Commit 07596a89 authored by Szilárd Pfeiffer's avatar Szilárd Pfeiffer
Browse files

Merge branch '191-tls-client-hello-offers-tls-1-3-only-named-groups-in-earlier-protocol-versions' 

Closes: #191
parents 3a9577f5 2b14dc79

cryptolyzer/tls/client.py

+13 −1
Original line number Diff line number Diff line
@@ -155,6 +155,18 @@ class TlsHandshakeClientHelloSpecalization(TlsHandshakeClientHello): 


        return signature_algorithms



    @classmethod

    def _get_checkable_named_curves(cls, protocol_version_min, protocol_version_max):

        if protocol_version_max > TlsProtocolVersion(TlsVersion.TLS1_2):

            return list(TlsNamedCurve)



        return [

            named_curve

            for named_curve in TlsNamedCurve

            if (TlsProtocolVersion(named_curve.value.initial_version) <= protocol_version_max and

                TlsProtocolVersion(named_curve.value.last_version) >= protocol_version_min)

        ]



    @classmethod

    def _get_tls1_3_extensions(cls, protocol_versions, signature_algorithms_cert, key_share_curves=None):

        key_share_entries = []
@@ -192,7 +204,7 @@ class TlsHandshakeClientHelloSpecalization(TlsHandshakeClientHello): 
        if hostname is not None:

            extensions.append(TlsExtensionServerNameClient(hostname))

        if named_curves is None:

            named_curves = list(TlsNamedCurve)

            named_curves = self._get_checkable_named_curves(protocol_version_min, protocol_version_max)



        if signature_algorithms is None:

            signature_algorithms = self._get_signature_algorithms(

cryptoparser @ 81fbcd7a

Compare de8efa76 to 81fbcd7a
Original line number Diff line number Diff line 
Subproject commit de8efa76aa683a7bfec810ef661614371c120a8d
 
Subproject commit 81fbcd7a6a2b74955d854cd6326e8d98be4c5ee7

test/tls/test_client.py

+27 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ from cryptoparser.tls.extension import ( 
    TlsExtensionKeyShareServer,

    TlsExtensionSignatureAlgorithms,

    TlsExtensionSignatureAlgorithmsCert,

    TlsExtensionType,

    TlsKeyShareEntry,

    TlsNamedCurve,

)
@@ -192,6 +193,32 @@ class TestTlsHandshakeClientHello(unittest.TestCase): 
        )

        self.assertIsNotNone(client_hello)



    @staticmethod

    def _get_named_curves(protocol_version):

        client_hello = TlsHandshakeClientHelloSpecalization(

            hostname=None,

            protocol_versions=[protocol_version],

            cipher_suites=list(TlsCipherSuite),

            named_curves=None,

            signature_algorithms=None,

            extensions=[],

        )

        return client_hello.extensions.get_item_by_type(TlsExtensionType.SUPPORTED_GROUPS).elliptic_curves



    def test_named_curves_filtered_by_protocol_version(self):

        named_curves = self._get_named_curves(self._PROTOCOL_VERSION)

        self.assertIn(TlsNamedCurve.SECP256R1, named_curves)

        self.assertIn(TlsNamedCurve.GC256A, named_curves)

        self.assertNotIn(TlsNamedCurve.X25519_ML_KEM_768, named_curves)

        self.assertNotIn(TlsNamedCurve.CURVESM2, named_curves)



        named_curves = self._get_named_curves(TlsProtocolVersion(TlsVersion.TLS1))

        self.assertIn(TlsNamedCurve.SECP256R1, named_curves)

        self.assertNotIn(TlsNamedCurve.GC256A, named_curves)



        named_curves = self._get_named_curves(TlsProtocolVersion(TlsVersion.TLS1_3))

        self.assertIn(TlsNamedCurve.X25519_ML_KEM_768, named_curves)





class TestTls13ClientHelloKeyShare(unittest.TestCase):

    # pylint: disable=protected-access