Changeset 124

Timestamp:

03/01/17 20:13:07 (8 years ago)

Author:

tim

Message:

.

File:

• trunk/lib/bletchley/ssltls.py (modified) (4 diffs)

trunk/lib/bletchley/ssltls.py

@@ -55 +55 @@
 
 
-def startSSLTLS(sock, mode='client', protocol=SSL.TLSv1_METHOD, key=None, certChain=[], cipher_list=b'DES-CBC3-SHA:RC4-MD5:RC4-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA:ADH-AES256-GCM-SHA384'):
+def startSSLTLS(sock, mode='client', protocol=SSL.TLSv1_METHOD, key=None, certChain=[], cipher_list=None):
     '''
     cipher_list names drawn from:
@@ -79 +79 @@
 
 def ConnectSSLTLS(host, port, cipher_list=None, handshake_callback=None, verbose=True):
-    protocols = [("SSL 2/3", SSL.SSLv23_METHOD),
-                 ("TLS 1.0", SSL.TLSv1_METHOD), 
-                 ("TLS 1.1", SSL.TLSv1_1_METHOD),
-                 ("TLS 1.2", SSL.TLSv1_2_METHOD),
-                 ("SSL 3.0", SSL.SSLv3_METHOD),
-                 ("SSL 2.0", SSL.SSLv2_METHOD)]
+    backup_cipher_list = b'DES-CBC3-SHA:RC4-MD5:RC4-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ADH-AES256-GCM-SHA384'
+    protocols = [("SSL 2/3", SSL.SSLv23_METHOD, None),
+                 ("SSL 2/3", SSL.SSLv23_METHOD, backup_cipher_list),
+                 ("TLS 1.0", SSL.TLSv1_METHOD, None),
+                 ("TLS 1.0", SSL.TLSv1_METHOD, backup_cipher_list), 
+                 ("TLS 1.1", SSL.TLSv1_1_METHOD, None),
+                 ("TLS 1.1", SSL.TLSv1_1_METHOD, backup_cipher_list),
+                 ("TLS 1.2", SSL.TLSv1_2_METHOD, None),
+                 ("TLS 1.2", SSL.TLSv1_2_METHOD, backup_cipher_list),
+                 ("SSL 3.0", SSL.SSLv3_METHOD, None),
+                 ("SSL 3.0", SSL.SSLv3_METHOD, backup_cipher_list),
+                 ("SSL 2.0", SSL.SSLv2_METHOD, None),
+                 ("SSL 2.0", SSL.SSLv2_METHOD, backup_cipher_list)]
 
     conn = None
-    for pname,p in protocols:
+    for pname,p,cl in protocols:
         serverSock = socket.socket()
         serverSock.connect((host,port))
@@ -100 +107 @@
             
         try:
-            conn = startSSLTLS(serverSock, mode='client', protocol=p, cipher_list=cipher_list)
+            conn = startSSLTLS(serverSock, mode='client', protocol=p, cipher_list=cl)
             break
         except ValueError as e:
@@ -110 +117 @@
                 sys.stderr.write("\nThis could happen because the server requires "
                                  "certain SSL/TLS versions or a client certificiate."
-                                 "  Have no fear, we'll keep trying...\n")            
+                                 "  Have no fear, we'll keep trying...\n")
         except Exception as e:
             sys.stderr.write("Unknown exception during %s handshake with server: \n" % pname)