Request hangs when a TLS 1.3 server rejects the client certificate after the handshake #8486

"""mitmdump hangs when a TLS 1.3 server rejects the client after the handshake.

Starts a local HTTPS server that requires a client certificate, starts stock
mitmdump (no addons, no client certificate configured), and sends one request
through it. Run with `python tls13_alert_repro.py [1.2|1.3]`; needs `cryptography`
and `mitmdump` on PATH.
"""

import datetime
import os
import socket
import ssl
import subprocess
import sys
import tempfile
import threading
import time

from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.x509.oid import NameOID

TLS = {"1.2": ssl.TLSVersion.TLSv1_2, "1.3": ssl.TLSVersion.TLSv1_3}[
    sys.argv[1] if len(sys.argv) > 1 else "1.3"
]
WORK = tempfile.mkdtemp()
NOW = datetime.datetime.now(datetime.UTC)


def issue(name, issuer=None, *, ca=False, san=None):
    key = ec.generate_private_key(ec.SECP256R1())
    subject = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, name)])
    builder = (
        x509.CertificateBuilder()
        .subject_name(subject)
        .issuer_name(issuer[0].subject if issuer else subject)
        .public_key(key.public_key())
        .serial_number(x509.random_serial_number())
        .not_valid_before(NOW - datetime.timedelta(days=1))
        .not_valid_after(NOW + datetime.timedelta(days=1))
        .add_extension(x509.BasicConstraints(ca=ca, path_length=None), critical=True)
    )
    if san:
        builder = builder.add_extension(
            x509.SubjectAlternativeName([x509.DNSName(san)]), critical=False
        )
    return builder.sign(issuer[1] if issuer else key, hashes.SHA256()), key


def write(name, *parts):
    path = os.path.join(WORK, name)
    with open(path, "wb") as f:
        for part in parts:
            if isinstance(part, x509.Certificate):
                f.write(part.public_bytes(serialization.Encoding.PEM))
            else:
                f.write(
                    part.private_bytes(
                        serialization.Encoding.PEM,
                        serialization.PrivateFormat.PKCS8,
                        serialization.NoEncryption(),
                    )
                )
    return path


server_ca = issue("server CA", ca=True)
client_ca = issue("client CA", ca=True)
leaf = issue("localhost", server_ca, san="localhost")
SERVER_CA = write("server-ca.pem", server_ca[0])
CLIENT_CA = write("client-ca.pem", client_ca[0])
SERVER = write("server.pem", leaf[0], leaf[1])


def serve():
    """An HTTPS server that requires a client certificate signed by CLIENT_CA."""
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    context.load_cert_chain(SERVER)
    context.load_verify_locations(CLIENT_CA)
    context.verify_mode = ssl.CERT_REQUIRED
    context.minimum_version = context.maximum_version = TLS
    listener = socket.create_server(("127.0.0.1", 0))

    def accept():
        while True:
            conn, _ = listener.accept()
            tls = context.wrap_socket(conn, server_side=True, do_handshake_on_connect=False)
            try:
                tls.do_handshake()
            except ssl.SSLError as exc:
                print(f"server: rejected client: {exc.reason}")
            tls.close()

    threading.Thread(target=accept, daemon=True).start()
    return listener.getsockname()[1]


def free_port():
    with socket.socket() as s:
        s.bind(("127.0.0.1", 0))
        return s.getsockname()[1]


server_port = serve()
proxy_port = free_port()
mitmdump = subprocess.Popen(
    [
        "mitmdump",
        "--listen-port", str(proxy_port),
        "--set", f"confdir={WORK}",
        "--set", f"ssl_verify_upstream_trusted_ca={SERVER_CA}",
    ]
)
for _ in range(100):
    try:
        socket.create_connection(("127.0.0.1", proxy_port), timeout=0.1).close()
        break
    except OSError:
        time.sleep(0.1)

start = time.monotonic()
try:
    raw = socket.create_connection(("127.0.0.1", proxy_port), timeout=15)
    authority = f"localhost:{server_port}"
    raw.sendall(f"CONNECT {authority} HTTP/1.1\r\nHost: {authority}\r\n\r\n".encode())
    while b"\r\n\r\n" not in raw.recv(4096):
        pass
    client = ssl.create_default_context(cafile=os.path.join(WORK, "mitmproxy-ca-cert.pem"))
    tunnel = client.wrap_socket(raw, server_hostname="localhost")
    tunnel.sendall(f"GET / HTTP/1.1\r\nHost: {authority}\r\nConnection: close\r\n\r\n".encode())
    response = b""
    while chunk := tunnel.recv(65536):
        response += chunk
    outcome = response.split(b"\r\n", 1)[0].decode()
except TimeoutError:
    outcome = "no response (client timed out)"
finally:
    mitmdump.terminate()
    mitmdump.wait()
print(f"TLS {sys.argv[1] if len(sys.argv) > 1 else '1.3'}: {outcome} after {time.monotonic() - start:.1f}s")