SSL handshake can hang WSGI

[Jon Slenk]

Versions of Python before 2.6.6rc1 have http://bugs.python.org/issue5103. This can hang swift/common/wsgi.py. We've locally tested adding "do_handshake_on_connect=False" in ssl.wrap_socket. http://bazaar.launchpad.net/~hudson-openstack/swift/trunk/view/head:/swift/common/wsgi.py#L75. This is a possible denial of service problem. [We're on Bexar, but the relevant code looks to be the same in Diablo.]

[John Dickinson (notmyname)]

can you give us a merge proposal of what you changed?

[Jon Slenk (jslenk)]

hi, sorry to be obtuse.

lines 75, 76 of swift/common/wsgi.py:
                sock = ssl.wrap_socket(sock, certfile=conf['cert_file'],
                    keyfile=conf['key_file'])

new lines 75, 76 of swift/common/wsgi.py:
                sock = ssl.wrap_socket(sock, certfile=conf['cert_file'],
                    keyfile=conf['key_file'], do_handshake_on_connect=False)

[Jon Slenk (jslenk)]

(ugh that formatting word-wrap is painful)

[Jérémy Guermonprez (jguermonprez)]

By using an ssl terminaison, as it seems to be recommended, you don't encounter the problem anymore.
Pound (http://www.apsis.ch/pound) is an open source alternative that seems pretty good.

[John Dickinson (notmyname)]

There are some other ssl issues I've been looking into lately as well. The summary is that it's a bad idea to terminate ssl on the proxy.

[John Dickinson (notmyname)]

SSL support is only provided in swift for example purposes. SSL should be terminated external to swift