1SSL_read(3) OpenSSL SSL_read(3)
2
6 SSL_read - read bytes from a TLS/SSL connection.
7
9 #include <openssl/ssl.h>
10 int SSL_read(SSL *ssl, void *buf, int num);
12
14 SSL_read() tries to read num bytes from the specified ssl into the buf‐
15 fer buf.
16
18 If necessary, SSL_read() will negotiate a TLS/SSL session, if not
19 already explicitly performed by SSL_connect(3) or SSL_accept(3). If the
20 peer requests a re-negotiation, it will be performed transparently dur‐
21 ing the SSL_read() operation. The behaviour of SSL_read() depends on
22 the underlying BIO.
23 For the transparent negotiation to succeed, the ssl must have been ini‐
25 tialized to client or server mode. This is being done by calling
26 SSL_set_connect_state(3) or SSL_set_accept_state() before the first
27 call to an SSL_read() or SSL_write(3) function.
28 SSL_read() works based on the SSL/TLS records. The data are received in
30 records (with a maximum record size of 16kB for SSLv3/TLSv1). Only when
31 a record has been completely received, it can be processed (decryption
32 and check of integrity). Therefore data that was not retrieved at the
33 last call of SSL_read() can still be buffered inside the SSL layer and
34 will be retrieved on the next call to SSL_read(). If num is higher than
35 the number of bytes buffered, SSL_read() will return with the bytes
36 buffered. If no more bytes are in the buffer, SSL_read() will trigger
37 the processing of the next record. Only when the record has been
38 received and processed completely, SSL_read() will return reporting
39 success. At most the contents of the record will be returned. As the
40 size of an SSL/TLS record may exceed the maximum packet size of the
41 underlying transport (e.g. TCP), it may be necessary to read several
42 packets from the transport layer before the record is complete and
43 SSL_read() can succeed.
44 If the underlying BIO is blocking, SSL_read() will only return, once
46 the read operation has been finished or an error occurred, except when
47 a renegotiation take place, in which case a SSL_ERROR_WANT_READ may
48 occur. This behaviour can be controlled with the SSL_MODE_AUTO_RETRY
49 flag of the SSL_CTX_set_mode(3) call.
50 If the underlying BIO is non-blocking, SSL_read() will also return when
52 the underlying BIO could not satisfy the needs of SSL_read() to con‐
53 tinue the operation. In this case a call to SSL_get_error(3) with the
54 return value of SSL_read() will yield SSL_ERROR_WANT_READ or
55 SSL_ERROR_WANT_WRITE. As at any time a re-negotiation is possible, a
56 call to SSL_read() can also cause write operations! The calling process
57 then must repeat the call after taking appropriate action to satisfy
58 the needs of SSL_read(). The action depends on the underlying BIO. When
59 using a non-blocking socket, nothing is to be done, but select() can be
60 used to check for the required condition. When using a buffering BIO,
61 like a BIO pair, data must be written into or retrieved out of the BIO
62 before being able to continue.
63
65 When an SSL_read() operation has to be repeated because of
66 SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE, it must be repeated with
67 the same arguments.
68
70 The following return values can occur:
71 >0 The read operation was successful; the return value is the number
73 of bytes actually read from the TLS/SSL connection.
74 0 The read operation was not successful. The reason may either be a
76 clean shutdown due to a "close notify" alert sent by the peer (in
77 which case the SSL_RECEIVED_SHUTDOWN flag in the ssl shutdown state
78 is set (see SSL_shutdown(3), SSL_set_shutdown(3)). It is also pos‐
79 sible, that the peer simply shut down the underlying transport and
80 the shutdown is incomplete. Call SSL_get_error() with the return
81 value ret to find out, whether an error occurred or the connection
82 was shut down cleanly (SSL_ERROR_ZERO_RETURN).
83 SSLv2 (deprecated) does not support a shutdown alert protocol, so
85 it can only be detected, whether the underlying connection was
86 closed. It cannot be checked, whether the closure was initiated by
87 the peer or by something else.
88 <0 The read operation was not successful, because either an error
90 occurred or action must be taken by the calling process. Call
91 SSL_get_error() with the return value ret to find out the reason.
92
94 SSL_get_error(3), SSL_write(3), SSL_CTX_set_mode(3), SSL_CTX_new(3),
95 SSL_connect(3), SSL_accept(3) SSL_set_connect_state(3), SSL_shut‐
96 down(3), SSL_set_shutdown(3), ssl(3), bio(3)
970.9.8b 2001-09-13 SSL_read(3)