How to create a tlslite-ng server with TLS 1.3 support only? - ssl

Question

I would like to write a server/client TLS1.3 set of scripts in Python. Therefore, I use tlslite-ng library as only one which has TLS1.3 on board.
However, even my simple code fails:
#openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.pem -out certificate.pem
#
import os
import socket
#import sys
from tlslite.api import *
s = open("./certificate.pem").read()
x509 = X509()
x509.parse(s)
certChain = X509CertChain([x509])
#print (certChain)
s = open("./privateKey.pem").read()
privateKey = parsePEMKey(s, private=True)
#print (privateKey)
host = '127.0.1.1'
port = 8888
payload = 1500
server_address = (host, port)
def start_TLS_server():
socket_TLS = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
socket_TLS.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
socket_TLS.bind(server_address)
socket_TLS.listen(1)
#synchro = synchroSocket.accept()
connection = TLSConnection(socket_TLS)
settings = HandshakeSettings()
settings.minKeySize = 2048
settings.cipherNames = ["aes256"]
settings.minVersion = (3,1)
connection.handshakeServer(certChain=certChain, privateKey=privateKey, reqCert=True, settings=settings)
#connection.session.clientCertChain # X509CertChain
#connection.session.serverCertChain # X509CertChain
print(connection)
print("TLS server is running...")
while True:
data = connection.read(payload)
if not data:
break
connection.write(data)
connection.close()
if __name__ == "__main__":
start_TLS_server()
I'm getting error like this:
root#Admin-PC:/mnt/c/Users/andre/Documents/Visual Studio Code/Projects/SSNProject/TLSvsNPF# python3 TLSserver.py
<tlslite.tlsconnection.TLSConnection object at 0x7f0c9142fe48>
Traceback (most recent call last):
File "TLSserver.py", line 89, in <module>
start_TLS_server()
File "TLSserver.py", line 58, in start_TLS_server
connection.handshakeServer(certChain=certChain, privateKey=privateKey, reqCert=True, settings=settings)
File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 1191, in handshakeServer
nextProtos=nextProtos, anon=anon, alpn=alpn, sni=sni):
File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 1220, in handshakeServerAsync
for result in self._handshakeWrapperAsync(handshaker, checker):
File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 2216, in _handshakeWrapperAsync
for result in handshaker:
File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 1262, in _handshakeServerAsyncHelper
anon, alpn, sni):
File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsconnection.py", line 1485, in _serverGetClientHello
HandshakeType.client_hello):
File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsrecordlayer.py", line 657, in _getMsg
for result in self._getNextRecord():
File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsrecordlayer.py", line 829, in _getNextRecord
for result in self._getNextRecordFromSocket():
File "/usr/local/lib/python3.5/dist-packages/tlslite/tlsrecordlayer.py", line 853, in _getNextRecordFromSocket
for result in self._recordLayer.recvRecord():
File "/usr/local/lib/python3.5/dist-packages/tlslite/recordlayer.py", line 695, in recvRecord
for result in self._recordSocket.recv():
File "/usr/local/lib/python3.5/dist-packages/tlslite/recordlayer.py", line 188, in recv
for record in self._recvHeader():
File "/usr/local/lib/python3.5/dist-packages/tlslite/recordlayer.py", line 122, in _recvHeader
for result in self._sockRecvAll(1):
File "/usr/local/lib/python3.5/dist-packages/tlslite/recordlayer.py", line 99, in _sockRecvAll
socketBytes = self.sock.recv(length - len(buf))
File "/usr/local/lib/python3.5/dist-packages/tlslite/bufferedsocket.py", line 54, in recv
return self.socket.recv(bufsize)
OSError: [Errno 107] Transport endpoint is not connected
root#Admin-PC:/mnt/c/Users/andre/Documents/Visual Studio Code/Projects/SSNProject/TLSvsNPF#
As you may notice I am on Windows 10's Linux subsutem Ubuntu 16.04 LTS. I understand that mistake is somewhere in certificates but it is not clear where... Any suggestions?
Thank you

Answer 1

OSError: [Errno 107] Transport endpoint is not connected
you need to call accept() on the listening socket to get the socket and connection info which you wrap TLSConnection around.
See tlstest.py for an example.
Do note that you need to use the tls-1.3 branch for the TLS 1.3 support to be present, and aes256 cipher is incompatible with TLS 1.3 (aes256 is a name used for CBC mode cipher, no CBC mode ciphers are defined for TLS 1.3, you need to use aes256gcm or one of the other AEAD ciphers)