Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove 2nd client hello post openssl 1.1.1 bug workaround #3097

Merged
merged 4 commits into from
Oct 21, 2024
Merged

Remove 2nd client hello post openssl 1.1.1 bug workaround #3097

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c91eef4
Remove 2nd client hello post openssl 1.1.1 bug workaround
CoolCat467 Sep 29, 2024
332f111
Add newsfragment
CoolCat467 Sep 29, 2024
7f70723
Make newsfragment less wordy
CoolCat467 Sep 29, 2024
914b9e8
Merge branch 'python-trio:main' into dtls-2024
CoolCat467 Oct 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions newsfragments/3097.removal.rst
View file
Open in desktop
CoolCat467 marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Remove workaround for OpenSSL 1.1.1 DTLS ClientHello bug.
17 changes: 0 additions & 17 deletions src/trio/_dtls.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -734,23 +734,6 @@ async def handle_client_hello_untrusted(
# after all.
return

# Some old versions of OpenSSL have a bug with memory BIOs, where DTLSv1_listen
# consumes the ClientHello out of the BIO, but then do_handshake expects the
# ClientHello to still be in there (but not the one that ships with Ubuntu
# 20.04). In particular, this is known to affect the OpenSSL v1.1.1 that ships
# with Ubuntu 18.04. To work around this, we deliver a second copy of the
# ClientHello after DTLSv1_listen has completed. This is safe to do
# unconditionally, because on newer versions of OpenSSL, the second ClientHello
# is treated as a duplicate packet, which is a normal thing that can happen over
# UDP. For more details, see:
#
# https://github.com/pyca/pyopenssl/blob/e84e7b57d1838de70ab7a27089fbee78ce0d2106/tests/test_ssl.py#L4226-L4293
#
# This was fixed in v1.1.1a, and all later versions. So maybe in 2024 or so we
# can delete this. The fix landed in OpenSSL master as 079ef6bd534d2, and then
# was backported to the 1.1.1 branch as d1bfd8076e28.
stream._ssl.bio_write(packet)

# Check if we have an existing association
old_stream = endpoint._streams.get(address)
if old_stream is not None:
Expand Down
Loading