Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

avoid tracebacks / ignore errors from too low version SSL clients #334

Merged
merged 1 commit into from Nov 15, 2020

Conversation

sanderjo
Copy link
Contributor

@sanderjo sanderjo commented Nov 14, 2020

with help by @Safihre

❓ What kind of change does this PR introduce?

  • 🐞 bug fix
  • 🐣 feature
  • πŸ“‹ docs update
  • πŸ“‹ tests/coverage improvement
  • πŸ“‹ refactoring
  • πŸ’₯ other

πŸ“‹ What is the related issue number (starting with #)

#292

❓ What is the current behavior? (You can also link to an open issue here)

A TLSv1 connection like
echo | ~/git/testssl.sh/bin/openssl.Linux.x86_64 s_client -connect 127.0.0.1:8080 -tls1 2>&1
gives

2020-11-14 12:07:56,135::INFO::[notifier:122] Sending notification: Error - [14/Nov/2020:12:07:56] ENGINE Error in HTTPServer.tick
Traceback (most recent call last):
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1788, in serve
    self.tick()
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 2023, in tick
    conn = self.connections.get_conn(self.socket)
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 188, in get_conn
    return self._from_server_socket(server_socket)
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 207, in _from_server_socket
    s, ssl_env = self.server.ssl_adapter.wrap(s)
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 277, in wrap
    s = self.context.wrap_socket(
  File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.8/ssl.py", line 1040, in _create
    self.do_handshake()
  File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1123)

and a SSLv3 connection like
echo | ~/git/testssl.sh/bin/openssl.Linux.x86_64 s_client -connect 127.0.0.1:8080 -ssl3 2>&1
gives

2020-11-14 12:08:23,233::INFO::[notifier:122] Sending notification: Error - [14/Nov/2020:12:08:23] ENGINE Error in HTTPServer.tick
Traceback (most recent call last):
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1788, in serve
    self.tick()
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 2023, in tick
    conn = self.connections.get_conn(self.socket)
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 188, in get_conn
    return self._from_server_socket(server_socket)
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 207, in _from_server_socket
    s, ssl_env = self.server.ssl_adapter.wrap(s)
  File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 277, in wrap
    s = self.context.wrap_socket(
  File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.8/ssl.py", line 1040, in _create
    self.do_handshake()
  File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: VERSION_TOO_LOW] version too low (_ssl.c:1123)

❓ What is the new behavior (if this is a feature change)?

No more traceback

πŸ“‹ Other information:

πŸ“‹ Checklist:

  • I think the code is well written
  • I wrote good commit messages
  • I have squashed related commits together after the changes have been approved
  • Unit tests for the changes exist
  • Integration tests for the changes exist (if applicable)
  • I used the same coding conventions as the rest of the project
  • The new code doesn't generate linter offenses
  • Documentation reflects the changes
  • The PR relates to only one subject with a clear title
    and description in grammatically correct, complete sentences

This change is Reviewable

@webknjaz webknjaz closed this Nov 15, 2020
@webknjaz webknjaz reopened this Nov 15, 2020
@webknjaz webknjaz merged commit f95f15f into cherrypy:master Nov 15, 2020
@sanderjo sanderjo deleted the patch-1 branch November 15, 2020 18:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants