Python ssl login on Debian

Question

I am trying to use Python 2.7 mechanize to log in to Mint.com with the following code:

 import mechanize br = mechanize.Browser() br.open("https://wwws.mint.com/login.event") 

this works fine on OSX but freezes on debian. The problem seems to be related to ssl; trace ends on

 File "/usr/lib/python2.7/ssl.py", line 305, in do_handshake self._sslobj.do_handshake() 

EDIT: the problem remains on Debian using urllib2 . As suggested in the comments, the problem seems to be ssl related. Why would this be a problem for Debian and not OSX?

Answer 1

In Fedora, everything looks fine:

 [ bharrington@leviathan ~]$ python Python 2.7.5 (default, Aug 22 2013, 09:31:58) [GCC 4.8.1 20130603 (Red Hat 4.8.1-1)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import mechanize >>> br = mechanize.Browser() >>> br.open("https://wwws.mint.com/login.event") <response_seek_wrapper at 0x29b6440 whose wrapped object = <closeable_response at 0x29b6320 whose fp = <socket._fileobject object at 0x298d150>>> >>> br.title() 'Mint > Start Here' >>> 

This makes me think about the SSL / OpenSSL libraries used. To verify this, you can run from the command line:

 $ openssl s_client -connect wwws.mint.com:443 

You should see an SSL certificate to display the mint, as well as a full check of the certificate chain and the final line: "Check return code: 0 (ok)"

While I strongly doubt that this is an SSL problem directly, I find it worth checking out. Also check the mechanization version. Debian is different in that it uses stable versions of the code (rather than new versions). The version I checked with mechanization was 0.2.5

Answer 2

This is a manifestation of incompatibility between the latest versions of OpenSSL and some web servers. Apple is doing everything possible to eliminate OpenSSL on OS X, so they only apply security fixes (OpenSSL was difficult to maintain as part of the OS, not to mention “minor” updates that present problems like this), while Debian uses the later OpenSSL version 1.0.1.

@Brian Redbeards's suggestion to check openssl using the command line is good - it depended on me on wwws.mint.com when I just tried.

This question on ServerFault finally answered. A trusted SSLLabs test identifies long handshake intolerance as a problem that affects OpenSSL 1.0.1 and later, and links to an OpenSSL error with some possible workarounds.

Either using -no_tls1_2 , as one of the OpenSSL developers recommends, or reduces the list of ciphers with the -cipher argument, makes OpenSSL 1.0.1 successfully communicate with wwws.mint.com (as well as with the other server that I tried to communicate).

For my purposes - a script that will not be distributed - I ssl.wrap_socket as follows:

 import ssl old_wrap_socket = ssl.wrap_socket def wrap_socket(sock, keyfile=None, certfile=None, server_side=False, cert_reqs=ssl.CERT_NONE, ssl_version=ssl.PROTOCOL_SSLv3, ca_certs=None, do_handshake_on_connect=True, suppress_ragged_eofs=True, ciphers=None): return old_wrap_socket(sock, keyfile, certfile, server_side, cert_reqs, ssl_version, ca_certs, do_handshake_on_connect, suppress_ragged_eofs, ciphers) ssl.wrap_socket = wrap_socket import mechanize 

The default value for ssl_version is ssl.PROTOCOL_SSLv23 ; changing it to PROTOCOL_SSLv3 , he has successfully connected.

You can protect this patch using a test, for example ssl.OPENSSL_VERSION_INFO[:3] >= (1, 0, 1) .

This could probably be indicated as a Debian OpenSSL error, if it was not already.