OLD | NEW |
(Empty) | |
| 1 diff --git a/third_party/tlslite/tlslite/TLSConnection.py b/third_party/tlslite/
tlslite/TLSConnection.py |
| 2 index e882e2c..3f6b736 100644 |
| 3 --- a/third_party/tlslite/tlslite/TLSConnection.py |
| 4 +++ b/third_party/tlslite/tlslite/TLSConnection.py |
| 5 @@ -936,7 +936,8 @@ class TLSConnection(TLSRecordLayer): |
| 6 def handshakeServer(self, sharedKeyDB=None, verifierDB=None, |
| 7 certChain=None, privateKey=None, reqCert=False, |
| 8 sessionCache=None, settings=None, checker=None, |
| 9 - reqCAs=None, tlsIntolerant=0): |
| 10 + reqCAs=None, tlsIntolerant=0, |
| 11 + signedCertTimestamps=None): |
| 12 """Perform a handshake in the role of server. |
| 13 |
| 14 This function performs an SSL or TLS handshake. Depending on |
| 15 @@ -1016,14 +1017,15 @@ class TLSConnection(TLSRecordLayer): |
| 16 """ |
| 17 for result in self.handshakeServerAsync(sharedKeyDB, verifierDB, |
| 18 certChain, privateKey, reqCert, sessionCache, settings, |
| 19 - checker, reqCAs, tlsIntolerant): |
| 20 + checker, reqCAs, tlsIntolerant, signedCertTimestamps): |
| 21 pass |
| 22 |
| 23 |
| 24 def handshakeServerAsync(self, sharedKeyDB=None, verifierDB=None, |
| 25 certChain=None, privateKey=None, reqCert=False, |
| 26 sessionCache=None, settings=None, checker=None, |
| 27 - reqCAs=None, tlsIntolerant=0): |
| 28 + reqCAs=None, tlsIntolerant=0, |
| 29 + signedCertTimestamps=None): |
| 30 """Start a server handshake operation on the TLS connection. |
| 31 |
| 32 This function returns a generator which behaves similarly to |
| 33 @@ -1041,14 +1043,16 @@ class TLSConnection(TLSRecordLayer): |
| 34 privateKey=privateKey, reqCert=reqCert, |
| 35 sessionCache=sessionCache, settings=settings, |
| 36 reqCAs=reqCAs, |
| 37 - tlsIntolerant=tlsIntolerant) |
| 38 + tlsIntolerant=tlsIntolerant, |
| 39 + signedCertTimestamps=signedCertTimestamps) |
| 40 for result in self._handshakeWrapperAsync(handshaker, checker): |
| 41 yield result |
| 42 |
| 43 |
| 44 def _handshakeServerAsyncHelper(self, sharedKeyDB, verifierDB, |
| 45 - certChain, privateKey, reqCert, sessionCache, |
| 46 - settings, reqCAs, tlsIntolerant): |
| 47 + certChain, privateKey, reqCert, |
| 48 + sessionCache, settings, reqCAs, |
| 49 + tlsIntolerant, signedCertTimestamps): |
| 50 |
| 51 self._handshakeStart(client=False) |
| 52 |
| 53 @@ -1060,6 +1064,9 @@ class TLSConnection(TLSRecordLayer): |
| 54 raise ValueError("Caller passed a privateKey but no certChain") |
| 55 if reqCAs and not reqCert: |
| 56 raise ValueError("Caller passed reqCAs but not reqCert") |
| 57 + if signedCertTimestamps and not certChain: |
| 58 + raise ValueError("Caller passed signedCertTimestamps but no " |
| 59 + "certChain") |
| 60 |
| 61 if not settings: |
| 62 settings = HandshakeSettings() |
| 63 @@ -1415,6 +1422,8 @@ class TLSConnection(TLSRecordLayer): |
| 64 self.version, serverRandom, |
| 65 sessionID, cipherSuite, certificateType) |
| 66 serverHello.channel_id = clientHello.channel_id |
| 67 + if clientHello.signed_cert_timestamps: |
| 68 + serverHello.signed_cert_timestamps = signedCertTimestamps |
| 69 doingChannelID = clientHello.channel_id |
| 70 msgs.append(serverHello) |
| 71 msgs.append(Certificate(certificateType).create(serverCertChain)) |
| 72 diff --git a/third_party/tlslite/tlslite/constants.py b/third_party/tlslite/tlsl
ite/constants.py |
| 73 index e357dd0..4e150bd 100644 |
| 74 --- a/third_party/tlslite/tlslite/constants.py |
| 75 +++ b/third_party/tlslite/tlslite/constants.py |
| 76 @@ -32,6 +32,7 @@ class ContentType: |
| 77 all = (20,21,22,23) |
| 78 |
| 79 class ExtensionType: |
| 80 + signed_cert_timestamps = 18 # signed_certificate_timestamp extension |
| 81 channel_id = 30031 |
| 82 |
| 83 class AlertLevel: |
| 84 diff --git a/third_party/tlslite/tlslite/messages.py b/third_party/tlslite/tlsli
te/messages.py |
| 85 index fa4d817..3eb2e52 100644 |
| 86 --- a/third_party/tlslite/tlslite/messages.py |
| 87 +++ b/third_party/tlslite/tlslite/messages.py |
| 88 @@ -131,6 +131,7 @@ class ClientHello(HandshakeMsg): |
| 89 self.compression_methods = [] # a list of 8-bit values |
| 90 self.srp_username = None # a string |
| 91 self.channel_id = False |
| 92 + self.signed_cert_timestamps = False |
| 93 |
| 94 def create(self, version, random, session_id, cipher_suites, |
| 95 certificate_types=None, srp_username=None): |
| 96 @@ -177,6 +178,8 @@ class ClientHello(HandshakeMsg): |
| 97 self.certificate_types = p.getVarList(1, 1) |
| 98 elif extType == ExtensionType.channel_id: |
| 99 self.channel_id = True |
| 100 + elif extType == ExtensionType.signed_cert_timestamps: |
| 101 + self.signed_cert_timestamps = True |
| 102 else: |
| 103 p.getFixBytes(extLength) |
| 104 soFar += 4 + extLength |
| 105 @@ -224,6 +227,7 @@ class ServerHello(HandshakeMsg): |
| 106 self.certificate_type = CertificateType.x509 |
| 107 self.compression_method = 0 |
| 108 self.channel_id = False |
| 109 + self.signed_cert_timestamps = None |
| 110 |
| 111 def create(self, version, random, session_id, cipher_suite, |
| 112 certificate_type): |
| 113 @@ -273,6 +277,9 @@ class ServerHello(HandshakeMsg): |
| 114 if self.channel_id: |
| 115 extLength += 4 |
| 116 |
| 117 + if self.signed_cert_timestamps: |
| 118 + extLength += 4 + len(self.signed_cert_timestamps) |
| 119 + |
| 120 if extLength != 0: |
| 121 w.add(extLength, 2) |
| 122 |
| 123 @@ -286,6 +293,10 @@ class ServerHello(HandshakeMsg): |
| 124 w.add(ExtensionType.channel_id, 2) |
| 125 w.add(0, 2) |
| 126 |
| 127 + if self.signed_cert_timestamps: |
| 128 + w.add(ExtensionType.signed_cert_timestamps, 2) |
| 129 + w.addVarSeq(stringToBytes(self.signed_cert_timestamps), 1, 2) |
| 130 + |
| 131 return HandshakeMsg.postWrite(self, w, trial) |
| 132 |
| 133 class Certificate(HandshakeMsg): |
OLD | NEW |