View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0004041 | unreal | ircd | public | 2011-08-21 05:16 | 2011-10-08 13:31 |
| Reporter | Adam- | Assigned To | syzop | ||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | wont fix | ||
| Product Version | 3.2.9-RC1 | ||||
| Summary | 0004041: ZLines & SSL | ||||
| Description | I've gzlined myself from the network, and if I connect normally I get the standard: (23:12:47) [192] -!- Irssi: Connection to 192.168.1.2 established (23:12:47) [192] -!- ERROR Closing Link: [::ffff:192.168.1.2] Z:Lined ([OperServ] You have an open proxy running on your host (HTTP:192.168.1.2:3128)) (23:12:47) -!- Irssi: Connection lost to 192.168.1. Nothing wrong there. However if I connect using SSL I get: (23:13:08) [192] -!- Irssi: Connecting to 192.168.1.2 [192.168.1.2] port 6697 (23:13:08) -!- Irssi: warning SSL handshake failed: unknown protocol (23:13:08) -!- Irssi: Connection lost to 192.168.1.2 I've confirmed this with multiple clients. Normal SSL connections from non-zlined hosts work okay. | ||||
| Steps To Reproduce | ZLine yourself and attempt to connect over SSL. | ||||
| Additional Information | I'm actually using Unreal-RC2... it's not on the list. OpenSSL 0.9.8n 24 Mar 2010 | ||||
| 3rd party modules | |||||
|
|
I think that the real issue is deciding whether or not initializing an SSL connection for a zlined client is considered too expensive or not. IMO, this bug will soon become obsolete. Modern setups which use STARTTLS will be able to be given the zline error message before the SSL initialization and that setup seems most ideal. |
|
|
Unfortunately this is a design decision: as binki states, we do not initialize an SSL handshake for (G)ZLINE. What a (G)ZLINE does is immediately disconnect the user, not processing any received data, and only sending the exact error message.. nothing more. If you don't like that, then use a KLINE/GLINE instead, which allows an SSL connection to be initialized, a user to send it's USER/NICK/PASS registration and so on. Best fix for the client would be to do some magic: treat data which it receives before a proper SSL Hello / Handshake is established as unencrypted text, or at least if it begins with "ERROR:". |
