-
-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Add basic TLS 1.3 client and server automaton and tests #2244
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Codecov Report
@@ Coverage Diff @@
## master #2244 +/- ##
=========================================
+ Coverage 85.47% 86.17% +0.7%
=========================================
Files 235 235
Lines 49127 49257 +130
=========================================
+ Hits 41991 42448 +457
+ Misses 7136 6809 -327
|
|
There was a problem with some TLS 1.2 server tests defined in tests_tls_netaccess.uts due to a default value changed for TLSSignature. I didn't catch this error locally because my version of OpenSSL support the new value. Which version of OpenSSL are you using for your tests with "open_ssl_client" on top ? |
|
@romain-perez that the version installed with Ubuntu Xenial used by Travis. You can add the following to your commits. It will display the |
scapy/layers/tls/automaton_cli.py
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there any reason for this change? I prefer a static list created rather than that. Also, using a variable might be useless, and we can get rid of the noqa:s:
p.ext = [
TLS_Ext_SupportedVersion_CH(versions=["TLS 1.3"]),
TLS_Ext_SupportedGroups(groups=supported_groups),
TLS_Ext_KeyShare_CH(
client_shares=[KeyShareEntry(group=self.curve)],
),
TLS_Ext_SignatureAlgorithms(sig_algs=["sha256+rsaepss"]),
]There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes the reason for this change is because the list of extensions can't always be static if we want to implement all the TLS 1.3 handshake functionalities. For example, the extensions will change depending we are authenticating with PSK, sending 0-RTT encrypted data...
So this change is not really particularly helpful for this PR because it implements only a "basic" 1-RTT handshake but it's mainly to prepare for the next PR where the list of extensions will change.
I will fix the noqa: and get rid of the useless variable in my next commit.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd rather keep a static list for now, and add dynamic changes when needed. Would that work for you?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I changed that in my last commit but I've made a minor modification to add the static list if there's no extension provided in self.client_hello
scapy/layers/tls/record.py
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please do not introduce useless changes.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I will also fix this and the others in my next commit.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks a lot!
scapy/layers/tls/record.py
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Same.
scapy/layers/tls/record_tls13.py
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Same.
b826897 to
a0c1439
Compare
Fix failed tests and remove useless changes add crypto_advanced flag for TLS 1.3 tests
a0c1439 to
4dfcf4c
Compare
This PR adds TLS 1.3 automaton for 1-RTT handshake (both client and server) and their associated tests.