Support password callbacks for ECH keys.

Author: ZeroIntensity

Doc/library/ssl.rst

@@ -1749,13 +1749,17 @@ to speed up repeated connections from the same clients.
 
    .. versionadded:: 3.4
 
-.. method:: SSLContext.load_ech_keys(keyfile, *, for_retry=True)
+.. method:: SSLContext.load_ech_keys(keyfile, password=None, *, for_retry=True)
 
    Load a server's Encrypted Client Hello (ECH) private key and configuration.
-   The *keyfile* must be the path to a PEM file containing an unencrypted
-   private key followed by its matching ECHConfigList. Load the server's TLS
+   The *keyfile* must be the path to a PEM file containing a private key
+   followed by its matching ECHConfigList. Load the server's TLS
    certificate and private key separately with :meth:`load_cert_chain`.
 
+   The *password* argument is used to decrypt encrypted private keys. It accepts
+   a string, bytes, bytearray, or a callable returning one of those types, as in
+   :meth:`load_cert_chain`. Passwords are never requested interactively.
+
    Each call adds keys and configurations to those already loaded into the
    context. If *for_retry* is true, the new configurations are included in
    ECH retry configurations sent to clients.

Lib/test/certdata/ech-encrypted.pem

@@ -2317,6 +2317,23 @@ def test_load_ech_keys(self):
         self.assertEqual(client.get_ech_status(),
                          ssl.ECHStatus.ECH_STATUS_SUCCESS)
 
+    @requires_ech_x25519
+    def test_load_ech_keys_password(self):
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        # ech.pem's key encrypted with:
+        # openssl pkey -in ech.pem -aes-256-cbc -passout pass:somepass
+        filename = data_file('ech-encrypted.pem')
+        for password in (KEY_PASSWORD, lambda: KEY_PASSWORD):
+            self.assertIsNone(ctx.load_ech_keys(filename, password=password))
+
+        def password_error():
+            raise ValueError('password callback failed')
+
+        with self.assertRaisesRegex(ValueError, 'password callback failed'):
+            ctx.load_ech_keys(filename, password=password_error)
+        self.assertIsNone(ctx.load_ech_keys(data_file('ech.pem'),
+                                          password=password_error))
+
     @requires_ech_x25519
     def test_ech_handshake(self):
         key, config = self.read_ech_key_and_config()

Lib/test/test_ssl.py

@@ -5442,20 +5442,14 @@ _ssl__SSLContext_set_ech_config_impl(PySSLContext *self,
 }
 
 static int
-ech_password_callback(char *buf, int size, int rwflag, void *userdata)
-{
-    /* ECH key files must be unencrypted. Never prompt for a password. */
-    return -1;
-}
-
-static int
-load_ech_keys(SSL_CTX *ctx, BIO *bio, int for_retry)
+load_ech_keys(SSL_CTX *ctx, BIO *bio, int for_retry,
+              _PySSLPasswordInfo *pw_info)
 {
     int result = 0;
     int old_keys, new_keys;
     OSSL_ECHSTORE *store = NULL;
     EVP_PKEY *key = PEM_read_bio_PrivateKey(bio, NULL,
-                                            ech_password_callback, NULL);
+                                            _password_callback, pw_info);
     if (key == NULL) {
         goto end;
     }
@@ -5488,60 +5482,80 @@ load_ech_keys(SSL_CTX *ctx, BIO *bio, int for_retry)
 }
 
 /*[clinic input]
-@critical_section
 _ssl._SSLContext.load_ech_keys
 
     keyfile: object
+    password: object = None
     *
     for_retry: bool = True
 
 Load server ECH keys and configurations from a PEM file.
 
-The file must contain an unencrypted private key followed by its
-ECHConfigList.
+The file must contain a private key followed by its ECHConfigList.
+The password argument may be a string, bytes, bytearray, or a
+callable returning one of those types. It is only needed for
+encrypted keys.
 If for_retry is true, advertise the configurations in ECH retry
 responses.
 [clinic start generated code]*/
 
 static PyObject *
 _ssl__SSLContext_load_ech_keys_impl(PySSLContext *self, PyObject *keyfile,
-                                    int for_retry)
-/*[clinic end generated code: output=8de2cc58ce2f8077 input=3e6617d346227acd]*/
+                                    PyObject *password, int for_retry)
+/*[clinic end generated code: output=73b9b4832b89f40d input=016a625a1505de4a]*/
 {
     PyObject *keyfile_bytes;
+    PyObject *ret = NULL;
+    _PySSLPasswordInfo pw_info = { NULL, NULL, NULL, 0, 0 };
     if (!PyUnicode_FSConverter(keyfile, &keyfile_bytes)) {
         return NULL;
     }
+    if (password != Py_None) {
+        if (PyCallable_Check(password)) {
+            pw_info.callable = password;
+        } else if (!_pwinfo_set(&pw_info, password,
+                                "password should be a string or callable")) {
+            goto done;
+        }
+    }
     const char *filename = PyBytes_AS_STRING(keyfile_bytes);
     int result = 0;
     int open_failed = 0;
 
     ERR_clear_error();
-    PySSL_BEGIN_ALLOW_THREADS(self)
+    PyMutex_Lock(&self->tstate_mutex);
+    PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state);
     errno = 0;
     BIO *bio = BIO_new_file(filename, "rb");
     if (bio == NULL) {
         open_failed = 1;
     }
     else {
-        result = load_ech_keys(self->ctx, bio, for_retry);
+        result = load_ech_keys(self->ctx, bio, for_retry, &pw_info);
         BIO_free(bio);
     }
-    PySSL_END_ALLOW_THREADS(self)
+    PySSL_END_ALLOW_THREADS_S(pw_info.thread_state);
+    PyMutex_Unlock(&self->tstate_mutex);
 
     if (result != 1) {
-        if (open_failed && errno != 0) {
+        if (pw_info.error) {
+            /* The password callback has already set the exception. */
+            ERR_clear_error();
+        }
+        else if (open_failed && errno != 0) {
             PyErr_SetFromErrnoWithFilenameObject(PyExc_OSError, keyfile);
             ERR_clear_error();
         }
         else {
             _setSSLError(get_state_ctx(self), NULL, 0, __FILE__, __LINE__);
         }
-        Py_DECREF(keyfile_bytes);
-        return NULL;
+        goto done;
     }
+    ret = Py_NewRef(Py_None);
+done:
+    PyMem_Free(pw_info.password);
     Py_DECREF(keyfile_bytes);
-    Py_RETURN_NONE;
+    return ret;
 }
 #endif /* HAVE_OPENSSL_ECH */