Project

General

Profile

Actions

Bug #261

closed

Failed SSL handshake causes bip to write to a random socket, and never close the connection

Added by Thijs Alkemade almost 13 years ago. Updated almost 11 years ago.

Status:
Resolved
Priority:
High
Target version:
Start date:
2011-11-10
Due date:
% Done:

100%

Estimated time:
Patch Available:
Yes
Found in Versions:
0.8.2
Confirmed:
Yes
Branch:
Security:
Yes
Help Needed:
No

Description

Lately, I've occasionally received errors in my client saying "Unknown message '28126:error:1407609C:SSL', The IRC server received a message it did not understand.", typing 'lsof -i' on the machine bip is running on would then show there was an incoming connection from a weird, foreign IP address to bip, which ended up in CLOSED_WAIT state.

My theory on why this happens is this: when using SSL (client_side_ssl = true), bip will write an error to stderr when the SSL handshake fails. However, if it is running as a daemon, stderr will have been closed. This means that it is likely that this file descriptor is now used as a connection to a server or client. So when something connects and tries to send something that isn't a valid SSL handshake, bip will print an error to the server, which then responds that it doesn't understand that message. This could even allow an attacker to, for example, cause bip to send a lot of malformed messages and get disconnected from the server.

This happens because there is a BIO* struct created that is initialized with stderr (src/connection.c:1206) for handling SSL errors. It would be better if this were printed to the global log file.

Also, when an SSL handshake error occurs, a socket is never closed, but remains in CLOSE_WAIT state forever. This happens because a socket that is set to have an error will never be closed (src/connection.c:57).

I'm attaching a patch that fixed both of these problems.


Files

bip.diff (962 Bytes) bip.diff A patch which fixes this problem Thijs Alkemade, 2011-11-10 22:44

Related issues 1 (0 open1 closed)

Has duplicate Bip - Bug #297: crash, probably due to file descriptor leakRejected2012-06-02

Actions
Actions

Also available in: Atom PDF