Don't return shutdown errors during shutdown

boring/src/error.rs

@@ -152,15 +152,32 @@ impl Error {
     /// Pops the first error off the OpenSSL error stack.
     #[must_use = "Use ErrorStack::clear() to drop the error stack"]
     #[corresponds(ERR_get_error_line_data)]
+    #[inline]
     pub fn get() -> Option<Error> {
+        Self::get_(false)
+    }
+
+    /// Use [`ErrorStack::clear()`] or [`ErrorStack::get()`] afterwards
+    #[corresponds(ERR_peek_last_error_line_data)]
+    #[inline]
+    pub fn peek() -> Option<Error> {
+        Self::get_(true)
+    }
+
+    fn get_(peek: bool) -> Option<Error> {
         unsafe {
             ffi::init();
 
             let mut file = ptr::null();
             let mut line = 0;
             let mut data = ptr::null();
             let mut flags = 0;
-            match ffi::ERR_get_error_line_data(&mut file, &mut line, &mut data, &mut flags) {
+            let code = if !peek {
+                ffi::ERR_get_error_line_data(&mut file, &mut line, &mut data, &mut flags)
+            } else {
+                ffi::ERR_peek_last_error_line_data(&mut file, &mut line, &mut data, &mut flags)
+            };
+            match code {
                 0 => None,
                 code => {
                     // The memory referenced by data is only valid until that slot is overwritten

boring/src/ssl/mod.rs

@@ -4069,7 +4069,26 @@ impl<S: Read + Write> SslStream<S> {
         match unsafe { ffi::SSL_shutdown(self.ssl.as_ptr()) } {
             0 => Ok(ShutdownResult::Sent),
             1 => Ok(ShutdownResult::Received),
-            n => Err(self.make_error(n)),
+            n => {
+                let e = self.make_error(n);
+
+                // If boring returns PROTOCOL_IS_SHUTDOWN then the connection
+                // has already been shutdown and we can just return Ok(()), as
+                // this was exactly what we wanted to do anyway.
+                if e.code() == ErrorCode::SSL {
+                    if let Some(stack) = e.ssl_error() {
+                        if let Some(first) = stack.errors().first() {
+                            if first.library_reason(ffi::ERR_LIB_SSL)
+                                == Some(ffi::SSL_R_PROTOCOL_IS_SHUTDOWN)
+                            {
+                                return Ok(ShutdownResult::Received);
+                            }
+                        }
+                    }
+                }
+
+                Err(e)
+            }
         }
     }
 

boring/src/x509/mod.rs

@@ -28,7 +28,7 @@ use crate::asn1::{
 };
 use crate::bio::{MemBio, MemBioSlice};
 use crate::conf::ConfRef;
-use crate::error::ErrorStack;
+use crate::error::{Error as PackedError, ErrorStack};
 use crate::ex_data::Index;
 use crate::hash::{DigestBytes, MessageDigest};
 use crate::nid::Nid;
@@ -809,10 +809,9 @@ impl X509 {
                 let r =
                     ffi::PEM_read_bio_X509(bio.as_ptr(), ptr::null_mut(), None, ptr::null_mut());
                 if r.is_null() {
-                    let err = ffi::ERR_peek_last_error();
-
-                    if ffi::ERR_GET_LIB(err) == ffi::ERR_LIB_PEM.0.try_into().unwrap()
-                        && ffi::ERR_GET_REASON(err) == ffi::PEM_R_NO_START_LINE
+                    if PackedError::peek()
+                        .and_then(|err| err.library_reason(ffi::ERR_LIB_PEM))
+                        .is_some_and(|code| code == ffi::PEM_R_NO_START_LINE)
                     {
                         ErrorStack::clear();
                         break;