Catch additional errors to prevent warnings logged when connections

are closed immediately after opening.

Closes #750.

diff --git a/tornado/iostream.py b/tornado/iostream.py
index 16b0fac1acad72b680546b38222d1e791e150946..b84d17734c8fbf4d35f94db1ae3466d9a53e163c 100644 (file)
--- a/tornado/iostream.py
+++ b/tornado/iostream.py
@@ -764,7 +764,7 @@ class SSLIOStream(IOStream):
             elif err.args[0] == ssl.SSL_ERROR_SSL:
                 try:
                     peer = self.socket.getpeername()
-                except:
+                except Exception:
                     peer = '(not connected)'
                 gen_log.warning("SSL Error on %d %s: %s",
                                 self.socket.fileno(), peer, err)
@@ -773,6 +773,11 @@ class SSLIOStream(IOStream):
         except socket.error as err:
             if err.args[0] in (errno.ECONNABORTED, errno.ECONNRESET):
                 return self.close(exc_info=True)
+        except AttributeError:
+            # On Linux, if the connection was reset before the call to
+            # wrap_socket, do_handshake will fail with an
+            # AttributeError.
+            return self.close(exc_info=True)
         else:
             self._ssl_accepting = False
             if not self._verify_cert(self.socket.getpeercert()):

diff --git a/tornado/netutil.py b/tornado/netutil.py
index 7b7d48dd6a18e4a423ea57ef79531cc2cd3d557c..18a84ec582745dcfd8b336b9fc4d55b96583abea 100644 (file)
--- a/tornado/netutil.py
+++ b/tornado/netutil.py
@@ -135,8 +135,15 @@ def add_accept_handler(sock, callback, io_loop=None):
             try:
                 connection, address = sock.accept()
             except socket.error as e:
+                # EWOULDBLOCK and EAGAIN indicate we have accepted every
+                # connection that is available.
                 if e.args[0] in (errno.EWOULDBLOCK, errno.EAGAIN):
                     return
+                # ECONNABORTED indicates that there was a connection
+                # but it was closed while still in the accept queue.
+                # (observed on FreeBSD).
+                if e.args[0] == errno.ECONNABORTED:
+                    continue
                 raise
             callback(connection, address)
     io_loop.add_handler(sock.fileno(), accept_handler, IOLoop.READ)

diff --git a/tornado/tcpserver.py b/tornado/tcpserver.py
index fbd9c63d3abccb94064ec132128f1028e0a3d806..b92fff6b8658550667d5aec8d68a2221bda2cb1c 100644 (file)
--- a/tornado/tcpserver.py
+++ b/tornado/tcpserver.py
@@ -216,7 +216,17 @@ class TCPServer(object):
                 else:
                     raise
             except socket.error as err:
-                if err.args[0] == errno.ECONNABORTED:
+                # If the connection is closed immediately after it is created
+                # (as in a port scan), we can get one of several errors.
+                # wrap_socket makes an internal call to getpeername,
+                # which may return either EINVAL (Mac OS X) or ENOTCONN
+                # (Linux).  If it returns ENOTCONN, this error is
+                # silently swallowed by the ssl module, so we need to
+                # catch another error later on (AttributeError in
+                # SSLIOStream._do_ssl_handshake).
+                # To test this behavior, try nmap with the -sT flag.
+                # https://github.com/facebook/tornado/pull/750
+                if err.args[0] in (errno.ECONNABORTED, errno.EINVAL):
                     return connection.close()
                 else:
                     raise