a k#d>@sdZddlmZddlZddlmZddlmZmZddl m Z ddl m Z ddl mmZejrddlmZmZmZdd lmZdd lmZejrdd lmZmZnGd d d ZiZGdddeZGddde Z!Gddde"ee#Z$ejrGddde$Z%Gddde%Z&ejrbGddde$Z'Gddde'Z(Gddde'Z)Gddde)Z*Gd d!d!e"ee#Z+ejrGd"d#d#e+Z,Gd$d%d%e,Z-ejrGd&d'd'e+Z.Gd(d)d)e.Z/ejrGd*d+d+e+Z0Gd,d-d-e0Z1dS).a] Authenticated Encryption with Associated Data ciphers. RFC 5288 introduces new ciphersuites for TLS 1.2 which are based on AES in Galois/Counter Mode (GCM). RFC 6655 in turn introduces AES_CCM ciphersuites. The related AEAD algorithms are defined in RFC 5116. Later on, RFC 7905 introduced cipher suites based on a ChaCha20-Poly1305 construction. )absolute_importN)conf) pkcs_i2osp pkcs_os2ip) CipherError)strxor)Cipher algorithmsmodes)default_backend) InvalidTag)AESCCMChaCha20Poly1305c@s eZdZdS)r N)__name__ __module__ __qualname__rrZ/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/layers/tls/crypto/cipher_aead.pyr !sr cs eZdZdZfddZZS)_AEADCipherMetaclassz Cipher classes are automatically registered through this metaclass. Furthermore, their name attribute is extracted from their class name. csN|ds|dd|d<tt|||||}|dsJ|t|dd<|S)N _AEADCiphername) startswithsuperr__new___tls_aead_cipher_algs)clsZ ciph_namebasesdctZ the_class __class__rrr,s  z_AEADCipherMetaclass.__new__)rrr__doc__r __classcell__rrrrr'src@seZdZdZdS) AEADTagErrorz- Raised when MAC verification fails. Nrrrr!rrrrr#6sr#csfeZdZdZdZdZdZdfdd Zfdd Zd d Z d d Z dddZ dddZ ddZ ZS)rz The hasattr(self, "pc_cls") tests correspond to the legacy API of the crypto library. With cryptography v2.0, both CCM and GCM should follow the else case. Note that the "fixed_iv" in TLS RFCs is called "salt" in the AEAD RFC 5116. aeadNcsdddd|_|dur*d|jd<d|j}|durFd|jd<d|j}|dur\d|jd<d }t|trnt|}tt|d|tt|d|tt|d|t |d rt|j t rt | || |t|jd |_n"t | || |td |_n |||_dS) z 'key' and 'fixed_iv' are to be provided as strings, whereas the internal # noqa: E501 'nonce_explicit' is an integer (it is simpler for incrementation). !! The whole 'nonce' may be called IV in certain RFCs. T)keyfixed_ivnonce_explicitNFr(r)r*rpc_clsbackend tag_lengthr.)readykey_len fixed_iv_len isinstancestrrrr __setattr__hasattrr,r r pc_cls_mode _get_noncer tag_len_cipher cipher_clsselfr(r)r*rrr__init__Is6              z_AEADCipher.__init__cs|dkr<|jdur0t|dr(||jj_n||j_d|jd<n8|dkrPd|jd<n$|dkrtt|trjt|}d|jd<t t | ||dS)Nr(r,Tr)r*) r;r7 algorithmr(_keyr1r4r5rrrr6r>rvalrrrr6os       z_AEADCipher.__setattr__cCs|jt|j|jSN)r)rr*nonce_explicit_len)r>rrrr9s z_AEADCipher._get_noncecCs"|jd}|d|jd|_dS)zK Increment the explicit nonce while avoiding any overflow. r'N)r*rE)r>nerrr_update_nonce_explicits z"_AEADCipher._update_nonce_explicitcCsdt|jvrt||t|drn||jj_d|jj_ |j }| || || }||j7}n|j|||}t|j|j}|||S)a Encrypt the data then prepend the explicit part of the nonce. The authentication tag is directly appended with the most recent crypto API. Additional data may be authenticated without encryption (as A). The 'seq_num' should never be used here, it is only a safeguard needed because one cipher (ChaCha20Poly1305) using TLS 1.2 logic in record.py actually is a _AEADCipher_TLS13 (even though others are not). Fr,N)six itervaluesr1rr7r9r;mode_initialization_vector_tag encryptorauthenticate_additional_dataupdatefinalizetagencryptrr*rErI)r>PAseq_numrOresr*rrr auth_encrypts       z_AEADCipher.auth_encryptTc Cs(|d|j||j|j ||j d}}}dt|jvrPt|||t||_|rr|t dt |7}t |dr| |j j_||j j_|j }||||}z |Wntyt|||Yn0n>z|j | |||}Wn tyt|d|Yn0|||fS)ae Decrypt the data and authenticate the associated data (i.e. A). If the verification fails, an AEADTagError is raised. It is the user's responsibility to catch it if deemed useful. If we lack the key, we raise a CipherError which contains the encrypted input. Note that we add the TLSCiphertext length to A although we're supposed to add the TLSCompressed length. Fortunately, they are the same, but the specifications actually messed up here. :'( The 'add_length' switch should always be True for TLS, but we provide it anyway (mostly for test cases, hum). The 'seq_num' should never be used here, it is only a safeguard needed because one cipher (ChaCha20Poly1305) using TLS 1.2 logic in record.py actually is a _AEADCipher_TLS13 (even though others are not). NF!Hr,)rEr:rJrKr1rrr*structpacklenr7r9r;rLrMrN decryptorrPrQrRr r#decrypt) r>rVCrWZ add_lengthZnonce_explicit_strmacr_rUrrr auth_decrypts6            z_AEADCipher.auth_decryptcCs$||j|j|j}|j|_|SrD)r r(r)r*r1copyr>crrrsnapshots z_AEADCipher.snapshot)NNN)N)NT)rrrr!typer3rEr?r6r9rIrYrcrgr"rrrrr=s&   0rc@s eZdZejZejZdZ dZ dS)Cipher_AES_128_GCMN) rrrr AESr,r GCMr8r2r:rrrrrisric@seZdZdZdS)Cipher_AES_256_GCM Nrrrr2rrrrrmsrmc@seZdZeZdZdZdS)Cipher_AES_128_CCMrjN)rrrr r<r2r:rrrrrpsrpc@seZdZdZdS)Cipher_AES_256_CCMrnNrorrrrrqsrqc@seZdZdZdS)Cipher_AES_128_CCM_8r'Nrrrr:rrrrrrsrrc@seZdZdZdS)Cipher_AES_256_CCM_8rnNrorrrrrtsrtcsReZdZdZdZdfdd ZfddZdd Zd d Zd d Z ddZ Z S)_AEADCipher_TLS13z The hasattr(self, "pc_cls") enable support for the legacy implementation of GCM in the cryptography library. They should not be used, and might eventually be removed, with cryptography v2.0. XXX r%Ncsddd|_|dur(d|jd<d|j}|durDd|jd<d|j}tt|d|tt|d|t|drt|jt rt ||| |t |j d |_qt ||| |t d |_n*|jtkr|||_n|j||j d |_dS) a9 'key' and 'fixed_iv' are to be provided as strings. This IV never changes: it is either the client_write_IV or server_write_IV. Note that 'nonce_explicit' is never used. It is only a safeguard for a call in session.py to the TLS 1.2/ChaCha20Poly1305 case (see RFC 7905). T)r(r)NFr(r+r)r,r-r0)r/)r1r2r3rrur6r7r4r,r rr8r r:r;r<rr=rrrr?s.            z_AEADCipher_TLS13.__init__csd|dkr<|jdur0t|dr(||jj_n||j_d|jd<n|dkrNd|jd<tt|||dS)Nr(r,Tr)) r;r7r@r(rAr1rrur6rBrrrr6(s     z_AEADCipher_TLS13.__setattr__cCs&|jt|}d||}t||jS)Nr+)r3r^rr))r>rWpadlenZpadded_seq_numrrrr94s z_AEADCipher_TLS13._get_noncecCsdt|jvrt||t|drpd|jj_|||jj_ |j }| || || }||j7}n@tjrt|jtr|j||||}n|j||||}|S)z Encrypt the data, and append the computed authentication code. The additional data for TLS 1.3 is the record header. Note that the cipher's authentication tag must be None when encrypting. Fr,N)rJrKr1rr7r;rLrNr9rMrOrPrQrRrSrcrypto_valid_advancedr4r rT)r>rUrVrWrOrXrrrrY9s       z_AEADCipher_TLS13.auth_encryptcCsF|d|j ||j d}}dt|jvrrVrarWrbr_rUrrrrcRs4"         z_AEADCipher_TLS13.auth_decryptcCs ||j|j}|j|_|SrD)r r(r)r1rdrerrrrgus z_AEADCipher_TLS13.snapshot)NNN) rrrr!rhr?r6r9rYrcrgr"rrrrrus% #ruc@s eZdZeZdZdZdZdZdS)Cipher_CHACHA20_POLY1305_TLS13rnrj rN) rrrrr<r2r:r3rErrrrry|s ryc@seZdZdZdS)rxz This TLS 1.2 cipher actually uses TLS 1.3 logic, as per RFC 7905. Changes occur at the record layer (in record.py). Nr$rrrrrxsrxc@s$eZdZejZejZdZ dZ dZ dS)Cipher_AES_128_GCM_TLS13rjrzN) rrrr rkr,r rlr8r2r3r:rrrrr{s r{c@seZdZdZdS)Cipher_AES_256_GCM_TLS13rnNrorrrrr|sr|c@seZdZeZdZdZdZdS)Cipher_AES_128_CCM_TLS13rjrzN)rrrr r<r2r:r3rrrrr}sr}c@seZdZdZdS)Cipher_AES_128_CCM_8_TLS13r'Nrsrrrrr~sr~)2r! __future__rr\Z scapy.configrZscapy.layers.tls.crypto.pkcs1rrZscapy.layers.tls.crypto.commonrZ scapy.utilsrZscapy.libs.sixZlibsrJZ crypto_validZ&cryptography.hazmat.primitives.ciphersrr r Zcryptography.hazmat.backendsr Zcryptography.exceptionsr rwZ+cryptography.hazmat.primitives.ciphers.aeadr rrrhr Exceptionr#with_metaclassobjectrrirmrprqrrrtruryrxr{r|r}r~rrrrsL