1SSL_read(3) OpenSSL SSL_read(3)
2
6 SSL_read - read bytes from a TLS/SSL connection.
7
9 #include <openssl/ssl.h>
10 int SSL_read(SSL *ssl, void *buf, int num);
12
14 SSL_read() tries to read num bytes from the specified ssl into the
15 buffer buf.
16
18 If necessary, SSL_read() will negotiate a TLS/SSL session, if not
19 already explicitly performed by SSL_connect(3) or SSL_accept(3). If the
20 peer requests a re-negotiation, it will be performed transparently
21 during the SSL_read() operation. The behaviour of SSL_read() depends on
22 the underlying BIO.
23 For the transparent negotiation to succeed, the ssl must have been
25 initialized to client or server mode. This is being done by calling
26 SSL_set_connect_state(3) or SSL_set_accept_state() before the first
27 call to an SSL_read() or SSL_write(3) function.
28 SSL_read() works based on the SSL/TLS records. The data are received in
30 records (with a maximum record size of 16kB for SSLv3/TLSv1). Only when
31 a record has been completely received, it can be processed (decryption
32 and check of integrity). Therefore data that was not retrieved at the
33 last call of SSL_read() can still be buffered inside the SSL layer and
34 will be retrieved on the next call to SSL_read(). If num is higher than
35 the number of bytes buffered, SSL_read() will return with the bytes
36 buffered. If no more bytes are in the buffer, SSL_read() will trigger
37 the processing of the next record. Only when the record has been
38 received and processed completely, SSL_read() will return reporting
39 success. At most the contents of the record will be returned. As the
40 size of an SSL/TLS record may exceed the maximum packet size of the
41 underlying transport (e.g. TCP), it may be necessary to read several
42 packets from the transport layer before the record is complete and
43 SSL_read() can succeed.
44 If the underlying BIO is blocking, SSL_read() will only return, once
46 the read operation has been finished or an error occurred, except when
47 a renegotiation take place, in which case a SSL_ERROR_WANT_READ may
48 occur. This behaviour can be controlled with the SSL_MODE_AUTO_RETRY
49 flag of the SSL_CTX_set_mode(3) call.
50 If the underlying BIO is non-blocking, SSL_read() will also return when
52 the underlying BIO could not satisfy the needs of SSL_read() to
53 continue the operation. In this case a call to SSL_get_error(3) with
54 the return value of SSL_read() will yield SSL_ERROR_WANT_READ or
55 SSL_ERROR_WANT_WRITE. As at any time a re-negotiation is possible, a
56 call to SSL_read() can also cause write operations! The calling process
57 then must repeat the call after taking appropriate action to satisfy
58 the needs of SSL_read(). The action depends on the underlying BIO. When
59 using a non-blocking socket, nothing is to be done, but select() can be
60 used to check for the required condition. When using a buffering BIO,
61 like a BIO pair, data must be written into or retrieved out of the BIO
62 before being able to continue.
63 SSL_pending(3) can be used to find out whether there are buffered bytes
65 available for immediate retrieval. In this case SSL_read() can be
66 called without blocking or actually receiving new data from the
67 underlying socket.
68
70 When an SSL_read() operation has to be repeated because of
71 SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE, it must be repeated with
72 the same arguments.
73
75 The following return values can occur:
76 > 0 The read operation was successful. The return value is the number
78 of bytes actually read from the TLS/SSL connection.
79 <= 0
81 <0 The read operation was not successful, because either the
82 connection was closed, an error occurred or action must be taken by
83 the calling process. Call SSL_get_error(3) with the return value
84 ret to find out the reason.
85 SSLv2 (deprecated) does not support a shutdown alert protocol, so
87 it can only be detected, whether the underlying connection was
88 closed. It cannot be checked, whether the closure was initiated by
89 the peer or by something else.
90 Old documentation indicated a difference between 0 and -1, and that
92 -1 was retryable. You should instead call SSL_get_error() to find
93 out if it's retryable.
94
96 SSL_get_error(3), SSL_write(3), SSL_CTX_set_mode(3), SSL_CTX_new(3),
97 SSL_connect(3), SSL_accept(3) SSL_set_connect_state(3), SSL_pending(3),
98 SSL_shutdown(3), SSL_set_shutdown(3), ssl(3), bio(3)
991.0.2o 2018-03-27 SSL_read(3)