Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

irc.connection.Factory.connect should support ssl.SSLContext.wrap_socket with the server_hostname parameter #216

Closed
bd808 opened this issue Oct 2, 2023 · 1 comment · Fixed by #221

Comments

@bd808
Copy link
Contributor

bd808 commented Oct 2, 2023

ssl.wrap_socket is the currently recommended helper for adding SSL/TLS support when using the library. ssl.wrap_socket usage however has been deprecated since Python 3.2. Instead clients are encouraged to use an instance of ssl.SSLContext and its wrap_socket method .

Per https://ircv3.net/docs/sni.html, IRCv3 capable clients must use SNI when connecting via TLS. ssl.SSLContext.wrap_socket is able to perform SNI negotiation and server certificate validation when it is called with a server_hostname parameter, but will error out with "ValueError: check_hostname requires server_hostname" or similar when server_hostname is omitted. The workaround for this is to set check_hostname = False and verify_mode = ssl.CERT_NONE on the ssl.SSLContext instance, but this also violates the IRCv3 spec and introduces man-in-the-middle potential for the TLS secured connection.

@jaraco
Copy link
Owner

jaraco commented Dec 25, 2023

Sounds good. Would you be willing to implement a patch?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants