Changeset 130 for trunk

Timestamp:

07/18/17 20:40:24 (7 years ago)

Author:

tim

Message:

fixed handshake algorithm for when openssl wants you to poll poll poll...

File:

• trunk/lib/bletchley/ssltls.py (modified) (5 diffs)

trunk/lib/bletchley/ssltls.py

@@ -2 +2 @@
 Utilities for manipulating certificates and SSL/TLS connections.
 
-Copyright (C) 2014,2016 Blindspot Security LLC
+Copyright (C) 2014,2016,2017 Blindspot Security LLC
 Author: Timothy D. Morgan
 
@@ -22 +22 @@
 import traceback
 import random
+import time
 import socket
 try:
@@ -74 +75 @@
     if mode == 'client':
         conn.set_connect_state()
-        conn.do_handshake()
+        # This hokey crap is required because OpenSSL wants you to poll rather than just block
+        # XXX: tie this sleep time into the timeout parameter
+        for tries in range(0,10):
+            try:
+                conn.do_handshake()
+                break
+            except OpenSSL.SSL.WantReadError as e:
+                time.sleep(0.1)
     else:
         conn.set_accept_state()
@@ -82 +90 @@
 
 def ConnectSSLTLS(host, port, cipher_list=None, timeout=None, handshake_callback=None, verbose=True):
-    backup_cipher_list = b'DES-CBC3-SHA:RC4-MD5:RC4-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ADH-AES256-GCM-SHA384'
-    protocols = [("SSL 2/3", SSL.SSLv23_METHOD, None),
+    backup_cipher_list = b'DES-CBC3-SHA:RC4-MD5:RC4-SHA:AES128-SHA:AES256-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ADH-AES256-GCM-SHA384'
+    protocols = [("SSL 2/3", SSL.SSLv23_METHOD, cipher_list),
                  ("SSL 2/3", SSL.SSLv23_METHOD, backup_cipher_list),
-                 ("TLS 1.0", SSL.TLSv1_METHOD, None),
+                 ("TLS 1.0", SSL.TLSv1_METHOD, cipher_list),
                  ("TLS 1.0", SSL.TLSv1_METHOD, backup_cipher_list), 
-                 ("TLS 1.1", SSL.TLSv1_1_METHOD, None),
+                 ("TLS 1.1", SSL.TLSv1_1_METHOD, cipher_list),
                  ("TLS 1.1", SSL.TLSv1_1_METHOD, backup_cipher_list),
-                 ("TLS 1.2", SSL.TLSv1_2_METHOD, None),
+                 ("TLS 1.2", SSL.TLSv1_2_METHOD, cipher_list),
                  ("TLS 1.2", SSL.TLSv1_2_METHOD, backup_cipher_list),
-                 ("SSL 3.0", SSL.SSLv3_METHOD, None),
+                 ("SSL 3.0", SSL.SSLv3_METHOD, cipher_list),
                  ("SSL 3.0", SSL.SSLv3_METHOD, backup_cipher_list),
-                 ("SSL 2.0", SSL.SSLv2_METHOD, None),
+                 ("SSL 2.0", SSL.SSLv2_METHOD, cipher_list),
                  ("SSL 2.0", SSL.SSLv2_METHOD, backup_cipher_list)]
 
@@ -124 +132 @@
         except SSL.Error as e:
             if verbose:
-                sys.stderr.write("Exception during %s handshake with server." % pname)
+                sys.stderr.write("Exception during %s handshake with server. (%s)" % (pname, e))
+                #traceback.print_exc(file=sys.stderr)
                 sys.stderr.write("\nThis could happen because the server requires "
-                                 "certain SSL/TLS versions or a client certificiate."
+                                 "certain SSL/TLS versions or a client certificate."
                                  "  Have no fear, we'll keep trying...\n")
         except Exception as e: