Improve support for TLS 1.3 post-handshake auth

❓ I’m submitting a …

• 🐞 bug report
• 🐣 feature request
• ❓ question about the decisions made in the repository

🐞 Describe the bug. What is the current behavior?

Failed TLS auth causes an exception happening after the TLS handshake if the client uses post_handshake_auth TLS extension. This happens when the server tries to read bytes with HTTP payload from the TCP connection (when starting to parse HTTP request). This code should also be protected by try/except wrapper.

❓ What is the motivation / use case for changing the behavior?

Make it work.

💡 To Reproduce

N/A

💡 Expected behavior

No traceback.

📋 Details

📋 Environment

• Cheroot version: master
• CherryPy version: master
• Python version: 3.7
• OS: N/A
• Browser: N/A

📋 Additional context

https://github.com/cherrypy/cherrypy/issues/1509#issuecomment-504750442

2019-06-23 11:45:27,812::WARNING::[_cplogging:216] [23/Jun/2019:11:45:27] ENGINE socket.error 1
Traceback (most recent call last):
  File "C:\Users\Saf\Documents\GitHub\tests\py3\lib\site-packages\cheroot\server.py", line 1263, in communicate
    req.parse_request()
  File "C:\Users\Saf\Documents\GitHub\tests\py3\lib\site-packages\cheroot\server.py", line 719, in parse_request
    success = self.read_request_line()
  File "C:\Users\Saf\Documents\GitHub\tests\py3\lib\site-packages\cheroot\server.py", line 760, in read_request_line
    request_line = self.rfile.readline()
  File "C:\Users\Saf\Documents\GitHub\tests\py3\lib\site-packages\cheroot\server.py", line 302, in readline
    data = self.rfile.readline(256)
  File "C:\Users\Saf\AppData\Local\Programs\Python\Python37\Lib\_pyio.py", line 513, in readline
    b = self.read(nreadahead())
  File "C:\Users\Saf\AppData\Local\Programs\Python\Python37\Lib\_pyio.py", line 492, in nreadahead
    readahead = self.peek(1)
  File "C:\Users\Saf\AppData\Local\Programs\Python\Python37\Lib\_pyio.py", line 1076, in peek
    return self._peek_unlocked(size)
  File "C:\Users\Saf\AppData\Local\Programs\Python\Python37\Lib\_pyio.py", line 1083, in _peek_unlocked
    current = self.raw.read(to_read)
  File "C:\Users\Saf\AppData\Local\Programs\Python\Python37\Lib\socket.py", line 589, in readinto
    return self._sock.recv_into(b)
  File "C:\Users\Saf\AppData\Local\Programs\Python\Python37\Lib\ssl.py", line 1052, in recv_into
    return self.read(nbytes, buffer)
  File "C:\Users\Saf\AppData\Local\Programs\Python\Python37\Lib\ssl.py", line 911, in read
    return self._sslobj.read(len, buffer)
ssl.SSLError: [SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:2488)

cc @Safihre

[webknjaz]

@thezoggy we’re unable to debug third-party software. The reproducer would need to be Cheroot-based and have no dependencies on unrelated libraries. It’s best to submit it as a pytest-based test in this repository, simulating the said case consistently.

[thezoggy]

its easy to reproduce this in sabnzbd with latest cherrypy/cheroot, if you try to go to the instance in firefox on android, https://wanip:port it will throw the traceback with a self-signed cert.

2021-03-16 15:55:08,801::ERROR::[_cplogging:213] [16/Mar/2021:15:55:08] ENGINE Error in HTTPServer.serve
Traceback (most recent call last):
  File "cheroot\server.py", line 1810, in serve
  File "cheroot\connections.py", line 201, in run
  File "cheroot\connections.py", line 218, in _run
  File "cheroot\connections.py", line 272, in _from_server_socket
  File "cheroot\ssl\builtin.py", line 277, in wrap
  File "ssl.py", line 500, in wrap_socket
  File "ssl.py", line 1040, in _create
  File "ssl.py", line 1309, in do_handshake
ssl.SSLError: [SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:1123)

would be nice to just suppress this traceback