openssl / openssl/openssl

Allow returning PSK server callback result through a callback

Open
#19,358 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

triaged: feature
Dominant language
C
Stars
30.8k
Forks
11.5k
Avg merge
10m
Merged PRs (30d)
1

Description

For TLS PKS, it is possible to set a callback on the server side using: SSL_CTX_set_psk_server_callback:

https://github.com/openssl/openssl/blob/1ec0acf264652bd981e95842723e5414d634cd93/include/openssl/ssl.h.in#L827-L832

However, the expectation is, that the callback can provide the PSK immediately. Having the PSK stored in some kind of database, this would require additional networking operations, which might block the call, and so the communication, and possibly the I/O loop of an application.

In order to support a model like this, it would be helpful if there would be a way which receives identity plus another callback (as input) which is used to report back the outcome of the operation. This way, it would be possible to postpone returning the result, without blocking anything.

Something like:

typedef void (*SSL_psk_server_async_result_cb_func)(SSL *ssl, unsigned char *psk, unsigned int psk_len);
typedef unsigned int (*SSL_psk_server_async_cb_func)(SSL *ssl, 
                                                const char *identity, 
                                                SSL_psk_server_async_result_cb_func result_cb); 
 void SSL_set_psk_server_callback_async(SSL *ssl, SSL_psk_server_async_cb_func cb); 

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the SSL_CTX_set_psk_server_callback declaration in include/openssl/ssl.h.in and trace the existing server-side PSK callback path. Define how the proposed identity and result callbacks would defer PSK retrieval without blocking the TLS or application I/O loop; the work is done when the asynchronous outcome can be reported through the public API.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.