Skip to content

Commit 21f972e

Browse files
ic0nsic0ns
committed
Cleaned up most of the signature and hash algorithm mess
1 parent 94a5b7e commit 21f972e

File tree

9 files changed

+60
-55
lines changed

9 files changed

+60
-55
lines changed

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/config/Config.java‎

Lines changed: 10 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ public static Config createEmptyConfig() {
195195
/**
196196
* Which Signature and Hash algorithms we support
197197
*/
198-
private List<SignatureAndHashAlgorithm> supportedSignatureAndHashAlgorithms;
198+
private List<SignatureAndHashAlgorithm> defaultClientSupportedSignatureAndHashAlgorithms;
199199

200200
/**
201201
* Which Ciphersuites we support by default
@@ -852,8 +852,6 @@ public static Config createEmptyConfig() {
852852

853853
private List<ECPointFormat> defaultClientSupportedPointFormats;
854854

855-
private List<SignatureAndHashAlgorithm> defaultClientSupportedSignatureAndHashAlgorithms;
856-
857855
private List<SignatureAndHashAlgorithm> defaultServerSupportedSignatureAndHashAlgorithms;
858856

859857
private SignatureAndHashAlgorithm defaultSelectedSignatureAndHashAlgorithm = SignatureAndHashAlgorithm.RSA_SHA1;
@@ -1124,8 +1122,8 @@ public static Config createEmptyConfig() {
11241122
defaultServerConnection = new InboundConnection("server", 443, "localhost");
11251123
workflowTraceType = WorkflowTraceType.HANDSHAKE;
11261124

1127-
supportedSignatureAndHashAlgorithms = new LinkedList<>();
1128-
supportedSignatureAndHashAlgorithms.addAll(SignatureAndHashAlgorithm.getImplemented());
1125+
defaultClientSupportedSignatureAndHashAlgorithms = new LinkedList<>();
1126+
defaultClientSupportedSignatureAndHashAlgorithms.addAll(SignatureAndHashAlgorithm.getImplemented());
11291127
defaultClientSupportedCompressionMethods = new LinkedList<>();
11301128
defaultClientSupportedCompressionMethods.add(CompressionMethod.NULL);
11311129
defaultServerSupportedCompressionMethods = new LinkedList<>();
@@ -1938,21 +1936,6 @@ public final void setDefaultClientSNIEntries(SNIEntry... defaultClientSNIEntryLi
19381936
this.defaultClientSNIEntryList = new ArrayList(Arrays.asList(defaultClientSNIEntryList));
19391937
}
19401938

1941-
public List<SignatureAndHashAlgorithm> getDefaultClientSupportedSignatureAndHashAlgorithms() {
1942-
return defaultClientSupportedSignatureAndHashAlgorithms;
1943-
}
1944-
1945-
public void setDefaultClientSupportedSignatureAndHashAlgorithms(
1946-
List<SignatureAndHashAlgorithm> defaultClientSupportedSignatureAndHashAlgorithms) {
1947-
this.defaultClientSupportedSignatureAndHashAlgorithms = defaultClientSupportedSignatureAndHashAlgorithms;
1948-
}
1949-
1950-
public final void setDefaultClientSupportedSignatureAndHashAlgorithms(
1951-
SignatureAndHashAlgorithm... defaultClientSupportedSignatureAndHashAlgorithms) {
1952-
this.defaultClientSupportedSignatureAndHashAlgorithms = Arrays
1953-
.asList(defaultClientSupportedSignatureAndHashAlgorithms);
1954-
}
1955-
19561939
public List<ECPointFormat> getDefaultServerSupportedPointFormats() {
19571940
return defaultServerSupportedPointFormats;
19581941
}
@@ -2285,18 +2268,19 @@ public void setClientAuthentication(Boolean clientAuthentication) {
22852268
this.clientAuthentication = clientAuthentication;
22862269
}
22872270

2288-
public List<SignatureAndHashAlgorithm> getSupportedSignatureAndHashAlgorithms() {
2289-
return supportedSignatureAndHashAlgorithms;
2271+
public List<SignatureAndHashAlgorithm> getDefaultClientSupportedSignatureAndHashAlgorithms() {
2272+
return defaultClientSupportedSignatureAndHashAlgorithms;
22902273
}
22912274

2292-
public void setSupportedSignatureAndHashAlgorithms(
2293-
List<SignatureAndHashAlgorithm> supportedSignatureAndHashAlgorithms) {
2294-
this.supportedSignatureAndHashAlgorithms = supportedSignatureAndHashAlgorithms;
2275+
public void setDefaultClientSupportedSignatureAndHashAlgorithms(
2276+
List<SignatureAndHashAlgorithm> defaultClientSupportedSignatureAndHashAlgorithms) {
2277+
this.defaultClientSupportedSignatureAndHashAlgorithms = defaultClientSupportedSignatureAndHashAlgorithms;
22952278
}
22962279

22972280
public final void setSupportedSignatureAndHashAlgorithms(
22982281
SignatureAndHashAlgorithm... supportedSignatureAndHashAlgorithms) {
2299-
this.supportedSignatureAndHashAlgorithms = new ArrayList(Arrays.asList(supportedSignatureAndHashAlgorithms));
2282+
this.defaultClientSupportedSignatureAndHashAlgorithms = new ArrayList(
2283+
Arrays.asList(supportedSignatureAndHashAlgorithms));
23002284
}
23012285

23022286
public List<ProtocolVersion> getSupportedVersions() {

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/config/delegate/SignatureAndHashAlgorithmDelegate.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@ public void setSignatureAndHashAlgorithms(List<SignatureAndHashAlgorithm> signat
3838
public void applyDelegate(Config config) {
3939
if (signatureAndHashAlgorithms != null) {
4040
config.setAddSignatureAndHashAlgorithmsExtension(true);
41-
config.setSupportedSignatureAndHashAlgorithms(signatureAndHashAlgorithms);
41+
config.setDefaultClientSupportedSignatureAndHashAlgorithms(signatureAndHashAlgorithms);
42+
config.setDefaultServerSupportedSignatureAndHashAlgorithms(signatureAndHashAlgorithms);
4243
config.setDefaultSelectedSignatureAndHashAlgorithm(signatureAndHashAlgorithms.get(0));
4344
}
4445
}

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/protocol/handler/CertificateRequestHandler.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
*/
99
package de.rub.nds.tlsattacker.core.protocol.handler;
1010

11+
import com.google.common.collect.Sets;
1112
import de.rub.nds.modifiablevariable.util.ArrayConverter;
1213
import de.rub.nds.tlsattacker.core.constants.ClientCertificateType;
1314
import de.rub.nds.tlsattacker.core.constants.SignatureAndHashAlgorithm;
@@ -16,6 +17,7 @@
1617
import de.rub.nds.tlsattacker.core.protocol.preparator.CertificateRequestPreparator;
1718
import de.rub.nds.tlsattacker.core.protocol.serializer.CertificateRequestSerializer;
1819
import de.rub.nds.tlsattacker.core.state.TlsContext;
20+
import java.util.Collections;
1921
import java.util.LinkedList;
2022
import java.util.List;
2123
import org.apache.logging.log4j.LogManager;
@@ -49,6 +51,7 @@ public void adjustTLSContext(CertificateRequestMessage message) {
4951
adjustClientCertificateTypes(message);
5052
adjustDistinguishedNames(message);
5153
adjustServerSupportedSignatureAndHashAlgorithms(message);
54+
adjustSelectedSignatureAndHashAlgorithm();
5255
}
5356

5457
private void adjustServerSupportedSignatureAndHashAlgorithms(CertificateRequestMessage message) {
@@ -106,4 +109,19 @@ private List<SignatureAndHashAlgorithm> convertSignatureAndHashAlgorithms(byte[]
106109
}
107110
return list;
108111
}
112+
113+
private void adjustSelectedSignatureAndHashAlgorithm() {
114+
if (Collections.disjoint(tlsContext.getChooser().getClientSupportedSignatureAndHashAlgorithms(), tlsContext
115+
.getChooser().getServerSupportedSignatureAndHashAlgorithms())) {
116+
LOGGER.warn("Client and Server have no signature and hash algorithm in common");
117+
} else {
118+
Sets.SetView<SignatureAndHashAlgorithm> intersection = Sets.intersection(
119+
Sets.newHashSet(tlsContext.getChooser().getClientSupportedSignatureAndHashAlgorithms()),
120+
Sets.newHashSet(tlsContext.getChooser().getServerSupportedSignatureAndHashAlgorithms()));
121+
SignatureAndHashAlgorithm algo = (SignatureAndHashAlgorithm) intersection.toArray()[0];
122+
tlsContext.setSelectedSignatureAndHashAlgorithm(algo);
123+
LOGGER.debug("Adjusting selected signature and hash algorithm to: " + algo.name());
124+
125+
}
126+
}
109127
}

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/protocol/preparator/extension/SignatureAndHashAlgorithmsExtensionPreparator.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ private void prepareSignatureAndHashAlgorithms(SignatureAndHashAlgorithmsExtensi
4747

4848
private byte[] createSignatureAndHashAlgorithmsArray() {
4949
ByteArrayOutputStream stream = new ByteArrayOutputStream();
50-
for (SignatureAndHashAlgorithm algo : chooser.getConfig().getSupportedSignatureAndHashAlgorithms()) {
50+
for (SignatureAndHashAlgorithm algo : chooser.getConfig().getDefaultClientSupportedSignatureAndHashAlgorithms()) {
5151
try {
5252
stream.write(algo.getByteValue());
5353
} catch (IOException ex) {

‎TLS-Core/src/main/resources/default_config.xml‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -96,27 +96,27 @@
9696
</defaultServerConnection>
9797
<defaultRunningMode>CLIENT</defaultRunningMode>
9898
<clientAuthentication>false</clientAuthentication>
99-
<supportedSignatureAndHashAlgorithms>DSA_MD5</supportedSignatureAndHashAlgorithms>
100-
<supportedSignatureAndHashAlgorithms>DSA_SHA1</supportedSignatureAndHashAlgorithms>
101-
<supportedSignatureAndHashAlgorithms>DSA_SHA224</supportedSignatureAndHashAlgorithms>
102-
<supportedSignatureAndHashAlgorithms>DSA_SHA256</supportedSignatureAndHashAlgorithms>
103-
<supportedSignatureAndHashAlgorithms>DSA_SHA384</supportedSignatureAndHashAlgorithms>
104-
<supportedSignatureAndHashAlgorithms>DSA_SHA512</supportedSignatureAndHashAlgorithms>
105-
<supportedSignatureAndHashAlgorithms>RSA_MD5</supportedSignatureAndHashAlgorithms>
106-
<supportedSignatureAndHashAlgorithms>RSA_SHA1</supportedSignatureAndHashAlgorithms>
107-
<supportedSignatureAndHashAlgorithms>RSA_SHA224</supportedSignatureAndHashAlgorithms>
108-
<supportedSignatureAndHashAlgorithms>RSA_SHA256</supportedSignatureAndHashAlgorithms>
109-
<supportedSignatureAndHashAlgorithms>RSA_SHA384</supportedSignatureAndHashAlgorithms>
110-
<supportedSignatureAndHashAlgorithms>RSA_SHA512</supportedSignatureAndHashAlgorithms>
111-
<supportedSignatureAndHashAlgorithms>ECDSA_MD5</supportedSignatureAndHashAlgorithms>
112-
<supportedSignatureAndHashAlgorithms>ECDSA_SHA1</supportedSignatureAndHashAlgorithms>
113-
<supportedSignatureAndHashAlgorithms>ECDSA_SHA224</supportedSignatureAndHashAlgorithms>
114-
<supportedSignatureAndHashAlgorithms>ECDSA_SHA256</supportedSignatureAndHashAlgorithms>
115-
<supportedSignatureAndHashAlgorithms>ECDSA_SHA384</supportedSignatureAndHashAlgorithms>
116-
<supportedSignatureAndHashAlgorithms>ECDSA_SHA512</supportedSignatureAndHashAlgorithms>
117-
<supportedSignatureAndHashAlgorithms>GOSTR34102001_GOSTR3411</supportedSignatureAndHashAlgorithms>
118-
<supportedSignatureAndHashAlgorithms>GOSTR34102012_256_GOSTR34112012_256</supportedSignatureAndHashAlgorithms>
119-
<supportedSignatureAndHashAlgorithms>GOSTR34102012_512_GOSTR34112012_512</supportedSignatureAndHashAlgorithms>
99+
<defaultClientSupportedSignatureAndHashAlgorithms>DSA_MD5</defaultClientSupportedSignatureAndHashAlgorithms>
100+
<defaultClientSupportedSignatureAndHashAlgorithms>DSA_SHA1</defaultClientSupportedSignatureAndHashAlgorithms>
101+
<defaultClientSupportedSignatureAndHashAlgorithms>DSA_SHA224</defaultClientSupportedSignatureAndHashAlgorithms>
102+
<defaultClientSupportedSignatureAndHashAlgorithms>DSA_SHA256</defaultClientSupportedSignatureAndHashAlgorithms>
103+
<defaultClientSupportedSignatureAndHashAlgorithms>DSA_SHA384</defaultClientSupportedSignatureAndHashAlgorithms>
104+
<defaultClientSupportedSignatureAndHashAlgorithms>DSA_SHA512</defaultClientSupportedSignatureAndHashAlgorithms>
105+
<defaultClientSupportedSignatureAndHashAlgorithms>RSA_MD5</defaultClientSupportedSignatureAndHashAlgorithms>
106+
<defaultClientSupportedSignatureAndHashAlgorithms>RSA_SHA1</defaultClientSupportedSignatureAndHashAlgorithms>
107+
<defaultClientSupportedSignatureAndHashAlgorithms>RSA_SHA224</defaultClientSupportedSignatureAndHashAlgorithms>
108+
<defaultClientSupportedSignatureAndHashAlgorithms>RSA_SHA256</defaultClientSupportedSignatureAndHashAlgorithms>
109+
<defaultClientSupportedSignatureAndHashAlgorithms>RSA_SHA384</defaultClientSupportedSignatureAndHashAlgorithms>
110+
<defaultClientSupportedSignatureAndHashAlgorithms>RSA_SHA512</defaultClientSupportedSignatureAndHashAlgorithms>
111+
<defaultClientSupportedSignatureAndHashAlgorithms>ECDSA_MD5</defaultClientSupportedSignatureAndHashAlgorithms>
112+
<defaultClientSupportedSignatureAndHashAlgorithms>ECDSA_SHA1</defaultClientSupportedSignatureAndHashAlgorithms>
113+
<defaultClientSupportedSignatureAndHashAlgorithms>ECDSA_SHA224</defaultClientSupportedSignatureAndHashAlgorithms>
114+
<defaultClientSupportedSignatureAndHashAlgorithms>ECDSA_SHA256</defaultClientSupportedSignatureAndHashAlgorithms>
115+
<defaultClientSupportedSignatureAndHashAlgorithms>ECDSA_SHA384</defaultClientSupportedSignatureAndHashAlgorithms>
116+
<defaultClientSupportedSignatureAndHashAlgorithms>ECDSA_SHA512</defaultClientSupportedSignatureAndHashAlgorithms>
117+
<defaultClientSupportedSignatureAndHashAlgorithms>GOSTR34102001_GOSTR3411</defaultClientSupportedSignatureAndHashAlgorithms>
118+
<defaultClientSupportedSignatureAndHashAlgorithms>GOSTR34102012_256_GOSTR34112012_256</defaultClientSupportedSignatureAndHashAlgorithms>
119+
<defaultClientSupportedSignatureAndHashAlgorithms>GOSTR34102012_512_GOSTR34112012_512</defaultClientSupportedSignatureAndHashAlgorithms>
120120
<defaultClientSupportedCiphersuites>TLS_RSA_WITH_3DES_EDE_CBC_SHA</defaultClientSupportedCiphersuites>
121121
<defaultClientSupportedCiphersuites>TLS_RSA_WITH_AES_128_CBC_SHA</defaultClientSupportedCiphersuites>
122122
<defaultClientSupportedCiphersuites>TLS_RSA_WITH_NULL_MD5</defaultClientSupportedCiphersuites>

‎TLS-Core/src/test/java/de/rub/nds/tlsattacker/core/config/delegate/SignatureAndHashAlgorithmDelegateTest.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,10 @@ public void testApplyDelegate() {
8282
assertFalse(config.isAddSignatureAndHashAlgrorithmsExtension());
8383
delegate.applyDelegate(config);
8484
assertTrue(config.isAddSignatureAndHashAlgrorithmsExtension());
85-
assertTrue(config.getSupportedSignatureAndHashAlgorithms().contains(SignatureAndHashAlgorithm.RSA_SHA512));
86-
assertTrue(config.getSupportedSignatureAndHashAlgorithms().contains(SignatureAndHashAlgorithm.DSA_SHA512));
85+
assertTrue(config.getDefaultClientSupportedSignatureAndHashAlgorithms().contains(
86+
SignatureAndHashAlgorithm.RSA_SHA512));
87+
assertTrue(config.getDefaultClientSupportedSignatureAndHashAlgorithms().contains(
88+
SignatureAndHashAlgorithm.DSA_SHA512));
8789
}
8890

8991
@Test

‎TLS-Core/src/test/java/de/rub/nds/tlsattacker/core/protocol/preparator/CertificateVerifyPreparatorTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ public void testPrepareRSA() throws NoSuchAlgorithmException {
117117
algoList.add(SignatureAndHashAlgorithm.RSA_MD5);
118118
algoList.add(SignatureAndHashAlgorithm.ECDSA_SHA1);
119119
algoList.add(SignatureAndHashAlgorithm.RSA_SHA1);
120-
context.getConfig().setSupportedSignatureAndHashAlgorithms(algoList);
120+
context.getConfig().setDefaultClientSupportedSignatureAndHashAlgorithms(algoList);
121121
preparator.prepare();
122122
assertArrayEquals(new byte[] { 1, 1, }, message.getSignatureHashAlgorithm().getValue());
123123
// TODO I dont check if the signature is correctly calcualted or
@@ -137,7 +137,7 @@ public void testPrepareEC() throws NoSuchAlgorithmException, NoSuchProviderExcep
137137
algoList.add(SignatureAndHashAlgorithm.RSA_MD5);
138138
algoList.add(SignatureAndHashAlgorithm.ECDSA_SHA1);
139139
algoList.add(SignatureAndHashAlgorithm.RSA_SHA1);
140-
context.getConfig().setSupportedSignatureAndHashAlgorithms(algoList);
140+
context.getConfig().setDefaultClientSupportedSignatureAndHashAlgorithms(algoList);
141141
preparator.prepare();
142142
LOGGER.info(ArrayConverter.bytesToHexString(message.getSignature().getValue(), false));
143143

‎TLS-Core/src/test/java/de/rub/nds/tlsattacker/core/protocol/preparator/DHEServerKeyExchangePreparatorTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ public void testPrepare() {
5555
List<SignatureAndHashAlgorithm> SigAndHashList = new LinkedList<>();
5656
SigAndHashList.add(SignatureAndHashAlgorithm.RSA_SHA1);
5757
SigAndHashList.add(SignatureAndHashAlgorithm.DSA_MD5);
58-
context.getConfig().setSupportedSignatureAndHashAlgorithms(SigAndHashList);
58+
context.getConfig().setDefaultClientSupportedSignatureAndHashAlgorithms(SigAndHashList);
5959
// Test
6060
preparator.prepareHandshakeMessageContents();
6161

‎TLS-Core/src/test/java/de/rub/nds/tlsattacker/core/protocol/preparator/ECDHEServerKeyExchangePreparatorTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ private void loadTestVectorsToContext() throws IOException, NoSuchAlgorithmExcep
135135

136136
List<SignatureAndHashAlgorithm> SigAndHashList = new LinkedList<>();
137137
SigAndHashList.add(SignatureAndHashAlgorithm.RSA_SHA512);
138-
config.setSupportedSignatureAndHashAlgorithms(SigAndHashList);
138+
config.setDefaultClientSupportedSignatureAndHashAlgorithms(SigAndHashList);
139139
}
140140

141141
@Test

0 commit comments

Comments
 (0)