Bug 960168
| Summary: | failed incoming SSL connection stays open | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Saveliev Peter <peet> | ||||||
| Component: | python | Assignee: | Matej Stuchlik <mstuchli> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Jan Kepler <jkejda> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 6.4 | CC: | bkabrda, fholec, jberan, jkejda, lnovich, michal.skrivanek, mstuchli | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | python-2.6.6-47.el6 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2013-11-21 09:14:59 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 744237 [details]
simple SSL server testcase
Upstream issue is fixed and closed. Tested OK. Merged into cpython 2.7 branch as http://hg.python.org/cpython/rev/85e5a93e534e This fix is easily backportable to RHEL 6 python-2.6. Created attachment 756235 [details]
SSL fix backported from 2.7
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-1582.html |
Description of problem ====================== Having a server with SSLSocket waiting for connections, the incoming connection, failed on automatic do_handshake(), stays open forever — accept() raises the SSLError and does not return client connection socket. How reproducible ================ 146% Steps to reproduce ================== server side: 1. create a SOCK_STREAM socket 2. wrap it with wrap_socket() 3. listen() 4. accept() client side: 1. telnet to this port 2. enter any random text Expected results ================ 1. Incoming connection is closed and client disconnected Actual results ============== 1. On the server side, due to exception, the reference to the incoming connection gets lost. 2. The client stays connected as long as the server operates. Actually, this issue can lead to unintentional DoS, if a client will try open new connections on a failure — without explicit closing failed ones. Possible fix ============ Add into do_handshake() something like that: try: self._sslobj.do_handshake() except SSLError as e: self._sock.close() raise e Additional info =============== Python bugzilla issue: http://bugs.python.org/issue17918 Important: only Python2 versions are affected. Python3 works OK. Possibly related issue: http://bugs.python.org/issue12378 (differs: see the line above)