| 2274 | from test.ssl_servers import make_https_server |
| 2275 | |
| 2276 | class ThreadedEchoServer(threading.Thread): |
| 2277 | |
| 2278 | class ConnectionHandler(threading.Thread): |
| 2279 | |
| 2280 | """A mildly complicated class, because we want it to work both |
| 2281 | with and without the SSL wrapper around the socket connection, so |
| 2282 | that we can test the STARTTLS functionality.""" |
| 2283 | |
| 2284 | def __init__(self, server, connsock, addr): |
| 2285 | self.server = server |
| 2286 | self.running = False |
| 2287 | self.sock = connsock |
| 2288 | self.addr = addr |
| 2289 | self.sock.setblocking(True) |
| 2290 | self.sslconn = None |
| 2291 | threading.Thread.__init__(self) |
| 2292 | self.daemon = True |
| 2293 | |
| 2294 | def wrap_conn(self): |
| 2295 | try: |
| 2296 | self.sslconn = self.server.context.wrap_socket( |
| 2297 | self.sock, server_side=True) |
| 2298 | self.server.selected_alpn_protocols.append(self.sslconn.selected_alpn_protocol()) |
| 2299 | except (ConnectionResetError, BrokenPipeError, ConnectionAbortedError) as e: |
| 2300 | # We treat ConnectionResetError as though it were an |
| 2301 | # SSLError - OpenSSL on Ubuntu abruptly closes the |
| 2302 | # connection when asked to use an unsupported protocol. |
| 2303 | # |
| 2304 | # BrokenPipeError is raised in TLS 1.3 mode, when OpenSSL |
| 2305 | # tries to send session tickets after handshake. |
| 2306 | # https://github.com/openssl/openssl/issues/6342 |
| 2307 | # |
| 2308 | # ConnectionAbortedError is raised in TLS 1.3 mode, when OpenSSL |
| 2309 | # tries to send session tickets after handshake when using WinSock. |
| 2310 | self.server.conn_errors.append(str(e)) |
| 2311 | if self.server.chatty: |
| 2312 | handle_error("\n server: bad connection attempt from " + repr(self.addr) + ":\n") |
| 2313 | self.running = False |
| 2314 | self.close() |
| 2315 | return False |
| 2316 | except (ssl.SSLError, OSError) as e: |
| 2317 | # OSError may occur with wrong protocols, e.g. both |
| 2318 | # sides use PROTOCOL_TLS_SERVER. |
| 2319 | # |
| 2320 | # XXX Various errors can have happened here, for example |
| 2321 | # a mismatching protocol version, an invalid certificate, |
| 2322 | # or a low-level bug. This should be made more discriminating. |
| 2323 | # |
| 2324 | # bpo-31323: Store the exception as string to prevent |
| 2325 | # a reference leak: server -> conn_errors -> exception |
| 2326 | # -> traceback -> self (ConnectionHandler) -> server |
| 2327 | self.server.conn_errors.append(str(e)) |
| 2328 | if self.server.chatty: |
| 2329 | handle_error("\n server: bad connection attempt from " + repr(self.addr) + ":\n") |
| 2330 | |
| 2331 | # bpo-44229, bpo-43855, bpo-44237, and bpo-33450: |
| 2332 | # Ignore spurious EPROTOTYPE returned by write() on macOS. |
| 2333 | # See also http://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/ |
no outgoing calls