EOF occurred in violation of protocol (SSLv3 vs TLSv1)

[laclaro]

Hi!

I tried to use you example script to send a message via xmpp. I first ran into some errors:

Traceback (most recent call last):
File "/usr/local/bin/xmppPush.py", line 35, in
client.run()
File "/usr/local/lib/python2.7/dist-packages/pyxmpp2-2.0alpha2_git-py2.7.egg/pyxmpp2/client.py", line 216, in run
self.main_loop.loop(timeout)
File "/usr/local/lib/python2.7/dist-packages/pyxmpp2-2.0alpha2_git-py2.7.egg/pyxmpp2/mainloop/base.py", line 86, in loop
self.loop_iteration(interval)
File "/usr/local/lib/python2.7/dist-packages/pyxmpp2-2.0alpha2_git-py2.7.egg/pyxmpp2/mainloop/poll.py", line 145, in loop_iteration
self._handlers[fileno].handle_read()
File "/usr/local/lib/python2.7/dist-packages/pyxmpp2-2.0alpha2_git-py2.7.egg/pyxmpp2/transport.py", line 718, in handle_read
self._continue_tls_handshake()
File "/usr/local/lib/python2.7/dist-packages/pyxmpp2-2.0alpha2_git-py2.7.egg/pyxmpp2/transport.py", line 673, in _continue_tls_handshake
self._socket.do_handshake()
File "/usr/lib/python2.7/ssl.py", line 788, in do_handshake
self._sslobj.do_handshake()
ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:581)

Looking into that transport.py file, i figured, that this could be a SSL-version problem. My server does not allow SSLv23, because it's weak and everyone moved on to at least TLSv1. Although it seems that somewhere in transport.py ssl_version is set to ssl.PROTOCOL_TLSv1, in kwargs of function _initiate_starttls(self, **kwargs) it was still set to 3 (SSLv3).

Putting print(ssl.PROTOCOL_TLSv1) near that line also returned 3 (SSLv3). I don't know why. I now resolved the issue by adding

kwargs["ssl_version"] = ssl.PROTOCOL_TLSv1_2

which actually worked (ssl_version = 5).

Could you have a look at this? Maybe it affects only my system? I'm using python2.7

Best

Henning

[laclaro]

My bad. ssl_version = 3 means TLSv1.0. This was also forbidden with my server. So this is no more a pyxmpp2 issue.
Can one pass an "at least TLSv1" instead of an "only TLSv1"?