a
    kÄ#dïÎ  ã                   @   sÀ  d Z ddlmZ ddlZddlZddlZddlZddlmZ ddl	m
Z
mZ ddlmZmZ ddlmZ ddlmZ dd	lmZmZ dd
lmZ ddlmZmZmZmZmZmZmZ ddl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 ddl3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z; ddl<m=Z=m>Z>m?Z?m@Z@mAZAmBZB ddlCmDZDmEZEmFZF ddlGmHZHmIZI ddlJmKZK ddlLmMZM ddlNmOZO ddlPmQZQ ddlRmSZS G dd„ deƒZTdS )aë  
TLS client automaton. This makes for a primitive TLS stack.
Obviously you need rights for network access.

We support versions SSLv2 to TLS 1.3, along with many features.

In order to run a client to tcp/50000 with one cipher suite of your choice::

    from scapy.layers.tls import *
    ch = TLSClientHello(ciphers=<int code of the cipher suite>)
    t = TLSClientAutomaton(dport=50000, client_hello=ch)
    t.run()

You can also use it as a SuperSocket using the ``tlslink`` io::

    from scapy.layers.tls import *
    a = TLSClientAutomaton.tlslink(Raw, server="scapy.net", dport=443)
    a.send(HTTP()/HTTPRequest())
    while True:
        a.recv()

You can also use the io with a TCPSession, e.g. to get an HTTPS answer::

    from scapy.all import *
    from scapy.layers.http import *
    from scapy.layers.tls import *
    a = TLSClientAutomaton.tlslink(HTTP, server="www.google.com", dport=443)
    pkt = a.sr1(HTTP()/HTTPRequest(), session=TCPSession(app=True),
                timeout=2)
é    )Úprint_functionN)Úconf)Ú
randstringÚrepr_hex)ÚATMTÚselect_objects)Úwarning)Ú_TLSAutomaton)Ú_tls_versionÚ_tls_version_options)Ú
tlsSession)ÚTLS_Ext_SupportedGroupsÚTLS_Ext_SupportedVersion_CHÚTLS_Ext_SignatureAlgorithmsÚTLS_Ext_SupportedVersion_SHÚTLS_Ext_PSKKeyExchangeModesÚTLS_Ext_ServerNameÚ
ServerName)ÚTLSCertificateÚTLSCertificateRequestÚTLSCertificateVerifyÚTLSClientHelloÚTLSClientKeyExchangeÚTLSEncryptedExtensionsÚTLSFinishedÚTLSServerHelloÚTLSServerHelloDoneÚTLSServerKeyExchangeÚTLS13CertificateÚTLS13ClientHelloÚTLS13ServerHelloÚTLS13HelloRetryRequestÚTLS13CertificateRequestÚ_ASN1CertAndExtÚTLS13KeyUpdateÚTLS13NewSessionTicket)ÚSSLv2ClientHelloÚSSLv2ServerHelloÚSSLv2ClientMasterKeyÚSSLv2ServerVerifyÚSSLv2ClientFinishedÚSSLv2ServerFinishedÚSSLv2ClientCertificateÚSSLv2RequestCertificate)ÚTLS_Ext_KeyShare_CHÚKeyShareEntryÚTLS_Ext_KeyShare_HRRÚPSKIdentityÚPSKBinderEntryÚTLS_Ext_PreSharedKey_CH)ÚTLSAlertÚTLSChangeCipherSpecÚTLSApplicationData)Ú_tls_cipher_suitesÚ_tls_cipher_suites_cls)Ú_tls_named_groups)Ú
TLS13_HKDF)Úsix)ÚRaw©Úbytes_encodec                       s|  e Zd ZdZ�d_‡ fdd„	Zdd„ Zejd	d
�dd„ ƒZej	eddd�dd„ ƒZ
e ¡ dd„ ƒZe ¡ dd„ ƒZe ¡ dd„ ƒZe e¡dd„ ƒZe ¡ dd„ ƒZe e¡dd„ ƒZe ¡ dd„ ƒZe ¡ d d!„ ƒZe ¡ d"d#„ ƒZejed$d%�d&d'„ ƒZe ¡ d(d)„ ƒZejed*d%�d+d,„ ƒZe ¡ d-d.„ ƒZejed$d%�d/d0„ ƒZe ¡ d1d2„ ƒZejed*d%�d3d4„ ƒZe ¡ d5d6„ ƒZe ¡ d7d8„ ƒZejed$d%�d9d:„ ƒZejd	d;�d<d=„ ƒZejed*d%�d>d?„ ƒZ e ¡ d@dA„ ƒZ!dBdC„ Z"eje!d*d%�dDdE„ ƒZ#ejedFd%�dGdH„ ƒZ$dIdJ„ Z%eje!d$d%�dKdL„ ƒZ&ejedMd%�dNdO„ ƒZ'ejedMd%�dPdQ„ ƒZ(e ¡ dRdS„ ƒZ)e ¡ dTdU„ ƒZ*eje*d$d%�dVdW„ ƒZ+e ¡ dXdY„ ƒZ,dZd[„ Z-eje*d*d%�d\d]„ ƒZ.e e,¡d^d_„ ƒZ/e ¡ d`da„ ƒZ0eje0d$d%�dbdc„ ƒZ1e ¡ ddde„ ƒZ2e e2¡dfdg„ ƒZ3eje0d*d%�dhdi„ ƒZ4e ¡ djdk„ ƒZ5e e5¡dldm„ ƒZ6e ¡ dndo„ ƒZ7e e7¡dpdq„ ƒZ8e ¡ drds„ ƒZ9e ¡ dtdu„ ƒZ:e ¡ dvdw„ ƒZ;e e;¡dxdy„ ƒZ<e ¡ dzd{„ ƒZ=e e=¡d|d}„ ƒZ>e ¡ d~d„ ƒZ?e e?¡d€d�„ ƒZ@e ¡ d‚dƒ„ ƒZAejeAd$d%�d„d…„ ƒZBejeAd*d%�d†d‡„ ƒZCe ¡ dˆd‰„ ƒZDe eD¡dŠd‹„ ƒZEe ¡ dŒd�„ ƒZFe ¡ dŽd�„ ƒZGe ¡ d�d‘„ ƒZHejeHd$d%�d’d“„ ƒZIe ¡ d”d•„ ƒZJe ¡ d–d—„ ƒZKe eK¡d˜d™„ ƒZLe ¡ dšd›„ ƒZMe eM¡dœd�„ ƒZNe ¡ dždŸ„ ƒZOe eO¡d d¡„ ƒZPe ¡ d¢d£„ ƒZQe ¡ d¤d¥„ ƒZRe ¡ d¦d§„ ƒZSejeSd$d%�d¨d©„ ƒZTe ¡ dªd«„ ƒZUejeSd*d%�d¬d­„ ƒZVe ¡ d®d¯„ ƒZWe eU¡d°d±„ ƒZXe ¡ d²d³„ ƒZYe eY¡d´dµ„ ƒZZe ¡ d¶d·„ ƒZ[e ¡ d¸d¹„ ƒZ\e ¡ dºd»„ ƒZ]eje]d$d%�d¼d½„ ƒZ^e ¡ d¾d¿„ ƒZ_dÀdÁ„ Z`eje_d$d%�dÂdÃ„ ƒZaeje_d*d%�dÄdÅ„ ƒZbeje]d*d%�dÆdÇ„ ƒZceje]dFd%�dÈdÉ„ ƒZdejd	d;�dÊdË„ ƒZee ¡ dÌdÍ„ ƒZfe ef¡dÎdÏ„ ƒZge ¡ dÐdÑ„ ƒZhe ¡ dÒdÓ„ ƒZie ¡ dÔdÕ„ ƒZjejejd$d%�dÖd×„ ƒZkejejd*d%�dØdÙ„ ƒZle ¡ dÚdÛ„ ƒZme em¡dÜdÝ„ ƒZne ¡ dÞdß„ ƒZoe eo¡dàdá„ ƒZpe ¡ dâdã„ ƒZqe ¡ dädå„ ƒZrejejdFd%�dædç„ ƒZse ¡ dèdé„ ƒZte er¡dêdë„ ƒZue ¡ dìdí„ ƒZvejevd$d%�dîdï„ ƒZwejevd*d%�dðdñ„ ƒZxe ¡ dòdó„ ƒZye ey¡dôdõ„ ƒZze ¡ död÷„ ƒZ{e ¡ dødù„ ƒZ|e ¡ dúdû„ ƒZ}e e}¡düdý„ ƒZ~e ¡ dþdÿ„ ƒZe ¡ �d �d„ ƒZ€e e€¡�d�d„ ƒZ�e ¡ �d�d„ ƒZ‚e e‚¡�d�d„ ƒZƒe ¡ �d�d	„ ƒZ„e ¡ �d
�d„ ƒZ…e e…¡�d�d„ ƒZ†e ¡ �d�d„ ƒZ‡e ¡ �d�d„ ƒZˆe ¡ �d�d„ ƒZ‰eje‰d$d%��d�d„ ƒZŠeje‰d*d%��d�d„ ƒZ‹eje‰dFd%��d�d„ ƒZŒe ¡ �d�d„ ƒZ�eje‰dMd%��d�d„ ƒZŽe ¡ �d�d„ ƒZ�e e�¡�d �d!„ ƒZ�e ¡ �d"�d#„ ƒZ‘eje‘d$d%��d$�d%„ ƒZ’eje‘d*d%��d&�d'„ ƒZ“e ¡ �d(�d)„ ƒZ”eje‘dFd%��d*�d+„ ƒZ•e ¡ �d,�d-„ ƒZ–eje–d$d%��d.�d/„ ƒZ—eje–d*d%��d0�d1„ ƒZ˜eje–dFd%��d2�d3„ ƒZ™e ¡ �d4�d5„ ƒZšeješd$d%��d6�d7„ ƒZ›�d8�d9„ Zœe ¡ �d:�d;„ ƒZ�eje�d$d%��d<�d=„ ƒZžeje�d*d%��d>�d?„ ƒZŸe ¡ �d@�dA„ ƒZ eje d$d%��dB�dC„ ƒZ¡e ¡ �dD�dE„ ƒZ¢e ¡ �dF�dG„ ƒZ£eje£d$d%��dH�dI„ ƒZ¤e ¡ �dJ�dK„ ƒZ¥eje¥d$d%��dL�dM„ ƒZ¦e ¡ �dN�dO„ ƒZ§eje£d*d%��dP�dQ„ ƒZ¨e ¡ �dR�dS„ ƒZ©e e©¡�dT�dU„ ƒZªe ¡ �dV�dW„ ƒZ«e ¡ �dX�dY„ ƒZ¬ejd	�dZ��d[�d\„ ƒZ­ejd	d;��d]�d^„ ƒZ®‡  Z¯S (`  ÚTLSClientAutomatona–  
    A simple TLS test client automaton. Try to overload some states or
    conditions and see what happens on the other side.

    Rather than with an interruption, the best way to stop this client is by
    typing 'quit'. This won't be a message sent to the server.

    :param server: the server IP or hostname. defaults to 127.0.0.1
    :param dport: the server port. defaults to 4433
    :param server_name: the SNI to use. It does not need to be set
    :param mycert:
    :param mykey: may be provided as filenames. They will be used in
        the handshake, should the server ask for client authentication.
    :param client_hello: may hold a TLSClientHello or SSLv2ClientHello to be
        sent to the server. This is particularly useful for extensions
        tweaking. If not set, a default is populated accordingly.
    :param version: is a quicker way to advertise a protocol version ("sslv2",
        "tls1", "tls12", etc.) It may be overridden by the previous
        'client_hello'.
    :param data: is a list of raw data to be sent to the server once the
        handshake has been completed. Both 'stop_server' and 'quit' will
        work this way.
    ú	127.0.0.1éQ  Nc                    sÎ  t t| ƒjf ||dœ|¤Ž t ||¡}|d d | _|d d d | _|| _|| _d | _	d | _
d | _t|ttfƒr||| _nd | _d | _|r®t |d ¡}|s¨|  d¡ n|| _d| _t|tƒrÈ|g| _nFt|tjƒrât|ƒg| _n,t|tƒ�rtdd„ t|ƒD ƒƒ| _ng | _d | _| jdk�rÊd	| _|d u�rNt|d
ƒ}|t ¡ v �rN|| _t j!�r^d| _nd| _|| _"|	| _#|
| _$|| _%|| _&|d u�rÊt' (¡ D ]4\}}||k�r”|dk�rÀt j!�rÆ|| _n|| _�q”d S )N)ÚmycertÚmykeyr   é   z Unrecognized TLS version option.Fc                 s   s   | ]}t |ƒV  qd S ©Nr=   )Ú.0Úd© rH   úU/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/layers/tls/automaton_cli.pyÚ	<genexpr>“   ó    z0TLSClientAutomaton.parse_args.<locals>.<genexpr>é  é  é   é   é   Úx25519))Úsuperr?   Ú
parse_argsÚsocketÚgetaddrinfoÚremote_familyÚ	remote_ipÚremote_portÚserver_nameÚlocal_ipÚ
local_portÚ
isinstancer   r   Úclient_helloÚadvertised_tls_versionr   ÚgetÚvprintÚ	linebreakÚbytesÚdata_to_sendr;   Ústring_typesr>   ÚlistÚreversedÚcurveÚciphersuiteÚintr7   Úkeysr   Úcrypto_valid_advancedÚresumption_master_secretÚsession_ticket_file_inÚsession_ticket_file_outÚtls13_psk_secretÚtls13_psk_moder9   Úitems)ÚselfÚserverÚdportrY   rB   rC   r]   Úversionrl   rm   rn   ZpskZpsk_modeÚdatarh   rg   ZkargsÚtmpÚvÚcsZgroup_idÚng©Ú	__class__rH   rI   rS   i   sh    ÿþ






zTLSClientAutomaton.parse_argsc                 C   s®   | j rª| j}t|j }|  d| ¡ |jjj}|  d| ¡ |jdkrN|j}n|j	}|  dt
|ƒ ¡ |jr||  d|j ¡ |jdkr¢|jd }|  dt
|ƒ ¡ |  ¡  d S )NzVersion       : %szCipher suite  : %srL   zMaster secret : %szServer certificate chain: %rZresumption_secretzResumption master secret : %s)ÚverboseÚcur_sessionr
   Útls_versionr`   Úwcsrh   ÚnameZtls13_master_secretZmaster_secretr   Zserver_certsZtls13_derived_secrets)rr   Úsrx   ry   ÚmsZ
res_secretrH   rH   rI   Úvprint_sessioninfo²   s$    




ÿz%TLSClientAutomaton.vprint_sessioninfoT)Úinitialc                 C   s   |   d¡ |  ¡ ‚d S )NzStarting TLS client automaton.)r`   ÚINIT_TLS_SESSION©rr   rH   rH   rI   ÚINITIALÆ   s    
zTLSClientAutomaton.INITIALÚtlsZtlslink)r�   Zas_supersocketc                 C   s   d S rE   rH   )rr   ÚfdrH   rH   rI   Ú_socketË   s    zTLSClientAutomaton._socketc                 C   sØ  t dd�| _| j}| j|_| j|_| j}|r4||_n|j}|| _|jdk�rÌ| jr`t 	| j¡|_| j
�rÌt| j
dƒ�æ}t d| d¡¡d }t d| |¡¡d |_t d| d¡¡d }| |¡|_t d| d	¡¡d }| |¡}t d
|¡d |_t d| d	¡¡d }	| |	¡}t d
|¡d |_t d| d	¡¡d }
| |
¡|_W d   ƒ n1 �sb0    Y  | j�rÌ|jtv�rŽtd|jƒ n
t|j }t|jj ¡ ƒ}|jj}| t 	| j¡d|j|¡|_|  ¡ ‚d S )NÚclient)Zconnection_endrL   ÚrbÚBé   r   ú!Hé   ú!IzUnknown cipher suite %ds
   resumption)r   r~   rB   Zclient_certsrC   Z
client_keyr^   ro   ÚbinasciiÚ	unhexlifyrm   ÚopenÚstructÚunpackÚreadÚtls13_ticket_ciphersuiteZclient_session_nonceÚclient_ticket_ageÚclient_session_ticket_age_addÚclient_session_ticketrl   r8   r   r:   Úhash_algr�   ÚlowerÚhashÚdigest_sizeZexpand_labelÚCONNECT)rr   r‚   rx   Zdefault_versionÚfZresumed_ciphersuite_lenZticket_nonce_lenZclient_ticket_age_lenrw   Zclient_ticket_age_add_lenZ
ticket_lenÚcs_clsÚhkdfÚhash_lenrH   rH   rI   r†   Ï   s^    ÿ

ÿÿ
ÿÿ,
ýz#TLSClientAutomaton.INIT_TLS_SESSIONc                 C   s    t   | jt j¡}|  ¡  |  d| j| jf ¡ | | j| jf¡ || _ | j  ¡ d d… \| _| _	|  ¡  | j
jdv r~|  ¡ ‚n| j
jdkr”|  ¡ ‚n|  ¡ ‚d S )NzTrying to connect on %s:%dr‘   ©i   r‘   rL   )rT   rV   ÚSOCK_STREAMr`   rW   rX   ÚconnectÚgetsocknamerZ   r[   r~   r^   ÚSSLv2_PREPARE_CLIENTHELLOÚTLS13_STARTÚPREPARE_CLIENTFLIGHT1)rr   r‚   rH   rH   rI   r¡     s    
ÿ

zTLSClientAutomaton.CONNECTc                 C   s   |   ¡  d S rE   ©Ú
add_recordr‡   rH   rH   rI   r¬     s    z(TLSClientAutomaton.PREPARE_CLIENTFLIGHT1c                 C   sp   | j r| j }ntƒ }g }| jjdkr6|tdgd�g7 }| jrT|tt| jd�gd�7 }||_|  	|¡ |  
¡ ‚d S )Ni  ú
sha256+rsa©Zsig_algs©Ú
servername©Zservernames)r]   r   r~   r^   r   rY   r   r   ÚextÚadd_msgÚADDED_CLIENTHELLO)rr   Úpr´   rH   rH   rI   Úshould_add_ClientHello#  s    ÿ
z)TLSClientAutomaton.should_add_ClientHelloc                 C   s   d S rE   rH   r‡   rH   rH   rI   r¶   6  s    z$TLSClientAutomaton.ADDED_CLIENTHELLOc                 C   s   |   ¡  |  ¡ ‚d S rE   )Úflush_recordsÚSENT_CLIENTFLIGHT1r‡   rH   rH   rI   Úshould_send_ClientFlight1:  s    z,TLSClientAutomaton.should_send_ClientFlight1c                 C   s   |   ¡ ‚d S rE   )ÚWAITING_SERVERFLIGHT1r‡   rH   rH   rI   rº   ?  s    z%TLSClientAutomaton.SENT_CLIENTFLIGHT1c                 C   s   |   ¡  |  ¡ ‚d S rE   )Úget_next_msgÚRECEIVED_SERVERFLIGHT1r‡   rH   rH   rI   r¼   C  s    z(TLSClientAutomaton.WAITING_SERVERFLIGHT1c                 C   s   d S rE   rH   r‡   rH   rH   rI   r¾   H  s    z)TLSClientAutomaton.RECEIVED_SERVERFLIGHT1r�   )Úprioc                 C   s   |   t| j¡ dS ©zt
        XXX We should check the ServerHello attributes for discrepancies with
        our own ClientHello.
        N)Úraise_on_packetr   ÚHANDLED_SERVERHELLOr‡   rH   rH   rI   Úshould_handle_ServerHelloL  s    ÿz,TLSClientAutomaton.should_handle_ServerHelloc                 C   s   d S rE   rH   r‡   rH   rH   rI   rÂ   U  s    z&TLSClientAutomaton.HANDLED_SERVERHELLOr‘   c                 C   s   |   ¡ ‚d S rE   ©ÚMISSING_SERVERHELLOr‡   rH   rH   rI   Úmissing_ServerHelloY  s    z&TLSClientAutomaton.missing_ServerHelloc                 C   s   |   d¡ |  ¡ ‚d S )Nz Missing TLS ServerHello message!©r`   ÚCLOSE_NOTIFYr‡   rH   rH   rI   rÅ   ]  s    
z&TLSClientAutomaton.MISSING_SERVERHELLOc                 C   s&   | j jjjs|  t| j¡ |  ¡ ‚d S rE   )r~   ÚprcsÚkey_exchangeZ	anonymousrÁ   r   ÚHANDLED_SERVERCERTIFICATEr‡   rH   rH   rI   Úshould_handle_ServerCertificateb  s
    ÿz2TLSClientAutomaton.should_handle_ServerCertificatec                 C   s   d S rE   rH   r‡   rH   rH   rI   rË   i  s    z,TLSClientAutomaton.HANDLED_SERVERCERTIFICATEc                 C   s   |   ¡ ‚d S rE   )ÚMISSING_SERVERCERTIFICATEr‡   rH   rH   rI   Úmissing_ServerCertificatem  s    z,TLSClientAutomaton.missing_ServerCertificatec                 C   s   |   d¡ |  ¡ ‚d S )Nz Missing TLS Certificate message!rÇ   r‡   rH   rH   rI   rÍ   q  s    
z,TLSClientAutomaton.MISSING_SERVERCERTIFICATEc                 C   s.   |   d¡ | jr| js*|   d¡ |   d¡ d S )Nú!Server asked for a certificate...úNo client certificate to send!z1Will try and send an empty Certificate message...)r`   rC   rB   r‡   rH   rH   rI   ÚHANDLED_CERTIFICATEREQUESTv  s    

z-TLSClientAutomaton.HANDLED_CERTIFICATEREQUESTc                 C   s   |   t| j¡ dS )z¦
        XXX We should check the ServerKeyExchange attributes for discrepancies
        with our own ClientHello, along with the ServerHello and Certificate.
        N)rÁ   r   ÚHANDLED_SERVERKEYEXCHANGEr‡   rH   rH   rI   Ú6should_handle_ServerKeyExchange_from_ServerCertificate}  s    ÿzITLSClientAutomaton.should_handle_ServerKeyExchange_from_ServerCertificate)Úfinalc                 C   s   d S rE   rH   r‡   rH   rH   rI   ÚMISSING_SERVERKEYEXCHANGE†  s    z,TLSClientAutomaton.MISSING_SERVERKEYEXCHANGEc                 C   s   | j jjjs|  ¡ ‚d S rE   )r~   rÉ   rÊ   Zno_skerÕ   r‡   rH   rH   rI   Úmissing_ServerKeyExchangeŠ  s    z,TLSClientAutomaton.missing_ServerKeyExchangec                 C   s   d S rE   rH   r‡   rH   rH   rI   rÒ   �  s    z,TLSClientAutomaton.HANDLED_SERVERKEYEXCHANGEc                 C   s   |   t| j¡ dS ©z}
        XXX We should check the CertificateRequest attributes for discrepancies
        with the cipher suite, etc.
        N)rÁ   r   rÑ   r‡   rH   rH   rI   Ú should_handle_CertificateRequest“  s    ÿz3TLSClientAutomaton.should_handle_CertificateRequestc                 C   s   |   ¡  d S rE   ©rØ   r‡   rH   rH   rI   Ú7should_handle_CertificateRequest_from_ServerKeyExchange›  s    zJTLSClientAutomaton.should_handle_CertificateRequest_from_ServerKeyExchangeé   c                 C   s   |   ¡  d S rE   rÙ   r‡   rH   rH   rI   Ú7should_handle_CertificateRequest_from_ServerCertificateŸ  s    zJTLSClientAutomaton.should_handle_CertificateRequest_from_ServerCertificatec                 C   s   |   t| j¡ d S rE   )rÁ   r   ÚHANDLED_SERVERHELLODONEr‡   rH   rH   rI   Úshould_handle_ServerHelloDone£  s    ÿz0TLSClientAutomaton.should_handle_ServerHelloDonec                 C   s   |   ¡ S rE   ©rÞ   r‡   rH   rH   rI   Ú4should_handle_ServerHelloDone_from_ServerKeyExchange§  s    zGTLSClientAutomaton.should_handle_ServerHelloDone_from_ServerKeyExchangerD   c                 C   s   |   ¡ S rE   rß   r‡   rH   rH   rI   Ú5should_handle_ServerHelloDone_from_CertificateRequest«  s    zHTLSClientAutomaton.should_handle_ServerHelloDone_from_CertificateRequestc                 C   s   |   ¡ S rE   rß   r‡   rH   rH   rI   Ú4should_handle_ServerHelloDone_from_ServerCertificate¯  s    zGTLSClientAutomaton.should_handle_ServerHelloDone_from_ServerCertificatec                 C   s   |   ¡ ‚d S rE   )ÚPREPARE_CLIENTFLIGHT2r‡   rH   rH   rI   rÝ   ³  s    z*TLSClientAutomaton.HANDLED_SERVERHELLODONEc                 C   s   |   ¡  d S rE   r­   r‡   rH   rH   rI   rã   ·  s    z(TLSClientAutomaton.PREPARE_CLIENTFLIGHT2c                 C   sL   dd„ | j jD ƒ}t|vrdS g }| jr0| jg}|  t|d�¡ |  ¡ ‚dS )áE  
        If the server sent a CertificateRequest, we send a Certificate message.
        If no certificate is available, an empty Certificate message is sent:
        - this is a SHOULD in RFC 4346 (Section 7.4.6)
        - this is a MUST in RFC 5246 (Section 7.4.6)

        XXX We may want to add a complete chain.
        c                 S   s   g | ]}t |ƒ‘qS rH   ©Útype©rF   ÚmrH   rH   rI   Ú
<listcomp>Å  rK   zCTLSClientAutomaton.should_add_ClientCertificate.<locals>.<listcomp>N©Úcerts)r~   Úhandshake_messages_parsedr   rB   rµ   r   ÚADDED_CLIENTCERTIFICATE©rr   Úhs_msgrë   rH   rH   rI   Úshould_add_ClientCertificate»  s    
z/TLSClientAutomaton.should_add_ClientCertificatec                 C   s   d S rE   rH   r‡   rH   rH   rI   rí   Î  s    z*TLSClientAutomaton.ADDED_CLIENTCERTIFICATEc                 C   s   |   tƒ ¡ |  ¡ ‚d S rE   )rµ   r   ÚADDED_CLIENTKEYEXCHANGEr‡   rH   rH   rI   Úshould_add_ClientKeyExchangeÒ  s    z/TLSClientAutomaton.should_add_ClientKeyExchangec                 C   s   |   ¡ S rE   ©rò   r‡   rH   rH   rI   Ú/should_add_ClientKeyExchange_from_ClientFlight2Ö  s    zBTLSClientAutomaton.should_add_ClientKeyExchange_from_ClientFlight2c                 C   s   |   ¡ S rE   ró   r‡   rH   rH   rI   Ú3should_add_ClientKeyExchange_from_ClientCertificateÚ  s    zFTLSClientAutomaton.should_add_ClientKeyExchange_from_ClientCertificatec                 C   s   d S rE   rH   r‡   rH   rH   rI   rñ   Þ  s    z*TLSClientAutomaton.ADDED_CLIENTKEYEXCHANGEc                 C   sJ   dd„ | j jD ƒ}t|vs.| jdu s.| jdu r2dS |  tƒ ¡ |  ¡ ‚dS )áh  
        XXX Section 7.4.7.1 of RFC 5246 states that the CertificateVerify
        message is only sent following a client certificate that has signing
        capability (i.e. not those containing fixed DH params).
        We should verify that before adding the message. We should also handle
        the case when the Certificate message was empty.
        c                 S   s   g | ]}t |ƒ‘qS rH   rå   rç   rH   rH   rI   ré   ë  rK   z>TLSClientAutomaton.should_add_ClientVerify.<locals>.<listcomp>N)r~   rì   r   rB   rC   rµ   r   ÚADDED_CERTIFICATEVERIFY©rr   rï   rH   rH   rI   Úshould_add_ClientVerifyâ  s    	ÿþz*TLSClientAutomaton.should_add_ClientVerifyc                 C   s   d S rE   rH   r‡   rH   rH   rI   r÷   ó  s    z*TLSClientAutomaton.ADDED_CERTIFICATEVERIFYc                 C   s    |   ¡  |  tƒ ¡ |  ¡ ‚d S rE   ©r®   rµ   r5   ÚADDED_CHANGECIPHERSPECr‡   rH   rH   rI   Ú2should_add_ChangeCipherSpec_from_CertificateVerify÷  s    zETLSClientAutomaton.should_add_ChangeCipherSpec_from_CertificateVerifyc                 C   s    |   ¡  |  tƒ ¡ |  ¡ ‚d S rE   rú   r‡   rH   rH   rI   Ú2should_add_ChangeCipherSpec_from_ClientKeyExchangeý  s    zETLSClientAutomaton.should_add_ChangeCipherSpec_from_ClientKeyExchangec                 C   s   d S rE   rH   r‡   rH   rH   rI   rû     s    z)TLSClientAutomaton.ADDED_CHANGECIPHERSPECc                 C   s    |   ¡  |  tƒ ¡ |  ¡ ‚d S rE   )r®   rµ   r   ÚADDED_CLIENTFINISHEDr‡   rH   rH   rI   Úshould_add_ClientFinished  s    z,TLSClientAutomaton.should_add_ClientFinishedc                 C   s   d S rE   rH   r‡   rH   rH   rI   rþ     s    z'TLSClientAutomaton.ADDED_CLIENTFINISHEDc                 C   s   |   ¡  |  ¡ ‚d S rE   )r¹   ÚSENT_CLIENTFLIGHT2r‡   rH   rH   rI   Úshould_send_ClientFlight2  s    z,TLSClientAutomaton.should_send_ClientFlight2c                 C   s   |   ¡ ‚d S rE   )ÚWAITING_SERVERFLIGHT2r‡   rH   rH   rI   r     s    z%TLSClientAutomaton.SENT_CLIENTFLIGHT2c                 C   s   |   ¡  |  ¡ ‚d S rE   )r½   ÚRECEIVED_SERVERFLIGHT2r‡   rH   rH   rI   r    s    z(TLSClientAutomaton.WAITING_SERVERFLIGHT2c                 C   s   d S rE   rH   r‡   rH   rH   rI   r    s    z)TLSClientAutomaton.RECEIVED_SERVERFLIGHT2c                 C   s   |   t| j¡ d S rE   )rÁ   r5   ÚHANDLED_CHANGECIPHERSPECr‡   rH   rH   rI   Úshould_handle_ChangeCipherSpec#  s    ÿz1TLSClientAutomaton.should_handle_ChangeCipherSpecc                 C   s   d S rE   rH   r‡   rH   rH   rI   r  (  s    z+TLSClientAutomaton.HANDLED_CHANGECIPHERSPECc                 C   s   |   t| j¡ d S rE   )rÁ   r   ÚHANDLED_SERVERFINISHEDr‡   rH   rH   rI   Úshould_handle_Finished,  s    ÿz)TLSClientAutomaton.should_handle_Finishedc                 C   s    |   d¡ |  ¡  |   d¡ d S )NzTLS handshake completed!ú You may send data or use 'quit'.©r`   r„   r‡   rH   rH   rI   r  1  s    
z)TLSClientAutomaton.HANDLED_SERVERFINISHEDc                 C   s   |   ¡ ‚d S rE   ©ÚWAIT_CLIENTDATAr‡   rH   rH   rI   Úshould_wait_ClientData9  s    z)TLSClientAutomaton.should_wait_ClientDatac                 C   s   d S rE   rH   r‡   rH   rH   rI   r  =  s    z"TLSClientAutomaton.WAIT_CLIENTDATAc                 C   s  | j st| jrTt| jd gdƒ}|rJ|  ¡  |  t|d  ¡ d�¡ |  ¡ ‚|  	¡ ‚q~t
j ¡  dd¡ dd¡ ¡ }n
| j  ¡ }|dkrŠd	S |d
krœ|  	¡ ‚n4|dkrÐ| jjdkrÐ|  ¡  |  tdd�¡ |  ¡ ‚| jrÞ|d7 }|  ¡  |  t|d�¡ |  ¡ ‚d	S )z®
        The user may type in:
        GET / HTTP/1.1\r\nHost: testserver.com\r\n\r\n
        Special characters are handled so that it becomes a valid HTTP request.
        r‰   r   )rv   ú\rúú\nÚ
s   quitNs   waits
   key_updaterL   Zupdate_requested)Zrequest_updateó   
)rc   Úis_atmt_socketr   Zioinr®   rµ   r6   ÚrecvÚADDED_CLIENTDATAÚWAITING_SERVERDATAr;   ÚmovesÚinputÚreplaceÚencodeÚpopr~   r   r$   ra   )rr   rŠ   rv   rH   rH   rI   Úadd_ClientDataA  s0    
 

z!TLSClientAutomaton.add_ClientDatac                 C   s   |   ¡ ‚d S rE   )rÈ   r‡   rH   rH   rI   Úno_more_ClientDatag  s    z%TLSClientAutomaton.no_more_ClientDatac                 C   s   d S rE   rH   r‡   rH   rH   rI   r  k  s    z#TLSClientAutomaton.ADDED_CLIENTDATAc                 C   s   |   ¡  |  ¡ ‚d S rE   )r¹   ÚSENT_CLIENTDATAr‡   rH   rH   rI   Úshould_send_ClientDatao  s    z)TLSClientAutomaton.should_send_ClientDatac                 C   s   |   ¡ ‚d S rE   )r  r‡   rH   rH   rI   r  t  s    z"TLSClientAutomaton.SENT_CLIENTDATAc                 C   s   |   dd¡ |  ¡ ‚d S ©Ng333333Ó?r�   )r½   ÚRECEIVED_SERVERDATAr‡   rH   rH   rI   r  x  s    z%TLSClientAutomaton.WAITING_SERVERDATAc                 C   s   d S rE   rH   r‡   rH   rH   rI   r   }  s    z&TLSClientAutomaton.RECEIVED_SERVERDATAc              	   C   s¦  | j s|  ¡ ‚| j d }t|tƒrL| jr:| jj |j¡ nt	d|j ƒ �n>t|t
ƒrnt	d| ƒ |  ¡ ‚�nt|tƒ�r~t	d| ƒ | j�rŠt| jdƒ�Ð}| t dd¡¡ | t d| jjjj¡¡ | t d|j¡¡ | |j¡ | t dd¡¡ | t d	tt ¡ ƒ¡¡ | t dd¡¡ | t d	|j¡¡ | t d|j¡¡ | | jj¡ W d   ƒ n1 �sr0    Y  nt	d| ƒ | j d
d … | _ |  ¡ ‚d S )Nr   ú> Received: %rz> Received: %r ÚwbrŽ   r‘   r�   rD   r’   r�   )Ú	buffer_inr  r\   r6   r  Zoir‰   Úsendrv   Úprintr4   rÈ   r%   rn   r•   Úwriter–   Úpackr~   r€   rh   ÚvalZnoncelenZticket_nonceri   ÚtimeZticket_age_addZ	ticketlenrœ   ÚHANDLED_SERVERDATA)rr   r·   r¢   rH   rH   rI   Úshould_handle_ServerData�  s:    




ÿ0z+TLSClientAutomaton.should_handle_ServerDatac                 C   s   |   ¡ ‚d S rE   r
  r‡   rH   rH   rI   r*  ¸  s    z%TLSClientAutomaton.HANDLED_SERVERDATAc                 C   s   |   ¡  |   d¡ d S )Nz*Trying to send a TLSAlert to the server...©r`   r‡   rH   rH   rI   rÈ   ¼  s    zTLSClientAutomaton.CLOSE_NOTIFYc                 C   sP   |   ¡  |  tddd�¡ z|  ¡  W n tyB   |  d¡ Y n0 |  ¡ ‚d S )Nr�   r   )ÚlevelÚdescrz;Could not send termination Alert, maybe the server stopped?)r®   rµ   r4   r¹   Ú	Exceptionr`   ÚFINALr‡   rH   rH   rI   Úclose_sessionÁ  s    z TLSClientAutomaton.close_sessionc                 C   s   d S rE   rH   r‡   rH   rH   rI   rª   Í  s    z,TLSClientAutomaton.SSLv2_PREPARE_CLIENTHELLOc                 C   s6   | j dd� | jpttdƒd�}|  |¡ |  ¡ ‚d S )NT©Zis_sslv2rN   )Ú	challenge)r®   r]   r&   r   rµ   ÚSSLv2_ADDED_CLIENTHELLO©rr   r·   rH   rH   rI   Ússlv2_should_add_ClientHelloÑ  s    
z/TLSClientAutomaton.sslv2_should_add_ClientHelloc                 C   s   d S rE   rH   r‡   rH   rH   rI   r4  Ø  s    z*TLSClientAutomaton.SSLv2_ADDED_CLIENTHELLOc                 C   s   |   ¡  |  ¡ ‚d S rE   )r¹   ÚSSLv2_SENT_CLIENTHELLOr‡   rH   rH   rI   Ússlv2_should_send_ClientHelloÜ  s    z0TLSClientAutomaton.sslv2_should_send_ClientHelloc                 C   s   |   ¡ ‚d S rE   )ÚSSLv2_WAITING_SERVERHELLOr‡   rH   rH   rI   r7  á  s    z)TLSClientAutomaton.SSLv2_SENT_CLIENTHELLOc                 C   s   |   ¡  |  ¡ ‚d S rE   )r½   ÚSSLv2_RECEIVED_SERVERHELLOr‡   rH   rH   rI   r9  å  s    z,TLSClientAutomaton.SSLv2_WAITING_SERVERHELLOc                 C   s   d S rE   rH   r‡   rH   rH   rI   r:  ê  s    z-TLSClientAutomaton.SSLv2_RECEIVED_SERVERHELLOc                 C   s   |   t| j¡ d S rE   )rÁ   r'   ÚSSLv2_HANDLED_SERVERHELLOr‡   rH   rH   rI   Ússlv2_should_handle_ServerHelloî  s    ÿz2TLSClientAutomaton.sslv2_should_handle_ServerHelloc                 C   s   d S rE   rH   r‡   rH   rH   rI   r;  ó  s    z,TLSClientAutomaton.SSLv2_HANDLED_SERVERHELLOc                 C   s   |   ¡ ‚d S rE   )ÚSSLv2_MISSING_SERVERHELLOr‡   rH   rH   rI   Ússlv2_missing_ServerHello÷  s    z,TLSClientAutomaton.sslv2_missing_ServerHelloc                 C   s   |   d¡ |  ¡ ‚d S )Nz"Missing SSLv2 ServerHello message!©r`   ÚSSLv2_CLOSE_NOTIFYr‡   rH   rH   rI   r=  û  s    
z,TLSClientAutomaton.SSLv2_MISSING_SERVERHELLOc                 C   s$   | j dd� |  tƒ ¡ |  ¡ ‚d S )NTr2  )r®   rµ   r(   ÚSSLv2_ADDED_CLIENTMASTERKEYr‡   rH   rH   rI   Ú sslv2_should_add_ClientMasterKey   s    z3TLSClientAutomaton.sslv2_should_add_ClientMasterKeyc                 C   s   d S rE   rH   r‡   rH   rH   rI   rA    s    z.TLSClientAutomaton.SSLv2_ADDED_CLIENTMASTERKEYc                 C   s   |   ¡  |  ¡ ‚d S rE   )r¹   ÚSSLv2_SENT_CLIENTMASTERKEYr‡   rH   rH   rI   Ú!sslv2_should_send_ClientMasterKey
  s    z4TLSClientAutomaton.sslv2_should_send_ClientMasterKeyc                 C   s   |   ¡ ‚d S rE   )ÚSSLv2_WAITING_SERVERVERIFYr‡   rH   rH   rI   rC    s    z-TLSClientAutomaton.SSLv2_SENT_CLIENTMASTERKEYc                 C   s   |   dd¡ |  ¡ ‚d S )Ng      à?r   )r½   ÚSSLv2_RECEIVED_SERVERVERIFYr‡   rH   rH   rI   rE    s    z-TLSClientAutomaton.SSLv2_WAITING_SERVERVERIFYc                 C   s   d S rE   rH   r‡   rH   rH   rI   rF    s    z.TLSClientAutomaton.SSLv2_RECEIVED_SERVERVERIFYc                 C   s   | j t| jdd� d S )NF)r½   )rÁ   r)   ÚSSLv2_HANDLED_SERVERVERIFYr‡   rH   rH   rI   Ú sslv2_should_handle_ServerVerify  s    þz3TLSClientAutomaton.sslv2_should_handle_ServerVerifyc                 C   s   d S rE   rH   r‡   rH   rH   rI   rG  $  s    z-TLSClientAutomaton.SSLv2_HANDLED_SERVERVERIFYc                 C   sB   dd„ | j jD ƒ}t|v rd S | jdd� |  tƒ ¡ |  ¡ ‚d S )Nc                 S   s   g | ]}t |ƒ‘qS rH   rå   rç   rH   rH   rI   ré   )  rK   zFTLSClientAutomaton.sslv2_should_add_ClientFinished.<locals>.<listcomp>Tr2  )r~   rì   r*   r®   rµ   ÚSSLv2_ADDED_CLIENTFINISHEDrø   rH   rH   rI   Ússlv2_should_add_ClientFinished(  s    z2TLSClientAutomaton.sslv2_should_add_ClientFinishedc                 C   s   |   ¡ S rE   ©rJ  r‡   rH   rH   rI   Ú1sslv2_should_add_ClientFinished_from_ServerVerify0  s    zDTLSClientAutomaton.sslv2_should_add_ClientFinished_from_ServerVerifyc                 C   s   |   ¡ ‚d S rE   ©ÚSSLv2_WAITING_SERVERFINISHEDr‡   rH   rH   rI   Ú2sslv2_should_wait_ServerFinished_from_ServerVerify4  s    zETLSClientAutomaton.sslv2_should_wait_ServerFinished_from_ServerVerifyc                 C   s   |   ¡ S rE   rK  r‡   rH   rH   rI   Ú3sslv2_should_add_ClientFinished_from_NoServerVerify8  s    zFTLSClientAutomaton.sslv2_should_add_ClientFinished_from_NoServerVerifyc                 C   s   |   ¡ ‚d S rE   )ÚSSLv2_MISSING_SERVERVERIFYr‡   rH   rH   rI   Ússlv2_missing_ServerVerify<  s    z-TLSClientAutomaton.sslv2_missing_ServerVerifyc                 C   s   |   d¡ |  ¡ ‚d S )Nz#Missing SSLv2 ServerVerify message!r?  r‡   rH   rH   rI   rQ  @  s    
z-TLSClientAutomaton.SSLv2_MISSING_SERVERVERIFYc                 C   s   d S rE   rH   r‡   rH   rH   rI   rI  E  s    z-TLSClientAutomaton.SSLv2_ADDED_CLIENTFINISHEDc                 C   s   |   ¡  |  ¡ ‚d S rE   )r¹   ÚSSLv2_SENT_CLIENTFINISHEDr‡   rH   rH   rI   Ú sslv2_should_send_ClientFinishedI  s    z3TLSClientAutomaton.sslv2_should_send_ClientFinishedc                 C   s8   dd„ | j jD ƒ}t|v r$|  ¡ ‚n|  ¡  |  ¡ ‚d S )Nc                 S   s   g | ]}t |ƒ‘qS rH   rå   rç   rH   rH   rI   ré   P  rK   z@TLSClientAutomaton.SSLv2_SENT_CLIENTFINISHED.<locals>.<listcomp>)r~   rì   r)   rN  r½   rF  rø   rH   rH   rI   rS  N  s
    
z,TLSClientAutomaton.SSLv2_SENT_CLIENTFINISHEDc                 C   s   |   ¡  |  ¡ ‚d S rE   )r½   ÚSSLv2_RECEIVED_SERVERFINISHEDr‡   rH   rH   rI   rN  W  s    z/TLSClientAutomaton.SSLv2_WAITING_SERVERFINISHEDc                 C   s   d S rE   rH   r‡   rH   rH   rI   rU  \  s    z0TLSClientAutomaton.SSLv2_RECEIVED_SERVERFINISHEDc                 C   s   |   t| j¡ d S rE   )rÁ   r+   ÚSSLv2_HANDLED_SERVERFINISHEDr‡   rH   rH   rI   Ú"sslv2_should_handle_ServerFinished`  s    ÿz5TLSClientAutomaton.sslv2_should_handle_ServerFinishedc                 C   s   |   t| j¡ d S rE   )rÁ   r-   Ú SSLv2_HANDLED_REQUESTCERTIFICATEr‡   rH   rH   rI   Ú&sslv2_should_handle_RequestCertificateg  s    ÿz9TLSClientAutomaton.sslv2_should_handle_RequestCertificatec                 C   s,   |   d¡ | jr| js(|   d¡ |  ¡ ‚d S )NrÏ   rÐ   )r`   rC   rB   r@  r‡   rH   rH   rI   rX  l  s    

z3TLSClientAutomaton.SSLv2_HANDLED_REQUESTCERTIFICATEc                 C   s*   | j dd� |  t| jd�¡ |  ¡ ‚d S )NTr2  )Zcertdata)r®   rµ   r,   rB   ÚSSLv2_ADDED_CLIENTCERTIFICATEr‡   rH   rH   rI   Ú"sslv2_should_add_ClientCertificates  s    z5TLSClientAutomaton.sslv2_should_add_ClientCertificatec                 C   s   d S rE   rH   r‡   rH   rH   rI   rZ  y  s    z0TLSClientAutomaton.SSLv2_ADDED_CLIENTCERTIFICATEc                 C   s   |   ¡  |  ¡ ‚d S rE   )r¹   ÚSSLv2_SENT_CLIENTCERTIFICATEr‡   rH   rH   rI   Ú#sslv2_should_send_ClientCertificate}  s    z6TLSClientAutomaton.sslv2_should_send_ClientCertificatec                 C   s   |   ¡ ‚d S rE   rM  r‡   rH   rH   rI   r\  ‚  s    z/TLSClientAutomaton.SSLv2_SENT_CLIENTCERTIFICATEc                 C   s    |   d¡ |  ¡  |   d¡ d S )NzSSLv2 handshake completed!r  r	  r‡   rH   rH   rI   rV  ˆ  s    
z/TLSClientAutomaton.SSLv2_HANDLED_SERVERFINISHEDc                 C   s   |   ¡ ‚d S rE   )ÚSSLv2_MISSING_SERVERFINISHEDr‡   rH   rH   rI   Ússlv2_missing_ServerFinishedŽ  s    z/TLSClientAutomaton.sslv2_missing_ServerFinishedc                 C   s   |   d¡ |  ¡ ‚d S )Nz%Missing SSLv2 ServerFinished message!r?  r‡   rH   rH   rI   r^  ’  s    
z/TLSClientAutomaton.SSLv2_MISSING_SERVERFINISHEDc                 C   s   |   ¡ ‚d S rE   ©ÚSSLv2_WAITING_CLIENTDATAr‡   rH   rH   rI   Ússlv2_should_wait_ClientData™  s    z/TLSClientAutomaton.sslv2_should_wait_ClientDatac                 C   s   d S rE   rH   r‡   rH   rH   rI   ra  �  s    z+TLSClientAutomaton.SSLv2_WAITING_CLIENTDATAc                 C   s~   | j s&tj ¡  dd¡ dd¡ ¡ }n| j  ¡ }|  d| ¡ |dkrJd S | jrX|d7 }| j	dd� |  
t|ƒ¡ |  ¡ ‚d S )	Nr  r  r  r  z> Read from list: %sÚquitTr2  )rc   r;   r  r  r  r  r  r`   ra   r®   rµ   r<   ÚSSLv2_ADDED_CLIENTDATA)rr   rv   rH   rH   rI   Ússlv2_add_ClientData¡  s     
z'TLSClientAutomaton.sslv2_add_ClientDatac                 C   s   |   ¡ ‚d S rE   )r@  r‡   rH   rH   rI   Ússlv2_no_more_ClientData°  s    z+TLSClientAutomaton.sslv2_no_more_ClientDatac                 C   s   d S rE   rH   r‡   rH   rH   rI   rd  ´  s    z)TLSClientAutomaton.SSLv2_ADDED_CLIENTDATAc                 C   s   |   ¡  |  ¡ ‚d S rE   )r¹   ÚSSLv2_SENT_CLIENTDATAr‡   rH   rH   rI   Ússlv2_should_send_ClientData¸  s    z/TLSClientAutomaton.sslv2_should_send_ClientDatac                 C   s   |   ¡ ‚d S rE   )ÚSSLv2_WAITING_SERVERDATAr‡   rH   rH   rI   rg  ½  s    z(TLSClientAutomaton.SSLv2_SENT_CLIENTDATAc                 C   s   |   dd¡ |  ¡ ‚d S r  )r½   ÚSSLv2_RECEIVED_SERVERDATAr‡   rH   rH   rI   ri  Á  s    z+TLSClientAutomaton.SSLv2_WAITING_SERVERDATAc                 C   s   d S rE   rH   r‡   rH   rH   rI   rj  Æ  s    z,TLSClientAutomaton.SSLv2_RECEIVED_SERVERDATAc                 C   sV   | j s|  ¡ ‚| j d }td|j ƒ |j d¡r:|  ¡ ‚| j dd … | _ |  ¡ ‚d S )Nr   r!  s   goodbyer�   )r#  ra  r%  ÚloadÚ
startswithr@  ÚSSLv2_HANDLED_SERVERDATAr5  rH   rH   rI   Ússlv2_should_handle_ServerDataÊ  s    
z1TLSClientAutomaton.sslv2_should_handle_ServerDatac                 C   s   |   ¡ ‚d S rE   r`  r‡   rH   rH   rI   rm  Õ  s    z+TLSClientAutomaton.SSLv2_HANDLED_SERVERDATAc                 C   s   |   ¡  |   d¡ dS )z~
        There is no proper way to end an SSLv2 session.
        We try and send a 'goodbye' message as a substitute.
        z+Trying to send a 'goodbye' to the server...Nr,  r‡   rH   rH   rI   r@  Ù  s    z%TLSClientAutomaton.SSLv2_CLOSE_NOTIFYc                 C   sV   |   ¡  |  tdƒ¡ z|  ¡  W n ty>   |  d¡ Y n0 | j ¡  |  ¡ ‚d S )NZgoodbyez8Could not send our goodbye. The server probably stopped.)	r®   rµ   r<   r¹   r/  r`   rT   Úcloser0  r‡   rH   rH   rI   Ússlv2_close_sessionâ  s    
z&TLSClientAutomaton.sslv2_close_sessionc                 C   s   d S rE   rH   r‡   rH   rH   rI   r«   ï  s    zTLSClientAutomaton.TLS13_STARTc                 C   sø  g d¢}t jr| d¡ | jdd� | jr2| j}n | jd u rBd}n| j}t|d�}g }|tdgd�7 }| j}|j	�r„| j
d	kr´|td	d
�7 }|t|d�7 }|tt| jd�gd�7 }n|tdd
�7 }|j�rDt|j }t|jj ¡ ƒ}|jj}tt ¡ |j d ƒ}	|	|j d@ }
t|j|
d�}t|d| d�}|t|g|gd�7 }n>tdƒ}|jj}tdd�}t|d| d�}|t|g|gd�7 }n8|t|d�7 }|tt| jd�gd�7 }|t ddgd�7 }| j!�rÜ|t"t#| j!d�gd�7 }||_$|  %|¡ |  &¡ ‚d S )N)Z	secp256r1Z	secp384r1Zx448rQ   F©Zis_tls13rM   )ÚcipherszTLS 1.3©ÚversionsÚ
psk_dhe_ke©Zkxmodes©Úgroups©Úgroup©Zclient_sharesÚpsk_keéè  ì   ÿÿ ©ÚidentityZobfuscated_ticket_ageó    ©Z
binder_lenZbinder©Z
identitiesZbindersÚsha256ÚClient_identity©r€  úsha256+rsaepssr¯   r°   r±   r³   )'r   rk   Úappendr®   r]   rh   r   r   r~   ro   rp   r   r   r.   r/   rg   rœ   r8   r™   r:   r�   r�   rž   rŸ   r    ri   r)  rš   r›   r1   r2   r3   r   rY   r   r   r´   rµ   ÚTLS13_ADDED_CLIENTHELLO)rr   Zsupported_groupsr·   Úcr´   r‚   r£   r¤   r¥   ÚagemsÚobfuscated_ageÚpsk_idÚpsk_binder_entryrH   rH   rI   Útls13_should_add_ClientHelloó  sz    



ÿ

ÿÿÿÿ

ÿÿ
ÿÿ
ÿ
z/TLSClientAutomaton.tls13_should_add_ClientHelloc                 C   s   |   ¡ ‚d S rE   )ÚTLS13_SENDING_CLIENTFLIGHT1r‡   rH   rH   rI   r‰  I  s    z*TLSClientAutomaton.TLS13_ADDED_CLIENTHELLOc                 C   s   d S rE   rH   r‡   rH   rH   rI   r�  M  s    z.TLSClientAutomaton.TLS13_SENDING_CLIENTFLIGHT1c                 C   s   |   ¡  |  ¡ ‚d S rE   )r¹   ÚTLS13_SENT_CLIENTFLIGHT1r‡   rH   rH   rI   Útls13_should_send_ClientFlight1Q  s    z2TLSClientAutomaton.tls13_should_send_ClientFlight1c                 C   s   |   ¡ ‚d S rE   )ÚTLS13_WAITING_SERVERFLIGHT1r‡   rH   rH   rI   r‘  V  s    z+TLSClientAutomaton.TLS13_SENT_CLIENTFLIGHT1c                 C   s   |   ¡  |  ¡ ‚d S rE   )r½   ÚTLS13_RECEIVED_SERVERFLIGHT1r‡   rH   rH   rI   r“  Z  s    z.TLSClientAutomaton.TLS13_WAITING_SERVERFLIGHT1c                 C   s   d S rE   rH   r‡   rH   rH   rI   r”  _  s    z/TLSClientAutomaton.TLS13_RECEIVED_SERVERFLIGHT1c                 C   s   |   t| j¡ dS rÀ   )rÁ   r    ÚTLS13_HANDLED_SERVERHELLOr‡   rH   rH   rI   Útls13_should_handle_ServerHelloc  s    ÿz2TLSClientAutomaton.tls13_should_handle_ServerHelloc                 C   s   |   t| j¡ dS rÀ   )rÁ   r!   ÚTLS13_HELLO_RETRY_REQUESTEDr‡   rH   rH   rI   Ú%tls13_should_handle_HelloRetryRequestl  s    ÿz8TLSClientAutomaton.tls13_should_handle_HelloRetryRequestc                 C   s   |   t| j¡ d S rE   )rÁ   r4   Ú&TLS13_HANDLED_ALERT_FROM_SERVERFLIGHT1r‡   rH   rH   rI   Ú!tls13_should_handle_AlertMessage_u  s    ÿz4TLSClientAutomaton.tls13_should_handle_AlertMessage_c                 C   s&   |   d¡ |   | j ¡ ¡ |  ¡ ‚d S )NzReceived Alert message !)r`   Zcur_pktZ	mysummaryrÈ   r‡   rH   rH   rI   r™  z  s    
z9TLSClientAutomaton.TLS13_HANDLED_ALERT_FROM_SERVERFLIGHT1c                 C   s   |   ¡ ‚d S rE   rÄ   r‡   rH   rH   rI   Útls13_missing_ServerHello€  s    z,TLSClientAutomaton.tls13_missing_ServerHelloc                 C   s   d S rE   rH   r‡   rH   rH   rI   r—  „  s    z.TLSClientAutomaton.TLS13_HELLO_RETRY_REQUESTEDc                 C   s  | j }d|_| jdd� |jd }t|tƒr,|j}|jrd|jD ]$}t|tƒrR|j	}t|t
ƒr>|j}q>|rl|st|  ¡ ‚g }|tt| gd�7 }|j�rª| jdkrÚ|tdd�f7 }|tt| gd�7 }|tt|d	�gd
�7 }n|tdd�7 }|j�rjt|j }t|jj ¡ ƒ}	|	jj}
tt   ¡ |j! d ƒ}||j" d@ }t#|j|d�}t$|
d|
 d�}|t%|g|gd�7 }n>tdƒ}	|	jj}
t#dd�}t$|
d|
 d�}|t%|g|gd�7 }n:|tt| gd�7 }|tt|d	�gd
�7 }|t&dgd�7 }t'||d�}|  (|¡ |  )¡ ‚d S )NTFrq  éÿÿÿÿrs  ru  rv  rw  ry  r{  r|  r}  r~  r  r�  r‚  rƒ  r„  r…  r†  r‡  r°   )rr  r´   )*r~   Ztls13_retryr®   rì   r\   r!   Úcipherr´   r0   Úselected_groupr   ru   rÈ   r   r
   ro   rp   r   r   r9   r.   r/   rœ   r8   r™   r:   r�   r�   rž   rŸ   r    ri   r)  rš   r›   r1   r2   r3   r   r   rµ   r‰  )rr   r‚   Zhrrrh   Úerž  Zselected_versionr´   r£   r¤   r¥   r‹  rŒ  r�  rŽ  r·   rH   rH   rI   Ú"tls13_should_add_ClientHello_Retryˆ  sl    






ÿÿÿÿ

ÿÿ

z5TLSClientAutomaton.tls13_should_add_ClientHello_Retryc                 C   s   d S rE   rH   r‡   rH   rH   rI   r•  Ô  s    z,TLSClientAutomaton.TLS13_HANDLED_SERVERHELLOc                 C   s   |   t| j¡ d S rE   )rÁ   r   Ú!TLS13_HANDLED_ENCRYPTEDEXTENSIONSr‡   rH   rH   rI   Ú'tls13_should_handle_encrytpedExtensionsØ  s    ÿz:TLSClientAutomaton.tls13_should_handle_encrytpedExtensionsc                 C   s   |   t| j¡ d S rE   )rÁ   r5   Ú TLS13_HANDLED_CHANGE_CIPHER_SPECr‡   rH   rH   rI   Ú$tls13_should_handle_ChangeCipherSpecÝ  s    ÿz7TLSClientAutomaton.tls13_should_handle_ChangeCipherSpecc                 C   s   d| j _|  ¡ ‚d S )NT)r~   Úmiddlebox_compatibilityr•  r‡   rH   rH   rI   r£  â  s    z3TLSClientAutomaton.TLS13_HANDLED_CHANGE_CIPHER_SPECc                 C   s   |   d¡ |  ¡ ‚d S )Nz,Missing TLS 1.3 EncryptedExtensions message!rÇ   r‡   rH   rH   rI   Ú tls13_missing_encryptedExtensionç  s    
z3TLSClientAutomaton.tls13_missing_encryptedExtensionc                 C   s   d S rE   rH   r‡   rH   rH   rI   r¡  ì  s    z4TLSClientAutomaton.TLS13_HANDLED_ENCRYPTEDEXTENSIONSc                 C   s   |   t| j¡ dS r×   )rÁ   r"   Ú TLS13_HANDLED_CERTIFICATEREQUESTr‡   rH   rH   rI   Ú?tls13_should_handle_certificateRequest_from_encryptedExtensionsð  s    ÿzRTLSClientAutomaton.tls13_should_handle_certificateRequest_from_encryptedExtensionsc                 C   s   |   ¡  d S rE   ©Útls13_should_handle_Certificater‡   rH   rH   rI   Ú8tls13_should_handle_certificate_from_encryptedExtensionsù  s    zKTLSClientAutomaton.tls13_should_handle_certificate_from_encryptedExtensionsc                 C   s   | j jr|  t| j¡ d S rE   )r~   ro   rÁ   r   ÚTLS13_HANDLED_FINISHEDr‡   rH   rH   rI   Ú5tls13_should_handle_finished_from_encryptedExtensionsý  s    ÿzHTLSClientAutomaton.tls13_should_handle_finished_from_encryptedExtensionsc                 C   s   d S rE   rH   r‡   rH   rH   rI   r§    s    z3TLSClientAutomaton.TLS13_HANDLED_CERTIFICATEREQUESTc                 C   s   |   ¡ S rE   r©  r‡   rH   rH   rI   Ú7tls13_should_handle_Certificate_from_CertificateRequest  s    zJTLSClientAutomaton.tls13_should_handle_Certificate_from_CertificateRequestc                 C   s   |   t| j¡ d S rE   )rÁ   r   ÚTLS13_HANDLED_CERTIFICATEr‡   rH   rH   rI   rª    s    ÿz2TLSClientAutomaton.tls13_should_handle_Certificatec                 C   s   d S rE   rH   r‡   rH   rH   rI   r¯    s    z,TLSClientAutomaton.TLS13_HANDLED_CERTIFICATEc                 C   s   |   t| j¡ d S rE   )rÁ   r   Ú TLS13_HANDLED_CERTIFICATE_VERIFYr‡   rH   rH   rI   Ú%tls13_should_handle_CertificateVerify  s    ÿz8TLSClientAutomaton.tls13_should_handle_CertificateVerifyc                 C   s   |   d¡ |  ¡ ‚d S )Nz*Missing TLS 1.3 CertificateVerify message!rÇ   r‡   rH   rH   rI   Útls13_missing_CertificateVerify  s    
z2TLSClientAutomaton.tls13_missing_CertificateVerifyc                 C   s   d S rE   rH   r‡   rH   rH   rI   r°    s    z3TLSClientAutomaton.TLS13_HANDLED_CERTIFICATE_VERIFYc                 C   s   |   t| j¡ d S rE   )rÁ   r   r¬  r‡   rH   rH   rI   Útls13_should_handle_finished!  s    ÿz/TLSClientAutomaton.tls13_should_handle_finishedc                 C   s   |   ¡ ‚d S rE   )ÚTLS13_PREPARE_CLIENTFLIGHT2r‡   rH   rH   rI   r¬  &  s    z)TLSClientAutomaton.TLS13_HANDLED_FINISHEDc                 C   s0   | j jr | jdd� |  tƒ ¡ | jdd� d S )NT)Zis_tls12rq  )r~   r¥  r®   rµ   r5   r‡   rH   rH   rI   r´  *  s    z.TLSClientAutomaton.TLS13_PREPARE_CLIENTFLIGHT2c                 C   sX   dd„ | j jD ƒ}t|vr"|  ¡ ‚g }| jr<|t| jd�7 }|  t|d�¡ |  ¡ ‚dS )rä   c                 S   s   g | ]}t |ƒ‘qS rH   rå   rç   rH   rH   rI   ré   ;  rK   zITLSClientAutomaton.tls13_should_add_ClientCertificate.<locals>.<listcomp>)Úcertrê   N)r~   rì   r"   ÚTLS13_ADDED_CLIENTCERTIFICATErB   r#   rµ   r   rî   rH   rH   rI   Ú"tls13_should_add_ClientCertificate1  s    
z5TLSClientAutomaton.tls13_should_add_ClientCertificatec                 C   s   d S rE   rH   r‡   rH   rH   rI   r¶  F  s    z0TLSClientAutomaton.TLS13_ADDED_CLIENTCERTIFICATEc                 C   sN   dd„ | j jD ƒ}t|vs.| jdu s.| jdu r6|  ¡ S |  tƒ ¡ |  ¡ ‚dS )rö   c                 S   s   g | ]}t |ƒ‘qS rH   rå   rç   rH   rH   rI   ré   S  rK   zOTLSClientAutomaton.tls13_should_add_ClientCertificateVerify.<locals>.<listcomp>N)	r~   rì   r"   rB   rC   Útls13_should_add_ClientFinishedrµ   r   ÚTLS13_ADDED_CERTIFICATEVERIFYrø   rH   rH   rI   Ú(tls13_should_add_ClientCertificateVerifyJ  s    	ÿþz;TLSClientAutomaton.tls13_should_add_ClientCertificateVerifyc                 C   s   |   ¡ S rE   )r¸  r‡   rH   rH   rI   r¹  [  s    z0TLSClientAutomaton.TLS13_ADDED_CERTIFICATEVERIFYc                 C   s   |   tƒ ¡ |  ¡ ‚d S rE   )rµ   r   ÚTLS13_ADDED_CLIENTFINISHEDr‡   rH   rH   rI   r¸  _  s    z2TLSClientAutomaton.tls13_should_add_ClientFinishedc                 C   s   d S rE   rH   r‡   rH   rH   rI   r»  d  s    z-TLSClientAutomaton.TLS13_ADDED_CLIENTFINISHEDc                 C   s   |   ¡  |  ¡ ‚d S rE   )r¹   ÚTLS13_SENT_CLIENTFLIGHT2r‡   rH   rH   rI   Útls13_should_send_ClientFlight2h  s    z2TLSClientAutomaton.tls13_should_send_ClientFlight2c                 C   s(   |   d¡ |  ¡  |   d¡ |  ¡ ‚d S )NzTLS 1.3 handshake completed!r  )r`   r„   r  r‡   rH   rH   rI   r¼  m  s    

z+TLSClientAutomaton.TLS13_SENT_CLIENTFLIGHT2c                 C   s   |   ¡ ‚d S rE   )r0  r‡   rH   rH   rI   ÚSOCKET_CLOSEDt  s    z TLSClientAutomaton.SOCKET_CLOSED)Ústopc                 C   s"   | j jdv r|  ¡ ‚n|  ¡ ‚d S )Nr¦   )r~   r^   r@  rÈ   r‡   rH   rH   rI   ÚSTOPx  s    
zTLSClientAutomaton.STOPc                 C   s"   |   d¡ | j ¡  |   d¡ d S )NzClosing client socket...zEnding TLS client automaton.)r`   rT   ro  r‡   rH   rH   rI   r0  €  s    

zTLSClientAutomaton.FINAL)r@   rA   NNNNNNNNNNNNN)°Ú__name__Ú
__module__Ú__qualname__Ú__doc__rS   r„   r   Ústaterˆ   Zioeventr‹   r†   r¡   r¬   Ú	conditionr¸   r¶   r»   rº   r¼   r¾   rÃ   rÂ   rÆ   rÅ   rÌ   rË   rÎ   rÍ   rÑ   rÓ   rÕ   rÖ   rÒ   rØ   rÚ   rÜ   rÞ   rà   rá   râ   rÝ   rã   rð   rí   rò   rô   rõ   rñ   rù   r÷   rü   rý   rû   rÿ   rþ   r  r   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r+  r*  rÈ   r1  rª   r6  r4  r8  r7  r9  r:  r<  r;  r>  r=  rB  rA  rD  rC  rE  rF  rH  rG  rJ  rL  rO  rP  rR  rQ  rI  rT  rS  rN  rU  rW  rY  rX  r[  rZ  r]  r\  rV  r_  r^  rb  ra  re  rf  rd  rh  rg  ri  rj  rn  rm  r@  rp  r«   r�  r‰  r�  r’  r‘  r“  r”  r–  r˜  rš  r™  r›  r—  r   r•  r¢  r¤  r£  r¦  r¡  r¨  r«  r­  r§  r®  rª  r¯  r±  r²  r°  r³  r¬  r´  r·  r¶  rº  r¹  r¸  r»  r½  r¼  r¾  rÀ  r0  Ú__classcell__rH   rH   r{   rI   r?   P   s¤           ÷I



<



















































%






6






















































UK
r?   )UrÄ  Ú
__future__r   rT   r“   r–   r)  Zscapy.configr   Zscapy.utilsr   r   Zscapy.automatonr   r   Zscapy.errorr   Zscapy.layers.tls.automatonr	   Zscapy.layers.tls.basefieldsr
   r   Zscapy.layers.tls.sessionr   Zscapy.layers.tls.extensionsr   r   r   r   r   r   r   Zscapy.layers.tls.handshaker   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   Z scapy.layers.tls.handshake_sslv2r&   r'   r(   r)   r*   r+   r,   r-   Z"scapy.layers.tls.keyexchange_tls13r.   r/   r0   r1   r2   r3   Zscapy.layers.tls.recordr4   r5   r6   Zscapy.layers.tls.crypto.suitesr7   r8   Zscapy.layers.tls.crypto.groupsr9   Zscapy.layers.tls.crypto.hkdfr:   Z
scapy.libsr;   Zscapy.packetr<   Zscapy.compatr>   r?   rH   rH   rH   rI   Ú<module>   s0   $P( 