0

I'm trying to recreate some customer issue which requires me to block SSL packets coming from a server i.e. TCP connection steps should go ahead but SSL handshake should stall.

Are there any tools under Windows OS or any 3rd party tool that can be used to simulate this (I know under Linux, I can probably use iproutes command for this).

1
  • 1
    What customer issue? Do they really have a situation that blocks SSL traffic and allows the rest through? Doesn't seem likely. I think you need further analysis rather than trying to create an irrelevant condition.
    – EJP
    May 30, 2011 at 9:57

2 Answers 2

0

Use a simple python or perl script to fake the protocol.

Stop your ssh daemon on the server and then start up the Python script:

    class MyTCPHandler(SocketServer.BaseRequestHandler):
    """
    The RequestHandler class for our server.

    It is instantiated once per connection to the server, and must
    override the handle() method to implement communication to the
    client.
    """

    def handle(self):
        # self.request is the TCP socket connected to the client
        self.data = self.request.recv(1024).strip()
        print "%s wrote:" % self.client_address[0]
        print self.data
        # just send back the same data, but upper-cased
        # Simulate error Here!
        # maybe exit()
        self.request.send(self.data.upper())

if __name__ == "__main__":
    HOST, PORT = "localhost", 22

    # Create the server, binding to localhost on port 9999
    server = SocketServer.TCPServer((HOST, PORT), MyTCPHandler)

    # Activate the server; this will keep running until you
    # interrupt the program with Ctrl-C
    server.serve_forever()

Just tweak the script to get it to "fail" the way you want either not replying, sending rubbish back, or killing the listener process.

5
  • Thanks, but unfortunately can't mess around with the server. Whatever has to done, has to be done on the client side.
    – Ankur
    May 30, 2011 at 5:27
  • Ah in that case try configuring windows "firewall" to block port 22.
    – James Anderson
    May 30, 2011 at 6:01
  • Thanks a lot. I'll try using secpol.msc and blocking port 22 on my server IP.
    – Ankur
    May 30, 2011 at 6:19
  • 2
    Port 22 is for SSH, not an SSL/TLS based protocol. @Ankur, are you after a specific SSL/TLS-based protocol which would run on its standard port (e.g. HTTPS, SMTPS, IMAPS, ...), in which case you could block that port indeed, or are you trying to block any potential handshake on any port?
    – Bruno
    May 30, 2011 at 18:12
  • the latter, need to block any SSL handshake packets coming from server.
    – Ankur
    May 31, 2011 at 6:21
0

It is not clear to me what exactly you want to do. Do you want to leave the TCP connection open but not send any TLS handshaking packets? Do you want to immediately close the TCP connection? Do you want to only send a few TLS packets? If so, which ones?

In any event, you might find the openssl s_client and/or the openssl s_server command-line testing utilities useful, as well as wireshark, for diagnosing SSL issues.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .