Mailman 3 March 2019 - Twisted-web

Twisted Web Agent configurable Elliptic Curves settings
by Paul Tremberth Dec. 16, 2021

Dec. 16, 2021

Hello, The other day, we had a Scrapy user report an issue connecting to https://www.skelbiu.lt/ with OpenSSL 1.1 [1] To not mix scrapy's things with Twisted Web, I used this (adapted from official docs): #--------------- from __future__ import print_function from twisted.internet import reactor from twisted.web.client import Agent from twisted.web.http_headers import Headers agent = Agent(reactor) d = agent.request( 'GET', 'https://www.skelbiu.lt/', Headers({'User-Agent': ['Twisted Web Client Example']}), None) def cbResponse(ignored): print('Response received') d.addCallback(cbResponse) def cbShutdown(ignored): print(ignored) reactor.stop() d.addBoth(cbShutdown) reactor.run() #--------------- And I did get a Handshake failure too: $ python twistedtest.py [Failure instance: Traceback (failure with no frames): <class 'twisted.web._newclient.ResponseNeverReceived'>: [<twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')]>] ] It seems this happens (at least) with OpenSSL 1.1.0e (currently in Debian 9 sid [2]) It does not happen (for me) with OpenSSL 1.0.2g for example. I dug into this this afternoon and narrowed it down to the use of _defaultCurveName = u"prime256v1" in twisted.internet._sslverify.py I tried patching the current trunk with _defaultCurveName = u"secp384r1" (the EC that ssllabs.com reports) and it did work. Looking at ClientHello messages for openssl 1.0.2 and 1.1 [4]: with 1.1, only 1 Elliptic Curve is sent by Twisted Web Agent, secp256r1 openssl v1.1 client uses 4 by default: ecdh_x25519, secp256r1, secp521r1, secp384r1 I was wondering what is the proper way to configure requested Elliptic Curves. I haven't seen any interface for this, contrary to ciphers with acceptableCiphers. Thank you for your input. Best, Paul. [1] https://github.com/scrapy/scrapy/issues/2717 [2] https://packages.debian.org/fr/source/sid/openssl [3] https://github.com/twisted/twisted/blob/78679af87e349721a167f35bef239e192e9… [4] https://github.com/scrapy/scrapy/issues/2717#issuecomment-297464034

2 2

Test
by Philippe Lafoucrière Aug. 5, 2021

Aug. 5, 2021

Hi all just a test

3 2

Listening on 2 addresses
by Axel Rau April 2, 2019

April 2, 2019

I have a simple web application with the plugin below. It works fine with IPv4 or IPv6. The host has 2 addresses (IPv4 + IPv6 = dual stack). How can I extend the plugin to let my server listen on both addresses? Please advice, Axel PS: The plugin: from zope.interface import implementer from twisted.application.service import IServiceMaker from twisted.application import internet from twisted.plugin import IPlugin from twisted.python import usage from meteo import meteo_factory class Options(usage.Options): optParameters = [ ['port', 'p', 80, 'The port number to listen on.'], ['ipv4_address', '4', None, 'The IPv4 address to listen on.'], ['ipv6_address', '6', None, 'The IPv6 address to listen on.'], ['host', 'l', None, 'The hostname where to listen at']] @implementer(IServiceMaker, IPlugin) class MeteoServiceMaker(object): tapname = 'meteo' description = 'A web application for the meteo package' options = Options def makeService(self, options): """ Constructs a TCP server from a factory defined in meteo.py """ return internet.TCPServer( int(options['port']), meteo_factory, interface=options['ipv6_address']) serviceMaker = MeteoServiceMaker() --- PGP-Key:29E99DD6 ☀ computing @ chaos claudius

2 4

Twisted Klein idle connection timeout
by John Aherne March 6, 2019

March 6, 2019

Klein defaults to the twisted http timeout of 60 seconds. But in twisted web Site setup you can define a timeout parameter to change this. e.g. factory = Site(root, timeout=300) I can't see any option to add a parameter in Klein to change this. Is there no option for this or have I just missed the obvious setup point. Thanks for any info. -- *John Aherne* *www.rocs.co.uk <http://www.rocs.co.uk>* 020 7223 7567

2 2