Author kyuupichan
Recipients kyuupichan, yselivanov
Date 2017-04-03.14:10:14
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1491228615.05.0.224246839796.issue29970@psf.upfronthosting.co.za>
In-reply-to
Content
Original report at old repo here:  https://github.com/python/asyncio/issues/483

There this is reported fixed by https://github.com/python/cpython/pull/480

I wish to report that whilst the above patch might have a small positive effect, it is far from solving the actual issue.  Several users report eventual exhaustion of the open file resource running SSL asyncio servers.

Here are graphs provided by a friend running my ElectrumX server software, first accepting SSL connections and the second accepting TCP connections only.  Both of the servers were monkey-patched with the pull-480 fix above, so this is evidence it isn't solving the issue.

http://imgur.com/a/cWnSu

As you can see, the TCP server (which has far less connections; most users use SSL) has no leaked file handles, whereas the SSL server has over 300.

This becomes an easy denial of service vector against asyncio servers.  One way to trigger this (though I doubt it explains the numbers above) is simply to connect to the SSL server from telnet, and do nothing.  asyncio doesn't time you out, the telnet session seems to sit there forever, and the open file resources are lost in the SSL handshake stage until the remote host kindly decides to disconnect.

I suspect these resource issues all revolve around the SSL handshake process, certainly at the opening of a connection, but also perhaps when closing.

As the application author I am not informed by asyncio of a potential connection until the initial handshake is complete, so I cannot do anything to close these phantom socket connections.  I have to rely on asyncio to be properly handling DoS issues and it is not currently doing so robustly.
History
Date User Action Args
2017-04-03 14:10:15kyuupichansetrecipients: + kyuupichan, yselivanov
2017-04-03 14:10:15kyuupichansetmessageid: <1491228615.05.0.224246839796.issue29970@psf.upfronthosting.co.za>
2017-04-03 14:10:14kyuupichanlinkissue29970 messages
2017-04-03 14:10:14kyuupichancreate