pyopenssl has the following test in its testsuite which breaks:
def test_client_receives_servers_data(self) -> None:
"""
The data the server sends in its callback is received by the client.
"""
calls = []
def server_callback(*args: object, **kwargs: object) -> bytes:
return self.sample_ocsp_data
def client_callback(
conn: Connection, ocsp_data: bytes, ignored: None
) -> bool:
calls.append(ocsp_data)
return True
client = self._client_connection(callback=client_callback, data=None)
server = self._server_connection(callback=server_callback, data=None)
handshake_in_memory(client, server)
assert len(calls) == 1
> assert calls[0] == self.sample_ocsp_data
E AssertionError: assert b'' == b'this is totally ocsp data'
E
E Full diff:
E - (b'this is totally ocsp data')
E + b''
tests/test_ssl.py:4640: AssertionError
This is broken since commit b1b4b15 ("Add support for TLS 1.3 OCSP multi-stapling for server certs"). This is still broken on the current 3.6 branch.
The callback is assigned via SSL_CTX_set_tlsext_status_cb().
The client reads the OCSP data via SSL_get_tlsext_status_ocsp_resp() and the server writes with SSL_set_tlsext_status_ocsp_resp().
Is it reasonable to send a string or does it have to be something that is returned by OCSP_response_create()?
I don't see much that is different while looking at SSL_TEST_CERT_STATUS_GOOD_RESPONSE_EXT in test/helpers/handshake.c
Sebastian
pyopenssl has the following test in its testsuite which breaks:
This is broken since commit b1b4b15 ("Add support for TLS 1.3 OCSP multi-stapling for server certs"). This is still broken on the current 3.6 branch.
The callback is assigned via SSL_CTX_set_tlsext_status_cb().
The client reads the OCSP data via SSL_get_tlsext_status_ocsp_resp() and the server writes with SSL_set_tlsext_status_ocsp_resp().
Is it reasonable to send a string or does it have to be something that is returned by OCSP_response_create()?
I don't see much that is different while looking at SSL_TEST_CERT_STATUS_GOOD_RESPONSE_EXT in test/helpers/handshake.c
Sebastian