Allow all SSL versions (even insecure ones) #10184

Thoufak · 2024-12-19T08:05:28Z

Thoufak
Dec 19, 2024

I'm connecting to a WebSocket server over an HTTP proxy and getting this error:
[[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1129)]
It works fine with some other HTTP proxies.

I found this comment and I'm trying to follow it to allow all SSL versions (even insecure ones). This is my code:

import aiohttp, ssl

context = ssl.SSLContext()
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE
context.options &= ~ssl.OP_NO_SSLv3
context.verify_flags &= ~ssl.VERIFY_X509_STRICT

connector = aiohttp.TCPConnector(ssl=context)

async with aiohttp.ClientSession(connector=connector) as session:
    async with session.ws_connect("wss://zws2.web.telegram.org", protocols=("binary",), proxy=..., proxy_auth=..., ssl=context) as ws_server:
        print("Connected")

However, I'm still getting the error:

Traceback (most recent call last):
  File "/Users/ss2/PycharmProjects/MyProject/resources/venv/lib/python3.9/site-packages/aiohttp/connector.py", line 1095, in _start_tls_connection
    tls_transport = await self._loop.start_tls(
  File "/Users/ss2/.pyenv/versions/3.9.5/lib/python3.9/asyncio/base_events.py", line 1231, in start_tls
    await waiter
  File "/Users/ss2/.pyenv/versions/3.9.5/lib/python3.9/asyncio/futures.py", line 284, in __await__
    yield self  # This tells Task to wait for completion.
  File "/Users/ss2/.pyenv/versions/3.9.5/lib/python3.9/asyncio/tasks.py", line 328, in __wakeup
    future.result()
  File "/Users/ss2/.pyenv/versions/3.9.5/lib/python3.9/asyncio/futures.py", line 201, in result
    raise self._exception
  File "/Users/ss2/.pyenv/versions/3.9.5/lib/python3.9/asyncio/sslproto.py", line 528, in data_received
    ssldata, appdata = self._sslpipe.feed_ssldata(data)
  File "/Users/ss2/.pyenv/versions/3.9.5/lib/python3.9/asyncio/sslproto.py", line 188, in feed_ssldata
    self._sslobj.do_handshake()
  File "/Users/ss2/.pyenv/versions/3.9.5/lib/python3.9/ssl.py", line 944, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1129)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/ss2/PycharmProjects/MyProject/src/modules/dialogs/servers/ws_proxy.py", line 111, in _handle_client
    async with session.ws_connect(url, protocols=("binary",), proxy=proxy_url, proxy_auth=proxy_auth, ssl=context) as ws_server:
  File "/Users/ss2/PycharmProjects/MyProject/resources/venv/lib/python3.9/site-packages/aiohttp/client.py", line 1138, in __aenter__
    self._resp = await self._coro
  File "/Users/ss2/PycharmProjects/MyProject/resources/venv/lib/python3.9/site-packages/aiohttp/client.py", line 776, in _ws_connect
    resp = await self.request(
  File "/Users/ss2/PycharmProjects/MyProject/resources/venv/lib/python3.9/site-packages/aiohttp/client.py", line 535, in _request
    conn = await self._connector.connect(
  File "/Users/ss2/PycharmProjects/MyProject/resources/venv/lib/python3.9/site-packages/aiohttp/connector.py", line 542, in connect
    proto = await self._create_connection(req, traces, timeout)
  File "/Users/ss2/PycharmProjects/MyProject/resources/venv/lib/python3.9/site-packages/aiohttp/connector.py", line 905, in _create_connection
    _, proto = await self._create_proxy_connection(req, traces, timeout)
  File "/Users/ss2/PycharmProjects/MyProject/resources/venv/lib/python3.9/site-packages/aiohttp/connector.py", line 1325, in _create_proxy_connection
    return await self._start_tls_connection(
  File "/Users/ss2/PycharmProjects/MyProject/resources/venv/lib/python3.9/site-packages/aiohttp/connector.py", line 1111, in _start_tls_connection
    raise ClientConnectorSSLError(req.connection_key, exc) from exc
aiohttp.client_exceptions.ClientConnectorSSLError: Cannot connect to host zws2.web.telegram.org:443 ssl:<ssl.SSLContext object at 0x13f0bbf40> [[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1129)]

The resulting SSLContext is as follows:

Dreamsorcerer · 2024-12-19T15:10:39Z

Dreamsorcerer
Dec 19, 2024
Maintainer

Sounds like an issue with the proxy (first result about that error suggests their proxy required http: https://stackoverflow.com/questions/65516325/ssl-wrong-version-number-on-python-request). Other reports suggest it's the wrong port number (i.e. you might be sending an HTTPS request to an HTTP port).

To actually allow all versions (which I'm not convinced is your problem), you can simply set the minimum_version: https://docs.python.org/3/library/ssl.html#ssl.SSLContext.minimum_version

3 replies

Thoufak Dec 25, 2024
Author

first result about that error suggests their proxy required http: https://stackoverflow.com/questions/65516325/ssl-wrong-version-number-on-python-request)

My proxy is already specified with the http scheme like so:
async with session.ws_connect(..., proxy="http://xxx.xxx.xxx.xxx:yyyy") as ws_server:

Thoufak Dec 25, 2024
Author

Other reports suggest it's the wrong port number (i.e. you might be sending an HTTPS request to an HTTP port).

Do you mean the port of the proxy server or the port of the destination server?
As for the proxy port, I tried sending a request to an HTTPS website like so:
curl -x my-proxy-here https://www.google.com
and it returns a 200. As far as I understand, that means that this proxy is capable of making HTTPS connections through the specified port (please note, that my goal is to use WSS, not HTTPS).
As for the destination server, I'm trying to connect to port 443. I'm sure that it accepts WSS connections (in fact, other proxies work just fine).

Thoufak Dec 25, 2024
Author

To actually allow all versions (which I'm not convinced is your problem), you can simply set the minimum_version: https://docs.python.org/3/library/ssl.html#ssl.SSLContext.minimum_version

By default minimum_version is set to MINIMUM_SUPPORTED. I also tried setting it to SSLv3, but it didn't help.

Thoufak · 2024-12-25T11:37:48Z

Thoufak
Dec 25, 2024
Author

I'm trying to narrow down the issue and also get some more logs about the problem. I sent a GET request with a header "Connection: Upgrade" to imitate a websocket connection process.

In case of a direct connection it works just fine:

curl -i -N \
  -X GET "https://zws5.web.telegram.org/apiws" \
  -H "Host: zws5.web.telegram.org" \
  -H "Connection: Upgrade" \
  -H "Pragma: no-cache" \
  -H "Cache-Control: no-cache" \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0" \ 
  -H "Upgrade: websocket" \
  -H "Origin: https://web.telegram.org" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Accept-Encoding: gzip, deflate, br, zstd" \
  -H "Accept-Language: ru,en-GB;q=0.9,en-US;q=0.8,en;q=0.7,zh-CN;q=0.6,zh;q=0.5,hi;q=0.4,ur;q=0.3" \
  -H "Sec-WebSocket-Key: EDPJZItdES1CaQOQfY5+Nw==" \
  -H "Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits" \
  -H "Sec-WebSocket-Protocol: binary"

HTTP/1.1 101 Switching Protocols
Server: nginx/1.18.0
Date: Wed, 25 Dec 2024 11:25:59 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 4moITavdHGVNIHqenlIotyspq1E=
Sec-WebSocket-Protocol: binary

However, sending the same request through a proxy results in an error:

curl -i -N \
  -X GET "https://zws5.web.telegram.org/apiws" \
  -H "Host: zws5.web.telegram.org" \
  -H "Connection: Upgrade" \
  -H "Pragma: no-cache" \
  -H "Cache-Control: no-cache" \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0" \ 
  -H "Upgrade: websocket" \
  -H "Origin: https://web.telegram.org" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Accept-Encoding: gzip, deflate, br, zstd" \
  -H "Accept-Language: ru,en-GB;q=0.9,en-US;q=0.8,en;q=0.7,zh-CN;q=0.6,zh;q=0.5,hi;q=0.4,ur;q=0.3" \
  -H "Sec-WebSocket-Key: EDPJZItdES1CaQOQfY5+Nw==" \
  -H "Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits" \
  -H "Sec-WebSocket-Protocol: binary" \
  --proxy "my-proxy-here"

HTTP/1.1 200 Connection established
server: proxy/1.1

curl: (35) error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version

I also tried to find out the TLS requirement of the server with a command openssl s_client -connect web.telegram.org:443 . The output is attached. There's a line saying Protocol : TLSv1.3. Does this mean the server requires that TLS version, and my proxy doesn't support it?

openssl output.txt

1 reply

Thoufak Dec 25, 2024
Author

and my proxy doesn't support it?

The proxy seems to support TLS 1.3 because this command succeeds:
curl -x my-proxy-here https://www.google.com --tlsv1.3

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow all SSL versions (even insecure ones) #10184

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 4 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

Allow all SSL versions (even insecure ones) #10184

Thoufak Dec 19, 2024

Replies: 2 comments · 4 replies

Dreamsorcerer Dec 19, 2024 Maintainer

Thoufak Dec 25, 2024 Author

Thoufak Dec 25, 2024 Author

Thoufak Dec 25, 2024 Author

Thoufak Dec 25, 2024 Author

Thoufak Dec 25, 2024 Author

Thoufak
Dec 19, 2024

Replies: 2 comments 4 replies

Dreamsorcerer
Dec 19, 2024
Maintainer

Thoufak Dec 25, 2024
Author

Thoufak Dec 25, 2024
Author

Thoufak Dec 25, 2024
Author

Thoufak
Dec 25, 2024
Author

Thoufak Dec 25, 2024
Author