SSL_connect fails on systemd socket

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

SSL_connect fails on systemd socket

Tiwari, Hari Sahaya

Hi,

 

I am trying to implement a client server program over SSL through systemd.

Here I have a TCP systemd socket (listening on a predefined port) and its associated service.

 

systemd socket file:-

# cat /usr/lib/systemd/system/test_ssl.socket

[Unit]

Description=Test socket

 

[Socket]

ListenStream=2000

Accept=true

MaxConnections=900

 

[Install]

WantedBy=sockets.target

 

systemd service file:-

# cat /usr/lib/systemd/system/test_ssl@.service

[Unit]

Description= Test Service

Requires=test_ssl.socket

 

[Service]

ExecStart=/home/SSL/server

StandardInput=socket

KillMode=process

 

[Install]

WantedBy=multi-user.target

 

The service file invoke the binary /home/SSL/server.

 

Here is it a very simple client server program, where

1.       Server binds and listens on a port number.

2.       Client first connects to server with normal connect (server will do accept)

3.       Once it gets the fd, client does the SSL_connect over same connection. (server will do SSL_accept)

4.       After that it will be SSL_read & SSL_write.

 

Once, I start the systemd socket I can see the systemd starts listening on port 2000.

# systemctl start test_ssl.socket

#  netstat -an | grep 2000

tcp6       0      0 :::2000                 :::*                    LISTEN

 

Post than when executing client, SSL_conect fails.

# ./client localhost 2000

OpenConnection succedeed. << normal connect succeeds.

SSL_connect failed.

140691172779952:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:365:

Here client is able to do normal connect, post that SSL_connect fails.

 

This client server program works well outside of systemd.

 

Do I need to add some extra steps to get this working?

Any help or reference would be appreciated.

 

Thanks & Regards,

 

 

Reply | Threaded
Open this post in threaded view
|

Re: SSL_connect fails on systemd socket

Matt Caswell-2


On 28/01/2020 14:03, Tiwari, Hari Sahaya wrote:
> 140691172779952:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong
> version number:s3_pkt.c:365:

You don't say, but from the reference to s3_pkt.c above I assume you are
using OpenSSL 1.0.2

This error means that the server has received a record that has the
wrong protocol version number in it. It has progressed far enough along
the line that it has already processed the initial ClientHello from the
client and is now trying to read some later record from the client.
Because it has already processed the initial ClientHello we have already
determined which protocol version is in use, so all records should use
that protocol version in their headers. In the case of this error we've
received something other than that version.

This usually occurs because of some corruption of the data.

Are you also using OpenSSL 1.0.2 on the client?

Matt

>
> Here client is able to do normal connect, post that SSL_connect fails.
>
>  
>
> This client server program works well outside of systemd.
>
>  
>
> Do I need to add some extra steps to get this working?
>
> Any help or reference would be appreciated.
>
>  
>
> Thanks & Regards,
>
>  
>
>  
>
Reply | Threaded
Open this post in threaded view
|

RE: SSL_connect fails on systemd socket

Tiwari, Hari Sahaya
Yes, client is also on same version 1.0.2
In this case SSL handshake(SSL_connect & SSL_accept) is done through systemd socket/service, which is failing.
Any references around it will be very helpful.

Regards,
Hari.

-----Original Message-----
From: openssl-users [mailto:[hidden email]] On Behalf Of Matt Caswell
Sent: Tuesday, January 28, 2020 8:27 PM
To: [hidden email]
Subject: Re: SSL_connect fails on systemd socket



On 28/01/2020 14:03, Tiwari, Hari Sahaya wrote:
> 140691172779952:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong
> version number:s3_pkt.c:365:

You don't say, but from the reference to s3_pkt.c above I assume you are using OpenSSL 1.0.2

This error means that the server has received a record that has the wrong protocol version number in it. It has progressed far enough along the line that it has already processed the initial ClientHello from the client and is now trying to read some later record from the client.
Because it has already processed the initial ClientHello we have already determined which protocol version is in use, so all records should use that protocol version in their headers. In the case of this error we've received something other than that version.

This usually occurs because of some corruption of the data.

Are you also using OpenSSL 1.0.2 on the client?

Matt

>
> Here client is able to do normal connect, post that SSL_connect fails.
>
>  
>
> This client server program works well outside of systemd.
>
>  
>
> Do I need to add some extra steps to get this working?
>
> Any help or reference would be appreciated.
>
>  
>
> Thanks & Regards,
>
>  
>
>  
>
Reply | Threaded
Open this post in threaded view
|

Re: SSL_connect fails on systemd socket

Matt Caswell-2


On 29/01/2020 17:28, Tiwari, Hari Sahaya wrote:
> Yes, client is also on same version 1.0.2
> In this case SSL handshake(SSL_connect & SSL_accept) is done through systemd socket/service, which is failing.
> Any references around it will be very helpful.

What kind of BIO are you using for reading the data in the server?

Is it possible to get a wireshark trace of the failing handshake?

Matt


>
> Regards,
> Hari.
>
> -----Original Message-----
> From: openssl-users [mailto:[hidden email]] On Behalf Of Matt Caswell
> Sent: Tuesday, January 28, 2020 8:27 PM
> To: [hidden email]
> Subject: Re: SSL_connect fails on systemd socket
>
>
>
> On 28/01/2020 14:03, Tiwari, Hari Sahaya wrote:
>> 140691172779952:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong
>> version number:s3_pkt.c:365:
>
> You don't say, but from the reference to s3_pkt.c above I assume you are using OpenSSL 1.0.2
>
> This error means that the server has received a record that has the wrong protocol version number in it. It has progressed far enough along the line that it has already processed the initial ClientHello from the client and is now trying to read some later record from the client.
> Because it has already processed the initial ClientHello we have already determined which protocol version is in use, so all records should use that protocol version in their headers. In the case of this error we've received something other than that version.
>
> This usually occurs because of some corruption of the data.
>
> Are you also using OpenSSL 1.0.2 on the client?
>
> Matt
>
>>
>> Here client is able to do normal connect, post that SSL_connect fails.
>>
>>  
>>
>> This client server program works well outside of systemd.
>>
>>  
>>
>> Do I need to add some extra steps to get this working?
>>
>> Any help or reference would be appreciated.
>>
>>  
>>
>> Thanks & Regards,
>>
>>  
>>
>>  
>>
>
Reply | Threaded
Open this post in threaded view
|

RE: SSL_connect fails on systemd socket

Tiwari, Hari Sahaya
Hi Matt,

I got it working through systemd. My server program needed some modifications to properly respond to SSL_connect.

Thanks for your assistance.

Regards,
Hari.

-----Original Message-----
From: Matt Caswell [mailto:[hidden email]]
Sent: Wednesday, January 29, 2020 11:14 PM
To: Tiwari, Hari Sahaya <[hidden email]>; [hidden email]
Subject: Re: SSL_connect fails on systemd socket



On 29/01/2020 17:28, Tiwari, Hari Sahaya wrote:
> Yes, client is also on same version 1.0.2 In this case SSL
> handshake(SSL_connect & SSL_accept) is done through systemd socket/service, which is failing.
> Any references around it will be very helpful.

What kind of BIO are you using for reading the data in the server?

Is it possible to get a wireshark trace of the failing handshake?

Matt


>
> Regards,
> Hari.
>
> -----Original Message-----
> From: openssl-users [mailto:[hidden email]] On
> Behalf Of Matt Caswell
> Sent: Tuesday, January 28, 2020 8:27 PM
> To: [hidden email]
> Subject: Re: SSL_connect fails on systemd socket
>
>
>
> On 28/01/2020 14:03, Tiwari, Hari Sahaya wrote:
>> 140691172779952:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong
>> version number:s3_pkt.c:365:
>
> You don't say, but from the reference to s3_pkt.c above I assume you
> are using OpenSSL 1.0.2
>
> This error means that the server has received a record that has the wrong protocol version number in it. It has progressed far enough along the line that it has already processed the initial ClientHello from the client and is now trying to read some later record from the client.
> Because it has already processed the initial ClientHello we have already determined which protocol version is in use, so all records should use that protocol version in their headers. In the case of this error we've received something other than that version.
>
> This usually occurs because of some corruption of the data.
>
> Are you also using OpenSSL 1.0.2 on the client?
>
> Matt
>
>>
>> Here client is able to do normal connect, post that SSL_connect fails.
>>
>>  
>>
>> This client server program works well outside of systemd.
>>
>>  
>>
>> Do I need to add some extra steps to get this working?
>>
>> Any help or reference would be appreciated.
>>
>>  
>>
>> Thanks & Regards,
>>
>>  
>>
>>  
>>
>