Server: Elegant way to handle wrong client identity?

[mprt]

I'm trying to properly refuse a connection when the client_identity is not in the list.

For now, I'm generating a random psk as workaround and catch the SSLError that is raised on a PSK mismatch:

import string
from random import choice

def psk_resolution(identity):
    try:
        psk = PSK_LIST[identity]
    except KeyError:
        allchar = string.ascii_letters + string.punctuation + string.digits
        psk = ("".join(choice(allchar) for x in range(40)))
    return psk

Is there a more elegant solution?

[drbild]

Just returning None or the empty string should suffice.

See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_psk_client_callback.html

[mprt]

Ah, I overlooked the most obvious solutions.

Empty String works fine. When using None, the server raises a SystemError instead of the expected SSLError, but that's also perfectly fine for my case.

Thanks for the quick reply and for the hint to the important parts of the documentation!

[drbild]

Glad that worked!