From 115af39aacf9b2458073a7424aa6a2382e4d009b Mon Sep 17 00:00:00 2001 From: nnposter Date: Sun, 9 Aug 2026 22:03:18 +0000 Subject: [PATCH] Tolerate TLS peers that do not send close_notify --- CHANGELOG | 3 +++ nsock/src/nsock_ssl.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index 9df3f23e4..918cf79e8 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,8 @@ #Nmap Changelog ($Id$); -*-text-*- +o [NSE][GH#3430] Nmap now tolerates TLS targets that do not send close_notify. + [nnposter] + Nmap 7.991 [2026-08-06] o Fixed a memory-consumption hang in Ncat's HTTP proxy code that affected both diff --git a/nsock/src/nsock_ssl.c b/nsock/src/nsock_ssl.c index da73b2d68..79ea7458f 100644 --- a/nsock/src/nsock_ssl.c +++ b/nsock/src/nsock_ssl.c @@ -208,6 +208,9 @@ static nsock_ssl_ctx nsock_pool_ssl_init_helper(SSL_CTX *ctx, int flags) { SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2); if (flags & NSOCK_SSL_MAX_SPEED) { SSL_CTX_set_options(ctx, SSL_OP_ALL); +#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF + SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF); +#endif if (!SSL_CTX_set_cipher_list(ctx, CIPHERS_FAST)) fatal("Unable to set OpenSSL cipher list: %s",