Skip to content

Commit c91eef4

Browse files
committed
Remove 2nd client hello post openssl 1.1.1 bug workaround
1 parent 4e979bf commit c91eef4

File tree

1 file changed

+0
-17
lines changed

1 file changed

+0
-17
lines changed

src/trio/_dtls.py

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -738,23 +738,6 @@ async def handle_client_hello_untrusted(
738738
# after all.
739739
return
740740

741-
# Some old versions of OpenSSL have a bug with memory BIOs, where DTLSv1_listen
742-
# consumes the ClientHello out of the BIO, but then do_handshake expects the
743-
# ClientHello to still be in there (but not the one that ships with Ubuntu
744-
# 20.04). In particular, this is known to affect the OpenSSL v1.1.1 that ships
745-
# with Ubuntu 18.04. To work around this, we deliver a second copy of the
746-
# ClientHello after DTLSv1_listen has completed. This is safe to do
747-
# unconditionally, because on newer versions of OpenSSL, the second ClientHello
748-
# is treated as a duplicate packet, which is a normal thing that can happen over
749-
# UDP. For more details, see:
750-
#
751-
# https://github.com/pyca/pyopenssl/blob/e84e7b57d1838de70ab7a27089fbee78ce0d2106/tests/test_ssl.py#L4226-L4293
752-
#
753-
# This was fixed in v1.1.1a, and all later versions. So maybe in 2024 or so we
754-
# can delete this. The fix landed in OpenSSL master as 079ef6bd534d2, and then
755-
# was backported to the 1.1.1 branch as d1bfd8076e28.
756-
stream._ssl.bio_write(packet)
757-
758741
# Check if we have an existing association
759742
old_stream = endpoint._streams.get(address)
760743
if old_stream is not None:

0 commit comments

Comments
 (0)