a kÄ#d„2ã@sÀdZddlmZddlmZddlmZddlmZddl m Z ddl m Z dd „Z d d „Zd d „Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„ZGd d!„d!eƒZd"S)#z TLS Pseudorandom Function. é)Úabsolute_import)Úwarning)Ústrxor)Ú_tls_hash_algs)Ú_tls_hmac_algs)Ú bytes_encodecCst|jj}||d|}t|ƒ}d}||ƒ |¡}|dkrh|||ƒ ||¡7}||ƒ |¡}|d8}q2|d|…S)aß Provides the implementation of P_hash function defined in section 5 of RFC 4346 (and section 5 of RFC 5246). Two parameters have been added (hm and req_len): - secret : the key to be used. If RFC 4868 is to be believed, the length must match hm.key_len. Actually, python hmac takes care of formatting every key. - seed : the seed to be used. - req_len : the length of data to be generated by iterating the specific HMAC function (hm). This prevents multiple calls to the function. - hm : the hmac function class to use for iteration (either Hmac_MD5 or Hmac_SHA1 in TLS <= 1.1 or Hmac_SHA256 or Hmac_SHA384 in TLS 1.2) éórN)Zhash_algÚhash_lenrÚdigest)ÚsecretÚseedÚreq_lenZhmr ÚnÚresÚa©rúR/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/layers/tls/crypto/prf.pyÚ _tls_P_hashs rcCst|||tdƒS)NzHMAC-MD5©rr©r r rrrrÚ _tls_P_MD56srcCst|||tdƒS)NzHMAC-SHArrrrrÚ _tls_P_SHA1:srcCst|||tdƒS)Nz HMAC-SHA256rrrrrÚ _tls_P_SHA256>srcCst|||tdƒS)Nz HMAC-SHA384rrrrrÚ _tls_P_SHA384BsrcCst|||tdƒS)Nz HMAC-SHA512rrrrrÚ _tls_P_SHA512FsrcCs„tdƒ}||jd|j}d}|dkr>|| ||¡7}n:d}||krxt|ƒ d¡}|| |||¡7}|d7}qB|d|…S)NÚMD5rr rÚutf8)rr r ÚstrÚencode)r r rÚhash_md5ÚroundsrÚrÚlabelrrrÚ _sslv2_PRFLs  r$c Cs–|dkrtdƒdSgd¢}d}tdƒ}tdƒ}||jd|j}t|ƒD]8}|||d} | | ||¡} || || ¡7}qP|d |…S) a= Provides the implementation of SSLv3 PRF function: SSLv3-PRF(secret, seed) = MD5(secret || SHA-1("A" || secret || seed)) || MD5(secret || SHA-1("BB" || secret || seed)) || MD5(secret || SHA-1("CCC" || secret || seed)) || ... req_len should not be more than 26 x 16 = 416. i z9_ssl_PRF() is not expected to provide more than 416 bytesÚ)óAóBóCóDóEóFóGóHóIóJóKóLóMóNóOóPóQóRóSóTóUóVóWóXóYóZr ÚSHArrN)rrr Úranger ) r r rÚdrZ hash_sha1r r!Úir#ÚtmprrrÚ_ssl_PRF]s    rEc CsTt|ƒdd}|d|…}|| d…}t||||ƒ}t||||ƒ}t||ƒS)a] Provides the implementation of TLS PRF function as defined in section 5 of RFC 4346: PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR P_SHA-1(S2, label + seed) Parameters are: - secret: the secret used by the HMAC in the 2 expansion functions (S1 and S2 are the halves of this secret). - label: specific label as defined in various sections of the RFC depending on the use of the generated PRF keystream - seed: the seed used by the expansion functions. - req_len: amount of keystream to be generated réN)Úlenrrr) r r#r rZtmp_lenZS1ZS2Za1Za2rrrÚ_tls_PRF|s  rHcCst||||ƒS)a+ Provides the implementation of TLS 1.2 PRF function as defined in section 5 of RFC 5246: PRF(secret, label, seed) = P_SHA256(secret, label + seed) Parameters are: - secret: the secret used by the HMAC in the 2 expansion functions (S1 and S2 are the halves of this secret). - label: specific label as defined in various sections of the RFC depending on the use of the generated PRF keystream - seed: the seed used by the expansion functions. - req_len: amount of keystream to be generated )r©r r#r rrrrÚ_tls12_SHA256PRF—srJcCst||||ƒS©N)rrIrrrÚ_tls12_SHA384PRFªsrLcCst||||ƒSrK)rrIrrrÚ_tls12_SHA512PRF®srMc@sDeZdZdZddd„Zddd „Zd d „Zd d „Zdd„Zdd„Z dS)ÚPRFa! The PRF used by SSL/TLS varies based on the version of the protocol and (for TLS 1.2) possibly the Hash algorithm of the negotiated cipher suite. The various uses of the PRF (key derivation, computation of verify_data, computation of pre_master_secret values) for the different versions of the protocol also changes. In order to abstract those elements, the common _tls_PRF() object is provided. It is expected to be initialised in the context of the connection state using the tls_version and the cipher suite. ÚSHA256écCsŽ||_||_|dkrt|_nn|dkr,t|_n^|dks<|dkrDt|_nF|dkr‚|dkr\t|_qŠ|dkrlt|_qŠ|dvrzd|_t|_nt d ƒdS) NéiérPÚSHA384ÚSHA512)rr@rOzUnknown TLS version) Ú tls_versionÚ hash_namer$ÚprfrErHrLrMrJr)ÚselfrVrUrrrÚ__init__½s&ÿz PRF.__init__FNcCs^||}d}|dur$|dur$|}d}|jdkr2dS|jdkrJ| ||d¡S| |||d¡SdS)zÙ Return the 48-byte master_secret, computed from pre_master_secret, client_random and server_random. See RFC 5246, section 6.3. Supports Extended Master Secret Derivation, see RFC 7627 s master secretTNsextended master secretrQé0©rUrW)rXZpre_master_secretÚ client_randomÚ server_randomZextmsZhandshake_hashr r#rrrÚcompute_master_secretÔs  zPRF.compute_master_secretcCs4||}|jdkr | |||¡S| |d||¡SdS)zŠ Perform the derivation of master_secret into a key_block of req_len requested length. See RFC 5246, section 6.3. rQs key expansionNr[)rXÚ master_secretr]r\rr rrrÚderive_key_blockés zPRF.derive_key_blockcCsN|jdkrdS|jdkr´|dkr,dddœ}n dddœ}||}d}d}d } d } td ƒ} td ƒ} |  |||  ||||¡¡} |  || |  |||| ¡¡}| |}n–|dkrÈd ddœ}n dd dœ}d|| ¡}|jdkr$td ƒ |¡}td ƒ |¡}| ||||d¡}n&t|jƒ}| |¡}| |||d¡}|S)a Return verify_data based on handshake messages, connection end, master secret, and read_or_write position. See RFC 5246, section 7.4.9. Every TLS 1.2 cipher suite has a verify_data of length 12. Note also:: "This PRF with the SHA-256 hash function is used for all cipher suites defined in this document and in TLS documents published prior to this document when TLS 1.2 is negotiated." Cipher suites using SHA-384 were defined later on. rQNÚwritesCLNTsSRVR)ÚclientÚservers0666666666666666666666666666666666666666666666666s0\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\s(6666666666666666666666666666666666666666s(\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\rr@rbrcz %s finishedrRé )rUrr rrWrV)rXÚcon_endÚ read_or_writeZ handshake_msgr_rBr#Zsslv3_md5_pad1Zsslv3_md5_pad2Zsslv3_sha1_pad1Zsslv3_sha1_pad2Úmd5Úsha1Zmd5_hashZ sha1_hashZ verify_dataÚs1Ús2ÚhÚsrrrÚcompute_verify_dataõsP        ÿÿÿ  ÿÿÿ      zPRF.compute_verify_datac CsŽ||}|dkp|dk}|jdkr&dS|jdkrh|rB|||}n |||}tdƒ |¡d|…} n"|rrd} nd} | || |||¡} | S)zÉ Postprocess cipher key for EXPORT ciphersuite, i.e. weakens it. An export key generation example is given in section 6.3.1 of RFC 2246. See also page 86 of EKR's book. Ú clientwriteÚ serverreadrQNrsclient write keysserver write key©rUrr rW) rXÚkeyr\r]rerfrrlÚtbhZ export_keyÚtagrrrÚpostprocess_key_for_export0s$   ýzPRF.postprocess_key_for_exportc Csš||}|dkp|dk}|jdkr&dS|jdkr`|r>||}n||}tdƒ |¡d|…}n6| dd||d|¡} |rŠ| d|…}n | |d…}|S) z½ Generate IV for EXPORT ciphersuite, i.e. weakens it. An export IV generation example is given in section 6.3.1 of RFC 2246. See also page 86 of EKR's book. rnrorQNrr%sIV blockrFrp) rXr\r]rerfrrlrrZivZiv_blockrrrÚgenerate_iv_for_exportMs$   ý zPRF.generate_iv_for_export)rOrP)FN) Ú__name__Ú __module__Ú __qualname__Ú__doc__rYr^r`rmrtrurrrrrN²s ÿ  ;rNN)ryÚ __future__rZ scapy.errorrZ scapy.utilsrZscapy.layers.tls.crypto.hashrZscapy.layers.tls.crypto.h_macrZ scapy.compatrrrrrrrr$rErHrJrLrMÚobjectrNrrrrÚs&