On Thu, Nov 24, 2011 at 5:08 AM, Emmanuel Lecharny <[email protected]> wrote:
> Hi guys,
>
> yesterday, I fought with the way MINA 2 is dealing with SSL. Down the line,
> we use a filter for that, which handles the handhsake using the SslEngine
> class.
>
> The problem is that at the same time, the session is considered as opened,
> even if we haven't done any handshake, as we can't add the SslFilter to the
> session if it's not created yet. That leads to a situation where we could
> perfectly have an opened session but with a failed HandShake.
>
> For instance, as the handshake can be done when the first data is sent by
> the client, we will generate an exceptionCaught event, process it, but leave
> to the handler to close the session.
>
> From the user PoV, it makes no sense to continue to use a session which has
> failed during the SSL handshake. IMO, the server should not even open the
> session (the session should remain in the 'created' state, until the
> handshake has been completed. Now, if we do that, the Connector won't be
> able to send anything as the session is not connected. That leave us with a
> dilemna : we need the connection to be opened, but the connection should not
> be considered as valid until the handshake is done... How can we deal with
> this problem ?
>
> We decided that Ssl should be handled by the processor, not as a filter in
> the chain. That means :
> - we can keep the session in the 'created' mode until the handshake has been
> done on the server side
> - we can force the handshake to be done while creating the connection on the
> client side when using the Connector
> - in all other case (ie if the client uses a plain Socket), we have no
> problem as the session is not seen by the user.
>
> wdyt ?
>
>

This use case cover only the I want my whole session SSLed, but not
the use case when you start talking in plain unsecure TCP and a
command trigger the TLS handshake.
I wonder if there is use case where you try to TLS handshake and if it
fail you continue talking using plain unsecure TCP.

I'm not a big user of SSL/TLS, there is use case like that ? If so we
need to take them in account. I think it was the idea of a SSLFilter.
We can do that in MINA 3 :
 - a transport level SSL/TLS engine and the session is opened when the
handshake is completed
 - a filter for the more complex use case (which is going to be a bit
more painful)

Julien

Reply via email to