Boost.Asio async_handshake cannot be canceled

Question

When initiating an async_handshake with a Boost Asio SSL stream, and then implementing a deadline timer to cancel/close the stream before the handshake completes, the program will crash with a buffer overflow exception (on Windows, I haven't tried Linux yet). The crash is somewhere after the socket is closed, and external handlers finish executing, but before the run() command completes.

Is there a reason why the socket cannot be closed when an SSL handshake is in progress? Or is this a bug in Boost Asio?

class Connection
{
    void connect_handler(const boost::system::error_code &err)
    {
        ...
        ssock->async_handshake(boost::asio::ssl::stream_base::client,
                   boost::bind(&Connection::handle_handshake, this, _1));
        ...
    }

    void handle_handshake(const boost::system::error_code &err)
    {
        // CONNECTED SECURELY
    }

    void handle_timeout()
    {
        // HANDLE SSL SHUTDOWN IF ALREADY CONNECTED...
        ...
        ssock->shutdown(boost::asio::ip::tcp::socket::shutdown_both);
        ssock->close();
        delete ssock;
    }

    ...

    boost::asio::ssl::stream<boost::asio::ip::tcp::socket> *ssock;
};

To clarify, calling handle_timeout() before handle_handshake() is called by the IO service will crash in the io_service::run() method.

Is your `Connection` object still in scope after the `timeout`? See [boost-async-functions-and-shared-ptrs](http://stackoverflow.com/questions/11356742/boost-async-functions-and-shared-ptrs/19622084#19622084) — kenba, Oct 14 '16 at 09:56
It has to be, because the `io_service` is a member of the `Connection` class. The `io_service::run()` method on this member will crash before exiting, so it looks like an internal problem with OpenSSL. The timeout works just fine for all standard TCP jobs. — owacoder, Oct 14 '16 at 12:43
It's unusual to make `io_service` a member of a connection, it's usually a higher level object. I recommend taking it out of your `Connection` class and ensuring that it's scope lasts until (at least) the end of `main()`... — kenba, Oct 14 '16 at 15:03

blech · Answer 1 · 2018-08-01T03:49:33.513

We've ran into that one as well. My colleague (AW) found that culprit. Handshake uses read and write operations behind the scene, those need to be cancelled, and the handshake operation needs to properly finish (with operation_aborted error) before the ssock can be safely closed. Tested solution for this is below:

void handle_timeout() {
  ...

  // cancel pending read/write operations
  ssock->lowest_layer().cancel();

  // finish shutdown on next tick of event loop
  boost::asio::post([=] {
    ssock->shutdown(boost::asio::ip::tcp::socket::shutdown_both);
    ssock->close();
    delete ssock;
  });
}

score 0 · Accepted Answer · answered Oct 15 '16 at 19:22

The problem is the socket object is being destroyed before the asynchronous handlers complete. To cancel the pending/queued handlers, use io_service::stop() like this:

io_service.stop(); // Stop the IO service to prevent handlers from executing
ssock->shutdown(boost::asio::ip::tcp::socket::shutdown_both);
ssock->close();
delete ssock;

So no, it is not a bug in Boost.Asio itself.

Boost.Asio async_handshake cannot be canceled

2 Answers2