This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author baikie
Recipients baikie
Date 2011-08-24.19:11:32
SpamBayes Score 1.822045e-09
Marked as misclassified No
Message-id <1314213094.03.0.301914337294.issue12835@psf.upfronthosting.co.za>
In-reply-to
Content
Changeset fd10d042b41d removed the wrappers on ssl.SSLSocket for 
the new socket.send/recvmsg() methods (since I forgot to check 
for the existence of the underlying methods - see issue #6560), 
but this leaves SSLSocket with send/recvmsg() methods inherited 
from the underlying socket type; thus SSLSocket.sendmsg() will 
insert the given data into the stream without encrypting it (or 
wrapping it in SSL in any way). 
 
This immediately screws up the SSL connection, resulting in 
receive errors at both ends ("SSL3_GET_RECORD:wrong version 
number" and the like), but the data is clearly visible in a 
packet capture, so it's too late if it was actually something 
secret. 
 
Correspondingly, recvmsg() and recvmsg_into() return the 
encrypted data, and screw up the connection by removing it from 
the SSL stream. 
 
Of course, these methods don't make sense over SSL anyway, but if 
the programmer naively assumes they do, then ideally they should 
not expose any secret information. 
 
Attaching a patch implementing Antoine Pitrou's suggestion that 
the methods should simply raise NotImplementedError.  I don't 
know if these versions should also be added only if present on 
the underlying socket - they're Not Implemented either way :-)
History
Date User Action Args
2011-08-24 19:11:34baikiesetrecipients: + baikie
2011-08-24 19:11:34baikiesetmessageid: <1314213094.03.0.301914337294.issue12835@psf.upfronthosting.co.za>
2011-08-24 19:11:33baikielinkissue12835 messages
2011-08-24 19:11:32baikiecreate