Received data from python SSL server is incorrect

Question

I am trying to modify a socket server I wrote with the python socket library to use encryption using python's SSL library.

I am no able to successfully open a connection to the server, wrap it with an SSL context and send data to the server, but data sent back to the client is not what it should be.

My suspicion is that the server responses are not being decrypted on the client side, but I don't know why. I'm pretty new to SSL/TLS, and networking in general so... what am I missing?

The client is also written in python (for now, to facilitate testing)

Code:

Relevant Server stuff:

def sslServerLoop():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host, port))
    s.listen(5)

    context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    context.load_cert_chain('cert.pem')

    while True:
        conn, addr = s.accept()
        sslConn = context.wrap_socket(conn, server_side=True)
        data = sslConn.recv(1024)
        sslConn.sendall(response)
        sslConn.close()

Relevant Client stuff:

context = ssl.create_default_context(cafile='cert.pem')
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s = context.wrap_socket(s, server_hostname=server_addr)
s.connect((address, port))
s.sendall(msg)
s.shutdown(socket.SHUT_WR)
response = s.recv(1024)

Sending from client to server works fine, but data sent back to the client is wrong. For example if I set response = bytes([1]) on the server side, I receive b'\\x17\\x03\\x03\\x00\\x19\\xac\\xb6\\x7f@\\xc0\\xd3\\xce%\\x13G\\x01\\xbd\\x88y\\xf0\\xda..\\x02\\xf9\\xe4o\\xdd\\x1a\\xdb' on the client side. Most of that changes every time I try to run it, but the first 5 bytes are always the same (which is partly why I suspect it isn't being decrypted).

cert.pem is a self signed certificate generated using openssl as described in the python 3 SSL module documentation

Answer 1

It is not legal to shutdown a socket that is being used for SSL. It is a protocol violation. You must close via the SSL/TLS API you are using.