Question

I want to implement an SSL proxy in Java. I basically open two sockets browser-proxy,proxy-server, and run two threads which would write to proxy-server what they read from browser-proxy, and vice versa. Each thread looks like this:

while (true) {
   nr = in.read(buffer);
   if (nr == -1) System.out.println(sockin.toString()+" EOF  "+nr);
   if (nr == -1) break;
   out.write(buffer, 0, nr);
}
sockin.shutdownInput();
sockout.shutdownOutput(); // now the second thread will receive -1 on read

Each thread will only close the input socket, so that eventually both sockets are closed.

But what do I do if I want to use an SSLSocket? It seems that the shutdownOutput/Input methods are not supported there. Here’s the exception I get.

Exception in thread "Thread-35" java.lang.UnsupportedOperationException: \
The method shutdownInput() is not supported in SSLSocket
    at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.shutdownInput(Unknown Source)

What I came up with is:

try {
    while (true) {
       nr = in.read(buffer);
       if (nr == -1) System.out.println(sockin.toString()+" EOF  "+nr);
       if (nr == -1) break;
       out.write(buffer, 0, nr);
    }
    // possible race condition if by some mysterious way both threads would get EOF
    if (!sockin.isClosed()) sockin.close();
    if (!sockout.isClosed()) sockout.close();
} catch (SocketException e) {/*ignore expected "socket closed" exception, */}

I must catch and ignore end of socket exception every time my socket ends.

My questions are:

1. If shutdownInput() is unsupported, how come I’m getting a -1 answer from an SSLSocket.

2. Is there a better solution for my agony? I don’t think there’s anything sane, since one of the thread might be already in the blocking read method when the other thread marks him “I’m done”. And the only way I see to kick him out of the blocking thread is by closing the socket and raising a “closed socket” exception.

   (You could I guess use some unholy combination of multithread message passing and asynchronous data reading in order to signal the other thread your work is done, but this is so horrible that I’m afraid IntelliJ’s style cop will come after me just for thinking about it…)

Clarification: I know that shutdownInput and shutdownOutput doesn’t make sense, since you cannot have a half-duplex TLS connection, per spec. But given that, how can I end a TLS connection in Java without getting an exception?

Please, don’t tell me shutdownIput doesn’t make sense for TLS. I know that, this is not what I’m asking. I’m asking what else can I use, in order to close SSLSocket properly (hence the title, “Properly closing SSLSocket”.

Answer 1

This was my initial (temporarily deleted) answer, but it was apparently not good enough, since it was -2’ed quite quickly… I guess I should add more explanations.

It’s not possible to close half of the connection for SSL/TLS sockets to comply with the TLS protocol, as specified in the section on closure alerts.

The client and the server must
share knowledge that the connection is
ending in order to avoid a truncation
attack. Either party may initiate
the exchange of closing messages.

close_notify This message notifies the recipient that the sender will not
send any more messages on this connection. The session becomes unresumable if any connection is terminated without proper close_notify messages with level equal to warning.

Either party may initiate a close
by sending a close_notify alert.
Any data received after a closure
alert is ignored.

Each party is required to send a
close_notify alert before closing
the write side of the connection. It
is required that the other party
respond with a close_notify alert of
its own and close down the
connection immediately, discarding any
pending writes. It is not required
for the initiator of the close to wait
for the responding close_notify
alert before closing the read side of
the connection.

Although you may want to close only half of the connection (input or output via shutdownInput()/shutdownOutput()), the underlying TLS layer still needs to send this close_notify packet before really shutting down the communication, otherwise, it will be considered as a truncation attack.

The fix is quite simple: only use close() on SSLSockets: it doesn’t just close the connection as it would for normal TCP sockets, but it does it cleanly according to the SSL/TLS specification.

EDIT: Additional explanations.

The short answer is still: use close(), you may also need to find out when it’s appropriate to do so from the protocol on top of SSL/TLS.

(Just to clarify, what you’re trying to do is effectively a "Man-In-The-Middle" (MITM) proxy. You would need the client to be configured to trust the proxy’s certificate, possibly as if it was the server certificate if this is meant to happen transparently. How HTTPS connections work through an HTTP proxy is a different question.)

In some of your comments to your other related question, I got the impression that you thought that not returning -1 was "breaking the TLS protocol". This isn’t really about the protocol, but about the API: the way programming structures (classes, methods, functions, …) are provided to (programmer) user of the TLS stack to be able to use of TLS. SSLSocket is merely part of an API to provide programmers with the ability to use SSL/TLS in a way similar to plain Socket. The TLS specification doesn’t talk about sockets at all.
While TLS (and its precessor, SSL) were built with the aim to make it possible to provide this sort of abstraction, at the end of the day SSLSocket is just that: an abstraction.
In line with the OOP design principles, SSLSocket inherits Socket and tries to stick as closely as possible to the behaviour of Socket. However, because of the way SSL/TLS works (and because an SSLSocket effectively sits on top of a normal Socket), there cannot be an exact mapping of all features.

In particular, the area of transition from a normal TCP socket to an SSL/TLS socket can’t quite be modelled transparently.
Some arbitrary choices (e.g. how the handshake takes place) had to be made when designing the SSLSocket class:
it’s a compromise between not (a) exposing too much of the specificity of TLS to the SSLSocket user, (b) making the TLS mechanism work and (c) mapping all this to the existing interface provided by the superclass (Socket).
These choices inevitably have some impact on the functionality of the SSLSocket, and that’s why its Javadoc API page has a relatively large amount of text.
SSLSocket.close(), in terms of API, has to abide by the description of Socket.close().
The InputStream/OutputStream obtained from the SSLSocket are not the same as the one from the underlying plain Socket,which (unless you’ve converted it explicitly) you might not see.

SSLSocket is designed to be usable as closely as possibly as if it was a plain Socket, and the InputStream you get is designed to behave as closely as possibly to a file-based input stream.
This isn’t specific to Java, by the way. Even Unix sockets in C are used with a file descriptor and read().
These abstractions are convenient and work most of the time, so long as you know what their limitations are.

When it comes to read(), even in C, the notion of EOF comes from an end-of-file termination, but you’re not actually dealing with files.
The problem with TCP sockets is that, while you can detect when the remote party has chosen to close the connection when it sends FIN, you can’t detect it hasn’t, if it doesn’t send anything.
When reading nothing from a socket, there is no way to tell the difference between an inactive and a broken connection.
As such, when it comes to network programming, relying on reading -1 from the InputStream if fine, but you never rely solely on that, otherwise you may end up with unreleased, dead connections.
While it’s "polite" for a party to close the half TCP connection properly (in a way such as the remote party reads -1 on its InputStream or something equivalent, as described in Orderly Versus Abortive Connection Release in Java), handling this case isn’t sufficient.
This is why protocols on top of TCP are generally designed to give an indication as to when they’re done sending data: for example,
SMTP sends QUIT (and has specific terminators), HTTP 1.1 uses Content-Length or chunked encoding.

(By the way, if you’re not satisfied with the abstraction provided by SSLSocket, try to use SSLEngine directly. It’s likely to be harder, and it won’t change what the TLS specification says about sending close_notify.)

In general with TCP, you should know, at the application protocol level, when to stop sending and receiving data (to avoid unreleased connections and/or relying on timeout errors).
This sentence in the TLS specification makes this generally good practice a stronger requirement when it comes to TLS:
"It is required that the other party respond with a close_notify alert of its own and close down the connection immediately discarding any pending writes."
You will have to synchronize somehow, via the application protocol, or the remote party may still have something to write (especially if you’re allowing pipelined requests/responses).

If the proxy you’re writing is for intercepting HTTPS connections (as a MITM), you can look into the content of the requests. Even if the HTTP requests are pipelined, you can count the number of responses sent by
the target server (and expect when they end, via Content-Length or chunks delimiters).

However, you won’t be able to have a purely transparent, generic TLS "interceptor".
TLS is designed to secure the transport between two parties and not to have one in the middle.
While most of the mechanism to achieve that protection (avoiding a MITM) is done via the server certificate, some other TLS mechanisms will get in the way (closure alert is one of them).
Remember that you’re effectively creating two distinct TLS connections, the fact that they’re hard to merge as one shouldn’t be surprising, considering the purpose of TLS.

SSLSocket.close() is the right way to close an SSLSocket, but the application protocol will also help you determine when it’s appropriate to do so.