From: Michal Suchanek <hramrach@...>
Date: 2009-03-17T03:02:26+09:00
Subject: Re: SSLServer crashes when non-essl telnet connection is made

2009/3/15 Erick Cantwell <ecantwell@bluehost.com>:
> I have been working with the SSLServer class in Ruby and have run across
> a problem that I cannot get my head around:
>
> My basic server application accepts and handles SSL connections as it
> should (or as I think it should), but when I use telnet (non-SSL
> encrypted) the server crashes.
>
> I immediately assumed that there was a problem in my code so I began
> stripping it down to the bare minimum required.  However, when this did
> not correct the issue, I ended up with the most basic SSLServer possible
> and the symptoms have not gone away.
>
> Current test code(this code is not mine, but was the most basic
> SSLServer example that I could find...the result is the same with this
> code and my code):
>
> #!/usr/bin/ruby
>
> require 'socket'
> require 'openssl'
>
> include OpenSSL
>
> ctx = SSL::SSLContext.new()
> ctx.cert = X509::Certificate.new(File.read('/home/riot82/blah.crt'))
> ctx.key = PKey::RSA.new(File.read('/home/riot82/blah.key'))
> svr = TCPServer.new(2007)
> serv = SSL::SSLServer.new(svr, ctx)
>
> loop do
>   while soc = serv.accept
>        puts soc.read
>   end
> end
>
>
>
> This code works like I would expect when testing a connection with:
>
> openssl s_client -connect localhost:2007
>
> However, a simple telnet test:
>
> telnet localhost 2007
>
> Telnet makes the connection, but upon exit the server crashes with the
> following error message:
>
> /usr/lib/ruby/1.8/openssl/ssl.rb:171:in `accept': SSL_accept SYSCALL
> returned=5 errno=0 state=SSLv2/v3 read client hello A
> (OpenSSL::SSL::SSLError)
>        from /usr/lib/ruby/1.8/openssl/ssl.rb:171:in `accept'
>        from ./server3.rb:15
>        from ./server3.rb:14:in `loop'
>        from ./server3.rb:14
>

You are getting a SSL exception here.

I guess this is perfectly normal and expected. You connect to your SSL
server with telnet which does not support SSL, and then you(or
telnett) write some garbage (or nothing at all) which is not a SSL
handshake.

So the SSL library reports an error which appears as exception in Ruby.

You should catch the exception (and possibly print the error) and
retry the accept in case a valid SSL client connects later.


HTH

Michal