From b052489d27dc8f85dc52fe603c3db443fb8e28df Mon Sep 17 00:00:00 2001
From: Mario Fetka <mario.fetka@gmail.com>
Date: Thu, 30 Jul 2026 02:28:31 +0200
Subject: [PATCH] Unblock TLS peers during agent shutdown

---
 src/libs/connio/connio.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/libs/connio/connio.c b/src/libs/connio/connio.c
index c47aa68..3cb295a 100644
--- a/src/libs/connio/connio.c
+++ b/src/libs/connio/connio.c
@@ -612,6 +612,15 @@ ConnCloseAll()
     c = ConnIO.allocated.head;
     while (c) {
         if (!c->bSelfManage) {
+            /*
+             * ConnCloseAll() is the forceful service-shutdown path.  Stop
+             * transport I/O before ConnTcpClose() tries to send a TLS
+             * close_notify; otherwise an idle peer that never answers the
+             * alert can hold the entire agent in gnutls_bye().
+             */
+            if (c->socket != -1) {
+                IPshutdown(c->socket, 2);
+            }
             ConnTcpClose(c);
         }