Method receive_handshake_data

mitmproxy/proxy/layers/tls.py:294–398

(
        self, data: bytes
    )

                yield commands.SendData(self.conn, data)

    def receive_handshake_data(
        self, data: bytes
    ) -> layer.CommandGenerator[tuple[bool, str | None]]:
        # bio_write errors for b"", so we need to check first if we actually received something.
        if data:
            self.tls.bio_write(data)
        try:
            self.tls.do_handshake()
        except SSL.WantReadError:
            yield from self.tls_interact()
            return False, None
        except SSL.Error as e:
            # provide more detailed information for some errors.
            last_err = (
                e.args and isinstance(e.args[0], list) and e.args[0] and e.args[0][-1]
            )
            if last_err in [
                (
                    "SSL routines",
                    "tls_process_server_certificate",
                    "certificate verify failed",
                ),
                ("SSL routines", "", "certificate verify failed"),  # OpenSSL 3+
            ]:
                verify_result = SSL._lib.SSL_get_verify_result(self.tls._ssl)  # type: ignore
                error = SSL._ffi.string(  # type: ignore
                    SSL._lib.X509_verify_cert_error_string(verify_result)  # type: ignore
                ).decode()
                err = f"Certificate verify failed: {error}"
            elif last_err in [
                ("SSL routines", "ssl3_read_bytes", "tlsv1 alert unknown ca"),
                ("SSL routines", "ssl3_read_bytes", "sslv3 alert bad certificate"),
                ("SSL routines", "ssl3_read_bytes", "ssl/tls alert bad certificate"),
                ("SSL routines", "", "tlsv1 alert unknown ca"),  # OpenSSL 3+
                ("SSL routines", "", "sslv3 alert bad certificate"),  # OpenSSL 3+
                ("SSL routines", "", "ssl/tls alert bad certificate"),  # OpenSSL 3.2+
            ]:
                assert isinstance(last_err, tuple)
                err = last_err[2]
            elif (
                last_err
                in [
                    ("SSL routines", "ssl3_get_record", "wrong version number"),
                    ("SSL routines", "", "wrong version number"),  # OpenSSL 3+
                    ("SSL routines", "", "packet length too long"),  # OpenSSL 3+
                    ("SSL routines", "", "record layer failure"),  # OpenSSL 3+
                ]
                and data[:4].isascii()
            ):
                err = f"The remote server does not speak TLS."
            elif last_err in [
                ("SSL routines", "ssl3_read_bytes", "tlsv1 alert protocol version"),
                ("SSL routines", "", "tlsv1 alert protocol version"),  # OpenSSL 3+
            ]:
                err = (
                    f"The remote server and mitmproxy cannot agree on a TLS version to use. "
                    f"You may need to adjust mitmproxy's tls_version_server_min option."
                )