Unsuccessful TLS handshake leaking connections

Open
#2,785 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
networking

Research direction

Run the attached ssl_leak.py example with netcat on 127.0.0.1:9000 to reproduce the differing HTTP and HTTPS behavior. Then inspect IOStream.start_tls and iostream_tls_leak_fix.diff.txt; done means an incomplete handshake no longer leaves the underlying connection open, with the timeout behavior resolved.

Written by the indexing model from the issue text.

Description

iostream

Tornado's IOStream.start_tls leaks connections when the handshake starts but does not complete. The AsyncHTTPClient returns "HTTP 599: Timeout while connecting", but the underlying connection is not closed.

This can be reproduced quite easily: start a netcat to listen on 127.0.0.1:9000 and run the attached example with "ssl_leak.py http" or "ssl_leak.py https" to observe different behaviors. HTTP closes the connection (and netcat exits), while HTTPS keeps the connection up even after the request errors.

ssl_leak.py.txt

I've observed this behavior with

OpenSSL: OpenSSL 1.1.0f 25 May 2017
Python: 3.5.3 (default, Jan 19 2017, 14:11:04)
[GCC 6.3.0 20170124]
Tornado: 4.5.3

and

OpenSSL: OpenSSL 1.1.1d 10 Sep 2019
Python: 3.7.3 (default, Apr 3 2019, 05:39:12)
[GCC 8.3.0]
Tornado: 6.0.3

I've confirmed this is an issue in start_tls with a "fix", but this fix includes a timeout, which is currently hardcoded. This timeout value might need to be somehow passed into start_tls, but the start_tls is hidden quite deep.

iostream_tls_leak_fix.diff.txt

Dominant language
Python
Stars
22.2k
Forks
5.6k
Avg merge
3h 42m
Merged PRs (30d)
16

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from tornadoweb/tornado

All issues in tornadoweb/tornado

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.