Ensure close_notify is sent after user_canceled during quiet shutdown

[holtrop-wolfssl]

Description

Ensure close_notify is sent after user_canceled during quiet shutdown

Fixes #11131

Testing

How did you test?

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

This PR ensures that when a user_canceled alert is sent, a subsequent close_notify is still emitted during quiet shutdown, aligning shutdown behavior with the protocol expectation described in the TLS spec and addressing #11131.

Changes:

• Track whether a user_canceled has been sent (or queued) so quiet shutdown can still send the required close_notify.
• Update wolfSSL_shutdown() quiet-shutdown path to flush/emit close_notify when user_canceled occurred.
• Add a regression test covering quiet shutdown behavior after wolfSSL_SendUserCanceled().

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

File	Description
wolfssl/internal.h	Adds an options bit to record user_canceled state relevant to shutdown behavior.
src/ssl_api_rw.c	Implements the quiet-shutdown exception to still send close_notify after user_canceled.
src/ssl.c	Initializes the new options bit during SSL object reset/init.
tests/api/test_ssl_rw.[ch]	Registers and adds a new test validating the quiet shutdown + user_canceled behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +76 B (+0.1%, 66,959 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m3

• FLASH: .text +304 B (+0.2%, 125,971 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +640 B (+0.4%, 205,149 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +64 B (+0.1%, 69,475 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +768 B (+0.5%, 178,904 B / 262,144 B, total: 68% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +576 B (+0.3%, 186,812 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +64 B (+0.1%, 64,325 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +104 B, .text +2,880 B (+0.4%, 783,332 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +192 B (+0.2%, 217,628 B / 262,144 B, total: 83% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +172 B, .text +640 B (+0.3%, 301,832 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata +176 B, .text +960 B (+0.3%, 332,576 B / 1,048,576 B, total: 32% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +64 B (+0.1%, 64,325 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +256 B (+0.2%, 126,707 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4-tls13

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +512 B (+0.3%, 242,319 B / 262,144 B, total: 92% used)

gcc-arm-cortex-m7

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +640 B (+0.4%, 205,149 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +172 B, .text +576 B (+0.2%, 302,728 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .rodata.CSWTCH.1 +16 B, .rodata.str1.1 +158 B, .text +448 B (+0.3%, 242,319 B / 262,144 B, total: 92% used)

linuxkm-pie

• Data: __patchable_function_entries +152 B (+0.6%, 27,000 B)

linuxkm-standard

• Data: __patchable_function_entries +136 B (+0.3%, 49,800 B)

stm32-sim-stm32h753

• FLASH: .text +372 B (+0.2%, 188,580 B / 2,097,152 B, total: 9% used)

[holtrop-wolfssl]

retest this please (build removed)

[holtrop-wolfssl]

retest this please (fatal: early EOF
fatal: fetch-pack: invalid index-pack output
)

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11225

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[holtrop-wolfssl]

retest this please (org.jenkinsci.plugins.workflow.support.steps.AgentOfflineException: Unable to create live FilePath for wolf-linux-cloud-node-3kbiik; wolf-linux-cloud-node-3kbiik was marked offline: Connection was broken)

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11225

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11225

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Findings: 4
4 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11225

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11225

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11225

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[holtrop-wolfssl]

retest this please (Finished: FAILURE)