Python SSLError: 客户端错误（协议违规时发生EOF），服务器错误（SSL3_GET_RECORD: 版本号错误）

Question

我在用Python创建一个SSL套接字时遇到了一些困难，这个套接字需要通过一个需要认证的代理来连接。非常抱歉内容有点长，但我觉得详细描述会更好。

首先，服务器的代码是这样的：

class ThreadedTCPServer(SocketServer.ThreadingMixIn, SocketServer.TCPServer):

    def __init__(self, server_address, RequestHandlerClass, client_manager, recv_queue):
        SocketServer.TCPServer.__init__(self, server_address, RequestHandlerClass, bind_and_activate=True)

         <snipped out extra code>

class ThreadedTCPRequestHandler(SocketServer.BaseRequestHandler):

    def setup(self):

        while True:
            try:
                print 'trying to wrap in ssl'
                self.request = ssl.wrap_socket(self.request,
                                   certfile=(os.getcwd() + '/ssl_certs/newcert.pem'),
                                   keyfile=(os.getcwd() + '/ssl_certs/webserver.nopass.key'),
                                   server_side=True,
                                   cert_reqs=ssl.CERT_NONE,
                                   ssl_version=ssl.PROTOCOL_TLSv1,
                                   do_handshake_on_connect=False,
                                   suppress_ragged_eofs=True)
                break

            except Exception, ex:
                print 'error trying to wrap in ssl %s' % ex

    def handle(self):
        # Display message that client has connected
        print '\r[*] Received connection from %s:%s\r' % (self.client_address[0], self.client_address[1])

        while self.stopped() == False:
            recv_msg = self.request.read(1024)

            if recv_msg == '':
                self.stop.set()
                server.recv_queue.put(recv_msg)
                break
            else:
                server.recv_queue.put(recv_msg)

        if self.stopped():
            print '[!] Received STOP signal from %s:%s; Exiting!' % (self.client_address[0], self.client_address[1])

其次，这是客户端的代码，我在这里设置了通过需要认证的代理连接所需的信息：

class proxyCommsHandler():

    def __init__(self, user, password, remote_host, remote_port, list_of_proxies):
        # information needed to connect
        self.user = 'username'
        self.passwd = 'password'
        self.remote_host = 'remote_host_ip'
        self.remote_port = 8008
        self.list_of_proxies = [['proxyserver.hostname.com', 8080]]

        # setup basic authentication to send to the proxy when we try to connect
        self.user_pass = base64.encodestring(self.user + ':' + self.passwd)
        self.proxy_authorization = 'Proxy-authorization: Basic ' + self.user_pass + '\r\n'
        self.proxy_connect = 'CONNECT %s:%s HTTP/1.1\r\n' % (self.remote_host, self.remote_port)
        self.user_agent = "User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1\r\n"
        self.proxy_pieces = self.proxy_connect + self.proxy_authorization + self.user_agent + '\r\n'

现在，我在这里尝试连接代理，结果没有出现错误（我得到了一个'200'的状态码）：

self.proxy = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.proxy.connect( (proxy_host, proxy_port) )
self.proxy.sendall(self.proxy_pieces)
self.response = proxy.recv(1024)

接下来是客户端出问题的地方（我觉得是这里）。我试着把self.proxy用SSL包裹起来，像这样：

sslsock = ssl.wrap_socket(self.proxy, server_side=False, do_handshake_on_connect=True,
                                      ssl_version=ssl.PROTOCOL_TLSv1)

这是我在客户端看到的错误：

Traceback (most recent call last):
    File "C:\Python27\pyrevshell.py", line 467, in <module>
        proxyCommsHandler(None, None, None, None, list_of_proxies).run()
    File "C:\Python27\pyrevshell.py", line 300, in run
        ssl_version=ssl.PROTOCOL_TLSv1)
    File "C:\Python27\lib\ssl.py", line 372, in wrap_socket
        ciphers=ciphers)
    File "C:\Python27\lib\ssl.py", line 134, in __init__
        self.do_handshake()
    File "C:\Python27\lib\ssl.py", line 296, in do_handshake
        self._sslobj.do_handshake()
    SSLError: [Errno 8] _ssl.c:503: EOF occurred in violation of protocol

客户端确实连接上了，正如这里的输出所示：

trying to wrap in ssl
[*] Received connection from x.x.x.x:47144
[*] x.x.x.x:47144 added to the client list

但紧接着就出现了一个异常：

----------------------------------------
Exception happened during processing of request from ('x.x.x.x', 47144)
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 582, in process_request_thread
    self.finish_request(request, client_address)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 323, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/SocketServer.py", line 639, in __init__
      self.handle()
   File "shell_server.py", line 324, in handle
      recv_msg = self.request.read(1024)
   File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 138, in read
      return self._sslobj.read(len)
SSLError: [Errno 1] _ssl.c:1348: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
----------------------------------------

虽然我意识到根据抛出的异常，这听起来像是一个明显的问题，但有趣的是：

我最开始通过代理成功连接，如上所示
我可以在同样的代理后面用网页浏览器成功连接，并且没有抛出异常；我可以向浏览器传递数据
我在服务器和客户端两边尝试了不同的SSL协议版本，如这里的Python文档所示；每次在客户端都会出错

我在连接的两端都使用了Wireshark。使用普通浏览器连接到服务器时，我可以看到整个SSL握手和协商过程，一切都很顺利。

然而，当我使用上面显示的客户端时，一连接上就看到客户端发送了一个Client Hello消息，但我的服务器随后发送了一个RST数据包来终止连接（我还没确定这是在异常抛出之前还是之后）。

再次为内容的长度道歉，但我非常需要专家的建议。

error handling ssl authentication socket wireshark ssl handshake network protocols proxy

Python SSLError: 客户端错误（协议违规时发生EOF），服务器错误（SSL3_GET_RECORD: 版本号错误）

1 个回答

撰写回答