1
2
3
4
5
6
7 """Class for setting handshake parameters."""
8
9 from .constants import CertificateType
10 from .utils import cryptomath
11 from .utils import cipherfactory
12
13
14
15 CIPHER_NAMES = ["rc4", "aes256", "aes128", "3des"]
16 MAC_NAMES = ["sha"]
17 CIPHER_IMPLEMENTATIONS = ["openssl", "pycrypto", "python"]
18 CERTIFICATE_TYPES = ["x509"]
19
21 """This class encapsulates various parameters that can be used with
22 a TLS handshake.
23 @sort: minKeySize, maxKeySize, cipherNames, macNames, certificateTypes,
24 minVersion, maxVersion
25
26 @type minKeySize: int
27 @ivar minKeySize: The minimum bit length for asymmetric keys.
28
29 If the other party tries to use SRP, RSA, or Diffie-Hellman
30 parameters smaller than this length, an alert will be
31 signalled. The default is 1023.
32
33 @type maxKeySize: int
34 @ivar maxKeySize: The maximum bit length for asymmetric keys.
35
36 If the other party tries to use SRP, RSA, or Diffie-Hellman
37 parameters larger than this length, an alert will be signalled.
38 The default is 8193.
39
40 @type cipherNames: list
41 @ivar cipherNames: The allowed ciphers, in order of preference.
42
43 The allowed values in this list are 'aes256', 'aes128', '3des', and
44 'rc4'. If these settings are used with a client handshake, they
45 determine the order of the ciphersuites offered in the ClientHello
46 message.
47
48 If these settings are used with a server handshake, the server will
49 choose whichever ciphersuite matches the earliest entry in this
50 list.
51
52 NOTE: If '3des' is used in this list, but TLS Lite can't find an
53 add-on library that supports 3DES, then '3des' will be silently
54 removed.
55
56 The default value is ['rc4', 'aes256', 'aes128', '3des'].
57
58 @type macNames: list
59 @ivar macNames: The allowed MAC algorithms.
60
61 The allowed values in this list are 'sha' and 'md5'.
62
63 The default value is ['sha'].
64
65
66 @type certificateTypes: list
67 @ivar certificateTypes: The allowed certificate types, in order of
68 preference.
69
70 The only allowed certificate type is 'x509'. This list is only used with a
71 client handshake. The client will advertise to the server which certificate
72 types are supported, and will check that the server uses one of the
73 appropriate types.
74
75
76 @type minVersion: tuple
77 @ivar minVersion: The minimum allowed SSL/TLS version.
78
79 This variable can be set to (3,0) for SSL 3.0, (3,1) for
80 TLS 1.0, or (3,2) for TLS 1.1. If the other party wishes to
81 use a lower version, a protocol_version alert will be signalled.
82 The default is (3,0).
83
84 @type maxVersion: tuple
85 @ivar maxVersion: The maximum allowed SSL/TLS version.
86
87 This variable can be set to (3,0) for SSL 3.0, (3,1) for
88 TLS 1.0, or (3,2) for TLS 1.1. If the other party wishes to
89 use a higher version, a protocol_version alert will be signalled.
90 The default is (3,2). (WARNING: Some servers may (improperly)
91 reject clients which offer support for TLS 1.1. In this case,
92 try lowering maxVersion to (3,1)).
93
94 @type useExperimentalTackExtension: bool
95 @ivar useExperimentalTackExtension: Whether to enabled TACK support.
96
97 Note that TACK support is not standardized by IETF and uses a temporary
98 TLS Extension number, so should NOT be used in production software.
99 """
101 self.minKeySize = 1023
102 self.maxKeySize = 8193
103 self.cipherNames = CIPHER_NAMES
104 self.macNames = MAC_NAMES
105 self.cipherImplementations = CIPHER_IMPLEMENTATIONS
106 self.certificateTypes = CERTIFICATE_TYPES
107 self.minVersion = (3,0)
108 self.maxVersion = (3,2)
109 self.useExperimentalTackExtension = False
110
111
112
114 other = HandshakeSettings()
115 other.minKeySize = self.minKeySize
116 other.maxKeySize = self.maxKeySize
117 other.cipherNames = self.cipherNames
118 other.macNames = self.macNames
119 other.cipherImplementations = self.cipherImplementations
120 other.certificateTypes = self.certificateTypes
121 other.minVersion = self.minVersion
122 other.maxVersion = self.maxVersion
123
124 if not cipherfactory.tripleDESPresent:
125 other.cipherNames = [e for e in self.cipherNames if e != "3des"]
126 if len(other.cipherNames)==0:
127 raise ValueError("No supported ciphers")
128 if len(other.certificateTypes)==0:
129 raise ValueError("No supported certificate types")
130
131 if not cryptomath.m2cryptoLoaded:
132 other.cipherImplementations = \
133 [e for e in other.cipherImplementations if e != "openssl"]
134 if not cryptomath.pycryptoLoaded:
135 other.cipherImplementations = \
136 [e for e in other.cipherImplementations if e != "pycrypto"]
137 if len(other.cipherImplementations)==0:
138 raise ValueError("No supported cipher implementations")
139
140 if other.minKeySize<512:
141 raise ValueError("minKeySize too small")
142 if other.minKeySize>16384:
143 raise ValueError("minKeySize too large")
144 if other.maxKeySize<512:
145 raise ValueError("maxKeySize too small")
146 if other.maxKeySize>16384:
147 raise ValueError("maxKeySize too large")
148 for s in other.cipherNames:
149 if s not in CIPHER_NAMES:
150 raise ValueError("Unknown cipher name: '%s'" % s)
151 for s in other.cipherImplementations:
152 if s not in CIPHER_IMPLEMENTATIONS:
153 raise ValueError("Unknown cipher implementation: '%s'" % s)
154 for s in other.certificateTypes:
155 if s not in CERTIFICATE_TYPES:
156 raise ValueError("Unknown certificate type: '%s'" % s)
157
158 if other.minVersion > other.maxVersion:
159 raise ValueError("Versions set incorrectly")
160
161 if not other.minVersion in ((3,0), (3,1), (3,2)):
162 raise ValueError("minVersion set incorrectly")
163
164 if not other.maxVersion in ((3,0), (3,1), (3,2)):
165 raise ValueError("maxVersion set incorrectly")
166
167 return other
168
170 l = []
171 for ct in self.certificateTypes:
172 if ct == "x509":
173 l.append(CertificateType.x509)
174 else:
175 raise AssertionError()
176 return l
177