python / python/cpython

ALPN values are not limited to ASCII

Open
#91,763 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

topic-SSL type-bug
Dominant language
Python
Stars
77.2k
Forks
36k
PR merge metrics
PR metrics pending

Description

According to ALPN Identification Sequence, Python should accordingly not confine ALPN values to ASCII strings in https://github.com/python/cpython/blob/1c8b3b5d66a629258f1db16939b996264a8b9c37/Lib/ssl.py#L565-L575 and https://github.com/python/cpython/blob/1c8b3b5d66a629258f1db16939b996264a8b9c37/Modules/_ssl.c#L2064-L2081

The OpenJDK proposed to use "latin-1" encoding instead of ASCII. However, @jlaine views this workaround as a hack and suggests a more agreeable and maintainable solution https://github.com/aiortc/aioquic/pull/275#issuecomment-1092579877 .

Therefore, which is the more ideal solution, or another better fix?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the ALPN Identification Sequence specification and inspect the validation paths in Lib/ssl.py at lines 565-575 and Modules/_ssl.c at lines 2064-2081. Review the linked OpenJDK proposal and aioquic discussion before choosing an approach. Done means the implementation follows the permitted ALPN value encoding and has corresponding coverage for the affected paths.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.