classification
Title: Issue with ftplib.FTP_TLS and server forcing SSL connection reuse
Type: behavior Stage:
Components: Library (Lib) Versions: Python 3.4, Python 2.7
process
Status: closed Resolution: duplicate
Dependencies: Superseder: Add client-side SSL session resumption
View: 19500
Assigned To: Nosy List: Stephen Ash, christian.heimes, dwaites
Priority: normal Keywords:

Created on 2015-10-18 19:44 by dwaites, last changed 2016-09-08 23:09 by christian.heimes. This issue is now closed.

Messages (3)
msg253161 - (view) Author: Daniel Waites (dwaites) Date: 2015-10-18 19:44
There is an issue with the python FTPS module in the standard library which appears to be related to SSL session reuse. I noticed when I updated to a recent version of Pure-FTPd (1.0.42), python's FTPS library client stopped working and generated an error in the ssl unwrap call when a data connection is opened after prot_p() is used. Checking the change log on that version of Pure-FTPd, there is this note:

- The ONLY_ACCEPT_REUSED_SSL_SESSIONS switch (introduced in Pure-FTPd
1.0.22 circa 2009, but disabled back then due to client compatibility
concerns) is now on by default, except in broken clients compatibility mode.

Turning on the broken clients compatibility mode in pure-ftpd makes the Python client work again, so I'm surmising this is related to pure-ftpd forcing SSL session reuse. My question is, is this something the Python standard library should detect, or is it a problem lower in the stack (i.e., libssl?) Incidentally, I can reproduce this behavior on Python 2.7 as well.


Steps to reproduce:

import ftplib
ftp = ftplib.FTP_TLS(ftphost, ftpuser, ftppass)
ftp.prot_p()
ftp.retrbinary('RETR ' + cmofile, infile.write)

Traceback (most recent call last): 
File "/home/dwaites/bin/mysqlload.py", line 212, in 
main() 
File "/home/dwaites/bin/mysqlload.py", line 155, in main 
site.retrbinary('RETR ' + cmofile, infile.write) 
File "/usr/lib/python3.4/ftplib.py", line 449, in retrbinary 
conn.unwrap() 
File "/usr/lib/python3.4/ssl.py", line 788, in unwrap 
s = self._sslobj.shutdown() 
OSError: [Errno 0] Error
msg253162 - (view) Author: Daniel Waites (dwaites) Date: 2015-10-18 19:46
Incidentally, there appears to be an old bug report with a similar error message, although the error is encountered in a different context. http://bugs.python.org/issue10808 . Evidently, errors encountered in libssl aren't necessarily being propagated up to python.
msg275208 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2016-09-08 23:09
I'm going to add session support in #19500 (3.6).
History
Date User Action Args
2016-09-08 23:09:48christian.heimessetstatus: open -> closed

nosy: + christian.heimes
messages: + msg275208

superseder: Add client-side SSL session resumption
resolution: duplicate
2015-11-10 23:19:56Stephen Ashsetnosy: + Stephen Ash
2015-10-19 15:23:10dwaitessetversions: + Python 2.7
2015-10-18 19:46:25dwaitessetmessages: + msg253162
2015-10-18 19:44:18dwaitescreate