Tracebacks in cheroot with ssl and "builtin" in production use, reproducible with with "openssl s_client" and testssl.sh
See original GitHub issueโ Iโm submitting a โฆ
- ๐ bug report
- ๐ฃ feature request
- โ question about the decisions made in the repository
๐ Describe the bug. What is the current behavior?
SABnzbd uses cherrypy and cheroot. In production use, SABnzbd gets cherrypy / cheroot Tracebacks from port scanners and other strange connections. SABnzbd does show Tracebacks to the user, which is annoying.
These Tracebacks are reproducible by running a pure cheroot server, and then connecting to it with
echo "\n" | openssl s_client -connect 127.0.0.1:8070 -tls1
- the testssl.sh testing tool (https://github.com/drwetter/testssl.sh) talking against the cheroot server.
Note: this only happens with builtin
. Not any error with pyopenssl
. However, using pyopenssl
is not an option for SABnbd, right @Safihre ?
โ What is the motivation / use case for changing the behavior?
Avoiding Tracebacks
๐ก To Reproduce
Start a pure cheroot server:
#!/usr/bin/python3
from cheroot import wsgi
def my_crazy_app(environ, start_response):
status = '200 OK'
response_headers = [('Content-type','text/plain')]
start_response(status, response_headers)
return [b'Hello world!']
addr = '0.0.0.0', 8070
server = wsgi.Server(addr, my_crazy_app)
# the SSL stuff:
from cheroot.server import get_ssl_adapter_class
server.ssl_adapter = get_ssl_adapter_class(name='builtin')('./server.cert', './server.key')
server.start()
Then run the openssl CLI client against cheroot; see follouw-up post below https://github.com/cherrypy/cheroot/issues/292#issuecomment-641413394
Or automatic, heavy testing: run testssl.sh against the cheroot server:
./testssl.sh 127.0.0.1:8070
cheroot will start spitting out Tracebacks, for example:
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: VERSION_TOO_LOW] version too low (_ssl.c:1108)
Summary of errors seen in the Tracebacks:
ssl.SSLError: [SSL: BAD_ALERT_RECORD] no suitable key share (_ssl.c:1108)
ssl.SSLError: [SSL: BAD_RSA_DECRYPT] no suitable signature algorithm (_ssl.c:1108)
ssl.SSLError: [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1108)
ssl.SSLError: [SSL] internal error (_ssl.c:1108)
ssl.SSLError: [SSL: LENGTH_MISMATCH] length mismatch (_ssl.c:1108)
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
ssl.SSLError: [SSL: VERSION_TOO_LOW] version too low (_ssl.c:1108)
๐ก Expected behavior
No Traceback. Main reason: the ssl.SSLError is not a big deal, certainly not on the server side: just a non-compliant client. Let the client take care of it, not the server. The cheroot sould care too much about it; just ignore.
FWIW / As reference: running testssl.sh against apache2 gives normal, nice logging and results:
access.log
192.168.1.119 - - [09/Jun/2020:17:48:38 +0200] "GET / HTTP/1.1" 200 3679 "-" "TLS tester from https://testssl.sh/dev/"
192.168.1.119 - - [09/Jun/2020:17:49:24 +0200] "GET / HTTP/1.1" 200 3679 "-" "TLS tester from https://testssl.sh/dev/"
192.168.1.119 - - [09/Jun/2020:17:49:25 +0200] "GET / HTTP/1.1" 200 3679 "-" "TLS tester from https://testssl.sh/dev/"
192.168.1.119 - - [09/Jun/2020:17:49:50 +0200] "GET / HTTP/1.1" 200 3666 "https://google.com/" "TLS tester from https://testssl.sh/dev/"
192.168.1.119 - - [09/Jun/2020:17:49:51 +0200] "GET / HTTP/1.1" 200 3679 "https://google.com/" "TLS tester from https://testssl.sh/dev/"
192.168.1.119 - - [09/Jun/2020:17:49:52 +0200] "GET / HTTP/1.1" 200 3679 "https://google.com/" "TLS tester from https://testssl.sh/dev/"
192.168.1.119 - - [09/Jun/2020:17:49:53 +0200] "GET / HTTP/1.1" 200 3679 "https://google.com/" "TLS tester from https://testssl.sh/dev/"
error.log
[Tue Jun 09 17:49:48.591264 2020] [ssl:error] [pid 1003:tid 281473206698400] [client 192.168.1.119:56918] AH02042: rejecting client initiated renegotiation
[Tue Jun 09 17:49:49.678955 2020] [ssl:error] [pid 1004:tid 281473809244576] [client 192.168.1.119:56920] AH02042: rejecting client initiated renegotiation
๐ Details
See below for one run of testssl.sh
๐ Environment
- Cheroot version: 8.3.0
- CherryPy version: not applicable
- Python version: 3.8.2
- OS: Ubuntu 20.04
- Browser: testssl.sh
๐ Additional context
$ python3 cheroot_only.py
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: VERSION_TOO_LOW] version too low (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: BAD_ALERT_RECORD] no suitable key share (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: VERSION_TOO_LOW] version too low (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: BAD_RSA_DECRYPT] no suitable signature algorithm (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: BAD_RSA_DECRYPT] no suitable signature algorithm (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL] internal error (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: LENGTH_MISMATCH] length mismatch (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: VERSION_TOO_LOW] version too low (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Error in HTTPServer.tick
Traceback (most recent call last):
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1776, in serve
self.tick()
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/server.py", line 1999, in tick
conn = self.connections.get_conn(self.socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 180, in get_conn
return self._from_server_socket(server_socket)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/connections.py", line 199, in _from_server_socket
s, ssl_env = self.server.ssl_adapter.wrap(s)
File "/home/sander/.local/lib/python3.8/site-packages/cheroot/ssl/builtin.py", line 242, in wrap
s = self.context.wrap_socket(
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Result in SABnzbd:
Issue Analytics
- State:
- Created 3 years ago
- Comments:25 (25 by maintainers)
OK, here we go:
So changed the code to
And run
testssl.sh
against it โฆ and not one error.(Note: why not filter on
UNSUPPORTED_PROTOCOL
instead ofunsupported protocol
?)OK. Great. But why filter on those results at all? Wouldnโt it be OK to just default
ssl.SSL_ERROR_SSL
toreturn EMPTY_RESULT
? Is there anything useful builtin.py does / can do withssl.SSL_ERROR_SSL
?The same as the already listed errors: drop and ignore. I suggest we just extend the list already there with the new errors.