Server Handling of Connection Errors and SSL Errors

[RobBotic1]

In aiohttp server code, is there a mechanism to programmatically capture connection errors (e.g., SSLError)?

For example, my server requires a client to have certificates. When a client attempts to connect without a certificate, from an aiohttp perspective, I see nothing. If I turn on asyncio debugging (PYTHONASYNCIODEBUG=1), I see an SSLError printed: ssl.SSLError: [SSL: PEER_DID_NOT_RETURN_A_CERTIFICATE] peer did not return a certificate (_ssl.c:1007) but I'd like to be able to catch this error and handle it.

I've looked at the documentation for middleware and signals, but they appear to be focused on issues that occur at an HTTP layer. Is there a way to catch these sorts of errors so that custom handling could be done? I'd like to be able to take some specific actions when certain types of connection errors occur.

Thanks! And my apologies in advance if this is well-documented and I missed it.

[Dreamsorcerer]

Maybe if there's a traceback with that SSLError, it could provide a hint on where to look, but I'm not sure what's available, and it might be that the error is in the asyncio server code and not accessible..

But, typically, this would all be handled with nginx or similar, rather than in application code. We don't generally recommend exposing the application directly for a production environment.

[RobBotic1]

As I'm developing a diagnostic/test tool that is not exposed over the Internet, I would prefer to use SSL/TLS directly with aiohttp and not add in nginx or similar.

Here is a traceback. I do not see any aiohttp messages.

DEBUG:asyncio:<Server sockets=(<asyncio.TransportSocket fd=8, family=AddressFamily.AF_INET6, type=SocketKind.SOCK_STREAM, proto=6, laddr=('::1', 8888, 0, 0)>, <asyncio.TransportSocket fd=9, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=6, laddr=('127.0.0.1', 8888)>)> got a new connection from ('::1', 49545, 0, 0): <socket.socket fd=10, family=AddressFamily.AF_INET6, type=SocketKind.SOCK_STREAM, proto=0, laddr=('::1', 8888, 0, 0), raddr=('::1', 49545, 0, 0)>
DEBUG:asyncio:<asyncio.sslproto.SSLProtocol object at 0x10601fe80> starts SSL handshake
DEBUG:asyncio:<asyncio.sslproto.SSLProtocol object at 0x10601fe80>: SSL handshake failed
Traceback (most recent call last):
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/sslproto.py", line 637, in _on_handshake_complete
    raise handshake_exc
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/sslproto.py", line 188, in feed_ssldata
    self._sslobj.do_handshake()
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/ssl.py", line 975, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: PEER_DID_NOT_RETURN_A_CERTIFICATE] peer did not return a certificate (_ssl.c:1007)
DEBUG:asyncio:<asyncio.sslproto.SSLProtocol object at 0x10601fe80>: SSL error in data received
Traceback (most recent call last):
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/sslproto.py", line 534, in data_received
    ssldata, appdata = self._sslpipe.feed_ssldata(data)
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/sslproto.py", line 188, in feed_ssldata
    self._sslobj.do_handshake()
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/ssl.py", line 975, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: PEER_DID_NOT_RETURN_A_CERTIFICATE] peer did not return a certificate (_ssl.c:1007)
ERROR:asyncio:Error on transport creation for incoming connection
handle_traceback: Handle created at (most recent call last):
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/base_events.py", line 636, in run_until_complete
    self.run_forever()
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/base_events.py", line 603, in run_forever
    self._run_once()
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/base_events.py", line 1901, in _run_once
    handle._run()
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/events.py", line 80, in _run
    self._context.run(self._callback, *self._args)
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/selector_events.py", line 984, in _call_connection_lost
    super()._call_connection_lost(exc)
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/selector_events.py", line 742, in _call_connection_lost
    self._protocol.connection_lost(exc)
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/sslproto.py", line 508, in connection_lost
    self._wakeup_waiter(exc)
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/sslproto.py", line 472, in _wakeup_waiter
    self._waiter.set_exception(exc)
protocol: <RequestHandler disconnected>
transport: <asyncio.sslproto._SSLProtocolTransport object at 0x106105240>
Traceback (most recent call last):
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/selector_events.py", line 213, in _accept_connection2
    await waiter
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/sslproto.py", line 534, in data_received
    ssldata, appdata = self._sslpipe.feed_ssldata(data)
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/sslproto.py", line 188, in feed_ssldata
    self._sslobj.do_handshake()
  File "/opt/homebrew/Cellar/python@3.10/3.10.11/Frameworks/Python.framework/Versions/3.10/lib/python3.10/ssl.py", line 975, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: PEER_DID_NOT_RETURN_A_CERTIFICATE] peer did not return a certificate (_ssl.c:1007)

[Dreamsorcerer]

I don't think you can catch it. It's just logged if debug is enabled: https://github.com/python/cpython/blob/main/Lib/asyncio/selector_events.py#L254

[RobBotic1]

I do not know the aiohttp opinion on using set_exception_handler, but I was able to capture the exceptions with it provided I enabled debugging. I have no idea why enabling debugging was necessary.

Here's a simple example:

loop = asyncio.get_event_loop()
loop.set_debug(True)
loop.set_exception_handler(lambda loop, ctx: print('Caught ' + str(ctx.get('exception', ctx['message']))))

You can, of course, replace the lambda with your own function to handle the exceptions as you like.

[Dreamsorcerer]

Yes, I was thinking about actually catching the exception, but I guess you said to perform an action when the exception occurs, so that probably works fine.

[RobBotic1]

@Dreamsorcerer - thanks so much for all of your help!