python-trio / python-trio/trio
Support TLS 1.3 post handshake auth in trio.ssl
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 7.3k
- Forks
- 431
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 6
Description
This was recently added to the stdlib ssl APIs (in 3.8-dev, and also backported to the other -dev branches), so it should be a fairly straightforward matter of wrapping the new APIs: https://github.com/python/cpython/pull/9460
One thing I'm not clear on is how you trigger the post-handshake auth cycle if you don't want to commit to writing something immediately. (e.g., because what you decide to write will depend on the success/failure of the authentication.) Maybe you call do_handshake again? (If so then we need to provide a way to call do_handshake a second time!) Or does failure kill the connection, so it doesn't matter?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at trio.ssl and compare its wrappers with the new stdlib ssl APIs described in CPython PR 9460. Resolve how an application triggers post-handshake authentication without an immediate write, including whether a second do_handshake call is required. Done means TLS 1.3 post-handshake-auth behavior is defined and exposed consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100