I implemented a TCP socket client/server for a service I want to run on a virtual machine.
Furthermore, I want to encrypt the data transfer in both directions using the python library ssl. Currently, my code looks like this:
Server:
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
context.set_ciphers('ECDHE-ECDSA-AES256-GCM-SHA384')
context.load_cert_chain(certfile="cert.pem", keyfile="prKey.pem")
tcpsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
tcpsock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
tcpsock.bind((ip, port))
ssocket = context.wrap_socket(tcpsock, server_side=True)
Client:
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
context.verify_mode = ssl.CERT_REQUIRED
context.check_hostname = True
context.load_verify_locations("cert.pem")
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ssock = context.wrap_socket(sock, server_hostname=server_ip)
I generated my private key + self-signed certificate with OpenSSL.
I recently met someone who seemed to know about encryption (I´m new to this topic), hence I asked him quite a lot about my code. He told me that TLS normally only encrypts traffic one way and that I needed mutual TLS, which is more complicated. Since he was not a python developer he could not give me specific advice for my code, so I searched on the internet and inside the SSL documentation.
I don´t know if this is an obvious/stupid question but I could not find a simple answer for if my server/client connection is encrypted from both sides.
I also used wireshark to track the traffic of my client/server:
I´m not sure how to interpret the output but every two lines the protocol says TLSv1.3 (in the dropdown description it says TLS 1.2 which should be correct regarding the chosen cipher) while in the other lines it says TCP. Does this mean that only one side uses TLS while the other side sends its data unencrypted?
Right now both (server and client) run on my localhost, later the server will be implemented on a virtual machine in my network.