sslv3 alert handshake failure

[DouglasBlackwood]

Hi!

I've encountered an error lately. It happened once and it seems to come from a lower layer. But I'd like some feedback before I create an issue.

Here is the stack trace:

SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1000)
[...]
  File "httpx/_client.py", line 1574, in request
    return await self.send(request, auth=auth, follow_redirects=follow_redirects)
  File "ddtrace/contrib/httpx/patch.py", line 137, in _wrapped_async_send
    resp = await wrapped(*args, **kwargs)
  File "httpx/_client.py", line 1661, in send
    response = await self._send_handling_auth(
  File "httpx/_client.py", line 1689, in _send_handling_auth
    response = await self._send_handling_redirects(
  File "httpx/_client.py", line 1726, in _send_handling_redirects
    response = await self._send_single_request(request)
  File "httpx/_client.py", line 1763, in _send_single_request
    response = await transport.handle_async_request(request)
  File "httpx/_transports/default.py", line 373, in handle_async_request
    resp = await self._pool.handle_async_request(req)
  File "httpcore/_async/connection_pool.py", line 216, in handle_async_request
    raise exc from None
  File "httpcore/_async/connection_pool.py", line 196, in handle_async_request
    response = await connection.handle_async_request(
  File "httpcore/_async/connection.py", line 99, in handle_async_request
    raise exc
  File "httpcore/_async/connection.py", line 76, in handle_async_request
    stream = await self._connect(request)
  File "httpcore/_async/connection.py", line 154, in _connect
    stream = await stream.start_tls(**kwargs)
  File "httpcore/_backends/anyio.py", line 80, in start_tls
    raise exc
  File "httpcore/_backends/anyio.py", line 71, in start_tls
    ssl_stream = await anyio.streams.tls.TLSStream.wrap(
  File "anyio/streams/tls.py", line 132, in wrap
    await wrapper._call_sslobject_method(ssl_object.do_handshake)
  File "anyio/streams/tls.py", line 140, in _call_sslobject_method
    result = func(*args)
  File "ssl.py", line 917, in do_handshake
    self._sslobj.do_handshake()

It happened during a request to another one of our servers. We perform this kind of request pretty often without any issues. This error happened only once.

I have the feeling that this error should be mapped to another higher-level exception, either in httpx or httpcore.

Here is my environment:

• Python runtime: 3.12.3(3.12.3 (main, May 14 2024, 07:34:56) [GCC 12.2.0])
• httpx 0.27.0
• httpcore 1.0.5
• anyio 4.4.0

What do you think?

[tomchristie]

Yes. Looks to me like we should include and map SSLError -> httpcore.ConnectError...

https://github.com/encode/httpcore/blob/c96fdf7d31c3ab983f4eec4ef7a25cd81edc7ac9/httpcore/_backends/anyio.py#L63-L67

In order to resolve this.

[DouglasBlackwood]

Should I create an issue on httpcore repo?

[tomchristie]

Yes please.

[DouglasBlackwood]

Thank you! Done encode/httpcore#917

[pquentin]

Hello! So this made it to httpcore 1.0.6, and it's currently breaking the test suite of elastic-transport-python that has been supporting HTTPX for a few months now. I find it a bit surprising, as all the other libraries we support don't do this:

• aiohttp raises aiohttp_exceptions.ClientSSLError
• requests raises requests.exceptions.SSLError
• urllib3 raises urllib3.exceptions.SSLError

(And in all cases, we also catch ssl.SSLError just to make sure.)

ConnectionError, to me, means that the TCP connection failed.

[pquentin]

Thanks! To be clear, this was working fine before encode/httpcore#917. As you can see in the stack trace in the original post here, SSLError is indeed raised.

[tomchristie]

Ah, let me be more clear...

sounds like we should escalate an issue for httpcore/httpx to include an `httpx.SSLError` case.

this was working fine

Ah the fine line between bug and expected-behaviour. 😉
We should be raising a subclass of httpx.RequestError here, as with all other networking exceptions.
Raising an httpx.ConnectError for the error as in encode/httpcore#917 is a bugfix.

Introducing an httpx.SSLError would be an enhancement.

[pquentin]

Understood, thank you. In which repo do you want me to create the issue then?

[tomchristie]

Thanks @pquentin... interesting question.

You're seeing this against httpx, so I'd say raise it here.

[pquentin]

Thanks, I opened #3350.