This repository was archived by the owner on Apr 26, 2024. It is now read-only.
Repository navigation
This repository was archived by the owner on Apr 26, 2024. It is now read-only.
adopt new Twisted TLS APIs #1691
Description
The code in Synapse uses a subclass of ssl.ContextFactory with some manual OpenSSL setup.
Twisted will do quite a lot of this for you (more every day!) and can handle several things that it looks like Synapse isn't doing right now, like service identity validation and sending server name indication.
The relevant APIs are:
- Implement
twisted.internet.interfaces.IOpenSSLClientConnectionCreatorortwisted.internet.interfaces.IOpenSSLServerConnectionCreatorrather than subclassingContextFactoryif you need to do your own thing. - Consider using
optionsForClientTLSfor clients, orCertificateOptions(sorry - horrible class name there, I know) for servers, if the default behavior is good enough.
Activity
krombel commentedon Oct 9, 2017
FTR: This would also make it easy to implement http2-connections - e.g. server2server
Add a comment re #1691
richvdh commentedon Sep 21, 2020
We've updated the client side now, but still subclass ContextFactory for Server-side connections.
Merge commit '4325be1a5' into anoa/dinsic_release_1_21_x