, NULL);
  </code></pre>
  
  <p>Later I read and write with SSL_read() and SSL_write() (honoring that -1 as a return code has to result in evaluating SSL_get_error() and my result in repeating the same function in my code).</p>
  
  <p>However the application handshake (a few bytes exchanged between client and server) works like a charm. But once the Server sends more than 4 bytes (after application handshake) to the client, the client seems to drop the connection (SSL_read() returns 0) even if the SSL_write on the Server returned exact the amount of bytes I sent (SSL_ERROR_SYSCALL is the SSL error and the system errno stays 0). The socket was not closed.</p>
  
  <p>Does anyone has a clue - maybe how to debug more an openssl application?</p>
  
  <p>Here is the output of the msg_callback from the Client:</p>
  
  <pre><code>SSL_connect:before/connect initialization
  SSL_connect:SSLv3 write client hello A
  SSL_connect:error in SSLv3 read server hello A
  SSL_connect:SSLv3 read server hello A
  SSL_connect:SSLv3 read server certificate A
  SSL_connect:SSLv3 read server done A
  SSL_connect:SSLv3 write client key exchange A
  SSL_connect:SSLv3 write change cipher spec A
  SSL_connect:SSLv3 write finished A
  SSL_connect:SSLv3 flush data
  SSL_connect:error in SSLv3 read server session ticket A
  SSL_connect:SSLv3 read server session ticket A
  SSL_connect:SSLv3 read finished A
  </code></pre>
  
  <p>---> here it closes</p>
  
  <p>Here is the output of the msg_callback from the Server:</p>
  
  <pre><code>SSL_accept:before/accept initialization
  SSL_accept:error in SSLv3 read client hello B
  SSL_accept:SSLv3 read client hello B
  SSL_accept:SSLv3 write server hello A
  SSL_accept:SSLv3 write certificate A
  SSL_accept:SSLv3 write server done A
  SSL_accept:SSLv3 flush data
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:error in SSLv3 read client certificate A
  SSL_accept:SSLv3 read client key exchange A
  SSL_accept:SSLv3 read finished A
  SSL_accept:SSLv3 write session ticket A
  SSL_accept:SSLv3 write change cipher spec A
  SSL_accept:SSLv3 write finished A
  SSL_accept:SSLv3 flush data
  </code></pre>
  
  <p>---> here it closes</p>
  
  <p>The tcpdump shows me, that che tcp-fin comes from the client first. But if the server doesn´t sent the "killing" 5 bytes the client can infinitely send application keepalive messages over the ssl link.</p>
  
  <p>In what condition is SSL_write able to alert the other side in such a way and how may I debug this behaviour? </p>