Hello Request breaks pyOpenSSL

Hi there,

I tried to hunt down https://github.com/mitmproxy/mitmproxy/issues/472 today and encountered a strange pyOpenSSL bug. If the server

1. requests renegotiation (Hello Request),
2. (unsuccessfully) asks for a client certificate during renegotation and then
3. sends some encrypted data, I cannot read that data using pyOpenSSL.

Here's my testcase - I think I'm doing nothing special:

from OpenSSL import SSL
import socket

ctx = SSL.Context(SSL.SSLv23_METHOD)
sock = SSL.Connection(ctx, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
sock.connect(("exchangedev.taskbox.co", 443))
sock.do_handshake()

def dump_creds():
    crand = sock.client_random().encode("hex")
    masterkey = sock.master_key().encode("hex")
    with open("keys","ab") as f:
        f.write("CLIENT_RANDOM {} {}\r\n".format(crand, masterkey))

dump_creds()

sock.send("GET /Microsoft-Server-ActiveSync HTTP/1.1\r\n"
          "Host: exchangedev.taskbox.co\r\n"
          "\r\n"
          "\r\n")

try:
    print(sock.recv(1))
finally:
    dump_creds() # renegotiated master key

Here's the output:

C:\Users\user\git\mitmproxy\test\>python test.py
Traceback (most recent call last):
  File "test.py", line 23, in <module>
    print(sock.recv(1))
  File "C:\Python27\lib\site-packages\OpenSSL\SSL.py", line 995, in recv
    self._raise_ssl_error(self._ssl, result)
  File "C:\Python27\lib\site-packages\OpenSSL\SSL.py", line 847, in _raise_ssl_error
    raise WantReadError()
OpenSSL.SSL.WantReadError

Now, that clearly looks like I'm not getting any data back. However, looking at Wireshark, I see this:

Similarly, using openssl s_client -connect exchangedev.taskbox.co:443, I get the response.

Here's the pcap dump with the corresponding SSL keys for Wireshark (Protocol Options -> SSL -> Master-Secret log file). For the lazy, here's also a screenshot:

The server mentioned above is on the public internet, and according to https://github.com/mitmproxy/mitmproxy/issues/472#issuecomment-73786789 you're welcome to use it for testing. If there's anything else I can help with, please let me know! 😃

Thanks!
Max

Start with the inline Python testcase, saved as test.py, and reproduce the WantReadError after the server requests renegotiation. Compare the recv behavior with the supplied pcap and SSL keys in Wireshark. Done means the encrypted response can be read through pyOpenSSL after this renegotiation sequence.