| diff --git a/third_party/tlslite/tlslite/messages.py b/third_party/tlslite/tlslite/messages.py |
| index e1be195..f2e2cfc 100644 |
| --- a/third_party/tlslite/tlslite/messages.py |
| +++ b/third_party/tlslite/tlslite/messages.py |
| @@ -460,7 +460,7 @@ class CertificateRequest(HandshakeMsg): |
| self.version = version |
| self.supported_signature_algs = [] |
| |
| - def create(self, certificate_types, certificate_authorities, sig_algs=()): |
| + def create(self, certificate_types, certificate_authorities, sig_algs): |
| self.certificate_types = certificate_types |
| self.certificate_authorities = certificate_authorities |
| self.supported_signature_algs = sig_algs |
| @@ -470,7 +470,8 @@ class CertificateRequest(HandshakeMsg): |
| p.startLengthCheck(3) |
| self.certificate_types = p.getVarList(1, 1) |
| if self.version >= (3,3): |
| - self.supported_signature_algs = p.getVarList(2, 2) |
| + self.supported_signature_algs = \ |
| + [(b >> 8, b & 0xff) for b in p.getVarList(2, 2)] |
| ca_list_length = p.get(2) |
| index = 0 |
| self.certificate_authorities = [] |
| @@ -485,7 +486,10 @@ class CertificateRequest(HandshakeMsg): |
| w = Writer() |
| w.addVarSeq(self.certificate_types, 1, 1) |
| if self.version >= (3,3): |
| - w.addVarSeq(self.supported_signature_algs, 2, 2) |
| + w.add(2 * len(self.supported_signature_algs), 2) |
| + for (hash, signature) in self.supported_signature_algs: |
| + w.add(hash, 1) |
| + w.add(signature, 1) |
| caLength = 0 |
| #determine length |
| for ca_dn in self.certificate_authorities: |
| @@ -646,22 +650,30 @@ class ClientKeyExchange(HandshakeMsg): |
| return self.postWrite(w) |
| |
| class CertificateVerify(HandshakeMsg): |
| - def __init__(self): |
| + def __init__(self, version): |
| HandshakeMsg.__init__(self, HandshakeType.certificate_verify) |
| + self.version = version |
| + self.signature_algorithm = None |
| self.signature = bytearray(0) |
| |
| - def create(self, signature): |
| + def create(self, signature_algorithm, signature): |
| + self.signature_algorithm = signature_algorithm |
| self.signature = signature |
| return self |
| |
| def parse(self, p): |
| p.startLengthCheck(3) |
| + if self.version >= (3,3): |
| + self.signature_algorithm = (p.get(1), p.get(1)) |
| self.signature = p.getVarBytes(2) |
| p.stopLengthCheck() |
| return self |
| |
| def write(self): |
| w = Writer() |
| + if self.version >= (3,3): |
| + w.add(self.signature_algorithm[0], 1) |
| + w.add(self.signature_algorithm[1], 1) |
| w.addVarSeq(self.signature, 1, 2) |
| return self.postWrite(w) |
| |
| diff --git a/third_party/tlslite/tlslite/tlsconnection.py b/third_party/tlslite/tlslite/tlsconnection.py |
| index cb743fe..3d97e97 100644 |
| --- a/third_party/tlslite/tlslite/tlsconnection.py |
| +++ b/third_party/tlslite/tlslite/tlsconnection.py |
| @@ -956,6 +956,7 @@ class TLSConnection(TLSRecordLayer): |
| #If client authentication was requested and we have a |
| #private key, send CertificateVerify |
| if certificateRequest and privateKey: |
| + signatureAlgorithm = None |
| if self.version == (3,0): |
| masterSecret = calcMasterSecret(self.version, |
| premasterSecret, |
| @@ -966,12 +967,15 @@ class TLSConnection(TLSRecordLayer): |
| verifyBytes = self._handshake_md5.digest() + \ |
| self._handshake_sha.digest() |
| elif self.version == (3,3): |
| - verifyBytes = self._handshake_sha256.digest() |
| + # TODO: Signature algorithm negotiation not supported. |
| + signatureAlgorithm = (HashAlgorithm.sha1, SignatureAlgorithm.rsa) |
| + verifyBytes = self._handshake_sha.digest() |
| + verifyBytes = RSAKey.addPKCS1SHA1Prefix(verifyBytes) |
| if self.fault == Fault.badVerifyMessage: |
| verifyBytes[0] = ((verifyBytes[0]+1) % 256) |
| signedBytes = privateKey.sign(verifyBytes) |
| - certificateVerify = CertificateVerify() |
| - certificateVerify.create(signedBytes) |
| + certificateVerify = CertificateVerify(self.version) |
| + certificateVerify.create(signatureAlgorithm, signedBytes) |
| for result in self._sendMsg(certificateVerify): |
| yield result |
| yield (premasterSecret, serverCertChain, clientCertChain, tackExt) |
| @@ -1640,8 +1644,11 @@ class TLSConnection(TLSRecordLayer): |
| #Apple's Secure Transport library rejects empty certificate_types, |
| #so default to rsa_sign. |
| reqCertTypes = reqCertTypes or [ClientCertificateType.rsa_sign] |
| + #Only SHA-1 + RSA is supported. |
| + sigAlgs = [(HashAlgorithm.sha1, SignatureAlgorithm.rsa)] |
| msgs.append(CertificateRequest(self.version).create(reqCertTypes, |
| - reqCAs)) |
| + reqCAs, |
| + sigAlgs)) |
| msgs.append(ServerHelloDone()) |
| for result in self._sendMsgs(msgs): |
| yield result |
| @@ -1713,7 +1720,8 @@ class TLSConnection(TLSRecordLayer): |
| verifyBytes = self._handshake_md5.digest() + \ |
| self._handshake_sha.digest() |
| elif self.version == (3,3): |
| - verifyBytes = self._handshake_sha256.digest() |
| + verifyBytes = self._handshake_sha.digest() |
| + verifyBytes = RSAKey.addPKCS1SHA1Prefix(verifyBytes) |
| for result in self._getMsg(ContentType.handshake, |
| HandshakeType.certificate_verify): |
| if result in (0,1): yield result |
| diff --git a/third_party/tlslite/tlslite/tlsrecordlayer.py b/third_party/tlslite/tlslite/tlsrecordlayer.py |
| index eda11e6..a09499d 100644 |
| --- a/third_party/tlslite/tlslite/tlsrecordlayer.py |
| +++ b/third_party/tlslite/tlslite/tlsrecordlayer.py |
| @@ -804,7 +804,7 @@ class TLSRecordLayer(object): |
| elif subType == HandshakeType.certificate_request: |
| yield CertificateRequest(self.version).parse(p) |
| elif subType == HandshakeType.certificate_verify: |
| - yield CertificateVerify().parse(p) |
| + yield CertificateVerify(self.version).parse(p) |
| elif subType == HandshakeType.server_key_exchange: |
| yield ServerKeyExchange(constructorType, |
| self.version).parse(p) |
