Package tlslite :: Module handshakesettings |
[hide private]
[frames] | no frames]

# Source Code for Module tlslite.handshakesettings

      1  # Authors:
      2  #   Trevor Perrin
      3  #   Dave Baggett (Arcode Corporation) - cleanup handling of constants
      4  #
      5  # See the LICENSE file for legal information regarding use of this file.
      6
      7  """Class for setting handshake parameters."""
      8
      9  from .constants import CertificateType
     10  from .utils import cryptomath
     11  from .utils import cipherfactory
     12
     13  # RC4 is preferred as faster in Python, works in SSL3, and immune to CBC
     14  # issues such as timing attacks
     15  CIPHER_NAMES = ["rc4", "aes256", "aes128", "3des"]
     16  MAC_NAMES = ["sha"] # "md5" is allowed
     17  CIPHER_IMPLEMENTATIONS = ["openssl", "pycrypto", "python"]
     18  CERTIFICATE_TYPES = ["x509"]
     19
     20 -class HandshakeSettings(object):
     21      """This class encapsulates various parameters that can be used with
     22      a TLS handshake.
     23      @sort: minKeySize, maxKeySize, cipherNames, macNames, certificateTypes,
     24      minVersion, maxVersion
     25
     26      @type minKeySize: int
     27      @ivar minKeySize: The minimum bit length for asymmetric keys.
     28
     29      If the other party tries to use SRP, RSA, or Diffie-Hellman
     30      parameters smaller than this length, an alert will be
     31      signalled.  The default is 1023.
     32
     33      @type maxKeySize: int
     34      @ivar maxKeySize: The maximum bit length for asymmetric keys.
     35
     36      If the other party tries to use SRP, RSA, or Diffie-Hellman
     37      parameters larger than this length, an alert will be signalled.
     38      The default is 8193.
     39
     40      @type cipherNames: list
     41      @ivar cipherNames: The allowed ciphers, in order of preference.
     42
     43      The allowed values in this list are 'aes256', 'aes128', '3des', and
     44      'rc4'.  If these settings are used with a client handshake, they
     45      determine the order of the ciphersuites offered in the ClientHello
     46      message.
     47
     48      If these settings are used with a server handshake, the server will
     49      choose whichever ciphersuite matches the earliest entry in this
     50      list.
     51
     52      NOTE:  If '3des' is used in this list, but TLS Lite can't find an
     53      add-on library that supports 3DES, then '3des' will be silently
     54      removed.
     55
     56      The default value is ['rc4', 'aes256', 'aes128', '3des'].
     57
     58      @type macNames: list
     59      @ivar macNames: The allowed MAC algorithms.
     60
     61      The allowed values in this list are 'sha' and 'md5'.
     62
     63      The default value is ['sha'].
     64
     65
     66      @type certificateTypes: list
     67      @ivar certificateTypes: The allowed certificate types, in order of
     68      preference.
     69
     70      The only allowed certificate type is 'x509'.  This list is only used with a
     71      client handshake.  The client will advertise to the server which certificate
     72      types are supported, and will check that the server uses one of the
     73      appropriate types.
     74
     75
     76      @type minVersion: tuple
     77      @ivar minVersion: The minimum allowed SSL/TLS version.
     78
     79      This variable can be set to (3,0) for SSL 3.0, (3,1) for
     80      TLS 1.0, or (3,2) for TLS 1.1.  If the other party wishes to
     81      use a lower version, a protocol_version alert will be signalled.
     82      The default is (3,0).
     83
     84      @type maxVersion: tuple
     85      @ivar maxVersion: The maximum allowed SSL/TLS version.
     86
     87      This variable can be set to (3,0) for SSL 3.0, (3,1) for
     88      TLS 1.0, or (3,2) for TLS 1.1.  If the other party wishes to
     89      use a higher version, a protocol_version alert will be signalled.
     90      The default is (3,2).  (WARNING: Some servers may (improperly)
     91      reject clients which offer support for TLS 1.1.  In this case,
     92      try lowering maxVersion to (3,1)).
     93
     94      @type useExperimentalTackExtension: bool
     95      @ivar useExperimentalTackExtension: Whether to enabled TACK support.
     96
     97      Note that TACK support is not standardized by IETF and uses a temporary
     98      TLS Extension number, so should NOT be used in production software.
     99      """
    100 -    def __init__(self):
    101          self.minKeySize = 1023
    102          self.maxKeySize = 8193
    103          self.cipherNames = CIPHER_NAMES
    104          self.macNames = MAC_NAMES
    105          self.cipherImplementations = CIPHER_IMPLEMENTATIONS
    106          self.certificateTypes = CERTIFICATE_TYPES
    107          self.minVersion = (3,0)
    108          self.maxVersion = (3,2)
    109          self.useExperimentalTackExtension = False
    110
    111      # Validates the min/max fields, and certificateTypes
    112      # Filters out unsupported cipherNames and cipherImplementations
    113 -    def _filter(self):
    114          other = HandshakeSettings()
    115          other.minKeySize = self.minKeySize
    116          other.maxKeySize = self.maxKeySize
    117          other.cipherNames = self.cipherNames
    118          other.macNames = self.macNames
    119          other.cipherImplementations = self.cipherImplementations
    120          other.certificateTypes = self.certificateTypes
    121          other.minVersion = self.minVersion
    122          other.maxVersion = self.maxVersion
    123
    124          if not cipherfactory.tripleDESPresent:
    125              other.cipherNames = [e for e in self.cipherNames if e != "3des"]
    126          if len(other.cipherNames)==0:
    127              raise ValueError("No supported ciphers")
    128          if len(other.certificateTypes)==0:
    129              raise ValueError("No supported certificate types")
    130
    131          if not cryptomath.m2cryptoLoaded:
    132              other.cipherImplementations = \
    133                  [e for e in other.cipherImplementations if e != "openssl"]
    134          if not cryptomath.pycryptoLoaded:
    135              other.cipherImplementations = \
    136                  [e for e in other.cipherImplementations if e != "pycrypto"]
    137          if len(other.cipherImplementations)==0:
    138              raise ValueError("No supported cipher implementations")
    139
    140          if other.minKeySize<512:
    141              raise ValueError("minKeySize too small")
    142          if other.minKeySize>16384:
    143              raise ValueError("minKeySize too large")
    144          if other.maxKeySize<512:
    145              raise ValueError("maxKeySize too small")
    146          if other.maxKeySize>16384:
    147              raise ValueError("maxKeySize too large")
    148          for s in other.cipherNames:
    149              if s not in CIPHER_NAMES:
    150                  raise ValueError("Unknown cipher name: '%s'" % s)
    151          for s in other.cipherImplementations:
    152              if s not in CIPHER_IMPLEMENTATIONS:
    153                  raise ValueError("Unknown cipher implementation: '%s'" % s)
    154          for s in other.certificateTypes:
    155              if s not in CERTIFICATE_TYPES:
    156                  raise ValueError("Unknown certificate type: '%s'" % s)
    157
    158          if other.minVersion > other.maxVersion:
    159              raise ValueError("Versions set incorrectly")
    160
    161          if not other.minVersion in ((3,0), (3,1), (3,2)):
    162              raise ValueError("minVersion set incorrectly")
    163
    164          if not other.maxVersion in ((3,0), (3,1), (3,2)):
    165              raise ValueError("maxVersion set incorrectly")
    166
    167          return other
    168
    169 -    def _getCertificateTypes(self):
    170          l = []
    171          for ct in self.certificateTypes:
    172              if ct == "x509":
    173                  l.append(CertificateType.x509)
    174              else:
    175                  raise AssertionError()
    176          return l
    177