TLSServerAutomaton in tls1.3 of Scapy v2.6.1 cannot save_ticket(TLS13NewSessionTicket)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 12.6k
- Forks
- 2.2k
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 56
Description
Brief description
Using TLSServerAutomaton in tls1.3 of Scapy v2.6.1, after client access, TLS13NewSessionTicket cannot be saved to a file.
Scapy version
2.6.1
Python version
3.13
Operating system
windows11
Additional environment information
No response
How to reproduce
Start a tls server using the following code
tls13_s = TLSServerAutomaton(
**ssl_config,
handle_session_ticket=True,
session_ticket_file='./server_ticket.b'
)
tls13_s.run()
Check the following code.In some cases, TLS13NewSessionTicket may be added to "self.tls_session.post_handshake_messages", and is it necessary to check "self.tls_session.post_handshake_messages" when save_ticket?
class TLS13NewSessionTicket(_TLSHandshake):
def tls_session_update(self, msg_str):
"""
Covers both post_build- and post_dissection- context updates.
"""
# RFC8446 sect 4.4.1
# "Note, however, that subsequent post-handshake authentications do not
# include each other, just the messages through the end of the main
# handshake."
if self.tls_session.post_handshake:
self.tls_session.post_handshake_messages.append(msg_str)
else:
self.tls_session.handshake_messages.append(msg_str)
self.tls_session.handshake_messages_parsed.append(self)
class TLSServerAutomaton(_TLSAutomaton):
@ATMT.condition(ADDED_SERVERDATA)
def should_send_ServerData(self):
if self.session_ticket_file:
save_ticket = False
for p in self.buffer_out:
if isinstance(p, TLS13):
# Check if there's a NewSessionTicket to send
save_ticket = all(map(lambda x: isinstance(x, TLS13NewSessionTicket), # noqa: E501
p.inner.msg))
if save_ticket:
break
self.flush_records()
if self.session_ticket_file and save_ticket:
# Loop backward in message send to retrieve the parsed
# NewSessionTicket. This message is not completely build before the
# flush_records() call. Other way to build this message before ?
for p in reversed(self.cur_session.handshake_messages_parsed):
if isinstance(p, TLS13NewSessionTicket):
self.save_ticket(p)
break
raise self.SENT_SERVERDATA()
Actual result
TLS13NewSessionTicket cannot be saved to a file
Expected result
TLS13NewSessionTicket can be saved to a file
Related resources
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing TLSServerAutomaton.should_send_ServerData and TLS13NewSessionTicket.tls_session_update, focusing on where post_handshake_messages and handshake_messages_parsed are populated. Reproduce the TLSServerAutomaton configuration from the issue on Python 3.13, then verify that a TLS13NewSessionTicket is saved to session_ticket_file after client access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100