What is the exact danger of not waiting for peer’s close_notify response?
OpenSSL documentation says the following: (Source: https://openssl.org/docs/man3.0/man3/SSL_shutdown.html)
It is acceptable for an application to only send its shutdown alert and then close the underlying connection without waiting for the peer's response. This way resources can be saved, as the process can already terminate or serve another connection. This should only be done when it is known that the other side will not send more data, otherwise there is a risk of a truncation attack.
How would this attack work?
In my case, a higher layer closes the connection with no intent to read more data. It seems that a fast close would be the correct way; it presents no danger, and there is no additional benefit of waiting for a peer's close_notify.
If I am correct, it means that the documentation is not precise. It is not about peer sending more data but about a potential need by our side to process this data. If the data can be safely discarded, everything would be fine. And if it is not safe to discard, the bug is in the higher layer, and my TLS layer would be doing the correct thing.
Am I mistaken? Thanks!
