Any plans to add DTLS support? about python-mbedtls

[Synss]

As far as I can see, DTLS is fully working now. However, the tests with TLSVersion.TLSv1 do not pass anymore. I will investigate. I may nevertheless make a release with DTLS in and TLSv1 disabled in the meantime. The tests for TLSv1_1 and TLSv1_2 pass so TLS still works in principle.

[Synss]

I can give it a try and see how far I get... non-blocking IO even seems to be possible and would be really interesting.

[therealprof]

Yes, absolutely. mbedTLS is used in quite a lot of embedded devices with OSes like Zephyr (https://www.zephyrproject.org/) or ARMs own mbed OS (https://www.mbed.com/en/) for DTLS, even as a server.

If find mbedTLS to be quite a bit better than OpenSSL/LibreSSL in many regards but unfortunately the few DTLS implementations available for Python all rely on OpenSSL. 👎

[Synss]

Just to keep you updated, I am working on TLS now and for some time already. Handshake is working as well as send/recv on Python 3. On Python 2.7, handshake is working but the encrypted data do not seem to go over the socket. I do not think that certificate validation works.

Still, I am making progress.

Once TLS works reliably, I will go for DTLS.

I hope to be done by the end of the year.

[jarednm]

Any update on the status of this?

[Synss]

Hi @jarednm, TLS took longer than I thought. Recently, I have been working on creating wheels to distribute mbedtls (the C library) with mine so that pip install python-mbedtls just works. The recent 0.14 comes with 64-bit manylinux wheels.

Now DTLS is next on my list.

[Synss]

Still progressing.

[Synss]

Sorry, wrong button...

[Synss]

I have now witnessed a complete client-server DTLS handshake. Communication fails thereafter and DTLS is not usable but there is progress.

[Synss]

Now I have a working DTLS echo server. I still have to clean up and some socket-related things are not entirely clean to me. But the working echo server shows that most of the crypto (and most of the socket work) is in place.

[Synss]

One week after, I have basic DTLS fully working. Basic now means no DTLS cookie or certificate validation but handshake works reliably and a server is able to answer to several clients. Would that be good enough, I could make a release. Otherwise, I will release after cookie and certificate validation actually work—That could be a few more weeks.

[Synss]

DTLS is in 0.15.0 that I have just released. The tests for TLSv1 remain disabled: I do not understand what the problem is but I do not want to delay DTLS anymore.

Feedback is always welcome! But for now, I will close this ticket.