apple / swift-nio-ssl

TLS Support for SwiftNIO, based on BoringSSL.
https://swiftpackageindex.com/apple/swift-nio-ssl/main/documentation/niossl
Apache License 2.0
393 stars 143 forks source link

Modify TLS PSK API to handle the case when no hint is provided by the server #452

Closed martialln closed 3 months ago

martialln commented 11 months ago

Hello,

As I was trying to implement some HTTP calls using async-http-client and TLS-PSK authentication, I realised that my server was not sending any PSK hint.

The actual implementation of the clientPSKCallback makes the server psk hint mandatory. Similarly the implementation of the serverPSKCallback makes the server hint mandatory.

Reading RFC4279 it seems that on the opposite the server psk hint should be provided only on application that mandate it.

5.2. Identity Hint In the absence of an application profile specification specifying otherwise, servers SHOULD NOT provide an identity hint and clients MUST ignore the identity hint field. Applications that do use this field MUST specify its contents, how the value is chosen by the TLS server, and what the TLS client is expected to do with the value.

I made this PR to provide an empty string to the callbacks in the case the server doesn't provide one. Providing an optional might be a better solution in term of semantic but it would break the API.

martialln commented 11 months ago

@Lukasa thanks for your feedback.

I agree with you that deprecating the current API and proposing a new one is better on the long term but I was not confortable proposing it directly :)

I will rework the PR in that direction.

martialln commented 4 months ago

Hello @Lukasa I finally took some time to rework this MR.

I followed your guidance to deprecate the old properties and create new ones replacing the parameters by a struct so we may add more information later without breaking the API if necessary.

Let me know how it looks to you.

Thanks

martialln commented 3 months ago

Thank you for the feedbacks @Lukasa I have applied your suggestions.

Lukasa commented 3 months ago

@swift-server-bot test this please

Lukasa commented 3 months ago

Thank you for your contribution!

martialln commented 3 months ago

Thank you for your patience and your reviews