Skip to content

gh-63284: Add support for TLS-PSK (pre-shared key) to the ssl module #103181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 22 commits into from
Nov 27, 2023
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
9d0f6dc
gh-63284: Add support for TLS-PSK (pre-shared key) to the ssl module
grantramsay Mar 29, 2023
cfddf7b
Fix TLS-PSK for TLS 1.3
grantramsay Apr 3, 2023
603eeef
Merge branch 'main' into fix-issue-63284
arhadthedev May 14, 2023
18302e3
Decode TLS-PSK identities as UTF-8 rather than ASCII
grantramsay Jun 4, 2023
2efc876
Change TLS-PSK version added from 3.12 to 3.13
grantramsay Jun 4, 2023
a56784c
ReSTify NEWS.
gpshead Jun 5, 2023
7a1963d
Merge branch 'main' into fix-issue-63284
gpshead Jul 14, 2023
6f4100c
Set python exceptions raised during C callbacks as unraisable
grantramsay Jul 15, 2023
e4a97ec
Add NULL check for defensive coding
grantramsay Jul 15, 2023
3d75982
Get single value using PyBytes_AsStringAndSize
grantramsay Jul 15, 2023
539ed1f
Do not raise a decode exception if remote side sends invalid UTF-8 du…
grantramsay Jul 16, 2023
4634fc3
Free TLS-PSK callbacks when SSL context is deallocated
grantramsay Jul 16, 2023
d21c322
Use Py_XINCREF and Py_XDECREF for tidier NULL checking
grantramsay Jul 16, 2023
03fac4d
Check return value of SSL_CTX_use_psk_identity_hint
grantramsay Jul 16, 2023
3db3921
Update TLS-PSK documentation
grantramsay Jul 16, 2023
a75f3a7
Regenerate news entry to update the timestamp
grantramsay Jul 16, 2023
851a1e5
Merge branch 'main' into fix-issue-63284
gpshead Nov 26, 2023
4c68974
Update example key strings in the doc.
gpshead Nov 26, 2023
0fb8a3e
Update TLS-PSK documentation
grantramsay Nov 26, 2023
7788589
Regenerate news entry to update the timestamp
grantramsay Nov 26, 2023
11735b9
Code defensively around `z#` vs NULL and 0 length.
gpshead Nov 27, 2023
ad8b249
Merge branch 'fix-issue-63284' of https://github.com/grantramsay/cpyt…
gpshead Nov 27, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Decode TLS-PSK identities as UTF-8 rather than ASCII
RFC4279 states these are UTF-8.
Add unit test using non-ASCII chars
  • Loading branch information
grantramsay committed Jun 4, 2023
commit 18302e3c46a10757c82f34c7c7c4310addc98f83
11 changes: 11 additions & 0 deletions Lib/test/test_ssl.py
Original file line number Diff line number Diff line change
Expand Up @@ -4259,6 +4259,17 @@ def server_callback(identity):
with self.assertRaisesRegex(ssl.SSLError, 'Cannot add PSK client callback'):
server_context.set_psk_client_callback(client_callback)

# test with UTF-8 identities
identity_hint = '身份暗示' # Translation: "Identity hint"
client_identity = '客户身份' # Translation: "Customer identity"

client_context.set_psk_client_callback(client_callback)
server_context.set_psk_server_callback(server_callback, identity_hint)
server = ThreadedEchoServer(context=server_context)
with server:
with client_context.wrap_socket(socket.socket()) as s:
s.connect((HOST, server.port))

@requires_tls_version('TLSv1_3')
def test_psk_tls1_3(self):
psk = bytes.fromhex('deadbeef')
Expand Down
4 changes: 2 additions & 2 deletions Modules/_ssl.c
Original file line number Diff line number Diff line change
Expand Up @@ -4646,7 +4646,7 @@ static unsigned int psk_client_callback(SSL *s,
}

PyObject *hint_str = (hint != NULL) ?
PyUnicode_DecodeASCII(hint, strlen(hint), "strict") :
PyUnicode_DecodeUTF8(hint, strlen(hint), "strict") :
Py_NewRef(Py_None);
if (hint_str == NULL) {
goto error;
Expand Down Expand Up @@ -4743,7 +4743,7 @@ static unsigned int psk_server_callback(SSL *s,
}

PyObject *identity_str = (identity[0] != '\0') ?
PyUnicode_DecodeASCII(identity, strlen(identity), "strict") :
PyUnicode_DecodeUTF8(identity, strlen(identity), "strict") :
Py_NewRef(Py_None);
if (identity_str == NULL) {
goto error;
Expand Down
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy