Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect call to SSL_CTX_set_session_id_context on client side SSL context #105293

Closed
grantramsay opened this issue Jun 4, 2023 · 1 comment
Closed
Assignees
Labels
type-bug An unexpected behavior, bug, or error

Comments

@grantramsay
Copy link
Contributor

grantramsay commented Jun 4, 2023

When initialising an SSLContext there is a call to SSL_CTX_set_session_id_context():

#define SID_CTX "Python"
    SSL_CTX_set_session_id_context(self->ctx, (const unsigned char *) SID_CTX,
                                   sizeof(SID_CTX));
#undef SID_CTX

The openssl man pages state that SSL_CTX_set_session_id_context is a "server side only" operation:
https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_set_session_id_context.html

SSL_CTX_set_session_id_context, SSL_set_session_id_context - set context within which session can be reused (server side only)

The session id context becomes part of the session. The session id context is set by the SSL/TLS server. The SSL_CTX_set_session_id_context() and SSL_set_session_id_context() functions are therefore only useful on the server side.

In some circumstances, calling this on a client side socket can result in unexpected behavior. For example TLSv1.3 PSK: #103181 (comment)

The fix for this was originally part of another PR (#103181) @gpshead recommended creating a separate issue/PR

Linked PRs

@grantramsay grantramsay added the type-bug An unexpected behavior, bug, or error label Jun 4, 2023
grantramsay added a commit to grantramsay/cpython that referenced this issue Jun 4, 2023
… side SSL context

Openssl states this is a "server side only" operation.
Calling this on a client side socket can result in unexpected behavior
@gpshead gpshead self-assigned this Jun 5, 2023
grantramsay added a commit to grantramsay/cpython that referenced this issue Jul 14, 2023
… side SSL context

Openssl states this is a "server side only" operation.
Calling this on a client side socket can result in unexpected behavior
gpshead pushed a commit that referenced this issue Jul 14, 2023
…SSL context (#105295)

* gh-105293: Do not call SSL_CTX_set_session_id_context on client side SSL context

Openssl states this is a "server side only" operation.
Calling this on a client side socket can result in unexpected behavior

* Add news entry on SSL "set session id context" changes
@gpshead
Copy link
Member

gpshead commented Jul 14, 2023

While we could backport this to releases, unless it's actually causing a problem there (the issue has existed forever it seems) lets not bother. It seems most important for your new feature PR.

@gpshead gpshead closed this as completed Jul 14, 2023
kgdiem pushed a commit to kgdiem/cpython that referenced this issue Jul 14, 2023
… side SSL context (python#105295)

* pythongh-105293: Do not call SSL_CTX_set_session_id_context on client side SSL context

Openssl states this is a "server side only" operation.
Calling this on a client side socket can result in unexpected behavior

* Add news entry on SSL "set session id context" changes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-bug An unexpected behavior, bug, or error
Projects
None yet
Development

No branches or pull requests

2 participants