SSLV3_ALERT_HANDSHAKE_FAILURE (despite verify_ssl=False)

[rhegner]

Hi, I just started looking at your library (and I'm also new to Python...).

I took your getting started example and adjusted the settings as follows:

HOST = "192.168.1.1"
USERNAME = "admin"
PASSWORD = "..."
ENCRYPTION_METHOD = EncryptionMethod.MD5
VALIDATE_SSL_CERT = False

With that I get an SSL-related error:

Cannot connect to host 192.168.1.1:443 ssl:default [[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1028)]

That's a bit surprising, as I explicitly turned of SSL validation.

What can I do about this?

[rhegner]

This stackoverflow answer implies that depending on the python environment, the necessary ciphers used by the router might not be available.

Running openssl s_client -connect 192.168.1.1:443 indicates that my router wants to use the AES256-GCM-SHA384 cipher.
So I guess the question is: how can I make sure your library uses that cipher? How do I incorporate that code snippet from the stackoverflow answer into your getting started code? Or am I on a completely wrong track here?

[rhegner]

I was able to fix it, see pull request: #405

With that fix applied, the following works:

sslcontext = ssl._create_unverified_context()
sslcontext.set_ciphers("AES256-GCM-SHA384")
SagemcomClient(HOST, USERNAME, PASSWORD, ENCRYPTION_METHOD, verify_ssl=None, ssl_context=sslcontext)

In case you're interested in adding my router to your list, here are some details from the get_device_info() query:

model_name = 'Sunrise Internet Box'
model_number = 'SagemcomFast5360_Sunrise'
product_class = 'FAST5360'

It uses MD5, HTTPS (with some weird certificate) and username 'admin' and some password.

[rhegner]

PS: I just realized I can pass in a custom ClientSession, so I can solve my weird cipher issue even without changes in your library:

async def main() -> None:
    sslcontext = ssl._create_unverified_context()
    sslcontext.set_ciphers("AES256-GCM-SHA384")

    session = ClientSession(
        headers={"User-Agent": f"{DEFAULT_USER_AGENT}"},
        timeout=ClientTimeout(DEFAULT_TIMEOUT),
        connector=TCPConnector(
            ssl_context=sslcontext
        )
    )
    async with SagemcomClient(HOST, USERNAME, PASSWORD, ENCRYPTION_METHOD, session=session) as client:

So feel free to close this PR if you don't want to expose a separate parameter for the ssl context.

[iMicknl]

@rhegner that was my guess as well, but I didn't had time to look into this. Would you mind adding a PR to document this?

[rhegner]

Done, see #407