Develop Reference

Getting "sslv3 alert handshake failure" when trying to connect to imap

i need to do a script for imap backup but when i'm trying to connect to the imap server with my script i'm getting that error:
File "c:\Users\Lenovo\Desktop\python\progettoscuola.py", line 5, in <module>
imapSrc = imaplib.IMAP4_SSL('mail.safemail.it')
File "C:\Program Files\Python310\lib\imaplib.py", line 1323, in __init__
IMAP4.__init__(self, host, port, timeout)
File "C:\Program Files\Python310\lib\imaplib.py", line 202, in __init__
self.open(host, port, timeout)
File "C:\Program Files\Python310\lib\imaplib.py", line 1336, in open
IMAP4.open(self, host, port, timeout)
File "C:\Program Files\Python310\lib\imaplib.py", line 312, in open
self.sock = self._create_socket(timeout)
File "C:\Program Files\Python310\lib\imaplib.py", line 1327, in _create_socket
return self.ssl_context.wrap_socket(sock,
File "C:\Program Files\Python310\lib\ssl.py", line 512, in wrap_socket
return self.sslsocket_class._create(
File "C:\Program Files\Python310\lib\ssl.py", line 1070, in _create
self.do_handshake()
File "C:\Program Files\Python310\lib\ssl.py", line 1341, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:997)```

Python 3.10 increased the default security settings of the TLS stack by among other things prohibiting any ciphers which still use the RSA key exchange. RSA key exchange is long considered inferior since it does not provide forward secrecy and is therefore also no longer available in TLS 1.3. So in general the change in Python 3.10 can be considered an improvement.
But, some servers still require this obsolete key exchange and mail.safemail.it seems to be among these. Connecting to such servers with the newly hardened TLS settings will now fail, even if it succeeded with older versions of Python.
To make connections possible again it is necessary to use weaker security settings. For this specific server it can be done by falling back to the DEFAULT ciphers used by OpenSSL. The following code will create a new SSL context and use it for connecting to the host. The important part here is to use weaker settings using ctx.set_ciphers('DEFAULT') .
import imaplib
import ssl
ctx = ssl.create_default_context()
ctx.set_ciphers('DEFAULT')
imapSrc = imaplib.IMAP4_SSL('mail.safemail.it', ssl_context = ctx)

"OSError: [Errno 0] Error" in sslobj.do_handshake when listing a directory using ftplib on FTPS server

I want to connect to an FTPS server containing some not trusted certificate. When I use simple:
lftp -u user hostname
then after dir command there's an error:
ls: Fatal error: Certificate verification: Not trusted
The problem can be solved in lftp by executing the following command:
lftp -e "set ssl:verify-certificate false" -u user hostname
I'm trying to make the same connection in Python, using for example ftplib module:
import ftplib
ftp = ftplib.FTP_TLS()
ftp.connect(hostname, port)
ftp.login(username, password)
ftp.prot_p()
ftp.dir()
But it raises OSError exception:
Traceback (most recent call last):
File "/usr/lib/python3.8/code.py", line 90, in runcode
exec(code, self.locals)
File "<console>", line 1, in <module>
File "/usr/lib/python3.8/ftplib.py", line 558, in dir
self.retrlines(cmd, func)
File "/usr/lib/python3.8/ftplib.py", line 451, in retrlines
with self.transfercmd(cmd) as conn, \
File "/usr/lib/python3.8/ftplib.py", line 382, in transfercmd
return self.ntransfercmd(cmd, rest)[0]
File "/usr/lib/python3.8/ftplib.py", line 783, in ntransfercmd
conn = self.context.wrap_socket(conn,
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
OSError: [Errno 0] Error
The problem seems to be similar to te OSError during authenticating to an ftps server with ftplib.FTP_TLS so I also tried to use some other context, like:
import ssl
ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1_2)
ftp = FTP_TLS(context=ctx)
or
ctx = ssl.ssl._create_unverified_context(ssl.PROTOCOL_TLSv1_2)
ftp = FTP_TLS(context=ctx)
But the error is still the same. Any ideas how to disable certificate verification?

It cannot be a certificate problem, as you are getting error only at dir. The connect succeeds.
You get a TLS error when opening FTP data connection. It quite possible that the root cause is that the server require TLS session resumption.
See FTPS with Python ftplib - Session reuse required.

kafka-python producer - SSL connection failure - Trustore Only

I'm trying to publish messages via python to a kafka topic and am receiving an error. I can connect and publish via the CLI. Hoping for some guidance. I've googled and read the docs. Thanks!!
Successful CLI command:
kafka-console-producer --broker-list
123.45.67.891:1234,123.45.67.892:1234,123.45.67.893:1234 --
producer.config C:\Users\fake_user\Kafka\client-ssl.properties --topic FakeTopic
Contents of client-ssl.properties:
security.protocol = SSL
ssl.truststore.location = C:/Users/fake_user/Kafka/kafka-truststore
ssl.truststore.password = fakepass
Code:
from kafka import KafkaProducer
producer = KafkaProducer(bootstrap_servers=['123.45.67.891:1234', '123.45.67.892:1234', '123.45.67.893:1234'],
security_protocol='SSL',
ssl_certfile=r'C:\Users\fake_user\Kafka\kafka-truststore',
ssl_password='fakepass')
producer.send('FakeTopic', value='python_test', key='test')
Resultant Error:
Traceback (most recent call last):
File "kafka_post_test.py", line 6, in <module>
ssl_password='fakepass')
File "C:\Users\fake_user\AppData\Local\Programs\Python\Python37-32\lib\site-packages\kafka\producer\kafka.py", line 381, in __init__
**self.config)
File "C:\Users\fake_user\AppData\Local\Programs\Python\Python37-32\lib\site-packages\kafka\client_async.py", line 239, in __init__
self.config['api_version'] = self.check_version(timeout=check_timeout)
File "C:\Users\fake_user\AppData\Local\Programs\Python\Python37-32\lib\site-packages\kafka\client_async.py", line 874, in check_version
version = conn.check_version(timeout=remaining, strict=strict, topics=list(self.config['bootstrap_topics_filter']))
File "C:\Users\fake_user\AppData\Local\Programs\Python\Python37-32\lib\site-packages\kafka\conn.py", line 1078, in check_version
if not self.connect_blocking(timeout_at - time.time()):
File "C:\Users\fake_user\AppData\Local\Programs\Python\Python37-32\lib\site-packages\kafka\conn.py", line 331, in connect_blocking
self.connect()
File "C:\Users\fake_user\AppData\Local\Programs\Python\Python37-32\lib\site-packages\kafka\conn.py", line 420, in connect
if self._try_handshake():
File "C:\Users\fake_user\AppData\Local\Programs\Python\Python37-32\lib\site-packages\kafka\conn.py", line 496, in _try_handshake
self._sock.do_handshake()
File "C:\Users\fake_user\AppData\Local\Programs\Python\Python37-32\lib\ssl.py", line 1117, in do_handshake
self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1051)

Check out this link.
You have to add the SSL Cert to the JVM keystore for any pretty much any program that is run by Java.

I've found that by default, the python-kafka library, sets the ssl_cafile property to None. Setting it to the default os (/etc/pki/tls/cert.pem on linux) allowed me to connect to the kafka brokers.
https://kafka-python.readthedocs.io/en/master/_modules/kafka/producer/kafka.html#KafkaProducer.send

ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:749) [duplicate]

I'm working on an implicit TLS connection program with Python ftplib. I tried the solution provided in question python-ftp-implicit-tls-connection-issue(including Rg Glpj's and Juan Moreno's answers) to make the connection. But when I call retrline or retrbinary after logging into the ftp server like this(FTP_ITLS is the subclass of FTP_TLS):
58 server = FTP_ITLS()
59 server.connect(host="x.x.x.x", port=990)
60 server.login(user="user", passwd="******")
61 server.prot_p()
62
63 server.cwd("doc")
64 print(server.retrlines('LIST'))
65 # server.retrbinary('RETR contents.7z', open('contents.7z', 'wb').write)
66 server.quit()
I got an EOF error:
Traceback (most recent call last):
File "D:/Coding/test/itls.py", line 64, in <module>
print(server.retrlines('LIST'))
File "D:\Python\Python27\lib\ftplib.py", line 735, in retrlines
conn = self.transfercmd(cmd)
File "D:\Python\Python27\lib\ftplib.py", line 376, in transfercmd
return self.ntransfercmd(cmd, rest)[0]
File "D:\Python\Python27\lib\ftplib.py", line 713, in ntransfercmd
server_hostname=self.host)
File "D:\Python\Python27\lib\ssl.py", line 352, in wrap_socket
_context=self)
File "D:\Python\Python27\lib\ssl.py", line 579, in __init__
self.do_handshake()
File "D:\Python\Python27\lib\ssl.py", line 808, in do_handshake
self._sslobj.do_handshake()
ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:590)
As it seems ftplib uses PROTOCOL_SSLv23 as the default protocol in Python 2.7, I tried
PROTOCOL_TLSv1, PROTOCOL_TLSv1_1 and PROTOCOL_TLSv1_2, but none of them worked. And I also tried overriding ntransfercmd and auth, or setting ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1) as Steffen Ullrich said in question connect-to-ftp-tls-1-2-server-with-ftplib, but the error never disappeared. What can I do then? Thanks.

I ran into this trying to connect to a FileZilla FTP server. FileZilla has a setting in the "FTP over TLS settings" called "Require TLS session resumption on data connection when using PROT P". Disabling this option fixed this problem.
If you don't have control over the server, check out FTPS with Python ftplib - Session reuse required which goes over how to enable session reuse. This seems to require Python 3.6+, however.

Python socket ConnectionResetError: [Errno 54] Connection reset by peer vs socket.error: [Errno 104] Connection reset by peer

I'm having trouble debugging my code because I cannot understand the socket error being raised.
Here is the traceback.
Traceback (most recent call last):
File "clickpression.py", line 517, in <module> presser.main()
File "clickpression.py", line 391, in main
File "clickpression.py", line 121, in clickpress self.refresh_proxies(country=country)
File "clickpression.py", line 458, in refresh_proxies self.proxies = self.get_proxies(country=country)
File "helpers.py", line 72, in wrapper return func(*args, **kwargs)
File "clickpression.py", line 264, in get_proxies self.settings.SUPER_PROXY).read().decode('utf-8')
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/urllib/request.py", line 161, in urlopen return opener.open(url, data, timeout)
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/urllib/request.py", line 463, in open response = self._open(req, data)
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/urllib/request.py", line 481, in _open '_open', req)
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/urllib/request.py", line 441, in _call_chain result = func(*args)
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/urllib/request.py", line 1210, in http_open return self.do_open(http.client.HTTPConnection, req)
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/urllib/request.py", line 1185, in do_open r = h.getresponse()
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/http/client.py", line 1171, in getresponse response.begin()
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/http/client.py", line 351, in begin version, status, reason = self._read_status()
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/http/client.py", line 313, in _read_status line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
File "/usr/local/Cellar/python3/3.4.3/Frameworks/Python.framework/Versions/3.4/lib/python3.4/socket.py", line 374, in readinto return self._sock.recv_into(b)
ConnectionResetError: [Errno 54] Connection reset by peer
According to the errno library Errno 54 is errno.EXFULL which in the python 3 documentation is explained as exchange full.
To my understanding the Connection reset by peer is Errno 104 i.e errno.ECONNRESET.
So what does errno.EXFULL mean? and why does socket raise the error with a connection reset by peer description instead of exchange full. And or how are the two errors errno.EXFULL and errno.ECONNRESET related?
PS: I read that the errno 54 might be related to http proxy (I'm using a proxy in my code). If so, how?

According to the errno library Errno 54 is errno.EXFULL
Did you determine that by examining errno.errorcode[54]? Anyway - this errno library might be at fault. You could verify the meaning of an error code on your system by looking into errno.h, e. g. with the help of gcc:
gcc -xc -imacros errno.h -Wp,-P -E <(echo ECONNRESET)
Also, the Python documentation says:
To translate a numeric error code to an error message, use
os.strerror().
It may well be that error number 54 is ECONNRESET on your system, and that os.strerror(54) will attest that.
Now that you have verified that os.strerror(54) returns 'Exchange full', I am puzzled why the error number 54 and the error string Connection reset by peer do not match. If that happens on a system with strace or something similar, I would further check which error is returned by the operating system through use of strace -e network on the affected process.
Regarding your question about EXFULL: Its meaning seems somewhat system dependent; e. g. on Linux, EXFULL is returned from only a handful places in the kernel, the only network-related place being in br_if.c concerning network bridges, when no available bridge port number is found (other places are in USB and SCSI drivers).

I tried to use python to crew coin market on OKEX.com using WebSocket,cause the url is an outer address,i used a vpn service provided by us,but it still can work. here is the code an traceback.
from ws4py.client.threadedclient import WebSocketClient
class DummyClient(WebSocketClient):
def opened(self):
# self.send("{'event': 'addChannel', 'channel': 'ok_sub_futureusd_btc_ticker_this_week'}") #发送请求数据格式
# self.send("www.baidu.com")
self.send("{'event':'addChannel','channel':'ok_sub_spot_bch_btc_ticker'}")
def closed(self, code, reason=None):
print("Closed down", code, reason)
#服务器返回消息
def received_message(self, m):
print("recv:", m)
if __name__ == '__main__':
try:
# 服务器连接地址wss://real.okex.com:10440/websocket/okexapi
# ws = DummyClient('wss://real.okcoin.cn:10440/websocket/okcoinapi', protocols=['chat'])
ws = DummyClient('wss://real.okex.com:10440/websocket/okexapi', protocols=['chat'])
ws.connect()
#ws.send("my test...")
ws.run_forever()
except KeyboardInterrupt:
ws.close()

You can try this code to your project:
import ssl
ssl._create_default_https_context = ssl._create_unverified_context
if it not work,make sure the server open TLSv1 support.