Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenSSL::SSL::SSLSocket writes plaintext to the wire unless #connect is called #9

Closed
tarcieri opened this issue Mar 24, 2015 · 4 comments · Fixed by #469
Closed

OpenSSL::SSL::SSLSocket writes plaintext to the wire unless #connect is called #9

tarcieri opened this issue Mar 24, 2015 · 4 comments · Fixed by #469

Comments

@tarcieri
Copy link
Collaborator

Repro here:

https://gist.github.com/tarcieri/b20437a1b9364d82c365

Attempting to do I/O before the SSL handshake has completed should raise an exception instead of writing plaintext to the wire.
@rhenium
Copy link
Member

rhenium commented Jul 1, 2016

Note:
As an experiment, I disabled it but several tests outside test/openssl failed.

rhenium/ruby@195c9ad?w=1
https://gist.github.com/rhenium/8209b06c77a877beed98895c0c803df4

Tthe code is already in the oldest version of 'OpenSSL for Ruby' I could find, but the history before 'SSLSocket' is merged into it is missing. So I still don't know why it is made so.

http://cvs.savannah.gnu.org/viewvc/ossl/ossl_ssl.c?revision=1.1&root=rubypki&sortdir=down&view=markup

@tarcieri
Copy link
Collaborator Author

tarcieri commented Jul 2, 2016

@rhenium that's unfortunate 😢

I have run into similar problems with the test suite trying to make improvements like this.

@rhenium
Copy link
Member

rhenium commented Nov 21, 2016

Actually net/http was the only using the behavior. It has been replaced now: ruby/ruby@4081b34

Since the gem also targets 2.3 for now, we can't remove it immediately, though.

@ioquatix
Copy link
Member

+1

rhenium added a commit to rhenium/ruby-openssl that referenced this issue Oct 24, 2021
@rhenium
ssl: disallow reading/writing to unstarted SSL socket
bf78074 
OpenSSL::SSL::SSLSocket allowed #read and #write to be called before an
SSL/TLS handshake is completed. They passed unencrypted data to the
underlying socket.

This behavior is very odd to have in this library. A verbose mode
warning "SSL session is not started yet" was emitted whenever this
happened. It also didn't behave well with OpenSSL::Buffering. Let's
just get rid of it.

Fixes: ruby#9
@rhenium rhenium mentioned this issue Oct 24, 2021
Merged
matzbot pushed a commit to ruby/ruby that referenced this issue Nov 1, 2021
@rhenium
[ruby/openssl] ssl: disallow reading/writing to unstarted SSL socket
1ac7f23 
OpenSSL::SSL::SSLSocket allowed #read and #write to be called before an
SSL/TLS handshake is completed. They passed unencrypted data to the
underlying socket.

This behavior is very odd to have in this library. A verbose mode
warning "SSL session is not started yet" was emitted whenever this
happened. It also didn't behave well with OpenSSL::Buffering. Let's
just get rid of it.

Fixes: ruby/openssl#9

ruby/openssl@bf780748b3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

ssl: disallow reading/writing to unstarted SSL socket rhenium/ruby-openssl
3 participants
@tarcieri @ioquatix @rhenium