a
    kÄ#dy�  ã                %   @   sJ  d Z ddlmZ ddlZddlZddlmZmZ ddlm	Z	 ddl
mZmZmZmZmZmZmZmZmZmZ ddlmZ ddlmZmZmZ dd	lmZmZ dd
lmZ ddl m!Z!m"Z" ddl#m$Z$m%Z% ddl&m'Z'm(Z(m)Z)m*Z*m+Z+ ej,�rddl-m.Z. ddl/m0Z0m1Z1 ddl2m3Z3 ej4�r4ddl/m5Z5 ddl/m6Z6 dddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7œ$Z7d8d9„ Z8d:d;„ Z9G d<d=„ d=eƒZ:G d>d?„ d?eƒZ;G d@dA„ dAeƒZ<G dBdC„ dCeƒZ=G dDdE„ dEeƒZ>G dFdG„ dGeƒZ?G dHdI„ dIeƒZ@G dJdK„ dKeƒZAG dLdM„ dMeƒZBdNdOdPdQœZCdRdSdTœZDG dUdV„ dVeƒZEG dWdX„ dXeƒZFG dYdZ„ dZeƒZGeFeGdTœZHG d[d\„ d\eƒZIG d]d^„ d^eƒZJG d_d`„ d`eƒZKG dadb„ dbeƒZLG dcdd„ ddeƒZMeKeLeMdQœZNdedf„ ZOG dgdh„ dheƒZPG didj„ djeƒZQG dkdl„ dleƒZRG dmdn„ dneƒZSG dodp„ dpeƒZTG dqdr„ dreƒZUG dsdt„ dteƒZVdS )uz
TLS key exchange logic.
é    )Úabsolute_importN)ÚconfÚcrypto_validator)Úwarning)
ÚByteEnumFieldÚ	ByteFieldÚ	EnumFieldÚFieldLenFieldÚFieldListFieldÚPacketFieldÚShortEnumFieldÚ
ShortFieldÚStrFixedLenFieldÚStrLenField)Úorb)ÚPacketÚRawÚPadding)Ú	PubKeyRSAÚ
PrivKeyRSA)Ú_GenericTLSSessionInheritance)Ú_tls_versionÚ_TLSClientVersionField)Ú
pkcs_i2ospÚ
pkcs_os2ip)Ú_ffdh_groupsÚ_tls_named_curvesÚ_tls_named_groups_generateÚ_tls_named_groups_importÚ_tls_named_groups_pubbytes)Údefault_backend)ÚdhÚec)Úserialization)Úx25519)Úx448z	none+anonznone+rsaznone+dsaz
none+ecdsazmd5+anonzmd5+rsazmd5+dsaz	md5+ecdsaz	sha1+anonzsha1+rsazsha1+dsaz
sha1+ecdsazsha224+anonz
sha224+rsaz
sha224+dsazsha224+ecdsazsha256+anonz
sha256+rsaz
sha256+dsazsha256+ecdsazsha384+anonz
sha384+rsaz
sha384+dsazsha384+ecdsazsha512+anonz
sha512+rsaz
sha512+dsazsha512+ecdsazsha256+rsaepsszsha384+rsaepsszsha512+rsaepssZed25519Zed448zsha256+rsapsszsha384+rsapsszsha512+rsapss)$r   é   é   é   é   i  i  i  é   i  i  i  é   é  i  é  i   i  i  i  i   i  i  i  i   i  i  i  é  i  i  i  i  i	  i
  i  c                 C   s"   | j s
dS | j jsdS | j jdk S )a%  
    We expect this. If tls_version is not set, this means we did not process
    any complete ClientHello, so we're most probably reading/building a
    signature_algorithms extension, hence we cannot be in phantom_mode.
    However, if the tls_version has been set, we test for TLS 1.2.
    Fr-   )Útls_sessionÚtls_version©Úpkt© r3   úS/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/layers/tls/keyexchange.pyÚphantom_modeE   s
    r5   c                    s   ‡ ‡fdd„}|S )z¦
    Decorator for version-dependent fields.
    If get_or_add is True (means get), we return s, self.phantom_value.
    If it is False (means add), we return s.
    c                     s4   | d d… \}}}t |ƒr,ˆr(||jfS |S ˆ | Ž S )Nr(   )r5   Úphantom_value)ÚargsÚselfr2   Ús©ÚfÚ
get_or_addr3   r4   ÚwrapperY   s    
z!phantom_decorate.<locals>.wrapperr3   )r;   r<   r=   r3   r:   r4   Úphantom_decorateS   s    r>   c                   @   s,   e Zd ZdZdZeejdƒZeejdƒZdS )ÚSigAndHashAlgFieldzUsed in _TLSSignature.NTF)	Ú__name__Ú
__module__Ú__qualname__Ú__doc__r6   r>   r   ÚgetfieldÚaddfieldr3   r3   r3   r4   r?   c   s   r?   c                   @   s,   e Zd ZdZdZeejdƒZeejdƒZdS )ÚSigAndHashAlgsLenFieldú?Used in TLS_Ext_SignatureAlgorithms and TLSCertificateResquest.r   TFN)	r@   rA   rB   rC   r6   r>   r	   rD   rE   r3   r3   r3   r4   rF   j   s   rF   c                   @   s,   e Zd ZdZg ZeejdƒZeejdƒZdS )ÚSigAndHashAlgsFieldrG   TFN)	r@   rA   rB   rC   r6   r>   r
   rD   rE   r3   r3   r3   r4   rH   q   s   rH   c                       s,   e Zd ZdZ‡ fdd„Z‡ fdd„Z‡  ZS )ÚSigLenFieldú:There is a trick for SSLv2, which uses implicit lengths...c                    s.   |j j}|r|dk r|d fS tt| ƒ ||¡S )Nr+   )r/   r0   ÚsuperrI   rD   )r8   r2   r9   Úv©Ú	__class__r3   r4   rD   {   s    zSigLenField.getfieldc                    s,   |j j}|r|dk r|S tt| ƒ |||¡S )z3With SSLv2 you will never be able to add a sig_len.r+   )r/   r0   rK   rI   rE   )r8   r2   r9   ÚvalrL   rM   r3   r4   rE   �   s    zSigLenField.addfield)r@   rA   rB   rC   rD   rE   Ú__classcell__r3   r3   rM   r4   rI   x   s   rI   c                       s    e Zd ZdZ‡ fdd„Z‡  ZS )ÚSigValFieldrJ   c                    sx   |j }|jrf|jdk rft|jƒdkr:|jd jjjd }ntdƒ d}||d … |  ||d |… ¡fS t	t
| ƒ ||¡S )Nr+   r   é   zSNo client certificate provided. We're making a wild guess about the signature size.r)   )r/   r0   ÚlenZclient_certsZpubKeyÚpubkeyÚkey_sizer   Úm2irK   rQ   rD   )r8   r2   Úmr9   Úsig_lenrM   r3   r4   rD   Œ   s     zSigValField.getfield)r@   rA   rB   rC   rD   rP   r3   r3   rM   r4   rQ   ‰   s   rQ   c                       sh   e Zd ZdZdZeddeƒeddddd	�eddd
d„ d�gZ	‡ fdd„Z
dd„ Zdd„ Zdd„ Z‡  ZS )Ú_TLSSignatureaV  
    Prior to TLS 1.2, digitally-signed structure implicitly used the
    concatenation of a MD5 hash and a SHA-1 hash.
    Then TLS 1.2 introduced explicit SignatureAndHashAlgorithms,
    i.e. couples of (hash_alg, sig_alg). See RFC 5246, section 7.4.1.4.1.

    By default, the _TLSSignature implements the TLS 1.2 scheme,
    but if it is provided a TLS context with a tls_version < 0x0303
    at initialization, it will fall back to the implicit signature.
    Even more, the 'sig_len' field won't be used with SSLv2.

    #XXX 'sig_alg' should be set in __init__ depending on the context.
    zTLS Digital SignatureÚsig_algr.   rX   Nú!HÚsig_val)ÚfmtÚ	length_ofc                 C   s   | j S ©N)rX   r1   r3   r3   r4   Ú<lambda>¬   ó    z_TLSSignature.<lambda>©Úlength_fromc                    sN   t t| ƒj|i |¤Ž | jrJ| jjrJ| jjdk r8d | _n| jjdkrJd| _d S )Nr-   i  r.   )rK   rY   Ú__init__r/   r0   rZ   ©r8   r7   ÚkargsrM   r3   r4   rd   ®   s    ÿz_TLSSignature.__init__c                 C   s|   | j du r>| jjdkr*|j|ddd�| _qx|j|ddd�| _n:t| j   d¡\}}| d¡rbd}nd}|j|||d�| _dS )	zè
        Sign 'm' with the PrivKey 'key' and update our own 'sig_val'.
        Note that, even when 'sig_alg' is not None, we use the signature scheme
        of the PrivKey (neither do we care to compare the both of them).
        Nr+   Úpkcsúmd5-sha1©ÚtÚhÚmd5ú+Úpss)rZ   r/   r0   Úsignr\   Ú_tls_hash_sigÚsplitÚendswith)r8   rW   Úkeyrk   Úsigrj   r3   r3   r4   Ú_update_sig¹   s    

z_TLSSignature._update_sigc                 C   s€   | j r|| jrHt| j  d¡\}}| d¡r0d}nd}|j|| j ||d�S | jjdkrh|j|| j ddd�S |j|| j ddd�S dS )	z~
        Verify that our own 'sig_val' carries the signature of 'm' by the
        key associated to the Cert 'cert'.
        rm   rn   rg   ri   r+   rh   rl   F)r\   rZ   rp   rq   rr   Úverifyr/   r0   )r8   rW   Úcertrk   rt   rj   r3   r3   r4   Ú_verify_sigÌ   s    
z_TLSSignature._verify_sigc                 C   s   t S r_   ©r   ©r8   Úpr3   r3   r4   Úguess_payload_classà   s    z!_TLSSignature.guess_payload_class)r@   rA   rB   rC   Únamer?   rp   rI   rQ   Úfields_descrd   ru   rx   r|   rP   r3   r3   rM   r4   rY   ™   s   
ÿÿýrY   c                   @   s0   e Zd ZdZdgZd
dd„Zdd„ Zdd	„ ZdS )Ú_TLSSignatureFieldz�
    Used for 'digitally-signed struct' in several ServerKeyExchange,
    and also in CertificateVerify. We can handle the anonymous case.
    rc   Nc                 C   s   || _ t | ||t¡ d S r_   )rc   r   rd   rY   ©r8   r}   Údefaultrc   r3   r3   r4   rd   ë   s    z_TLSSignatureField.__init__c                 C   s$   |   |¡}|dkrd S t||jd�S )Nr   ©r/   )rc   rY   r/   )r8   r2   rW   Útmp_lenr3   r3   r4   rV   ï   s    
z_TLSSignatureField.m2ic                 C   sH   |   ||¡}|d u r|d fS d}tj|v r@|tj }|j`|j}||fS )Nra   )rV   r   Zpadding_layerZ
underlayerÚpayloadÚload)r8   r2   r9   ÚiÚremainÚrr3   r3   r4   rD   õ   s    

z_TLSSignatureField.getfield)N)r@   rA   rB   rC   Ú	__slots__rd   rV   rD   r3   r3   r3   r4   r   ä   s
   
r   c                   @   s(   e Zd ZdZdgZddd„Zdd„ ZdS )	Ú_TLSServerParamsFielda  
    This is a dispatcher for the Server*DHParams below, used in
    TLSServerKeyExchange and based on the key_exchange.server_kx_msg_cls.
    When this cls is None, it means that we should not see a ServerKeyExchange,
    so we grab everything within length_from and make it available using Raw.

    When the context has not been set (e.g. when no ServerHello was parsed or
    dissected beforehand), we (kinda) clumsily set the cls by trial and error.
    XXX We could use Serv*DHParams.check_params() once it has been implemented.
    rc   Nc                 C   s   || _ t | ||d ¡ d S r_   )rc   r   rd   r€   r3   r3   r4   rd     s    z_TLSServerParamsField.__init__c                 C   sî   |j }|  |¡}|jrX|jj |¡}|d u rLt|d |… ƒt||d … ƒ S |||d�S z,t||d�}t|j	d d… ƒt
vr€t‚|W S  tyè   t|ƒ}|||d�}t|j	d d… ƒt
vràt|d |… ƒt||d … ƒ  Y S | Y S 0 d S )Nr‚   r'   )r/   rc   ZprcsZkey_exchangeZserver_kx_msg_clsr   r   ÚServerDHParamsr   r…   rp   Ú	ExceptionÚ_tls_server_ecdh_cls_guess)r8   r2   rW   r9   rƒ   Úclsr{   r3   r3   r4   rV     s$    
 $z_TLSServerParamsField.m2i)N)r@   rA   rB   rC   r‰   rd   rV   r3   r3   r3   r4   rŠ     s   

rŠ   c                
   @   s”   e Zd ZdZdZedddd�edddd	„ d
�edddd�edddd	„ d
�edddd�edddd	„ d
�gZedd„ ƒZ	edd„ ƒZ
dd„ Zdd„ ZdS )r‹   a  
    ServerDHParams for FFDH-based key exchanges, as defined in RFC 5246/7.4.3.

    Either with .fill_missing() or .post_dissection(), the server_kx_privkey or
    server_kx_pubkey of the TLS context are updated according to the
    parsed/assembled values. It is the user's responsibility to store and
    restore the original values if he wants to keep them. For instance, this
    could be done between the writing of a ServerKeyExchange and the receiving
    of a ClientKeyExchange (which includes secret generation).
    zServer FFDH parametersÚdh_plenNÚdh_p©r^   Ú c                 C   s   | j S r_   )r�   r1   r3   r3   r4   r`   <  ra   zServerDHParams.<lambda>rb   Údh_glenÚdh_gc                 C   s   | j S r_   )r“   r1   r3   r3   r4   r`   ?  ra   Údh_YslenÚdh_Ysc                 C   s   | j S r_   )r•   r1   r3   r3   r4   r`   B  ra   c           	      C   sø   | j }td d  ¡ }td d }| js:t|j|d ƒ| _| jdu rPt| jƒ| _| jsdt|j	dƒ| _| j
du rtd| _
t| jƒ}t| jƒ}t ||¡ tƒ ¡}| jsÒ| ¡ |_|j ¡ }| ¡ j}t||jd ƒ| _| jdu rèt| jƒ| _|jsô||_dS )a#  
        We do not want TLSServerKeyExchange.build() to overload and recompute
        things every time it is called. This method can be called specifically
        to have things filled in a smart fashion.

        Note that we do not expect default_params.g to be more than 0xff.
        Zmodp2048r   r&   rR   N)r/   r   Úparameter_numbersr�   r   r{   r�   rS   r”   Úgr“   r   r!   ÚDHParameterNumbersÚ
parametersr    r–   Úgenerate_private_keyÚserver_kx_privkeyÚ
public_keyÚpublic_numbersÚyrU   r•   Úclient_kx_ffdh_params)	r8   r9   Zdefault_paramsZdefault_mLenr{   r˜   Zreal_paramsrT   rŸ   r3   r3   r4   Úfill_missingD  s.    	







zServerDHParams.fill_missingc                 C   sb   t | jƒ}t | jƒ}t ||¡}t | jƒ}t ||¡}| j}| t	ƒ ¡|_
|js^| t	ƒ ¡|_dS )zE
        XXX Check that the pubkey received is in the group.
        N)r   r�   r”   r!   r™   r–   ÚDHPublicNumbersr/   r�   r    Úserver_kx_pubkeyr    rš   )r8   r{   r˜   ZpnrŸ   rž   r9   r3   r3   r4   Úregister_pubkeyl  s    


zServerDHParams.register_pubkeyc                 C   s$   z|   ¡  W n ty   Y n0 d S r_   ©r¤   ÚImportError©r8   rˆ   r3   r3   r4   Úpost_dissection~  s    zServerDHParams.post_dissectionc                 C   s   t S )zÕ
        The signature after the params gets saved as Padding.
        This way, the .getfield() which _TLSServerParamsField inherits
        from PacketField will return the signature remain as expected.
        ry   rz   r3   r3   r4   r|   „  s    z"ServerDHParams.guess_payload_class©r@   rA   rB   rC   r}   r	   r   r~   r   r¡   r¤   r¨   r|   r3   r3   r3   r4   r‹   .  s*   
ÿÿÿù

'
r‹   Úexplicit_primeÚexplicit_char2Únamed_curve)r&   r'   r(   Zec_basis_trinomialZec_basis_pentanomial)r   r&   c                   @   sP   e Zd ZdZeddddd�edddd	„ d
�eddddd�edddd	„ d
�gZdS )Ú
ECCurvePktzElliptic CurveÚalenNÚaÚB©r^   r]   r’   c                 C   s   | j S r_   )r®   r1   r3   r3   r4   r`   ™  ra   zECCurvePkt.<lambda>rb   ÚblenÚbc                 C   s   | j S r_   )r²   r1   r3   r3   r4   r`   ›  ra   )r@   rA   rB   r}   r	   r   r~   r3   r3   r3   r4   r­   –  s   ýr­   c                   @   s>   e Zd ZdZdZeddddd�eddd	d
„ d�gZdd„ ZdS )ÚECTrinomialBasiszEC Trinomial Basisr   ÚklenNÚkr°   r±   r’   c                 C   s   | j S r_   )rµ   r1   r3   r3   r4   r`   ¤  ra   zECTrinomialBasis.<lambda>rb   c                 C   s   t S r_   ry   rz   r3   r3   r4   r|   ¦  s    z$ECTrinomialBasis.guess_payload_class©	r@   rA   rB   r}   rO   r	   r   r~   r|   r3   r3   r3   r4   r´      s   ÿr´   c                
   @   sz   e Zd ZdZdZeddddd�eddd	d
„ d�eddddd�edddd
„ d�eddddd�edddd
„ d�gZdd„ ZdS )ÚECPentanomialBasiszEC Pentanomial Basisr&   Úk1lenNZk1r°   r±   r’   c                 C   s   | j S r_   )r¹   r1   r3   r3   r4   r`   ®  ra   zECPentanomialBasis.<lambda>rb   Úk2lenZk2c                 C   s   | j S r_   )rº   r1   r3   r3   r4   r`   °  ra   Úk3lenZk3c                 C   s   | j S r_   )r»   r1   r3   r3   r4   r`   ²  ra   c                 C   s   t S r_   ry   rz   r3   r3   r4   r|   ´  s    z&ECPentanomialBasis.guess_payload_classr·   r3   r3   r3   r4   r¸   ª  s   ûr¸   c                   @   s$   e Zd ZdgZddd„Zdd„ ZdS )	Ú_ECBasisTypeFieldÚbasis_type_ofr   c                 C   s   || _ t | |||d¡ d S )Nr°   )r½   r   rd   )r8   r}   r�   Úenumr½   r‡   r3   r3   r4   rd   ¾  s    z_ECBasisTypeField.__init__c                 C   s(   |d u r$|  | j¡\}}| ||¡}|S r_   )Zgetfield_and_valr½   Úi2basis_type)r8   r2   ÚxZfldZfvalr3   r3   r4   Úi2mÂ  s    z_ECBasisTypeField.i2mN)r   )r@   rA   rB   r‰   rd   rÁ   r3   r3   r3   r4   r¼   »  s   
r¼   c                   @   s,   e Zd ZddgZdd„ Zdd„ Zdd„ Zd	S )
Ú_ECBasisFieldÚclsdictÚbasis_type_fromc                 C   s    || _ || _t | ||d ¡ d S r_   )rÃ   rÄ   r   rd   )r8   r}   r�   rÄ   rÃ   r3   r3   r4   rd   Ì  s    z_ECBasisField.__init__c                 C   s   |   |¡}| j| }||ƒS r_   )rÄ   rÃ   )r8   r2   rW   ÚbasisrŽ   r3   r3   r4   rV   Ñ  s    

z_ECBasisField.m2ic                 C   s&   d}z
|j }W n ty    Y n0 |S ©Nr   )rO   rŒ   )r8   r2   rÀ   rO   r3   r3   r4   r¿   Ö  s    
z_ECBasisField.i2basis_typeN)r@   rA   rB   r‰   rd   rV   r¿   r3   r3   r3   r4   rÂ   É  s   rÂ   c                   @   sÒ   e Zd ZdZdZeddeƒeddddd	�edd
dd„ d�e	dde
ƒeddddd	�edd
dd„ d�eddddd	�edd
dd„ d�eddddd	�edd
dd„ d�eddddd	�edd
dd„ d�gZdd„ Zdd„ ZdS )ÚServerECDHExplicitPrimeParamsz—
    We provide parsing abilities for ExplicitPrimeParams, but there is no
    support from the cryptography library, hence no context operations.
    z'Server ECDH parameters - Explicit PrimeÚ
curve_typer&   ÚplenNr{   r°   r±   r’   c                 C   s   | j S r_   )rÉ   r1   r3   r3   r4   r`   ï  ra   z&ServerECDHExplicitPrimeParams.<lambda>rb   ÚcurveÚbaselenÚbasec                 C   s   | j S r_   ©rË   r1   r3   r3   r4   r`   ó  ra   ÚorderlenÚorderc                 C   s   | j S r_   )rÎ   r1   r3   r3   r4   r`   ÷  ra   ÚcofactorlenÚcofactorc                 C   s   | j S r_   )rÐ   r1   r3   r3   r4   r`   û  ra   ÚpointlenÚpointc                 C   s   | j S r_   ©rÒ   r1   r3   r3   r4   r`   ÿ  ra   c                 C   s   | j du rtd | _ dS )z—
        Note that if it is not set by the user, the cofactor will always
        be 1. It is true for most, but not all, TLS elliptic curves.
        Nrª   ©rÈ   Ú_tls_ec_curve_types©r8   r3   r3   r4   r¡     s    
z*ServerECDHExplicitPrimeParams.fill_missingc                 C   s   t S r_   ry   rz   r3   r3   r4   r|   	  s    z1ServerECDHExplicitPrimeParams.guess_payload_class)r@   rA   rB   rC   r}   r   rÖ   r	   r   r   r­   r~   r¡   r|   r3   r3   r3   r4   rÇ   ç  s>   

ÿÿÿÿÿÿÿïrÇ   c                   @   s°   e Zd ZdZdZeddeƒeddƒedde	dƒe
deƒ d	d
„ eƒedeƒ eƒeddddd�edddd
„ d�eddƒeddƒeddddd�edddd
„ d�gZdd„ Zdd„ ZdS )ÚServerECDHExplicitChar2Paramsz�
    We provide parsing abilities for Char2Params, but there is no
    support from the cryptography library, hence no context operations.
    z'Server ECDH parameters - Explicit Char2rÈ   r'   rW   NÚ
basis_typerÅ   c                 C   s   | j S r_   )rÙ   r1   r3   r3   r4   r`     ra   z&ServerECDHExplicitChar2Params.<lambda>rÊ   rË   rÌ   r°   r±   r’   c                 C   s   | j S r_   rÍ   r1   r3   r3   r4   r`     ra   rb   rÏ   rÑ   rÒ   rÓ   c                 C   s   | j S r_   rÔ   r1   r3   r3   r4   r`   #  ra   c                 C   s   | j d u rtd | _ d S )Nr«   rÕ   r×   r3   r3   r4   r¡   %  s    
z*ServerECDHExplicitChar2Params.fill_missingc                 C   s   t S r_   ry   rz   r3   r3   r4   r|   )  s    z1ServerECDHExplicitChar2Params.guess_payload_class)r@   rA   rB   rC   r}   r   rÖ   r   r¼   Ú_tls_ec_basis_typesrÂ   r´   Ú_tls_ec_basis_clsr   r­   r	   r   r   r~   r¡   r|   r3   r3   r3   r4   rØ     s6   
ÿþÿÿÿñrØ   c                   @   sn   e Zd ZdZeddeƒeddeƒeddddd	�e	ddd
d„ d�gZ
edd„ ƒZedd„ ƒZdd„ Zdd„ ZdS )ÚServerECDHNamedCurveParamsz$Server ECDH parameters - Named CurverÈ   r(   r¬   NrÒ   rÓ   r°   r±   c                 C   s   | j S r_   rÔ   r1   r3   r3   r4   r`   4  ra   z#ServerECDHNamedCurveParams.<lambda>rb   c                 C   s‚   | j }| jdu rtd | _| jdu r*d| _| j}|tvr<d}t|ƒ|_| jdu r\t|jƒ| _| j	du rrt
| jƒ| _	|js~||_dS )a&  
        We do not want TLSServerKeyExchange.build() to overload and recompute
        things every time it is called. This method can be called specifically
        to have things filled in a smart fashion.

        XXX We should account for the point_format (before 'point' filling).
        Nr¬   é   )r/   rÈ   rÖ   r¬   r   r   rœ   rÓ   r   rÒ   rS   Úclient_kx_ecdh_params)r8   r9   Zcurve_groupr3   r3   r4   r¡   6  s"    	




ÿ
z'ServerECDHNamedCurveParams.fill_missingc                 C   s(   | j }t| j| jƒ|_|js$| j|_dS )zr
        XXX Support compressed point format.
        XXX Check that the pubkey received is on the curve.
        N)r/   r   r¬   rÓ   r£   rÞ   )r8   r9   r3   r3   r4   r¤   Y  s    
þz*ServerECDHNamedCurveParams.register_pubkeyc                 C   s$   z|   ¡  W n ty   Y n0 d S r_   r¥   r§   r3   r3   r4   r¨   l  s    z*ServerECDHNamedCurveParams.post_dissectionc                 C   s   t S r_   ry   rz   r3   r3   r4   r|   r  s    z.ServerECDHNamedCurveParams.guess_payload_class)r@   rA   rB   r}   r   rÖ   r   r   r	   r   r~   r   r¡   r¤   r¨   r|   r3   r3   r3   r4   rÜ   -  s    

ÿÿü
"
rÜ   c                 C   s    | sd S t | d ƒ}t |d ¡S rÆ   )r   Ú_tls_server_ecdh_clsÚget)rW   rÈ   r3   r3   r4   r�   {  s    r�   c                   @   sx   e Zd ZdZdZedddd�edddd	„ d
�edddd�edddd	„ d
�gZedd„ ƒZ	edd„ ƒZ
dd„ Zdd„ ZdS )ÚServerRSAParamsa  
    Defined for RSA_EXPORT kx : it enables servers to share RSA keys shorter
    than their principal {>512}-bit key, when it is not allowed for kx.

    This should not appear in standard RSA kx negotiation, as the key
    has already been advertised in the Certificate message.
    zServer RSA_EXPORT parametersÚ	rsamodlenNÚrsamodr‘   r’   c                 C   s   | j S r_   )râ   r1   r3   r3   r4   r`   �  ra   zServerRSAParams.<lambda>rb   Ú	rsaexplenÚrsaexpc                 C   s   | j S r_   )rä   r1   r3   r3   r4   r`   ’  ra   c                 C   s¤   t ƒ }|jdd� || j_|j ¡ }| js@t|j|jj	d ƒ| _| j
d u rVt| jƒ| _
t t |j¡t d¡ d ¡}| jsŠt|j|ƒ| _| jd u r t| jƒ| _d S )Nr*   )Z
modulusLenrR   r'   g       @)r   Zfill_and_storer/   Úserver_tmp_rsa_keyrT   rž   rã   r   ÚnrU   râ   rS   ÚmathÚceilÚlogÚerå   rä   )r8   r¶   ZpubNumrä   r3   r3   r4   r¡   ”  s    

 
zServerRSAParams.fill_missingc                 C   s(   | j }| j}| j}t|||fƒ| j_d S r_   )râ   rã   rå   r   r/   ræ   )r8   ZmLenrW   rë   r3   r3   r4   r¤   ¦  s    zServerRSAParams.register_pubkeyc                 C   s$   z|   ¡  W n ty   Y n0 d S r_   r¥   ©r8   r2   r3   r3   r4   r¨   ­  s    zServerRSAParams.post_dissectionc                 C   s   t S r_   ry   rz   r3   r3   r4   r|   ³  s    z#ServerRSAParams.guess_payload_classr©   r3   r3   r3   r4   rá   „  s"   ÿÿü

rá   c                   @   sN   e Zd ZdZdZeddddd�eddd	d
„ d�gZdd„ Zdd„ Z	dd„ Z
dS )ÚServerPSKParamsa  
    XXX We provide some parsing abilities for ServerPSKParams, but the
    context operations have not been implemented yet. See RFC 4279.
    Note that we do not cover the (EC)DHE_PSK key exchange,
    which should contain a Server*DHParams after 'psk_identity_hint'.
    úServer PSK parametersÚpsk_identity_hint_lenNZpsk_identity_hintr[   r±   r’   c                 C   s   | j S r_   )rï   r1   r3   r3   r4   r`   Ä  ra   zServerPSKParams.<lambda>rb   c                 C   s   d S r_   r3   r×   r3   r3   r4   r¡   Æ  s    zServerPSKParams.fill_missingc                 C   s   d S r_   r3   rì   r3   r3   r4   r¨   É  s    zServerPSKParams.post_dissectionc                 C   s   t S r_   ry   rz   r3   r3   r4   r|   Ì  s    z#ServerPSKParams.guess_payload_class)r@   rA   rB   rC   r}   r	   r   r~   r¡   r¨   r|   r3   r3   r3   r4   rí   ¹  s   ÿÿþrí   c                   @   sX   e Zd ZdZdZedddd�edddd	„ d
�gZedd„ ƒZ	dd„ Z
dd„ Zdd„ ZdS )ÚClientDiffieHellmanPublicaƒ  
    If the user provides a value for dh_Yc attribute, we assume he will set
    the pms and ms accordingly and trigger the key derivation on his own.

    XXX As specified in 7.4.7.2. of RFC 4346, we should distinguish the needs
    for implicit or explicit value depending on availability of DH parameters
    in *client* certificate. For now we can only do ephemeral/explicit DH.
    zClient DH Public ValueÚdh_YclenNÚdh_Ycr‘   r’   c                 C   s   | j S r_   )rñ   r1   r3   r3   r4   r`   â  ra   z"ClientDiffieHellmanPublic.<lambda>rb   c                 C   sv   | j }|j ¡ |_|j ¡ }| ¡ j}t||jd ƒ| _	|jrr|j
rr|j |j
¡}| d¡|_|jrj|jrr| ¡  d S )NrR   ó    )r/   r    r›   Úclient_kx_privkeyr�   rž   rŸ   r   rU   rò   r£   ÚexchangeÚlstripÚpre_master_secretÚextmsÚsession_hashÚcompute_ms_and_derive_keys)r8   r9   rT   rŸ   Úpmsr3   r3   r4   r¡   ä  s    

z&ClientDiffieHellmanPublic.fill_missingc                 C   sR   | j s&z|  ¡  W n ty$   Y n0 | jd u r<t| j ƒ| _t| jdƒ| j  | S )Nr'   )rò   r¡   r¦   rñ   rS   r   ©r8   r2   Úpayr3   r3   r4   Ú
post_buildõ  s    
z$ClientDiffieHellmanPublic.post_buildc                 C   sx   | j }|jr:t| jƒ}|j ¡ }t ||¡}| tƒ ¡|_	|j
rt|j	rt|j
 |j	¡}| d¡|_|jrl|jrt| ¡  dS )zð
        First we update the client DHParams. Then, we try to update the server
        DHParams generated during Server*DHParams building, with the shared
        secret. Finally, we derive the session keys and update the context.
        ró   N)r/   r    r   rò   r—   r!   r¢   r�   r    Úclient_kx_pubkeyrœ   rõ   rö   r÷   rø   rù   rú   )r8   rW   r9   rŸ   Zparam_numbersrž   ÚZZr3   r3   r4   r¨   ÿ  s    

z)ClientDiffieHellmanPublic.post_dissectionc                 C   s   t S r_   ry   rz   r3   r3   r4   r|     s    z-ClientDiffieHellmanPublic.guess_payload_class)r@   rA   rB   rC   r}   r	   r   r~   r   r¡   rþ   r¨   r|   r3   r3   r3   r4   rð   Ö  s   ÿÿ

rð   c                   @   sR   e Zd ZdZdZeddddd�eddd	d
„ d�gZedd„ ƒZ	dd„ Z
dd„ ZdS )ÚClientECDiffieHellmanPubliczR
    Note that the 'len' field is 1 byte longer than with the previous class.
    zClient ECDH Public ValueÚ
ecdh_YclenNÚecdh_Ycr°   r±   r’   c                 C   s   | j S r_   )r  r1   r3   r3   r4   r`      ra   z$ClientECDiffieHellmanPublic.<lambda>rb   c                 C   sä   | j }t|jƒ|_|j ¡ }t|tjtj	fƒr`| 
tjjtjj¡| _|jrº|jrº|j |j¡}nZ| ¡ j}| ¡ j}dt||jd ƒ t||jd ƒ | _|jrº|jrº|j t ¡ |j¡}|jrà|jrà||_|jrØ|jrà| ¡  d S )Nó   rR   )r/   r   rÞ   rô   r�   Ú
isinstancer$   ZX25519PublicKeyr%   ZX448PublicKeyZpublic_bytesr#   ZEncodingr   ZPublicFormatr  r£   rõ   rž   rÀ   rŸ   r   rU   r"   ÚECDHr÷   rø   rù   rú   )r8   r9   rT   rû   rÀ   rŸ   r3   r3   r4   r¡   "  s:    ÿ
ÿþ

ÿþÿz(ClientECDiffieHellmanPublic.fill_missingc                 C   sR   | j s&z|  ¡  W n ty$   Y n0 | jd u r<t| j ƒ| _t| jdƒ| j  | S )Nr&   )r  r¡   r¦   r  rS   r   rü   r3   r3   r4   rþ   C  s    
z&ClientECDiffieHellmanPublic.post_buildc                 C   sZ   | j }|jrt|j| jƒ|_|jrV|jrV|j t ¡ |j¡}||_	|j
rN|jrV| ¡  d S r_   )r/   rÞ   r   r  rÿ   rœ   rõ   r"   r  r÷   rø   rù   rú   )r8   rW   r9   r   r3   r3   r4   r¨   M  s    þz+ClientECDiffieHellmanPublic.post_dissection)r@   rA   rB   rC   r}   r	   r   r~   r   r¡   rþ   r¨   r3   r3   r3   r4   r    s   ÿÿþ
 
r  c                       s$   e Zd ZdZdZ‡ fdd„Z‡  ZS )Ú_UnEncryptedPreMasterSecretz‰
    When the content of an EncryptedPreMasterSecret could not be deciphered,
    we use this class to represent the encrypted data.
    z*RSA Encrypted PreMaster Secret (protected)c                    s"   |  dd ¡ tt| ƒj|i |¤ŽS ©Nr/   )ÚpoprK   r  rd   re   rM   r3   r4   rd   g  s    z$_UnEncryptedPreMasterSecret.__init__)r@   rA   rB   rC   r}   rd   rP   r3   r3   rM   r4   r  `  s   r  c                   @   sR   e Zd ZdZdZeddeƒedddƒgZe	ddd„ƒZ
d	d
„ Zdd„ Zdd„ ZdS )ÚEncryptedPreMasterSecretzO
    Pay attention to implementation notes in section 7.4.7.1 of RFC 5246.
    zRSA Encrypted PreMaster SecretÚclient_versionNÚrandomé.   c                 O   s0   |r,d|v r,|d }|j d u r,|jd u r,tS tS r  )ræ   Úserver_rsa_keyr  r
  )rŽ   Z_pktr7   rf   r9   r3   r3   r4   Údispatch_hooku  s
    z&EncryptedPreMasterSecret.dispatch_hookc           	      C   sî   | j }|}|j}|d u r|j}|dkrxt|ƒdk r6|S t d|d d… ¡d }t|ƒ|d krld}t|ƒ n|dd … }|jd urœ|j |¡}|dd … }n4|j	d urÀ|j	 |¡}|dd … }nd}d}t|ƒ ||_
|jrâ|jrê| ¡  |S )	Nr,   r'   r[   r   z7TLS 1.0+, but RSA Encrypted PMS with no explicit lengthiÐÿÿÿs0                                                   z9No server RSA key to decrypt Pre Master Secret. Skipping.)r/   r0   Úadvertised_tls_versionrS   ÚstructÚunpackr   ræ   Zdecryptr  r÷   rø   rù   rú   )	r8   rW   r9   Ztbdr0   rƒ   ÚerrZ	decryptedrû   r3   r3   r4   Úpre_dissect}  s4    


z$EncryptedPreMasterSecret.pre_dissectc                 C   s²   |}| j }||_|jr|jr$| ¡  |jdur@|jj|dd�}n6|jdurnt|jƒdkrn|jd j|dd�}nt	dƒ d}|j
}|du rŽ|j}|dkr¦t dt|ƒ¡}|| | S )	a>  
        We encrypt the premaster secret (the 48 bytes) with either the server
        certificate or the temporary RSA key provided in a server key exchange
        message. After that step, we add the 2 bytes to provide the length, as
        described in implementation notes at the end of section 7.4.7.1.
        Nrg   )rj   r   z(No material to encrypt Pre Master Secretra   r,   r[   )r/   r÷   rø   rù   rú   ræ   ZencryptZserver_certsrS   r   r0   r  r  Úpack)r8   r2   rý   Úencr9   rƒ   r0   r3   r3   r4   rþ   Ÿ  s"    
z#EncryptedPreMasterSecret.post_buildc                 C   s   t S r_   ry   rz   r3   r3   r4   r|   ¼  s    z,EncryptedPreMasterSecret.guess_payload_class)N)r@   rA   rB   rC   r}   r   r   r   r~   Úclassmethodr  r  rþ   r|   r3   r3   r3   r4   r
  l  s   ÿ
þ"r
  c                   @   s6   e Zd ZdZdZeddddd�eddd	d
„ d�gZdS )ÚClientPSKIdentitya'  
    XXX We provide parsing abilities for ServerPSKParams, but the context
    operations have not been implemented yet. See RFC 4279.
    Note that we do not cover the (EC)DHE_PSK nor the RSA_PSK key exchange,
    which should contain either an EncryptedPMS or a ClientDiffieHellmanPublic.
    rî   Úpsk_identity_lenNZpsk_identityr[   r±   r’   c                 C   s   | j S r_   )r  r1   r3   r3   r4   r`   Í  ra   zClientPSKIdentity.<lambda>rb   )r@   rA   rB   rC   r}   r	   r   r~   r3   r3   r3   r4   r  Â  s   ÿÿþr  )WrC   Ú
__future__r   rè   r  Zscapy.configr   r   Zscapy.errorr   Zscapy.fieldsr   r   r   r	   r
   r   r   r   r   r   Zscapy.compatr   Zscapy.packetr   r   r   Zscapy.layers.tls.certr   r   Zscapy.layers.tls.sessionr   Zscapy.layers.tls.basefieldsr   r   Zscapy.layers.tls.crypto.pkcs1r   r   Zscapy.layers.tls.crypto.groupsr   r   r   r   r   Zcrypto_validZcryptography.hazmat.backendsr    Z)cryptography.hazmat.primitives.asymmetricr!   r"   Zcryptography.hazmat.primitivesr#   Zcrypto_valid_advancedr$   r%   rp   r5   r>   r?   rF   rH   rI   rQ   rY   r   rŠ   r‹   rÖ   rÚ   r­   r´   r¸   rÛ   r¼   rÂ   rÇ   rØ   rÜ   rß   r�   rá   rí   rð   r  r  r
  r  r3   r3   r3   r4   Ú<module>   s˜   0	ïK-aþ



& Iþ	5BHV