Index: trunk/lib/bletchley/ssltls.py
===================================================================
--- trunk/lib/bletchley/ssltls.py	(revision 129)
+++ trunk/lib/bletchley/ssltls.py	(revision 130)
@@ -2,5 +2,5 @@
 Utilities for manipulating certificates and SSL/TLS connections.
 
-Copyright (C) 2014,2016 Blindspot Security LLC
+Copyright (C) 2014,2016,2017 Blindspot Security LLC
 Author: Timothy D. Morgan
 
@@ -22,4 +22,5 @@
 import traceback
 import random
+import time
 import socket
 try:
@@ -74,5 +75,12 @@
     if mode == 'client':
         conn.set_connect_state()
-        conn.do_handshake()
+        # This hokey crap is required because OpenSSL wants you to poll rather than just block
+        # XXX: tie this sleep time into the timeout parameter
+        for tries in range(0,10):
+            try:
+                conn.do_handshake()
+                break
+            except OpenSSL.SSL.WantReadError as e:
+                time.sleep(0.1)
     else:
         conn.set_accept_state()
@@ -82,16 +90,16 @@
 
 def ConnectSSLTLS(host, port, cipher_list=None, timeout=None, handshake_callback=None, verbose=True):
-    backup_cipher_list = b'DES-CBC3-SHA:RC4-MD5:RC4-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ADH-AES256-GCM-SHA384'
-    protocols = [("SSL 2/3", SSL.SSLv23_METHOD, None),
+    backup_cipher_list = b'DES-CBC3-SHA:RC4-MD5:RC4-SHA:AES128-SHA:AES256-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ADH-AES256-GCM-SHA384'
+    protocols = [("SSL 2/3", SSL.SSLv23_METHOD, cipher_list),
                  ("SSL 2/3", SSL.SSLv23_METHOD, backup_cipher_list),
-                 ("TLS 1.0", SSL.TLSv1_METHOD, None),
+                 ("TLS 1.0", SSL.TLSv1_METHOD, cipher_list),
                  ("TLS 1.0", SSL.TLSv1_METHOD, backup_cipher_list), 
-                 ("TLS 1.1", SSL.TLSv1_1_METHOD, None),
+                 ("TLS 1.1", SSL.TLSv1_1_METHOD, cipher_list),
                  ("TLS 1.1", SSL.TLSv1_1_METHOD, backup_cipher_list),
-                 ("TLS 1.2", SSL.TLSv1_2_METHOD, None),
+                 ("TLS 1.2", SSL.TLSv1_2_METHOD, cipher_list),
                  ("TLS 1.2", SSL.TLSv1_2_METHOD, backup_cipher_list),
-                 ("SSL 3.0", SSL.SSLv3_METHOD, None),
+                 ("SSL 3.0", SSL.SSLv3_METHOD, cipher_list),
                  ("SSL 3.0", SSL.SSLv3_METHOD, backup_cipher_list),
-                 ("SSL 2.0", SSL.SSLv2_METHOD, None),
+                 ("SSL 2.0", SSL.SSLv2_METHOD, cipher_list),
                  ("SSL 2.0", SSL.SSLv2_METHOD, backup_cipher_list)]
 
@@ -124,7 +132,8 @@
         except SSL.Error as e:
             if verbose:
-                sys.stderr.write("Exception during %s handshake with server." % pname)
+                sys.stderr.write("Exception during %s handshake with server. (%s)" % (pname, e))
+                #traceback.print_exc(file=sys.stderr)
                 sys.stderr.write("\nThis could happen because the server requires "
-                                 "certain SSL/TLS versions or a client certificiate."
+                                 "certain SSL/TLS versions or a client certificate."
                                  "  Have no fear, we'll keep trying...\n")
         except Exception as e:
