Package tlslite :: Module constants
[hide private]
[frames] | no frames]

Source Code for Module tlslite.constants

   1  # Authors:  
   2  #   Trevor Perrin 
   3  #   Google - defining ClientCertificateType 
   4  #   Google (adapted by Sam Rushing) - NPN support 
   5  #   Dimitris Moraitis - Anon ciphersuites 
   6  #   Dave Baggett (Arcode Corporation) - canonicalCipherName 
   7  #   Yngve Pettersen (ported by Paul Sokolovsky) - TLS 1.2 
   8  # 
   9  # See the LICENSE file for legal information regarding use of this file. 
  10   
  11  """Constants used in various places.""" 
12 13 -class TLSEnum(object):
14 """Base class for different enums of TLS IDs""" 15 16 @classmethod
17 - def _recursiveVars(cls, klass):
18 """Call vars recursively on base classes""" 19 fields = dict() 20 for basecls in klass.__bases__: 21 fields.update(cls._recursiveVars(basecls)) 22 fields.update(dict(vars(klass))) 23 return fields
24 25 @classmethod
26 - def toRepr(cls, value, blacklist=None):
27 """ 28 Convert numeric type to string representation 29 30 name if found, None otherwise 31 """ 32 fields = cls._recursiveVars(cls) 33 if blacklist is None: 34 blacklist = [] 35 return next((key for key, val in fields.items() \ 36 if key not in ('__weakref__', '__dict__', '__doc__', 37 '__module__') and \ 38 key not in blacklist and \ 39 val == value), None)
40 41 @classmethod
42 - def toStr(cls, value, blacklist=None):
43 """Convert numeric type to human-readable string if possible""" 44 ret = cls.toRepr(value, blacklist) 45 if ret is not None: 46 return ret 47 else: 48 return '{0}'.format(value)
49
50 51 -class CertificateType(TLSEnum):
52 x509 = 0 53 openpgp = 1
54
55 56 -class ClientCertificateType(TLSEnum):
57 rsa_sign = 1 58 dss_sign = 2 59 rsa_fixed_dh = 3 60 dss_fixed_dh = 4
61
62 63 -class SSL2HandshakeType(TLSEnum):
64 """SSL2 Handshake Protocol message types.""" 65 66 error = 0 67 client_hello = 1 68 client_master_key = 2 69 client_finished = 3 70 server_hello = 4 71 server_verify = 5 72 server_finished = 6 73 request_certificate = 7 74 client_certificate = 8
75
76 77 -class SSL2ErrorDescription(TLSEnum):
78 """SSL2 Handshake protocol error message descriptions""" 79 80 no_cipher = 0x0001 81 no_certificate = 0x0002 82 bad_certificate = 0x0004 83 unsupported_certificate_type = 0x0006
84
85 86 -class HandshakeType(TLSEnum):
87 """Message types in TLS Handshake protocol""" 88 89 hello_request = 0 90 client_hello = 1 91 server_hello = 2 92 certificate = 11 93 server_key_exchange = 12 94 certificate_request = 13 95 server_hello_done = 14 96 certificate_verify = 15 97 client_key_exchange = 16 98 finished = 20 99 certificate_status = 22 100 next_protocol = 67
101
102 103 -class ContentType(TLSEnum):
104 """TLS record layer content types of payloads""" 105 106 change_cipher_spec = 20 107 alert = 21 108 handshake = 22 109 application_data = 23 110 all = (20, 21, 22, 23) 111 112 @classmethod
113 - def toRepr(cls, value, blacklist=None):
114 """Convert numeric type to name representation""" 115 if blacklist is None: 116 blacklist = [] 117 blacklist.append('all') 118 return super(ContentType, cls).toRepr(value, blacklist)
119
120 121 -class ExtensionType(TLSEnum):
122 """TLS Extension Type registry values""" 123 124 server_name = 0 # RFC 6066 / 4366 125 status_request = 5 # RFC 6066 / 4366 126 cert_type = 9 # RFC 6091 127 supported_groups = 10 # RFC 4492, RFC-ietf-tls-negotiated-ff-dhe-10 128 ec_point_formats = 11 # RFC 4492 129 srp = 12 # RFC 5054 130 signature_algorithms = 13 # RFC 5246 131 alpn = 16 # RFC 7301 132 client_hello_padding = 21 # RFC 7685 133 encrypt_then_mac = 22 # RFC 7366 134 extended_master_secret = 23 # RFC 7627 135 supports_npn = 13172 136 tack = 0xF300 137 renegotiation_info = 0xff01 # RFC 5746
138
139 140 -class HashAlgorithm(TLSEnum):
141 """Hash algorithm IDs used in TLSv1.2""" 142 143 none = 0 144 md5 = 1 145 sha1 = 2 146 sha224 = 3 147 sha256 = 4 148 sha384 = 5 149 sha512 = 6
150
151 152 -class SignatureAlgorithm(TLSEnum):
153 """Signing algorithms used in TLSv1.2""" 154 155 anonymous = 0 156 rsa = 1 157 dsa = 2 158 ecdsa = 3
159
160 161 -class SignatureScheme(TLSEnum):
162 """ 163 Signature scheme used for signalling supported signature algorithms. 164 165 This is the replacement for the HashAlgorithm and SignatureAlgorithm 166 lists. Introduced with TLSv1.3. 167 """ 168 169 rsa_pkcs1_sha1 = (2, 1) 170 rsa_pkcs1_sha256 = (4, 1) 171 rsa_pkcs1_sha384 = (5, 1) 172 rsa_pkcs1_sha512 = (6, 1) 173 rsa_pss_sha256 = (8, 4) 174 rsa_pss_sha384 = (8, 5) 175 rsa_pss_sha512 = (8, 6) 176 177 @classmethod
178 - def toRepr(cls, value, blacklist=None):
179 """Convert numeric type to name representation""" 180 if blacklist is None: 181 blacklist = [] 182 blacklist += ['getKeyType', 'getPadding', 'getHash'] 183 return super(SignatureScheme, cls).toRepr(value, blacklist)
184 185 @staticmethod
186 - def getKeyType(scheme):
187 """ 188 Return the name of the signature algorithm used in scheme. 189 190 E.g. for "rsa_pkcs1_sha1" it returns "rsa" 191 """ 192 try: 193 getattr(SignatureScheme, scheme) 194 except AttributeError: 195 raise ValueError("\"{0}\" scheme is unknown".format(scheme)) 196 kType, _, _ = scheme.split('_') 197 return kType
198 199 @staticmethod
200 - def getPadding(scheme):
201 """Return the name of padding scheme used in signature scheme.""" 202 try: 203 getattr(SignatureScheme, scheme) 204 except AttributeError: 205 raise ValueError("\"{0}\" scheme is unknown".format(scheme)) 206 kType, padding, _ = scheme.split('_') 207 assert kType == 'rsa' 208 return padding
209 210 @staticmethod
211 - def getHash(scheme):
212 """Return the name of hash used in signature scheme.""" 213 try: 214 getattr(SignatureScheme, scheme) 215 except AttributeError: 216 raise ValueError("\"{0}\" scheme is unknown".format(scheme)) 217 kType, _, hName = scheme.split('_') 218 assert kType == 'rsa' 219 return hName
220
221 222 -class GroupName(TLSEnum):
223 """Name of groups supported for (EC)DH key exchange""" 224 225 # RFC4492 226 sect163k1 = 1 227 sect163r1 = 2 228 sect163r2 = 3 229 sect193r1 = 4 230 sect193r2 = 5 231 sect233k1 = 6 232 sect233r1 = 7 233 sect239k1 = 8 234 sect283k1 = 9 235 sect283r1 = 10 236 sect409k1 = 11 237 sect409r1 = 12 238 sect571k1 = 13 239 sect571r1 = 14 240 secp160k1 = 15 241 secp160r1 = 16 242 secp160r2 = 17 243 secp192k1 = 18 244 secp192r1 = 19 245 secp224k1 = 20 246 secp224r1 = 21 247 secp256k1 = 22 248 secp256r1 = 23 249 secp384r1 = 24 250 secp521r1 = 25 251 allEC = list(range(1, 26)) 252 253 # RFC7027 254 brainpoolP256r1 = 26 255 brainpoolP384r1 = 27 256 brainpoolP512r1 = 28 257 allEC.extend(list(range(26, 29))) 258 259 # RFC7919 260 ffdhe2048 = 256 261 ffdhe3072 = 257 262 ffdhe4096 = 258 263 ffdhe6144 = 259 264 ffdhe8192 = 260 265 allFF = list(range(256, 261)) 266 267 all = allEC + allFF 268 269 @classmethod
270 - def toRepr(cls, value, blacklist=None):
271 """Convert numeric type to name representation""" 272 if blacklist is None: 273 blacklist = [] 274 blacklist += ['all', 'allEC', 'allFF'] 275 return super(GroupName, cls).toRepr(value, blacklist)
276
277 278 -class ECPointFormat(TLSEnum):
279 """Names and ID's of supported EC point formats.""" 280 281 uncompressed = 0 282 ansiX962_compressed_prime = 1 283 ansiX962_compressed_char2 = 2 284 285 all = [uncompressed, 286 ansiX962_compressed_prime, 287 ansiX962_compressed_char2] 288 289 @classmethod
290 - def toRepr(cls, value, blacklist=None):
291 """Convert numeric type to name representation.""" 292 if blacklist is None: 293 blacklist = [] 294 blacklist.append('all') 295 return super(ECPointFormat, cls).toRepr(value, blacklist)
296
297 298 -class ECCurveType(TLSEnum):
299 """Types of ECC curves supported in TLS from RFC4492""" 300 301 explicit_prime = 1 302 explicit_char2 = 2 303 named_curve = 3
304
305 306 -class NameType(TLSEnum):
307 """Type of entries in Server Name Indication extension.""" 308 309 host_name = 0
310
311 312 -class CertificateStatusType(TLSEnum):
313 """Type of responses in the status_request and CertificateStatus msgs.""" 314 315 ocsp = 1
316
317 318 -class AlertLevel(TLSEnum):
319 """Enumeration of TLS Alert protocol levels""" 320 321 warning = 1 322 fatal = 2
323
324 325 -class AlertDescription(TLSEnum):
326 """ 327 @cvar bad_record_mac: A TLS record failed to decrypt properly. 328 329 If this occurs during a SRP handshake it most likely 330 indicates a bad password. It may also indicate an implementation 331 error, or some tampering with the data in transit. 332 333 This alert will be signalled by the server if the SRP password is bad. It 334 may also be signalled by the server if the SRP username is unknown to the 335 server, but it doesn't wish to reveal that fact. 336 337 338 @cvar handshake_failure: A problem occurred while handshaking. 339 340 This typically indicates a lack of common ciphersuites between client and 341 server, or some other disagreement (about SRP parameters or key sizes, 342 for example). 343 344 @cvar protocol_version: The other party's SSL/TLS version was unacceptable. 345 346 This indicates that the client and server couldn't agree on which version 347 of SSL or TLS to use. 348 349 @cvar user_canceled: The handshake is being cancelled for some reason. 350 351 """ 352 353 close_notify = 0 354 unexpected_message = 10 355 bad_record_mac = 20 356 decryption_failed = 21 357 record_overflow = 22 358 decompression_failure = 30 359 handshake_failure = 40 360 no_certificate = 41 #SSLv3 361 bad_certificate = 42 362 unsupported_certificate = 43 363 certificate_revoked = 44 364 certificate_expired = 45 365 certificate_unknown = 46 366 illegal_parameter = 47 367 unknown_ca = 48 368 access_denied = 49 369 decode_error = 50 370 decrypt_error = 51 371 export_restriction = 60 372 protocol_version = 70 373 insufficient_security = 71 374 internal_error = 80 375 inappropriate_fallback = 86 376 user_canceled = 90 377 no_renegotiation = 100 378 unsupported_extension = 110 # RFC 5246 379 certificate_unobtainable = 111 # RFC 6066 380 unrecognized_name = 112 # RFC 6066 381 bad_certificate_status_response = 113 # RFC 6066 382 bad_certificate_hash_value = 114 # RFC 6066 383 unknown_psk_identity = 115 384 no_application_protocol = 120 # RFC 7301
385
386 387 -class CipherSuite:
388 389 """ 390 Numeric values of ciphersuites and ciphersuite types 391 392 @cvar tripleDESSuites: ciphersuties which use 3DES symmetric cipher in CBC 393 mode 394 @cvar aes128Suites: ciphersuites which use AES symmetric cipher in CBC mode 395 with 128 bit key 396 @cvar aes256Suites: ciphersuites which use AES symmetric cipher in CBC mode 397 with 128 bit key 398 @cvar rc4Suites: ciphersuites which use RC4 symmetric cipher with 128 bit 399 key 400 @cvar shaSuites: ciphersuites which use SHA-1 HMAC integrity mechanism 401 and protocol default Pseudo Random Function 402 @cvar sha256Suites: ciphersuites which use SHA-256 HMAC integrity mechanism 403 and SHA-256 Pseudo Random Function 404 @cvar md5Suites: ciphersuites which use MD-5 HMAC integrity mechanism and 405 protocol default Pseudo Random Function 406 @cvar srpSuites: ciphersuites which use Secure Remote Password (SRP) key 407 exchange protocol 408 @cvar srpCertSuites: ciphersuites which use Secure Remote Password (SRP) 409 key exchange protocol with RSA server authentication 410 @cvar srpAllSuites: all SRP ciphersuites, pure SRP and with RSA based 411 server authentication 412 @cvar certSuites: ciphersuites which use RSA key exchange with RSA server 413 authentication 414 @cvar certAllSuites: ciphersuites which use RSA server authentication 415 @cvar anonSuites: ciphersuites which use anonymous Finite Field 416 Diffie-Hellman key exchange 417 @cvar ietfNames: dictionary with string names of the ciphersuites 418 """ 419 420 ietfNames = {} 421 422 # the ciphesuite names come from IETF, we want to keep them 423 #pylint: disable = invalid-name 424 425 # SSLv2 from draft-hickman-netscape-ssl-00.txt 426 SSL_CK_RC4_128_WITH_MD5 = 0x010080 427 ietfNames[0x010080] = 'SSL_CK_RC4_128_WITH_MD5' 428 SSL_CK_RC4_128_EXPORT40_WITH_MD5 = 0x020080 429 ietfNames[0x020080] = 'SSL_CK_RC4_128_EXPORT40_WITH_MD5' 430 SSL_CK_RC2_128_CBC_WITH_MD5 = 0x030080 431 ietfNames[0x030080] = 'SSL_CK_RC2_128_CBC_WITH_MD5' 432 SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 = 0x040080 433 ietfNames[0x040080] = 'SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5' 434 SSL_CK_IDEA_128_CBC_WITH_MD5 = 0x050080 435 ietfNames[0x050080] = 'SSL_CK_IDEA_128_CBC_WITH_MD5' 436 SSL_CK_DES_64_CBC_WITH_MD5 = 0x060040 437 ietfNames[0x060040] = 'SSL_CK_DES_64_CBC_WITH_MD5' 438 SSL_CK_DES_192_EDE3_CBC_WITH_MD5 = 0x0700C0 439 ietfNames[0x0700C0] = 'SSL_CK_DES_192_EDE3_CBC_WITH_MD5' 440 441 # SSL2 ciphersuites which use RC4 symmetric cipher 442 ssl2rc4 = [] 443 ssl2rc4.append(SSL_CK_RC4_128_WITH_MD5) 444 ssl2rc4.append(SSL_CK_RC4_128_EXPORT40_WITH_MD5) 445 446 # SSL2 ciphersuites which use RC2 symmetric cipher 447 ssl2rc2 = [] 448 ssl2rc2.append(SSL_CK_RC2_128_CBC_WITH_MD5) 449 ssl2rc2.append(SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5) 450 451 # SSL2 ciphersuites which use IDEA symmetric cipher 452 ssl2idea = [SSL_CK_IDEA_128_CBC_WITH_MD5] 453 454 # SSL2 ciphersuites which use (single) DES symmetric cipher 455 ssl2des = [SSL_CK_DES_64_CBC_WITH_MD5] 456 457 # SSL2 ciphersuites which use 3DES symmetric cipher 458 ssl2_3des = [SSL_CK_DES_192_EDE3_CBC_WITH_MD5] 459 460 # SSL2 ciphersuites which encrypt only part (40 bits) of the key 461 ssl2export = [] 462 ssl2export.append(SSL_CK_RC4_128_EXPORT40_WITH_MD5) 463 ssl2export.append(SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5) 464 465 # SSL2 ciphersuties which use 128 bit key 466 ssl2_128Key = [] 467 ssl2_128Key.append(SSL_CK_RC4_128_WITH_MD5) 468 ssl2_128Key.append(SSL_CK_RC4_128_EXPORT40_WITH_MD5) 469 ssl2_128Key.append(SSL_CK_RC2_128_CBC_WITH_MD5) 470 ssl2_128Key.append(SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5) 471 ssl2_128Key.append(SSL_CK_IDEA_128_CBC_WITH_MD5) 472 473 # SSL2 ciphersuites which use 64 bit key 474 ssl2_64Key = [SSL_CK_DES_64_CBC_WITH_MD5] 475 476 # SSL2 ciphersuites which use 192 bit key 477 ssl2_192Key = [SSL_CK_DES_192_EDE3_CBC_WITH_MD5] 478 479 # 480 # SSLv3 and TLS cipher suite definitions 481 # 482 483 # RFC 5246 - TLS v1.2 Protocol 484 TLS_RSA_WITH_NULL_MD5 = 0x0001 485 ietfNames[0x0001] = 'TLS_RSA_WITH_NULL_MD5' 486 TLS_RSA_WITH_NULL_SHA = 0x0002 487 ietfNames[0x0002] = 'TLS_RSA_WITH_NULL_SHA' 488 TLS_RSA_WITH_RC4_128_MD5 = 0x0004 489 ietfNames[0x0004] = 'TLS_RSA_WITH_RC4_128_MD5' 490 TLS_RSA_WITH_RC4_128_SHA = 0x0005 491 ietfNames[0x0005] = 'TLS_RSA_WITH_RC4_128_SHA' 492 TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x000A 493 ietfNames[0x000A] = 'TLS_RSA_WITH_3DES_EDE_CBC_SHA' 494 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x0016 495 ietfNames[0x0016] = 'TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA' 496 TLS_DH_ANON_WITH_RC4_128_MD5 = 0x0018 497 ietfNames[0x0018] = 'TLS_DH_ANON_WITH_RC4_128_MD5' 498 TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA = 0x001B 499 ietfNames[0x001B] = 'TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA' 500 TLS_RSA_WITH_AES_128_CBC_SHA = 0x002F 501 ietfNames[0x002F] = 'TLS_RSA_WITH_AES_128_CBC_SHA' 502 TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x0033 503 ietfNames[0x0033] = 'TLS_DHE_RSA_WITH_AES_128_CBC_SHA' 504 TLS_DH_ANON_WITH_AES_128_CBC_SHA = 0x0034 505 ietfNames[0x0034] = 'TLS_DH_ANON_WITH_AES_128_CBC_SHA' 506 TLS_RSA_WITH_AES_256_CBC_SHA = 0x0035 507 ietfNames[0x0035] = 'TLS_RSA_WITH_AES_256_CBC_SHA' 508 TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x0039 509 ietfNames[0x0039] = 'TLS_DHE_RSA_WITH_AES_256_CBC_SHA' 510 TLS_DH_ANON_WITH_AES_256_CBC_SHA = 0x003A 511 ietfNames[0x003A] = 'TLS_DH_ANON_WITH_AES_256_CBC_SHA' 512 TLS_RSA_WITH_NULL_SHA256 = 0x003B 513 ietfNames[0x003B] = 'TLS_RSA_WITH_NULL_SHA256' 514 TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x003C 515 ietfNames[0x003C] = 'TLS_RSA_WITH_AES_128_CBC_SHA256' 516 TLS_RSA_WITH_AES_256_CBC_SHA256 = 0x003D 517 ietfNames[0x003D] = 'TLS_RSA_WITH_AES_256_CBC_SHA256' 518 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 = 0x0067 519 ietfNames[0x0067] = 'TLS_DHE_RSA_WITH_AES_128_CBC_SHA256' 520 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 = 0x006B 521 ietfNames[0x006B] = 'TLS_DHE_RSA_WITH_AES_256_CBC_SHA256' 522 TLS_DH_ANON_WITH_AES_128_CBC_SHA256 = 0x006C 523 ietfNames[0x006C] = 'TLS_DH_ANON_WITH_AES_128_CBC_SHA256' 524 TLS_DH_ANON_WITH_AES_256_CBC_SHA256 = 0x006D 525 ietfNames[0x006D] = 'TLS_DH_ANON_WITH_AES_256_CBC_SHA256' 526 527 # RFC 5288 - AES-GCM ciphers for TLSv1.2 528 TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x009C 529 ietfNames[0x009C] = 'TLS_RSA_WITH_AES_128_GCM_SHA256' 530 TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x009D 531 ietfNames[0x009D] = 'TLS_RSA_WITH_AES_256_GCM_SHA384' 532 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = 0x009E 533 ietfNames[0x009E] = 'TLS_DHE_RSA_WITH_AES_128_GCM_SHA256' 534 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = 0x009F 535 ietfNames[0x009F] = 'TLS_DHE_RSA_WITH_AES_256_GCM_SHA384' 536 TLS_DH_ANON_WITH_AES_128_GCM_SHA256 = 0x00A6 537 ietfNames[0x00A6] = 'TLS_DH_ANON_WITH_AES_128_GCM_SHA256' 538 TLS_DH_ANON_WITH_AES_256_GCM_SHA384 = 0x00A7 539 ietfNames[0x00A7] = 'TLS_DH_ANON_WITH_AES_256_GCM_SHA384' 540 541 # Weird pseudo-ciphersuite from RFC 5746 542 # Signals that "secure renegotiation" is supported 543 # We actually don't do any renegotiation, but this 544 # prevents renegotiation attacks 545 TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0x00FF 546 ietfNames[0x00FF] = 'TLS_EMPTY_RENEGOTIATION_INFO_SCSV' 547 548 # RFC 7507 - Fallback Signaling Cipher Suite Value for Preventing Protocol 549 # Downgrade Attacks 550 TLS_FALLBACK_SCSV = 0x5600 551 ietfNames[0x5600] = 'TLS_FALLBACK_SCSV' 552 553 # RFC 4492 - ECC Cipher Suites for TLS 554 # unsupported - no support for ECDSA certificates 555 TLS_ECDH_ECDSA_WITH_NULL_SHA = 0xC001 556 ietfNames[0xC001] = 'TLS_ECDH_ECDSA_WITH_NULL_SHA' 557 TLS_ECDH_ECDSA_WITH_RC4_128_SHA = 0xC002 558 ietfNames[0xC002] = 'TLS_ECDH_ECDSA_WITH_RC4_128_SHA' 559 TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA = 0xC003 560 ietfNames[0xC003] = 'TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA' 561 TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA = 0xC004 562 ietfNames[0xC004] = 'TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA' 563 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA = 0xC005 564 ietfNames[0xC005] = 'TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA' 565 TLS_ECDHE_ECDSA_WITH_NULL_SHA = 0xC006 566 ietfNames[0xC006] = 'TLS_ECDHE_ECDSA_WITH_NULL_SHA' 567 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA = 0xC007 568 ietfNames[0xC007] = 'TLS_ECDHE_ECDSA_WITH_RC4_128_SHA' 569 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA = 0xC008 570 ietfNames[0xC008] = 'TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA' 571 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA = 0xC009 572 ietfNames[0xC009] = 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA' 573 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA = 0xC00A 574 ietfNames[0xC00A] = 'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA' 575 TLS_ECDH_RSA_WITH_NULL_SHA = 0xC00B 576 ietfNames[0xC00B] = 'TLS_ECDH_RSA_WITH_NULL_SHA' 577 TLS_ECDH_RSA_WITH_RC4_128_SHA = 0xC00C 578 ietfNames[0xC00C] = 'TLS_ECDH_RSA_WITH_RC4_128_SHA' 579 TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA = 0xC00D 580 ietfNames[0xC00D] = 'TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA' 581 TLS_ECDH_RSA_WITH_AES_128_CBC_SHA = 0xC00E 582 ietfNames[0xC00E] = 'TLS_ECDH_RSA_WITH_AES_128_CBC_SHA' 583 TLS_ECDH_RSA_WITH_AES_256_CBC_SHA = 0xC00F 584 ietfNames[0xC00F] = 'TLS_ECDH_RSA_WITH_AES_256_CBC_SHA' 585 586 # RFC 4492 - ECC Cipher Suites for TLS 587 TLS_ECDHE_RSA_WITH_NULL_SHA = 0xC010 588 ietfNames[0xC010] = 'TLS_ECDHE_RSA_WITH_NULL_SHA' 589 TLS_ECDHE_RSA_WITH_RC4_128_SHA = 0xC011 590 ietfNames[0xC011] = 'TLS_ECDHE_RSA_WITH_RC4_128_SHA' 591 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA = 0xC012 592 ietfNames[0xC012] = 'TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA' 593 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0xC013 594 ietfNames[0xC013] = 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA' 595 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0xC014 596 ietfNames[0xC014] = 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA' 597 TLS_ECDH_ANON_WITH_NULL_SHA = 0xC015 598 ietfNames[0xC015] = 'TLS_ECDH_ANON_WITH_NULL_SHA' 599 TLS_ECDH_ANON_WITH_RC4_128_SHA = 0xC016 600 ietfNames[0xC016] = 'TLS_ECDH_ANON_WITH_RC4_128_SHA' 601 TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA = 0xC017 602 ietfNames[0xC017] = 'TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA' 603 TLS_ECDH_ANON_WITH_AES_128_CBC_SHA = 0xC018 604 ietfNames[0xC018] = 'TLS_ECDH_ANON_WITH_AES_128_CBC_SHA' 605 TLS_ECDH_ANON_WITH_AES_256_CBC_SHA = 0xC019 606 ietfNames[0xC019] = 'TLS_ECDH_ANON_WITH_AES_256_CBC_SHA' 607 608 # RFC 5054 - Secure Remote Password (SRP) Protocol for TLS Authentication 609 TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA = 0xC01A 610 ietfNames[0xC01A] = 'TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA' 611 TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA = 0xC01B 612 ietfNames[0xC01B] = 'TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA' 613 TLS_SRP_SHA_WITH_AES_128_CBC_SHA = 0xC01D 614 ietfNames[0xC01D] = 'TLS_SRP_SHA_WITH_AES_128_CBC_SHA' 615 TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA = 0xC01E 616 ietfNames[0xC01E] = 'TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA' 617 TLS_SRP_SHA_WITH_AES_256_CBC_SHA = 0xC020 618 ietfNames[0xC020] = 'TLS_SRP_SHA_WITH_AES_256_CBC_SHA' 619 TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA = 0xC021 620 ietfNames[0xC021] = 'TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA' 621 622 # RFC 5289 - ECC Ciphers with SHA-256/SHA-384 HMAC and AES-GCM 623 # unsupported! - no support for ECDSA certificates 624 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 = 0xC023 625 ietfNames[0xC023] = 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256' 626 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 = 0xC024 627 ietfNames[0xC024] = 'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384' 628 TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 = 0xC025 629 ietfNames[0xC025] = 'TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256' 630 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 = 0xC026 631 ietfNames[0xC026] = 'TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384' 632 633 # RFC 5289 - ECC Ciphers with SHA-256/SHA-384 HMAC and AES-GCM 634 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 0xC027 635 ietfNames[0xC027] = 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256' 636 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 = 0xC028 637 ietfNames[0xC028] = 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384' 638 639 # RFC 5289 - ECC Ciphers with SHA-256/SHA-384 HMAC and AES-GCM 640 # unsupported 641 TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 = 0xC029 642 ietfNames[0xC029] = 'TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256' 643 TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 = 0xC02A 644 ietfNames[0xC02A] = 'TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384' 645 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0xC02B 646 ietfNames[0xC02B] = 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256' 647 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 = 0xC02C 648 ietfNames[0xC02C] = 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384' 649 TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 = 0xC02D 650 ietfNames[0xC02D] = 'TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256' 651 TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 = 0xC02E 652 ietfNames[0xC02E] = 'TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384' 653 654 # RFC 5289 - ECC Ciphers with SHA-256/SHA-384 HMAC and AES-GCM 655 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0xC02F 656 ietfNames[0xC02F] = 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256' 657 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 = 0xC030 658 ietfNames[0xC030] = 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384' 659 660 # RFC 5289 - ECC Ciphers with SHA-256/SHA-384 HMAC and AES-GCM 661 # unsupported 662 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 = 0xC031 663 ietfNames[0xC031] = 'TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256' 664 TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 = 0xC032 665 ietfNames[0xC032] = 'TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384' 666 667 # draft-ietf-tls-chacha20-poly1305-00 668 # ChaCha20/Poly1305 based Cipher Suites for TLS1.2 669 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_draft_00 = 0xCCA1 670 ietfNames[0xCCA1] = 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_draft_00' 671 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_draft_00 = 0xCCA3 672 ietfNames[0xCCA3] = 'TLS_DHE_RSA_WITH_CHACHA20_POLY1305_draft_00' 673 674 # RFC 7905 - ChaCha20-Poly1305 Cipher Suites for TLS 675 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 = 0xCCA8 676 ietfNames[0xCCA8] = 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256' 677 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 = 0xCCAA 678 ietfNames[0xCCAA] = 'TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256' 679 680 #pylint: enable = invalid-name 681 # 682 # Define cipher suite families below 683 # 684 685 # 3DES CBC ciphers 686 tripleDESSuites = [] 687 tripleDESSuites.append(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA) # unsupp 688 tripleDESSuites.append(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA) # unsupported 689 tripleDESSuites.append(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA) # unsupported 690 tripleDESSuites.append(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA) 691 tripleDESSuites.append(TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA) 692 tripleDESSuites.append(TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA) 693 tripleDESSuites.append(TLS_RSA_WITH_3DES_EDE_CBC_SHA) 694 tripleDESSuites.append(TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA) 695 tripleDESSuites.append(TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA) 696 tripleDESSuites.append(TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA) 697 698 # AES-128 CBC ciphers 699 aes128Suites = [] 700 aes128Suites.append(TLS_SRP_SHA_WITH_AES_128_CBC_SHA) 701 aes128Suites.append(TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA) 702 aes128Suites.append(TLS_RSA_WITH_AES_128_CBC_SHA) 703 aes128Suites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA) 704 aes128Suites.append(TLS_DH_ANON_WITH_AES_128_CBC_SHA) 705 aes128Suites.append(TLS_RSA_WITH_AES_128_CBC_SHA256) 706 aes128Suites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256) 707 aes128Suites.append(TLS_DH_ANON_WITH_AES_128_CBC_SHA256) 708 aes128Suites.append(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) # unsupp 709 aes128Suites.append(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) # unsupported 710 aes128Suites.append(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256) # unsupported 711 aes128Suites.append(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA) # unsupported 712 aes128Suites.append(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256) # unsupported 713 aes128Suites.append(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA) # unsupported 714 aes128Suites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) 715 aes128Suites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) 716 aes128Suites.append(TLS_ECDH_ANON_WITH_AES_128_CBC_SHA) 717 718 # AES-256 CBC ciphers 719 aes256Suites = [] 720 aes256Suites.append(TLS_SRP_SHA_WITH_AES_256_CBC_SHA) 721 aes256Suites.append(TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA) 722 aes256Suites.append(TLS_RSA_WITH_AES_256_CBC_SHA) 723 aes256Suites.append(TLS_DH_ANON_WITH_AES_256_CBC_SHA) 724 aes256Suites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA) 725 aes256Suites.append(TLS_RSA_WITH_AES_256_CBC_SHA256) 726 aes256Suites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256) 727 aes256Suites.append(TLS_DH_ANON_WITH_AES_256_CBC_SHA256) 728 aes256Suites.append(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384) # unsupported 729 aes256Suites.append(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) # unsupported 730 aes256Suites.append(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384) # unsupported 731 aes256Suites.append(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA) # unsupported 732 aes256Suites.append(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384) # unsupported 733 aes256Suites.append(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA) # unsupported 734 aes256Suites.append(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) 735 aes256Suites.append(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) 736 aes256Suites.append(TLS_ECDH_ANON_WITH_AES_256_CBC_SHA) 737 738 # AES-128 GCM ciphers 739 aes128GcmSuites = [] 740 aes128GcmSuites.append(TLS_RSA_WITH_AES_128_GCM_SHA256) 741 aes128GcmSuites.append(TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) 742 aes128GcmSuites.append(TLS_DH_ANON_WITH_AES_128_GCM_SHA256) 743 aes128GcmSuites.append(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) # unsupp 744 aes128GcmSuites.append(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256) # unsupp 745 aes128GcmSuites.append(TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256) # unsupp 746 aes128GcmSuites.append(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) 747 748 # AES-256-GCM ciphers (implicit SHA384, see sha384PrfSuites) 749 aes256GcmSuites = [] 750 aes256GcmSuites.append(TLS_RSA_WITH_AES_256_GCM_SHA384) 751 aes256GcmSuites.append(TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) 752 aes256GcmSuites.append(TLS_DH_ANON_WITH_AES_256_GCM_SHA384) 753 aes256GcmSuites.append(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) # unsupp 754 aes256GcmSuites.append(TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384) # unsupp 755 aes256GcmSuites.append(TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384) # unsupported 756 aes256GcmSuites.append(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) 757 758 # CHACHA20 cipher, 00'th IETF draft (implicit POLY1305 authenticator) 759 chacha20draft00Suites = [] 760 chacha20draft00Suites.append(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_draft_00) 761 chacha20draft00Suites.append(TLS_DHE_RSA_WITH_CHACHA20_POLY1305_draft_00) 762 763 # CHACHA20 cipher (implicit POLY1305 authenticator, SHA256 PRF) 764 chacha20Suites = [] 765 chacha20Suites.append(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) 766 chacha20Suites.append(TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256) 767 768 # RC4 128 stream cipher 769 rc4Suites = [] 770 rc4Suites.append(TLS_ECDHE_RSA_WITH_RC4_128_SHA) 771 rc4Suites.append(TLS_ECDHE_ECDSA_WITH_RC4_128_SHA) # unsupported 772 rc4Suites.append(TLS_ECDH_ECDSA_WITH_RC4_128_SHA) # unsupported 773 rc4Suites.append(TLS_ECDH_RSA_WITH_RC4_128_SHA) # unsupported 774 rc4Suites.append(TLS_DH_ANON_WITH_RC4_128_MD5) 775 rc4Suites.append(TLS_RSA_WITH_RC4_128_SHA) 776 rc4Suites.append(TLS_RSA_WITH_RC4_128_MD5) 777 rc4Suites.append(TLS_ECDH_ANON_WITH_RC4_128_SHA) 778 779 # no encryption 780 nullSuites = [] 781 nullSuites.append(TLS_RSA_WITH_NULL_MD5) 782 nullSuites.append(TLS_RSA_WITH_NULL_SHA) 783 nullSuites.append(TLS_RSA_WITH_NULL_SHA256) 784 nullSuites.append(TLS_ECDHE_ECDSA_WITH_NULL_SHA) # unsupported 785 nullSuites.append(TLS_ECDH_ECDSA_WITH_NULL_SHA) # unsupported 786 nullSuites.append(TLS_ECDH_RSA_WITH_NULL_SHA) # unsupported 787 nullSuites.append(TLS_ECDHE_RSA_WITH_NULL_SHA) 788 nullSuites.append(TLS_ECDH_ANON_WITH_NULL_SHA) 789 790 # SHA-1 HMAC, protocol default PRF 791 shaSuites = [] 792 shaSuites.append(TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA) 793 shaSuites.append(TLS_SRP_SHA_WITH_AES_128_CBC_SHA) 794 shaSuites.append(TLS_SRP_SHA_WITH_AES_256_CBC_SHA) 795 shaSuites.append(TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA) 796 shaSuites.append(TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA) 797 shaSuites.append(TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA) 798 shaSuites.append(TLS_RSA_WITH_3DES_EDE_CBC_SHA) 799 shaSuites.append(TLS_RSA_WITH_AES_128_CBC_SHA) 800 shaSuites.append(TLS_RSA_WITH_AES_256_CBC_SHA) 801 shaSuites.append(TLS_RSA_WITH_RC4_128_SHA) 802 shaSuites.append(TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA) 803 shaSuites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA) 804 shaSuites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA) 805 shaSuites.append(TLS_DH_ANON_WITH_AES_128_CBC_SHA) 806 shaSuites.append(TLS_DH_ANON_WITH_AES_256_CBC_SHA) 807 shaSuites.append(TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA) 808 shaSuites.append(TLS_RSA_WITH_NULL_SHA) 809 shaSuites.append(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) # unsupported 810 shaSuites.append(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) # unsupported 811 shaSuites.append(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA) # unsupported 812 shaSuites.append(TLS_ECDHE_ECDSA_WITH_RC4_128_SHA) # unsupported 813 shaSuites.append(TLS_ECDHE_ECDSA_WITH_NULL_SHA) # unsupported 814 shaSuites.append(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA) # unsupported 815 shaSuites.append(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA) # unsupported 816 shaSuites.append(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA) # unsupported 817 shaSuites.append(TLS_ECDH_ECDSA_WITH_RC4_128_SHA) # unsupported 818 shaSuites.append(TLS_ECDH_ECDSA_WITH_NULL_SHA) # unsupported 819 shaSuites.append(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA) # unsupported 820 shaSuites.append(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA) # unsupported 821 shaSuites.append(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA) # unsupported 822 shaSuites.append(TLS_ECDH_RSA_WITH_RC4_128_SHA) # unsupported 823 shaSuites.append(TLS_ECDH_RSA_WITH_NULL_SHA) # unsupported 824 shaSuites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) 825 shaSuites.append(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) 826 shaSuites.append(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA) 827 shaSuites.append(TLS_ECDHE_RSA_WITH_RC4_128_SHA) 828 shaSuites.append(TLS_ECDHE_RSA_WITH_NULL_SHA) 829 shaSuites.append(TLS_ECDH_ANON_WITH_AES_256_CBC_SHA) 830 shaSuites.append(TLS_ECDH_ANON_WITH_AES_128_CBC_SHA) 831 shaSuites.append(TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA) 832 shaSuites.append(TLS_ECDH_ANON_WITH_RC4_128_SHA) 833 shaSuites.append(TLS_ECDH_ANON_WITH_NULL_SHA) 834 835 # SHA-256 HMAC, SHA-256 PRF 836 sha256Suites = [] 837 sha256Suites.append(TLS_RSA_WITH_AES_128_CBC_SHA256) 838 sha256Suites.append(TLS_RSA_WITH_AES_256_CBC_SHA256) 839 sha256Suites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256) 840 sha256Suites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256) 841 sha256Suites.append(TLS_RSA_WITH_NULL_SHA256) 842 sha256Suites.append(TLS_DH_ANON_WITH_AES_128_CBC_SHA256) 843 sha256Suites.append(TLS_DH_ANON_WITH_AES_256_CBC_SHA256) 844 sha256Suites.append(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) # unsupported 845 sha256Suites.append(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256) # unsupported 846 sha256Suites.append(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256) # unsupported 847 sha256Suites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) 848 849 # SHA-384 HMAC, SHA-384 PRF 850 sha384Suites = [] 851 sha384Suites.append(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384) # unsupported 852 sha384Suites.append(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384) # unsupported 853 sha384Suites.append(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384) # unsupported 854 sha384Suites.append(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) 855 856 # stream cipher construction 857 streamSuites = [] 858 streamSuites.extend(rc4Suites) 859 streamSuites.extend(nullSuites) 860 861 # AEAD integrity, any PRF 862 aeadSuites = [] 863 aeadSuites.extend(aes128GcmSuites) 864 aeadSuites.extend(aes256GcmSuites) 865 aeadSuites.extend(chacha20Suites) 866 aeadSuites.extend(chacha20draft00Suites) 867 868 # TLS1.2 with SHA384 PRF 869 sha384PrfSuites = [] 870 sha384PrfSuites.extend(sha384Suites) 871 sha384PrfSuites.extend(aes256GcmSuites) 872 873 # MD-5 HMAC, protocol default PRF 874 md5Suites = [] 875 md5Suites.append(TLS_DH_ANON_WITH_RC4_128_MD5) 876 md5Suites.append(TLS_RSA_WITH_RC4_128_MD5) 877 md5Suites.append(TLS_RSA_WITH_NULL_MD5) 878 879 # SSL3, TLS1.0, TLS1.1 and TLS1.2 compatible ciphers 880 ssl3Suites = [] 881 ssl3Suites.extend(shaSuites) 882 ssl3Suites.extend(md5Suites) 883 884 # TLS1.2 specific ciphersuites 885 tls12Suites = [] 886 tls12Suites.extend(sha256Suites) 887 tls12Suites.extend(sha384Suites) 888 tls12Suites.extend(aeadSuites) 889 890 @staticmethod
891 - def filterForVersion(suites, minVersion, maxVersion):
892 """Return a copy of suites without ciphers incompatible with version""" 893 includeSuites = set([]) 894 if (3, 0) <= minVersion <= (3, 3): 895 includeSuites.update(CipherSuite.ssl3Suites) 896 if maxVersion == (3, 3): 897 includeSuites.update(CipherSuite.tls12Suites) 898 return [s for s in suites if s in includeSuites]
899 900 @staticmethod
901 - def _filterSuites(suites, settings, version=None):
902 if version is None: 903 version = settings.maxVersion 904 macNames = settings.macNames 905 cipherNames = settings.cipherNames 906 keyExchangeNames = settings.keyExchangeNames 907 macSuites = [] 908 if "sha" in macNames: 909 macSuites += CipherSuite.shaSuites 910 if "sha256" in macNames and version >= (3, 3): 911 macSuites += CipherSuite.sha256Suites 912 if "sha384" in macNames and version >= (3, 3): 913 macSuites += CipherSuite.sha384Suites 914 if "md5" in macNames: 915 macSuites += CipherSuite.md5Suites 916 if "aead" in macNames and version >= (3, 3): 917 macSuites += CipherSuite.aeadSuites 918 919 cipherSuites = [] 920 if "chacha20-poly1305" in cipherNames and version >= (3, 3): 921 cipherSuites += CipherSuite.chacha20Suites 922 if "chacha20-poly1305_draft00" in cipherNames and version >= (3, 3): 923 cipherSuites += CipherSuite.chacha20draft00Suites 924 if "aes128gcm" in cipherNames and version >= (3, 3): 925 cipherSuites += CipherSuite.aes128GcmSuites 926 if "aes256gcm" in cipherNames and version >= (3, 3): 927 cipherSuites += CipherSuite.aes256GcmSuites 928 if "aes128" in cipherNames: 929 cipherSuites += CipherSuite.aes128Suites 930 if "aes256" in cipherNames: 931 cipherSuites += CipherSuite.aes256Suites 932 if "3des" in cipherNames: 933 cipherSuites += CipherSuite.tripleDESSuites 934 if "rc4" in cipherNames: 935 cipherSuites += CipherSuite.rc4Suites 936 if "null" in cipherNames: 937 cipherSuites += CipherSuite.nullSuites 938 939 keyExchangeSuites = [] 940 if "rsa" in keyExchangeNames: 941 keyExchangeSuites += CipherSuite.certSuites 942 if "dhe_rsa" in keyExchangeNames: 943 keyExchangeSuites += CipherSuite.dheCertSuites 944 if "ecdhe_rsa" in keyExchangeNames: 945 keyExchangeSuites += CipherSuite.ecdheCertSuites 946 if "srp_sha" in keyExchangeNames: 947 keyExchangeSuites += CipherSuite.srpSuites 948 if "srp_sha_rsa" in keyExchangeNames: 949 keyExchangeSuites += CipherSuite.srpCertSuites 950 if "dh_anon" in keyExchangeNames: 951 keyExchangeSuites += CipherSuite.anonSuites 952 if "ecdh_anon" in keyExchangeNames: 953 keyExchangeSuites += CipherSuite.ecdhAnonSuites 954 955 return [s for s in suites if s in macSuites and 956 s in cipherSuites and s in keyExchangeSuites]
957 958 # SRP key exchange 959 srpSuites = [] 960 srpSuites.append(TLS_SRP_SHA_WITH_AES_256_CBC_SHA) 961 srpSuites.append(TLS_SRP_SHA_WITH_AES_128_CBC_SHA) 962 srpSuites.append(TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA) 963 964 @classmethod
965 - def getSrpSuites(cls, settings, version=None):
966 """Return SRP cipher suites matching settings""" 967 return cls._filterSuites(CipherSuite.srpSuites, settings, version)
968 969 # SRP key exchange, RSA authentication 970 srpCertSuites = [] 971 srpCertSuites.append(TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA) 972 srpCertSuites.append(TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA) 973 srpCertSuites.append(TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA) 974 975 @classmethod
976 - def getSrpCertSuites(cls, settings, version=None):
977 """Return SRP cipher suites that use server certificates""" 978 return cls._filterSuites(CipherSuite.srpCertSuites, settings, version)
979 980 srpAllSuites = srpSuites + srpCertSuites 981 982 @classmethod
983 - def getSrpAllSuites(cls, settings, version=None):
984 """Return all SRP cipher suites matching settings""" 985 return cls._filterSuites(CipherSuite.srpAllSuites, settings, version)
986 987 # RSA key exchange, RSA authentication 988 certSuites = [] 989 certSuites.append(TLS_RSA_WITH_AES_256_GCM_SHA384) 990 certSuites.append(TLS_RSA_WITH_AES_128_GCM_SHA256) 991 certSuites.append(TLS_RSA_WITH_AES_256_CBC_SHA256) 992 certSuites.append(TLS_RSA_WITH_AES_128_CBC_SHA256) 993 certSuites.append(TLS_RSA_WITH_AES_256_CBC_SHA) 994 certSuites.append(TLS_RSA_WITH_AES_128_CBC_SHA) 995 certSuites.append(TLS_RSA_WITH_3DES_EDE_CBC_SHA) 996 certSuites.append(TLS_RSA_WITH_RC4_128_SHA) 997 certSuites.append(TLS_RSA_WITH_RC4_128_MD5) 998 certSuites.append(TLS_RSA_WITH_NULL_MD5) 999 certSuites.append(TLS_RSA_WITH_NULL_SHA) 1000 certSuites.append(TLS_RSA_WITH_NULL_SHA256) 1001 1002 @classmethod
1003 - def getCertSuites(cls, settings, version=None):
1004 """Return ciphers with RSA authentication matching settings""" 1005 return cls._filterSuites(CipherSuite.certSuites, settings, version)
1006 1007 # FFDHE key exchange, RSA authentication 1008 dheCertSuites = [] 1009 dheCertSuites.append(TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256) 1010 dheCertSuites.append(TLS_DHE_RSA_WITH_CHACHA20_POLY1305_draft_00) 1011 dheCertSuites.append(TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) 1012 dheCertSuites.append(TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) 1013 dheCertSuites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256) 1014 dheCertSuites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256) 1015 dheCertSuites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA) 1016 dheCertSuites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA) 1017 dheCertSuites.append(TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA) 1018 1019 @classmethod
1020 - def getDheCertSuites(cls, settings, version=None):
1021 """Provide authenticated DHE ciphersuites matching settings""" 1022 return cls._filterSuites(CipherSuite.dheCertSuites, settings, version)
1023 1024 # ECDHE key exchange, RSA authentication 1025 ecdheCertSuites = [] 1026 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) 1027 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_draft_00) 1028 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) 1029 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) 1030 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) 1031 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) 1032 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) 1033 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) 1034 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA) 1035 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_RC4_128_SHA) 1036 ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_NULL_SHA) 1037 1038 @classmethod
1039 - def getEcdheCertSuites(cls, settings, version=None):
1040 """Provide authenticated ECDHE ciphersuites matching settings""" 1041 return cls._filterSuites(CipherSuite.ecdheCertSuites, settings, version)
1042 1043 # RSA authentication 1044 certAllSuites = srpCertSuites + certSuites + dheCertSuites + ecdheCertSuites 1045 1046 # ECDHE key exchange, ECDSA authentication 1047 ecdheEcdsaSuites = [] 1048 ecdheEcdsaSuites.append(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) 1049 ecdheEcdsaSuites.append(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) 1050 ecdheEcdsaSuites.append(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384) 1051 ecdheEcdsaSuites.append(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) 1052 ecdheEcdsaSuites.append(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) 1053 ecdheEcdsaSuites.append(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) 1054 ecdheEcdsaSuites.append(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA) 1055 ecdheEcdsaSuites.append(TLS_ECDHE_ECDSA_WITH_RC4_128_SHA) 1056 ecdheEcdsaSuites.append(TLS_ECDHE_ECDSA_WITH_NULL_SHA) 1057 1058 # anon FFDHE key exchange 1059 anonSuites = [] 1060 anonSuites.append(TLS_DH_ANON_WITH_AES_256_GCM_SHA384) 1061 anonSuites.append(TLS_DH_ANON_WITH_AES_128_GCM_SHA256) 1062 anonSuites.append(TLS_DH_ANON_WITH_AES_256_CBC_SHA256) 1063 anonSuites.append(TLS_DH_ANON_WITH_AES_256_CBC_SHA) 1064 anonSuites.append(TLS_DH_ANON_WITH_AES_128_CBC_SHA256) 1065 anonSuites.append(TLS_DH_ANON_WITH_AES_128_CBC_SHA) 1066 anonSuites.append(TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA) 1067 anonSuites.append(TLS_DH_ANON_WITH_RC4_128_MD5) 1068 1069 @classmethod
1070 - def getAnonSuites(cls, settings, version=None):
1071 """Provide anonymous DH ciphersuites matching settings""" 1072 return cls._filterSuites(CipherSuite.anonSuites, settings, version)
1073 1074 dhAllSuites = dheCertSuites + anonSuites 1075 1076 # anon ECDHE key exchange 1077 ecdhAnonSuites = [] 1078 ecdhAnonSuites.append(TLS_ECDH_ANON_WITH_AES_256_CBC_SHA) 1079 ecdhAnonSuites.append(TLS_ECDH_ANON_WITH_AES_128_CBC_SHA) 1080 ecdhAnonSuites.append(TLS_ECDH_ANON_WITH_3DES_EDE_CBC_SHA) 1081 ecdhAnonSuites.append(TLS_ECDH_ANON_WITH_RC4_128_SHA) 1082 ecdhAnonSuites.append(TLS_ECDH_ANON_WITH_NULL_SHA) 1083 1084 @classmethod
1085 - def getEcdhAnonSuites(cls, settings, version=None):
1086 """Provide anonymous ECDH ciphersuites matching settings""" 1087 return cls._filterSuites(CipherSuite.ecdhAnonSuites, settings, version)
1088 1089 # all ciphersuites which use ephemeral ECDH key exchange 1090 ecdhAllSuites = ecdheEcdsaSuites + ecdheCertSuites + ecdhAnonSuites 1091 1092 @staticmethod
1093 - def canonicalCipherName(ciphersuite):
1094 """Return the canonical name of the cipher whose number is provided.""" 1095 if ciphersuite in CipherSuite.aes128GcmSuites: 1096 return "aes128gcm" 1097 elif ciphersuite in CipherSuite.aes256GcmSuites: 1098 return "aes256gcm" 1099 elif ciphersuite in CipherSuite.aes128Suites: 1100 return "aes128" 1101 elif ciphersuite in CipherSuite.aes256Suites: 1102 return "aes256" 1103 elif ciphersuite in CipherSuite.rc4Suites: 1104 return "rc4" 1105 elif ciphersuite in CipherSuite.tripleDESSuites: 1106 return "3des" 1107 elif ciphersuite in CipherSuite.nullSuites: 1108 return "null" 1109 elif ciphersuite in CipherSuite.chacha20draft00Suites: 1110 return "chacha20-poly1305_draft00" 1111 elif ciphersuite in CipherSuite.chacha20Suites: 1112 return "chacha20-poly1305" 1113 else: 1114 return None
1115 1116 @staticmethod
1117 - def canonicalMacName(ciphersuite):
1118 """Return the canonical name of the MAC whose number is provided.""" 1119 if ciphersuite in CipherSuite.sha384Suites: 1120 return "sha384" 1121 elif ciphersuite in CipherSuite.sha256Suites: 1122 return "sha256" 1123 elif ciphersuite in CipherSuite.shaSuites: 1124 return "sha" 1125 elif ciphersuite in CipherSuite.md5Suites: 1126 return "md5" 1127 else: 1128 return None
1129
1130 1131 # The following faults are induced as part of testing. The faultAlerts 1132 # dictionary describes the allowed alerts that may be triggered by these 1133 # faults. 1134 -class Fault:
1135 badUsername = 101 1136 badPassword = 102 1137 badA = 103 1138 clientSrpFaults = list(range(101,104)) 1139 1140 badVerifyMessage = 601 1141 clientCertFaults = list(range(601,602)) 1142 1143 badPremasterPadding = 501 1144 shortPremasterSecret = 502 1145 clientNoAuthFaults = list(range(501,503)) 1146 1147 badB = 201 1148 serverFaults = list(range(201,202)) 1149 1150 badFinished = 300 1151 badMAC = 301 1152 badPadding = 302 1153 genericFaults = list(range(300,303)) 1154 1155 faultAlerts = {\ 1156 badUsername: (AlertDescription.unknown_psk_identity, \ 1157 AlertDescription.bad_record_mac),\ 1158 badPassword: (AlertDescription.bad_record_mac,),\ 1159 badA: (AlertDescription.illegal_parameter,),\ 1160 badPremasterPadding: (AlertDescription.bad_record_mac,),\ 1161 shortPremasterSecret: (AlertDescription.bad_record_mac,),\ 1162 badVerifyMessage: (AlertDescription.decrypt_error,),\ 1163 badFinished: (AlertDescription.decrypt_error,),\ 1164 badMAC: (AlertDescription.bad_record_mac,),\ 1165 badPadding: (AlertDescription.bad_record_mac,) 1166 } 1167 1168 faultNames = {\ 1169 badUsername: "bad username",\ 1170 badPassword: "bad password",\ 1171 badA: "bad A",\ 1172 badPremasterPadding: "bad premaster padding",\ 1173 shortPremasterSecret: "short premaster secret",\ 1174 badVerifyMessage: "bad verify message",\ 1175 badFinished: "bad finished message",\ 1176 badMAC: "bad MAC",\ 1177 badPadding: "bad padding" 1178 }
1179