python-trio / python-trio/trio
Make sure not to invalidate SSL sessions when closing with https_compatible=True
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 7.3k
- Forks
- 431
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 6
Description
Allegedly, if you use OpenSSL and close an SSL connection without sending or receiving a close-notify, then OpenSSL invalidates any negotiated session ticket. If true then this is annoying and bad. Future versions of Python might work around it, but possibly we should work around it first.
I believe this is easy: when we want to do an unclean shutdown, then tell our SSLObject to do a clean shutdown... and then throw away the bytes it gives us, instead of sending them. Gross hack, but it should work.
How do we test this? We already have a bunch of pyopenssl code for testing; maybe it gives some way to tell whether a session is successfully reused?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the https_compatible shutdown path and review the existing pyopenssl test code mentioned in the issue. Verify that an unclean close preserves SSL session reuse without sending close-notify bytes, and add a test that demonstrates successful session reuse.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100