Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 960168 - failed incoming SSL connection stays open
failed incoming SSL connection stays open
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: python (Show other bugs)
6.4
All Linux
unspecified Severity medium
: rc
: ---
Assigned To: Matej Stuchlik
Jan Kepler
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-05-06 11:31 EDT by Saveliev Peter
Modified: 2016-01-31 21:14 EST (History)
7 users (show)

See Also:
Fixed In Version: python-2.6.6-47.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-11-21 04:14:59 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
simple SSL server testcase (1.18 KB, text/x-python)
2013-05-06 11:32 EDT, Saveliev Peter
no flags Details
SSL fix backported from 2.7 (1.56 KB, patch)
2013-06-03 06:49 EDT, Matej Stuchlik
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Python 17918 None None None Never
Red Hat Product Errata RHSA-2013:1582 normal SHIPPED_LIVE Moderate: python security, bug fix, and enhancement update 2013-11-20 16:39:43 EST

  None (edit)
Description Saveliev Peter 2013-05-06 11:31:22 EDT
Description of problem
======================

Having a server with SSLSocket waiting for connections, the incoming connection, failed on automatic do_handshake(), stays open forever — accept() raises the SSLError and does not return client connection socket.

How reproducible
================

146%

Steps to reproduce
==================

server side:

1. create a SOCK_STREAM socket
2. wrap it with wrap_socket()
3. listen()
4. accept()

client side:

1. telnet to this port
2. enter any random text
  

Expected results
================

1. Incoming connection is closed and client disconnected

Actual results
==============

1. On the server side, due to exception, the reference to the incoming connection gets lost.
2. The client stays connected as long as the server operates.

Actually, this issue can lead to unintentional DoS, if a client will try open new connections on a failure — without explicit closing failed ones.

Possible fix
============

Add into do_handshake() something like that:

    try:
        self._sslobj.do_handshake()
    except SSLError as e:
        self._sock.close()
        raise e

Additional info
===============

Python bugzilla issue: http://bugs.python.org/issue17918
Important: only Python2 versions are affected. Python3 works OK.
Possibly related issue: http://bugs.python.org/issue12378 (differs: see the line above)
Comment 1 Saveliev Peter 2013-05-06 11:32:30 EDT
Created attachment 744237 [details]
simple SSL server testcase
Comment 3 Saveliev Peter 2013-05-07 04:37:33 EDT
Upstream issue is fixed and closed. Tested OK.

Merged into cpython 2.7 branch as http://hg.python.org/cpython/rev/85e5a93e534e
Comment 4 Bohuslav "Slavek" Kabrda 2013-05-22 08:20:55 EDT
This fix is easily backportable to RHEL 6 python-2.6.
Comment 5 Matej Stuchlik 2013-06-03 06:49:03 EDT
Created attachment 756235 [details]
SSL fix backported from 2.7
Comment 14 errata-xmlrpc 2013-11-21 04:14:59 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-1582.html

Note You need to log in before you can comment on or make changes to this bug.