Reland 'Require ECDHE for False Start.'

third_party/tlslite/tlslite/constants.py

 # Authors: 
 #   Trevor Perrin
 #   Google - defining ClientCertificateType
 #   Google (adapted by Sam Rushing) - NPN support
 #   Dimitris Moraitis - Anon ciphersuites
 #   Dave Baggett (Arcode Corporation) - canonicalCipherName
 #   Yngve Pettersen (ported by Paul Sokolovsky) - TLS 1.2
 #
 # See the LICENSE file for legal information regarding use of this file.
 
@@ skipping 58 matching lines @@
 
 class SignatureAlgorithm:
     anonymous = 0
     rsa = 1
     dsa = 2
     ecdsa = 3
     
 class NameType:
     host_name = 0
 
+class ECCurveType:
+    explicit_prime = 1
+    explicit_char2 = 2
+    named_curve = 3
+
+class NamedCurve:
+    secp256r1 = 23
+
 class AlertLevel:
     warning = 1
     fatal = 2
 
 class AlertDescription:
     """
     @cvar bad_record_mac: A TLS record failed to decrypt properly.
 
     If this occurs during a SRP handshake it most likely
     indicates a bad password.  It may also indicate an implementation
@@ skipping 82 matching lines @@
 
     TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x003C
     TLS_RSA_WITH_AES_256_CBC_SHA256 = 0x003D
 
     TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 = 0x0067
     TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 = 0x006B
 
     TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x009C
     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = 0x009E
 
+    TLS_ECDHE_RSA_WITH_RC4_128_SHA = 0xc011
+    TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA = 0xc012
+    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0xc013
+    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0xc014
+    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 0xc027
+    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0xc02f
+
     tripleDESSuites = []
     tripleDESSuites.append(TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA)
     tripleDESSuites.append(TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA)
     tripleDESSuites.append(TLS_RSA_WITH_3DES_EDE_CBC_SHA)
     tripleDESSuites.append(TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA)
+    tripleDESSuites.append(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA)
 
     aes128Suites = []
     aes128Suites.append(TLS_SRP_SHA_WITH_AES_128_CBC_SHA)
     aes128Suites.append(TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA)
     aes128Suites.append(TLS_RSA_WITH_AES_128_CBC_SHA)
     aes128Suites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA)
     aes128Suites.append(TLS_DH_ANON_WITH_AES_128_CBC_SHA)
     aes128Suites.append(TLS_RSA_WITH_AES_128_CBC_SHA256)
     aes128Suites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256)
+    aes128Suites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA)
+    aes128Suites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256)
 
     aes256Suites = []
     aes256Suites.append(TLS_SRP_SHA_WITH_AES_256_CBC_SHA)
     aes256Suites.append(TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA)
     aes256Suites.append(TLS_RSA_WITH_AES_256_CBC_SHA)
     aes256Suites.append(TLS_DH_ANON_WITH_AES_256_CBC_SHA)
     aes256Suites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA)
     aes256Suites.append(TLS_RSA_WITH_AES_256_CBC_SHA256)
     aes256Suites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256)
+    aes256Suites.append(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA)
 
     aes128GcmSuites = []
     aes128GcmSuites.append(TLS_RSA_WITH_AES_128_GCM_SHA256)
     aes128GcmSuites.append(TLS_DHE_RSA_WITH_AES_128_GCM_SHA256)
+    aes128GcmSuites.append(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
 
     rc4Suites = []
     rc4Suites.append(TLS_RSA_WITH_RC4_128_SHA)
     rc4Suites.append(TLS_RSA_WITH_RC4_128_MD5)
+    rc4Suites.append(TLS_ECDHE_RSA_WITH_RC4_128_SHA)
     
     shaSuites = []
     shaSuites.append(TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA)
     shaSuites.append(TLS_SRP_SHA_WITH_AES_128_CBC_SHA)
     shaSuites.append(TLS_SRP_SHA_WITH_AES_256_CBC_SHA)
     shaSuites.append(TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA)
     shaSuites.append(TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA)
     shaSuites.append(TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA)
     shaSuites.append(TLS_RSA_WITH_3DES_EDE_CBC_SHA)
     shaSuites.append(TLS_RSA_WITH_AES_128_CBC_SHA)
     shaSuites.append(TLS_RSA_WITH_AES_256_CBC_SHA)
     shaSuites.append(TLS_RSA_WITH_RC4_128_SHA)
     shaSuites.append(TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA)
     shaSuites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA)
     shaSuites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA)
     shaSuites.append(TLS_DH_ANON_WITH_AES_128_CBC_SHA)
     shaSuites.append(TLS_DH_ANON_WITH_AES_256_CBC_SHA)
+    shaSuites.append(TLS_ECDHE_RSA_WITH_RC4_128_SHA)
+    shaSuites.append(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA)
+    shaSuites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA)
+    shaSuites.append(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA)
     
     sha256Suites = []
     sha256Suites.append(TLS_RSA_WITH_AES_128_CBC_SHA256)
     sha256Suites.append(TLS_RSA_WITH_AES_256_CBC_SHA256)
     sha256Suites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256)
     sha256Suites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256)
     sha256Suites.append(TLS_RSA_WITH_AES_128_GCM_SHA256)
     sha256Suites.append(TLS_DHE_RSA_WITH_AES_128_GCM_SHA256)
+    sha256Suites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256)
+    sha256Suites.append(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
+
 
     aeadSuites = aes128GcmSuites
 
 
     md5Suites = []
     md5Suites.append(TLS_RSA_WITH_RC4_128_MD5)
 
     @staticmethod
     def _filterSuites(suites, settings, version=None):
         if version is None:
@@ skipping 21 matching lines @@
         if "3des" in cipherNames:
             cipherSuites += CipherSuite.tripleDESSuites
         if "rc4" in cipherNames:
             cipherSuites += CipherSuite.rc4Suites
 
         keyExchangeSuites = []
         if "rsa" in keyExchangeNames:
             keyExchangeSuites += CipherSuite.certSuites
         if "dhe_rsa" in keyExchangeNames:
             keyExchangeSuites += CipherSuite.dheCertSuites
+        if "ecdhe_rsa" in keyExchangeNames:
+            keyExchangeSuites += CipherSuite.ecdheCertSuites
         if "srp_sha" in keyExchangeNames:
             keyExchangeSuites += CipherSuite.srpSuites
         if "srp_sha_rsa" in keyExchangeNames:
             keyExchangeSuites += CipherSuite.srpCertSuites
         if "dh_anon" in keyExchangeNames:
             keyExchangeSuites += CipherSuite.anonSuites
 
         return [s for s in suites if s in macSuites and
                 s in cipherSuites and s in keyExchangeSuites]
 
@@ skipping 40 matching lines @@
     dheCertSuites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256)
     dheCertSuites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256)
     dheCertSuites.append(TLS_DHE_RSA_WITH_AES_256_CBC_SHA)
     dheCertSuites.append(TLS_DHE_RSA_WITH_AES_128_CBC_SHA)
     dheCertSuites.append(TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA)
 
     @staticmethod
     def getDheCertSuites(settings, version=None):
         return CipherSuite._filterSuites(CipherSuite.dheCertSuites, settings, version)
 
-    certAllSuites = srpCertSuites + certSuites + dheCertSuites
+    ecdheCertSuites = []
+    ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
+    ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256)
+    ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA)
+    ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA)
+    ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA)
+    ecdheCertSuites.append(TLS_ECDHE_RSA_WITH_RC4_128_SHA)
+
+    @staticmethod
+    def getEcdheCertSuites(settings, version=None):
+        return CipherSuite._filterSuites(CipherSuite.ecdheCertSuites, settings, version)
+
+    certAllSuites = srpCertSuites + certSuites + dheCertSuites + ecdheCertSuites
 
     anonSuites = []
     anonSuites.append(TLS_DH_ANON_WITH_AES_256_CBC_SHA)
     anonSuites.append(TLS_DH_ANON_WITH_AES_128_CBC_SHA)
     
     @staticmethod
     def getAnonSuites(settings, version=None):
         return CipherSuite._filterSuites(CipherSuite.anonSuites, settings, version)
 
     dhAllSuites = dheCertSuites + anonSuites
+    ecdhAllSuites = ecdheCertSuites
 
     @staticmethod
     def canonicalCipherName(ciphersuite):
         "Return the canonical name of the cipher whose number is provided."
         if ciphersuite in CipherSuite.aes128Suites:
             return "aes128"
         elif ciphersuite in CipherSuite.aes256Suites:
             return "aes256"
         elif ciphersuite in CipherSuite.rc4Suites:
             return "rc4"
@@ skipping 54 matching lines @@
         badUsername: "bad username",\
         badPassword: "bad password",\
         badA: "bad A",\
         badPremasterPadding: "bad premaster padding",\
         shortPremasterSecret: "short premaster secret",\
         badVerifyMessage: "bad verify message",\
         badFinished: "bad finished message",\
         badMAC: "bad MAC",\
         badPadding: "bad padding"
         }