[Twisted-Python] Fwd: Trouble with session id reuse/disabling with twisted TLS
Hi I have a twisted service, which uses TLS and I seeing some odd behaviour. New connections are accepted fine, but if a client tries to re-use a TLS session id with a new connection, the services rejects the connection. Poking at the TLS module I added the following line to help me figure out what was wrong: @@ -363,11 +365,13 @@ except ZeroReturnError: # TLS has shut down and no more TLS data will be received over # this connection. self._shutdownTLS() # Passing in None means the user protocol's connnectionLost # will get called with reason from underlying transport: self._tlsShutdownFinished(None) except Error as e: + log.msg('_flushReceiveBIO Error: %s' % str(e), system='protocols.TLS') # Something went pretty wrong. For example, this might be a # handshake failure (because there were no shared ciphers, because # a certificate failed to verify, etc). TLS can no longer proceed. (I think the above patch would be a nice addition to twisted as figuring out what goes wrong in the TLS stack is currently quite difficult). This gives me the following: 2014-04-30 15:02:08+0200 [protocols.TLS] _flushReceiveBIO Error: [('SSL routines', 'SSL_GET_PREV_SESSION', 'session id context uninitialized')] I am using the same (cached) context for all incoming connections. Using openssl s_client -connect host:port I can see that the service returns a session id and master key. If I disable session cache with: ctx.set_session_cache_mode(SSL.SESS_CACHE_OFF) The s_client command still returns session-id and master-key. Which is rather unexpected. (I am not using the CertificateOptions class, just SSL.Context) Code for context creation can be seen here: https://github.com/NORDUnet/opennsa/blob/master/opennsa/ctxfactory.py Without the disabling of session id. Any idea to what I am doing wrong here? This is with openssl 1.0.1-4ubuntu5.12, pyOpenSSL 14.1 and Twisted 13.1 regards, Henrik
On 30/04/14 17:43, Henrik Thostrup Jensen wrote:
This example: https://twistedmatrix.com/documents/12.0.0/core/howto/ssl.html#auto2 ...seems to work fine for me on both Twisted 12.1.0 / pyOpenSSL 0.13.1 and Twisted 13.2.0 / pyOpenSSL 0.14. I'm testing using: openssl s_client -connect host:port -reconnect ...and seeing: drop connection and then reconnect CONNECTED(00000003) --- Reused, TLSv1/SSLv3, Cipher is AES256-GCM-SHA384 ^^^^^^ looks ok. What do you see if you use that openssl command to test? Can you reduce it to a sscce with a fake self-signed cert?
Hi On 30 April 2014 19:26, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
... drop connection and then reconnect CONNECTED(00000003) 3074107592:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: Same error mesage on the service side. However, someone pointed me to this: https://stackoverflow.com/questions/22378442/how-to-disable-session-resumpti... Adding in: ctx.set_options(OP_NO_TICKET) Fixes the issue (well, the client no longer attemps to reuse the session). Since there is absolutely nothing performance sensitive about this, that is good enough for me.
Can you reduce it to a sscce with a fake self-signed cert?
Might try tomorrow. -- - Henrik
On 30/04/14 17:43, Henrik Thostrup Jensen wrote:
This example: https://twistedmatrix.com/documents/12.0.0/core/howto/ssl.html#auto2 ...seems to work fine for me on both Twisted 12.1.0 / pyOpenSSL 0.13.1 and Twisted 13.2.0 / pyOpenSSL 0.14. I'm testing using: openssl s_client -connect host:port -reconnect ...and seeing: drop connection and then reconnect CONNECTED(00000003) --- Reused, TLSv1/SSLv3, Cipher is AES256-GCM-SHA384 ^^^^^^ looks ok. What do you see if you use that openssl command to test? Can you reduce it to a sscce with a fake self-signed cert?
Hi On 30 April 2014 19:26, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
... drop connection and then reconnect CONNECTED(00000003) 3074107592:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: Same error mesage on the service side. However, someone pointed me to this: https://stackoverflow.com/questions/22378442/how-to-disable-session-resumpti... Adding in: ctx.set_options(OP_NO_TICKET) Fixes the issue (well, the client no longer attemps to reuse the session). Since there is absolutely nothing performance sensitive about this, that is good enough for me.
Can you reduce it to a sscce with a fake self-signed cert?
Might try tomorrow. -- - Henrik
participants (2)
-
Henrik Thostrup Jensen -
Phil Mayers