如何创建仅支持TLS 1.3的tlslite-ng服务器？

Question

我想用Python编写一个服务器/客户端TLS1.3脚本集。因此，我使用tlslite-ng库只有一个有TLS1.3 on board。

但是，即使我的简单代码也失败了：

#openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.pem -out certificate.pem
#
import os
import socket
#import sys
from tlslite.api import *

s = open("./certificate.pem").read()
x509 = X509()
x509.parse(s)
certChain = X509CertChain([x509])
#print (certChain)

s = open("./privateKey.pem").read()
privateKey = parsePEMKey(s, private=True)
#print (privateKey)


host = '127.0.1.1'  
port = 8888
payload = 1500
server_address = (host, port) 



def start_TLS_server():

    socket_TLS = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    socket_TLS.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    socket_TLS.bind(server_address)
    socket_TLS.listen(1)

    #synchro = synchroSocket.accept()

    connection = TLSConnection(socket_TLS)

    settings = HandshakeSettings()
    settings.minKeySize = 2048
    settings.cipherNames = ["aes256"]
    settings.minVersion = (3,1)
    connection.handshakeServer(certChain=certChain, privateKey=privateKey, reqCert=True, settings=settings)
    #connection.session.clientCertChain   # X509CertChain
    #connection.session.serverCertChain   # X509CertChain
    print(connection)

    print("TLS server is running...")

    while True:
        data = connection.read(payload)
        if not data: 
            break
        connection.write(data)

    connection.close()


if __name__ == "__main__":
    start_TLS_server()

我收到这样的错误：

root@Admin-PC:/mnt/c/Users/andre/Documents/Visual Studio Code/Projects/SSNProject/TLSvsNPF# python3 TLSserver.py
<tlslite.tlsconnection.TLSConnection object at 0x7f0c9142fe48>
Traceback (most recent call last):
  File "TLSserver.py", line 89, in <module>
    start_TLS_server()
  File "TLSserver.py", line 58, in start_TLS_server
    connection.handshakeServer(certChain=certChain, privateKey=privateKey, reqCert=True, settings=settings)
  File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 1191, in handshakeServer
    nextProtos=nextProtos, anon=anon, alpn=alpn, sni=sni):
  File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 1220, in handshakeServerAsync
    for result in self._handshakeWrapperAsync(handshaker, checker):
  File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 2216, in _handshakeWrapperAsync
    for result in handshaker:
  File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 1262, in _handshakeServerAsyncHelper
    anon, alpn, sni):
  File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 1485, in _serverGetClientHello
    HandshakeType.client_hello):
  File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsrecordlayer.py", line 657, in _getMsg
    for result in self._getNextRecord():
  File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsrecordlayer.py", line 829, in _getNextRecord
    for result in self._getNextRecordFromSocket():
  File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsrecordlayer.py", line 853, in _getNextRecordFromSocket
    for result in self._recordLayer.recvRecord():
  File "/usr/local/lib/python3.5/dist-packages/tlslite/recordlayer.py", line 695, in recvRecord
    for result in self._recordSocket.recv():
  File "/usr/local/lib/python3.5/dist-packages/tlslite/recordlayer.py", line 188, in recv
    for record in self._recvHeader():
  File "/usr/local/lib/python3.5/dist-packages/tlslite/recordlayer.py", line 122, in _recvHeader
    for result in self._sockRecvAll(1):
  File "/usr/local/lib/python3.5/dist-packages/tlslite/recordlayer.py", line 99, in _sockRecvAll
    socketBytes = self.sock.recv(length - len(buf))
  File "/usr/local/lib/python3.5/dist-packages/tlslite/bufferedsocket.py", line 54, in recv
    return self.socket.recv(bufsize)
OSError: [Errno 107] Transport endpoint is not connected
root@Admin-PC:/mnt/c/Users/andre/Documents/Visual Studio Code/Projects/SSNProject/TLSvsNPF#

您可能已经注意到我使用的是Windows 10的Linux子系统Ubuntu 16.04 LTS。我明白错误是在证书的某个地方，但不清楚在哪里......有什么建议吗？

谢谢

Answer 1

OSError：[Errno 107]传输端点未连接

你需要在监听套接字上调用accept()以获取包装TLSConnection的套接字和连接信息。

有关示例，请参阅tlstest.py。

请注意，您需要使用tls-1.3分支来存在TLS 1.3支持，并且aes256密码与TLS 1.3不兼容（aes256是用于CBC模式密码的名称，没有为TLS 1.3定义CBC模式密码，您需要使用aes256gcm或其他AEAD密码之一）