Returning SSL_TLSEXT_ERR_NOACK from SSL_CTX_set_tlsext_servername_callback doesn't stop sending

[d3x0r]

(3.9.2)

I don't yet have a simple test case of this.

I was enabling TLS on some TCP sockets. I realized I was sort of leaking valid server names if I don't check the requested server name, and fail if it's not part of the certificate... so I started checking on the name given in the initial request. If I didn't find the name in the list, then I return SSL_TLSEXT_ERR_NOACK, and setup some other conditions on my internal state...
When the SSL_do_handshake() returns, there is control data available to send ... which apparently includes the certificate.

I was testing against my TCP service using a browser, and deliberately sending bad hostnames... in the browser I got back an error more like 'common name not correct in certificate'... which means it got back the certificate, even though I said NOACK.... I did set a flag noHost internally, and if there is a noHost status and there's data to send, I don't send the data now, and the browser doesn't get the certificate; and now just indicates connection_closed.