SSLv3 - OSX use last OpenSSL version [tag: ssl.OPENSSL_VERSION // SSL.SSLeay_version(SSL.SSLEAY_VERSION)]

Hi,

To reproduce the bug,

``` python
import requests
requests.get('https://www.monova.org/')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 69, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 465, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 573, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/adapters.py", line 370, in send
    timeout=timeout
  File "/usr/local/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 544, in urlopen
    body=body, headers=headers)
  File "/usr/local/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 344, in _make_request
    self._raise_timeout(err=e, url=url, timeout_value=conn.timeout)
  File "/usr/local/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py", line 314, in _raise_timeout
    if 'timed out' in str(err) or 'did not complete (read)' in str(err):  # Python 2.6
TypeError: __str__ returned non-string (type Error)
```

On OSX python 2.7.10 and openssl 1.0.2a and requests 2.7.0

With openssl 0.9.8zd and python 2.7.8 and requests 2.6.0

``` python
  File "python2.7/site-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno 1] _ssl.c:510: error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error
```


Yeah, this is a result of a change in urllib3. We fixed it in shazow/urllib3#622, and this should be fixed in the next release.


Yes for this error TypeError: **str** returned non-string (type Error), but the problem is also that I can do requests.get('https://www.monova.org/') for no reason ? The website is online and work.

With this fix, I get this error :

``` python
("bad handshake: Error([('SSL routines', 'SSL23_GET_SERVER_HELLO', 'sslv3 alert handshake failure')],)",)
```


Oh, my apologies, I didn't read your report correctly. Sorry!


The most likely problem is that your OpenSSL is too old, and we cannot negotiate a cipher with the remote server. When I test with a newer OpenSSL version I negotiate TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, using TLS v1.2. When I use my system OpenSSL, I don't offer that cipher (or any ECDHE cipher), and I only use TLS v1.0. I suspect that's your problem.

What OS are you using?


I'm using OSX.

``` bash
python -c 'import ssl; print ssl.OPENSSL_VERSION'                                                                                                                                                     (06-02 12:50)
OpenSSL 1.0.2a
```

To get this I had to use brew

``` bash
brew install python --with-brewed-openssl
```

Because default ssl version is 

``` bash
oldpython -c 'import ssl; print ssl.OPENSSL_VERSION'                                                                                                                 
OpenSSL 0.9.8zd 8 Jan 2015
```

With openssl 1.0.2a

``` bash
openssl s_client -connect monova.org:443 -servername monova.org -verify False                                                                                                                        
verify depth is 0
CONNECTED(00000003)
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO ECC Certification Authority
verify error:num=20:unable to get local issuer certificate
140735182091088:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:s3_clnt.c:1205:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 3842 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1433242404
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
```

I have also try this without success (same error) :

``` python
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.poolmanager import PoolManager


class Ssl3HttpAdapter(HTTPAdapter):
    """"Transport adapter" that allows us to use SSLv3."""

    def init_poolmanager(self, connections, maxsize, block=False):
        self.poolmanager = PoolManager(num_pools=connections,
                                       maxsize=maxsize,
                                       block=block,
                                       ssl_version=ssl.PROTOCOL_SSLv3)
```


The SSLAdapter you've used won't help you here, because you need a _more_ recent SSL, not a less recent.

Can you try this for me please? `python -c 'from OpenSSL import SSL; print SSL.SSLeay_version(SSL.SSLEAY_VERSION)`

I believe you're using PyOpenSSL, and that you didn't build it against the home-brew OpenSSL. If that command prints something other than OpenSSL 1.0.2, you will want to run this command:

`env ARCHFLAGS="-arch x86_64" LDFLAGS="-L/usr/local/opt/openssl/lib" CFLAGS="-I/usr/local/opt/openssl/include" pip install -U cryptography`

Then try again.


``` bash
python -c 'from OpenSSL import SSL; print SSL.SSLeay_version(SSL.SSLEAY_VERSION)'                                                                                                                     (06-02 13:05)
OpenSSL 0.9.8zd 8 Jan 2015
```

Well that's the problem but this not working :

``` bash
env ARCHFLAGS="-arch x86_64" LDFLAGS="-L/usr/local/opt/openssl/lib" CFLAGS="-I/usr/local/opt/openssl/include" sudo pip install --upgrade cryptography
Requirement already up-to-date: cryptography in /Library/Python/2.7/site-packages
Requirement already up-to-date: idna in /Library/Python/2.7/site-packages (from cryptography)
Requirement already up-to-date: pyasn1 in /Library/Python/2.7/site-packages (from cryptography)
Requirement already up-to-date: six>=1.4.1 in /Library/Python/2.7/site-packages (from cryptography)
Requirement already up-to-date: setuptools in /usr/local/lib/python2.7/site-packages/setuptools-17.0-py2.7.egg (from cryptography)
Requirement already up-to-date: enum34 in /Library/Python/2.7/site-packages (from cryptography)
Requirement already up-to-date: ipaddress in /Library/Python/2.7/site-packages (from cryptography)
Requirement already up-to-date: cffi>=0.8 in /Library/Python/2.7/site-packages (from cryptography)
Requirement already up-to-date: pycparser in /Library/Python/2.7/site-packages (from cffi>=0.8->cryptography)
```


Add the `--force-reinstall` flag. =)


I just uninstall/reinstall :D.

env ARCHFLAGS="-arch x86_64" LDFLAGS="-L/usr/local/Cellar/openssl/1.0.2a-1/lib" CFLAGS="-I/usr/local/Cellar/openssl/1.0.2a-1/include" sudo pip install cryptography

``` bash
python -c 'from OpenSSL import SSL; print SSL.SSLeay_version(SSL.SSLEAY_VERSION)'                                                                                                                    
OpenSSL 1.0.2a 19 Mar 2015
```

Thanks for you're help