Skip to content

Commit 1a2a156

Browse files
gstarovogstarovo
committed
advertising ec point extension format
check if the client adverties the uncompressed point format extension error when uncompressed is not supported fix: changes in accepting the format(form ECPointFormat to string) of ec format. fix: tests, keyShares added to tests for checking ecc point extension
1 parent 768c262 commit 1a2a156

File tree

9 files changed

+314
-51
lines changed

9 files changed

+314
-51
lines changed

‎.gitignore

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@ coverage.xml
99
pylint_report.txt
1010
build/
1111
docs/_build/
12-
htmlcov/
12+
htmlcov/

‎scripts/tls.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,7 @@ def printGoodConnection(connection, seconds):
399399
if connection.server_cert_compression_algo:
400400
print(" Server compression algorithm used: {0}".format(
401401
connection.server_cert_compression_algo))
402+
print(" Session used ec point format extension: {0}".format(connection.session.ec_point_format))
402403

403404
def printExporter(connection, expLabel, expLength):
404405
if expLabel is None:

‎test

Whitespace-only changes.

‎tests/tlstest.py

Lines changed: 146 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
from xmlrpc import client as xmlrpclib
4545
import ssl
4646
from tlslite import *
47-
from tlslite.constants import KeyUpdateMessageType
47+
from tlslite.constants import KeyUpdateMessageType, ECPointFormat
4848

4949
try:
5050
from tack.structures.Tack import Tack
@@ -303,6 +303,76 @@ def connect():
303303

304304
test_no += 1
305305

306+
print("Test {0} - client compressed/uncompressed - uncompressed, TLSv1.2".format(test_no))
307+
synchro.recv(1)
308+
connection = connect()
309+
settings = HandshakeSettings()
310+
settings.minVersion = (3, 3)
311+
settings.maxVersion = (3, 3)
312+
settings.eccCurves = ["secp256r1", "secp384r1", "secp521r1", "x25519", "x448"]
313+
314+
connection.handshakeClientCert(settings=settings)
315+
testConnClient(connection)
316+
assert connection.session.ec_point_format == ECPointFormat.uncompressed
317+
connection.close()
318+
319+
test_no += 1
320+
321+
print("Test {0} - client compressed - compressed, TLSv1.2".format(test_no))
322+
synchro.recv(1)
323+
connection = connect()
324+
settings = HandshakeSettings()
325+
settings.minVersion = (3, 3)
326+
settings.maxVersion = (3, 3)
327+
settings.eccCurves = ["secp256r1", "secp384r1", "secp521r1", "x25519", "x448"]
328+
settings.keyShares = ["secp256r1"]
329+
connection.handshakeClientCert(settings=settings)
330+
testConnClient(connection)
331+
assert connection.session.ec_point_format == ECPointFormat.ansiX962_compressed_prime
332+
connection.close()
333+
334+
test_no += 1
335+
336+
print("Test {0} - client missing uncompressed - error, TLSv1.2".format(test_no))
337+
synchro.recv(1)
338+
connection = connect()
339+
settings = HandshakeSettings()
340+
settings.minVersion = (3, 3)
341+
settings.maxVersion = (3, 3)
342+
settings.ec_point_formats = [ECPointFormat.ansiX962_compressed_prime]
343+
settings.eccCurves = ["secp256r1", "secp384r1", "secp521r1", "x25519", "x448"]
344+
settings.keyShares = ["secp256r1"]
345+
try:
346+
connection.handshakeClientCert(settings=settings)
347+
assert False
348+
except ValueError as e:
349+
assert "Uncompressed EC point format is not provided" in str(e)
350+
except TLSAbruptCloseError as e:
351+
pass
352+
connection.close()
353+
354+
test_no += 1
355+
356+
print("Test {0} - client comppressed char2 - error, TLSv1.2".format(test_no))
357+
synchro.recv(1)
358+
connection = connect()
359+
settings = HandshakeSettings()
360+
settings.minVersion = (3, 3)
361+
settings.maxVersion = (3, 3)
362+
settings.ec_point_formats = [ECPointFormat.ansiX962_compressed_char2]
363+
settings.eccCurves = ["secp256r1", "secp384r1", "secp521r1", "x25519", "x448"]
364+
settings.keyShares = ["secp256r1"]
365+
try:
366+
connection.handshakeClientCert(settings=settings)
367+
assert False
368+
except ValueError as e:
369+
assert "Unknown EC point format provided: [2]" in str(e)
370+
except TLSAbruptCloseError as e:
371+
pass
372+
connection.close()
373+
374+
test_no += 1
375+
306376
print("Test {0} - mismatched ECDSA curve, TLSv1.2".format(test_no))
307377
synchro.recv(1)
308378
connection = connect()
@@ -2194,6 +2264,79 @@ def connect():
21942264

21952265
test_no += 1
21962266

2267+
print("Test {0} - server uncompressed ec format - uncompressed, TLSv1.2".format(test_no))
2268+
synchro.send(b'R')
2269+
connection = connect()
2270+
settings = HandshakeSettings()
2271+
settings.minVersion = (3, 1)
2272+
settings.maxVersion = (3, 3)
2273+
settings.eccCurves = ["secp256r1", "secp384r1", "secp521r1", "x25519", "x448"]
2274+
settings.keyShares = ["secp256r1"]
2275+
settings.ec_point_formats = [ECPointFormat.uncompressed]
2276+
connection.handshakeServer(certChain=x509ecdsaChain,
2277+
privateKey=x509ecdsaKey, settings=settings)
2278+
testConnServer(connection)
2279+
assert connection.session.ec_point_format == ECPointFormat.uncompressed
2280+
connection.close()
2281+
2282+
test_no += 1
2283+
2284+
print("Test {0} - server compressed ec format - compressed, TLSv1.2".format(test_no))
2285+
synchro.send(b'R')
2286+
connection = connect()
2287+
settings = HandshakeSettings()
2288+
settings.minVersion = (3, 1)
2289+
settings.maxVersion = (3, 3)
2290+
settings.eccCurves = ["secp256r1", "secp384r1", "secp521r1", "x25519", "x448"]
2291+
settings.keyShares = ["secp256r1"]
2292+
connection.handshakeServer(certChain=x509ecdsaChain,
2293+
privateKey=x509ecdsaKey, settings=settings)
2294+
testConnServer(connection)
2295+
assert connection.session.ec_point_format == ECPointFormat.ansiX962_compressed_prime
2296+
connection.close()
2297+
2298+
test_no +=1
2299+
2300+
print("Test {0} - server missing uncompressed in client - error, TLSv1.2".format(test_no))
2301+
synchro.send(b'R')
2302+
connection = connect()
2303+
settings = HandshakeSettings()
2304+
settings.minVersion = (3, 1)
2305+
settings.maxVersion = (3, 3)
2306+
settings.eccCurves = ["secp256r1", "secp384r1", "secp521r1", "x25519", "x448"]
2307+
settings.keyShares = ["secp256r1"]
2308+
try:
2309+
connection.handshakeServer(certChain=x509ecdsaChain,
2310+
privateKey=x509ecdsaKey, settings=settings)
2311+
assert False
2312+
except ValueError as e:
2313+
assert "Uncompressed EC point format is not provided" in str(e)
2314+
except TLSAbruptCloseError as e:
2315+
pass
2316+
connection.close()
2317+
2318+
test_no +=1
2319+
2320+
print("Test {0} - client compressed char2 - error, TLSv1.2".format(test_no))
2321+
synchro.send(b'R')
2322+
connection = connect()
2323+
settings = HandshakeSettings()
2324+
settings.minVersion = (3, 1)
2325+
settings.maxVersion = (3, 3)
2326+
settings.eccCurves = ["secp256r1", "secp384r1", "secp521r1", "x25519", "x448"]
2327+
settings.keyShares = ["secp256r1"]
2328+
try:
2329+
connection.handshakeServer(certChain=x509ecdsaChain,
2330+
privateKey=x509ecdsaKey, settings=settings)
2331+
assert False
2332+
except ValueError as e:
2333+
assert "Unknown EC point format provided: [2]" in str(e)
2334+
except TLSAbruptCloseError as e:
2335+
pass
2336+
connection.close()
2337+
2338+
test_no +=1
2339+
21972340
print("Test {0} - mismatched ECDSA curve, TLSv1.2".format(test_no))
21982341
synchro.send(b'R')
21992342
connection = connect()
@@ -3450,7 +3593,7 @@ def heartbeat_response_check(message):
34503593
assert synchro.recv(1) == b'R'
34513594
connection.close()
34523595

3453-
test_no += 1
3596+
test_no +=1
34543597

34553598
print("Tests {0}-{1} - XMLRPXC server".format(test_no, test_no + 2))
34563599

@@ -3483,6 +3626,7 @@ def add(self, x, y): return x + y
34833626

34843627
synchro.close()
34853628
synchroSocket.close()
3629+
34863630
test_no += 2
34873631

34883632
print("Test succeeded")

‎tlslite/handshakesettings.py

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
"""Class for setting handshake parameters."""
99

10-
from .constants import CertificateType
10+
from .constants import CertificateType, ECPointFormat
1111
from .utils import cryptomath
1212
from .utils import cipherfactory
1313
from .utils.compat import ecdsaAllCurves, int_types, ML_KEM_AVAILABLE
@@ -67,6 +67,8 @@
6767
TICKET_CIPHERS = ["chacha20-poly1305", "aes256gcm", "aes128gcm", "aes128ccm",
6868
"aes128ccm_8", "aes256ccm", "aes256ccm_8"]
6969
PSK_MODES = ["psk_dhe_ke", "psk_ke"]
70+
EC_POINT_FORMATS = [ECPointFormat.ansiX962_compressed_prime,
71+
ECPointFormat.uncompressed]
7072

7173
ALL_COMPRESSION_ALGOS_SEND = ["zlib"]
7274
if compression_algo_impls["brotli_compress"]:
@@ -385,6 +387,10 @@ class HandshakeSettings(object):
385387
option is for when a certificate was received/decompressed by this
386388
peer.
387389
390+
391+
:vartype ec_point_formats: list
392+
:ivar ec_point_formats: Enabled point format extension for
393+
elliptic curves.
388394
"""
389395

390396
def _init_key_settings(self):
@@ -432,6 +438,7 @@ def _init_misc_extensions(self):
432438
# resumed connections (as tickets are single-use in TLS 1.3
433439
self.ticket_count = 2
434440
self.record_size_limit = 2**14 + 1 # TLS 1.3 includes content type
441+
self.ec_point_formats = list(EC_POINT_FORMATS)
435442

436443
# Certificate compression
437444
self.certificate_compression_send = list(ALL_COMPRESSION_ALGOS_SEND)
@@ -642,6 +649,14 @@ def _sanityCheckExtensions(other):
642649
not 64 <= other.record_size_limit <= 2**14 + 1:
643650
raise ValueError("record_size_limit cannot exceed 2**14+1 bytes")
644651

652+
bad_ec_ext = [i for i in other.ec_point_formats if
653+
i not in EC_POINT_FORMATS]
654+
if bad_ec_ext:
655+
raise ValueError("Unknown EC point format provided: "
656+
"{0}".format(bad_ec_ext))
657+
if ECPointFormat.uncompressed not in other.ec_point_formats:
658+
raise ValueError("Uncompressed EC point format is not provided")
659+
645660
HandshakeSettings._sanityCheckEMSExtension(other)
646661

647662
if other.certificate_compression_send:
@@ -736,6 +751,7 @@ def _copy_extension_settings(self, other):
736751
other.sendFallbackSCSV = self.sendFallbackSCSV
737752
other.useEncryptThenMAC = self.useEncryptThenMAC
738753
other.usePaddingExtension = self.usePaddingExtension
754+
other.ec_point_formats = self.ec_point_formats
739755
# session tickets
740756
other.padding_cb = self.padding_cb
741757
other.ticketKeys = self.ticketKeys

0 commit comments

Comments
 (0)