File tree Expand file tree Collapse file tree 3 files changed +31
-2
lines changed Expand file tree Collapse file tree 3 files changed +31
-2
lines changed Original file line number Diff line number Diff line change @@ -2003,6 +2003,12 @@ to speed up repeated connections from the same clients.
2003
2003
2004
2004
Setting ``callback `` to :const: `None ` removes any existing callback.
2005
2005
2006
+ .. note ::
2007
+ When using TLS 1.3:
2008
+
2009
+ - the ``hint `` parameter is always :const: `None `.
2010
+ - the OpenSSL implementation requires client-identity to be a non-empty string.
2011
+
2006
2012
Example usage::
2007
2013
2008
2014
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
@@ -2041,6 +2047,9 @@ to speed up repeated connections from the same clients.
2041
2047
2042
2048
The parameter ``identity_hint `` is an optional identity hint sent to the client.
2043
2049
2050
+ .. note ::
2051
+ When using TLS 1.3 the ``identity_hint `` parameter is not sent to the client.
2052
+
2044
2053
Example usage::
2045
2054
2046
2055
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
Original file line number Diff line number Diff line change @@ -4252,6 +4252,22 @@ def server_callback(identity):
4252
4252
with client_context .wrap_socket (socket .socket ()) as s :
4253
4253
s .connect ((HOST , server .port ))
4254
4254
4255
+ # works with TLS 1.3, although identity_hint is not sent to client
4256
+ client_context .maximum_version = ssl .TLSVersion .TLSv1_3
4257
+ client_context .minimum_version = ssl .TLSVersion .TLSv1_3
4258
+ server_context .maximum_version = ssl .TLSVersion .TLSv1_3
4259
+ server_context .minimum_version = ssl .TLSVersion .TLSv1_3
4260
+
4261
+ def client_callback (hint ):
4262
+ self .assertIsNone (hint )
4263
+ return client_identity , psk
4264
+
4265
+ client_context .set_psk_client_callback (client_callback )
4266
+ server = ThreadedEchoServer (context = server_context )
4267
+ with server :
4268
+ with client_context .wrap_socket (socket .socket ()) as s :
4269
+ s .connect ((HOST , server .port ))
4270
+
4255
4271
# adding client callback to server or vice versa raises an exception
4256
4272
with self .assertRaisesRegex (ssl .SSLError , 'Cannot add PSK server callback' ):
4257
4273
client_context .set_psk_server_callback (server_callback , identity_hint )
Original file line number Diff line number Diff line change @@ -3171,10 +3171,14 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
3171
3171
usage for no cost at all. */
3172
3172
SSL_CTX_set_mode (self -> ctx , SSL_MODE_RELEASE_BUFFERS );
3173
3173
3174
+ /* Setting the session id context is a server-side only operation.
3175
+ * It can cause unexpected behaviour on client-side connections. */
3176
+ if (proto_version == PY_SSL_VERSION_TLS_SERVER ) {
3174
3177
#define SID_CTX "Python"
3175
- SSL_CTX_set_session_id_context (self -> ctx , (const unsigned char * ) SID_CTX ,
3176
- sizeof (SID_CTX ));
3178
+ SSL_CTX_set_session_id_context (self -> ctx , (const unsigned char * ) SID_CTX ,
3179
+ sizeof (SID_CTX ));
3177
3180
#undef SID_CTX
3181
+ }
3178
3182
3179
3183
params = SSL_CTX_get0_param (self -> ctx );
3180
3184
/* Improve trust chain building when cross-signed intermediate
You can’t perform that action at this time.
0 commit comments