0

So I have a twisted application where I create the SSL service like this:

myfactory=MyFactory(host, port)
service=SSLServer(port,myfactory, ssl.DefaultOpenSSLContextFactory(MY_SERVICE_SSL_KEY, MY_SERVICE_SSL_CERT))

Here MyFactory is just my custom Factory class, and MY_SERVICE_SSL_KEY and MY_SERVICE_SSL_CERT are the file paths to the key and cert files required by SSL.

The service is such that a client will connect to the service, send a line of information (which gets stored on on the server side) and then disconnects.

The issue is that for some client IPs, everything "seems" to work: the client connects, the server receives the expected data, and then connectionLost is called. I log the reason for connectionLost and get this:

[Failure instance: Traceback (failure with no frames): <class 'twisted.internet.error.ConnectionLost'>: Connection to the other side was lost in a non-clean fashion: Connection lost.

But for other client IP addresses, there seems to be an SSL handshake error where the connection is lost immediately:

application [28/Nov/2017 02:39:36] INFO MyProtocol ConnectionMade: xx.xx.xx.xx
application [28/Nov/2017 02:39:36] INFO MyProtocol ConnectionLost: xx.xx.xx.xx | [Failure instance: Traceback: <class 'OpenSSL.SSL.Error'>: [('SSL routines', 'SSL3_READ_BYTES', 'ssl handshake failure')]

Does anyone know why this happens? How can I fix it?

Marc
  • 3,386
  • 8
  • 44
  • 68
  • 2
    Please [edit] your question title to something descriptive enough of the problem or question to have meaning to future readers seeing it in a list of search results. Half of what you wrote is already available in the tags, and the remainder is so generic and non-descriptive as to be meaningless. – Ken White Nov 29 '17 at 02:14
  • Please read http://sscce.org/ – Jean-Paul Calderone Nov 29 '17 at 15:20
  • Are you able to determine any characteristic of the clients that fail? For example, are they trying to connect via an older protocol version that you have disabled? How do you know that they're sending valid handshakes? – lockcmpxchg8b Nov 30 '17 at 05:36
  • Yes, it now appears that the ones failing are unauthorized connection attempts. The incoming IP is from somewhere in Russia. There are no secrets worth hacking on my server, but it sure looks like someone is trying anyway. – Marc Dec 02 '17 at 23:10

0 Answers0