Skip to content

Neither DTLS nor error for SSLSocket.sendto() of UDP socket #63621

Closed
Closed
Neither DTLS nor error for SSLSocket.sendto() of UDP socket#63621
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or error

Description

@tiran
tiran
opened on Oct 28, 2013
BPO 19422
Nosy @pitrou, @giampaolo, @tiran, @vajrasky
Files
  • raises_error_on_wrap_socket_with_sock_dgram.patch
  • raises_error_on_wrap_socket_with_sock_dgram_v2.patch
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2013-12-28.16:36:28.776>
created_at = <Date 2013-10-28.12:56:51.010>
labels = ['type-bug', 'library']
title = 'Neither DTLS nor error for SSLSocket.sendto() of UDP socket'
updated_at = <Date 2013-12-28.16:36:28.775>
user = 'https://github.com/tiran'

    bugs.python.org fields:

    activity = <Date 2013-12-28.16:36:28.775>
actor = 'pitrou'
assignee = 'none'
closed = True
closed_date = <Date 2013-12-28.16:36:28.776>
closer = 'pitrou'
components = ['Library (Lib)']
creation = <Date 2013-10-28.12:56:51.010>
creator = 'christian.heimes'
dependencies = []
files = ['32489', '33256']
hgrepos = []
issue_num = 19422
keywords = ['patch']
message_count = 9.0
messages = ['201535', '201536', '201540', '202095', '206840', '207036', '207037', '207038', '207039']
nosy_count = 6.0
nosy_names = ['janssen', 'pitrou', 'giampaolo.rodola', 'christian.heimes', 'python-dev', 'vajrasky']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue19422'
versions = ['Python 2.7', 'Python 3.3', 'Python 3.4']

    Activity

    1. tiran commented on Oct 28, 2013

      @tiran
      tiran
      on Oct 28, 2013
      MemberAuthor

      Python's SSL module doesn't support DTLS (datagram TLS for UDP). The SSL code doesn't complain when an UDP socket is wrapped in a SSL socket. It happily sends the bytes unprotected and not encrypted over the wire:

      >>> import ssl, socket
>>> sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
>>> ssock = ssl.wrap_socket(sock)
>>> ssock.sendto(b"data", ("localhost", 12345))
4

      TCP sockets at least complain that the connection hasn't been established yet.

      >>> sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
>>> ssock = ssl.wrap_socket(sock)
>>> ssock.sendto(b"data", ("localhost", 12345))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/heimes/dev/python/cpython/Lib/ssl.py", line 517, in sendto
    return socket.sendto(self, data, flags_or_addr)
BrokenPipeError: [Errno 32] Broken pipe
    2. tiran
      added
      extension-modulesC modules in the Modules dir
      type-bugAn unexpected behavior, bug, or error
      on Oct 28, 2013

    3. tiran commented on Oct 28, 2013

      @tiran
      tiran
      on Oct 28, 2013
      MemberAuthor

      I think either sendto() or wrap_socket() should raise some kind of error for UDP instead of silently sending unencrypted data.

    4. pitrou commented on Oct 28, 2013

      @pitrou
      pitrou
      on Oct 28, 2013
      Member

      Agreed, this should definitely be fixed.

    5. pitrou
      added
      stdlibStandard Library Python modules in the Lib/ directory
      and removed
      extension-modulesC modules in the Modules dir
      on Oct 28, 2013

    6. vajrasky commented on Nov 4, 2013

      @vajrasky
      vajraskymannequin
      on Nov 4, 2013
      Mannequin

      Attached the patch to raise error when using sock dgram in wrap_socket.

      I am still unsure whether I should put the validation in C code (private function _wrap_socket) or not.

    7. vajrasky commented on Dec 23, 2013

      @vajrasky
      vajraskymannequin
      on Dec 23, 2013
      Mannequin

      Thanks, Antoine, for the review! Attached the patch to address Antoine's concern.

    8. pitrou commented on Dec 28, 2013

      @pitrou
      pitrou
      on Dec 28, 2013
      Member

      Actually, it seems the patch is flawed:

      >>> sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
>>> sock.type
2
>>> sock.settimeout(0)
>>> sock.type
2050

      But getsockopt() returns the expected value:

      >>> sock.getsockopt(socket.SOL_SOCKET, socket.SO_TYPE)
2

    9. python-dev commented on Dec 28, 2013

      @python-dev
      python-devmannequin
      on Dec 28, 2013
      Mannequin

      New changeset a00842b783cf by Antoine Pitrou in branch '3.3':
      Issue bpo-19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
      http://hg.python.org/cpython/rev/a00842b783cf

      New changeset f7dc02e6987a by Antoine Pitrou in branch 'default':
      Issue bpo-19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
      http://hg.python.org/cpython/rev/f7dc02e6987a

    10. python-dev commented on Dec 28, 2013

      @python-dev
      python-devmannequin
      on Dec 28, 2013
      Mannequin

      New changeset 44841d81bf14 by Antoine Pitrou in branch '2.7':
      Issue bpo-19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
      http://hg.python.org/cpython/rev/44841d81bf14

    11. pitrou commented on Dec 28, 2013

      @pitrou
      pitrou
      on Dec 28, 2013
      Member

      Updated patch is stricter (it checks for SOCK_STREAM). Pushed!

    12. pitrou
      closed this as completedon Dec 28, 2013
    13. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or error

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions