JohnDoee / deluge-client

A very lightweight pure-python Deluge RPC Client
MIT License
87 stars 14 forks source link

SSLError in Python 3.5. #2

Closed elektito closed 8 years ago

elektito commented 8 years ago

In Python 3.5.1 I get the following error when calling connect:

Traceback (most recent call last):
  File "dlrpc.py", line 13, in <module>
    main()
  File "dlrpc.py", line 6, in main
    client.connect()
  File "/tmp/fax/venv/lib/python3.5/site-packages/deluge_client/client.py", line 43, in connect
    self._socket.connect((self.host, self.port))
  File "/usr/lib/python3.5/ssl.py", line 1014, in connect
    self._real_connect(addr, False)
  File "/usr/lib/python3.5/ssl.py", line 1005, in _real_connect
    self.do_handshake()
  File "/usr/lib/python3.5/ssl.py", line 983, in do_handshake
    self._sslobj.do_handshake()
  File "/usr/lib/python3.5/ssl.py", line 628, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:645)

Deluge daemon is version 1.3.6 using libtorrent 0.16.13.0. The deluge-client is the version available on pypi right now.

With Python 3.4.3 and 2.7.6 everything seems to be fine.

elektito commented 8 years ago

After some poking around, this seems to be an artifact of SSLv3 being disabled in Python 2.7.9 and 3.5. Since I cannot upgrade the Python where Deluge daemon is running, nor can I change the decision to use Python 3.5, I had to find a hack to make things work. I found out I could update this line in client.py:

self._socket = ssl.wrap_socket(socket.socket(socket.AF_INET, socket.SOCK_STREAM))

to this:

self._socket = ssl.wrap_socket(socket.socket(socket.AF_INET, socket.SOCK_STREAM), ssl_version=ssl.PROTOCOL_SSLv3)

This forces the use of SSLv3.

JohnDoee commented 8 years ago

I doubt I can do a lot to actually fix it. SSLv3 is disabled all-around due to the POODLE attack so I can't even force a connection in my test setup.

The real solution is to upgrade your Deluge daemon to 1.3.11 or higher because that's where they disabled SSLv3 support.

Anyways, I added some auto-detection logic that will handle the cases where it'd actually be possible to connect.