What is the proper way to securely disconnect an asio SSL socket?

by

To securely disconnect, perform a shutdown operation and then close the underlying transport once shutdown has complete. Hence, the method you are currently using will perform a secure disconnect:

boost::system::error_code ec;
ssl_socket.cancel(ec);
ssl_socket.async_shutdown([](...) { ssl_socket.close(); };

Be aware that the current async_shutdown operation will be considered complete when either:

  • A close_notify has been received by the remote peer.
  • The remote peer closes the socket.
  • The operation has been cancelled.

Hence, if resources are bound to the lifetime of the socket or connection, then these resources will remain alive waiting for the remote peer to take action or until the operation is cancelled locally. However, waiting for a close_notify response is not required for a secure shutdown. If resources are bound to the connection, and locally the connection is considered dead upon sending a shutdown, then it may be worthwhile to not wait for the remote peer to take action:

ssl_socket.async_shutdown(...);
const char buffer[] = "";
async_write(ssl_socket, boost::asio::buffer(buffer),
    [](...) { ssl_socket.close(); })

When a client sends a close_notify message, the client guarantees that the client will not send additional data across the secure connection. In essence, the async_write() is being used to detect when the client has sent a close_notify, and within the completion handler, will close the underlying transport, causing the async_shutdown() to complete with boost::asio::error::operation_aborted. As noted in the linked answer, the async_write() operation is expected to fail.

… as the write side of PartyA‘s SSL stream has closed, the async_write() operation will fail with an SSL error indicating the protocol has been shutdown.

if ((error.category() == boost::asio::error::get_ssl_category())
     && (SSL_R_PROTOCOL_IS_SHUTDOWN == ERR_GET_REASON(error.value())))
{
  ssl_stream.lowest_layer().close();
}

The failed async_write() operation will then explicitly close the underlying transport, causing the async_shutdown() operation that is waiting for PartyB‘s close_notify to be cancelled.

More Related Contents:

  1. boost asio ssl async_shutdown always finishes with an error?
  2. Exception running boost asio ssl example
  3. Dynamic memory allocation in game server [closed]
  4. Why do I need strand per connection when using boost::asio?
  5. What is the usefulness of `enable_shared_from_this`?
  6. boost asio async_write : how to not interleaving async_write calls?
  7. Confused when boost::asio::io_service run method blocks/unblocks
  8. Should the exception thrown by boost::asio::io_service::run() be caught?
  9. Best documentation for Boost:asio?
  10. How to set a timeout on blocking sockets in boost asio?
  11. Boost::Asio : io_service.run() vs poll() or how do I integrate boost::asio in mainloop
  12. Why do we need to use boost::asio::io_service::work?
  13. Boost async_* functions and shared_ptr’s
  14. Boost.ASIO-based HTTP client library (like libcurl) [closed]
  15. Thread pool using boost asio
  16. boost::asio and Active Object
  17. Boost ASIO streambuf
  18. Copy a streambuf’s contents to a string
  19. Boost::asio – how to interrupt a blocked tcp server thread?
  20. c++ work queues with blocking
  21. C++ Socket Server – Unable to saturate CPU
  22. Boost linker error: Unresolved external symbol “class boost::system::error_category const & __cdecl boost::system::get_system_category(void)”
  23. Some clarification needed about synchronous versus asynchronous asio operations
  24. boost::asio + std::future – Access violation after closing socket
  25. BOOST ASIO – How to write console server
  26. Boost.Asio as header-only
  27. asio How to change the executor inside an awaitable?
  28. How to design proper release of a boost::asio socket or wrapper thereof
  29. Strange exception throw – assign: Operation not permitted
  30. Why does Boost.Asio not support an event-based interface?

Leave a Comment