<s> r'''<STR_LIT>''' <EOL> import logging <EOL> from nogotofail . mitm . connection . handlers . data import handlers <EOL> from nogotofail . mitm . connection . handlers . data import DataHandler <EOL> from nogotofail . mitm . connection . handlers . store import handler <EOL> from nogotofail . mitm . event import connection <EOL> from nogotofail . mitm . util import ssl2 , tls , vuln <EOL> class _TlsRecordHandler ( DataHandler ) : <EOL> """<STR_LIT>""" <EOL> ssl = False <EOL> class _TlsRecordBuffer ( ) : <EOL> MAX_BUFFER = <NUM_LIT> <EOL> def __init__ ( self ) : <EOL> self . buffer = "<STR_LIT>" <EOL> self . should_buffer = True <EOL> client_buffer = None <EOL> server_buffer = None <EOL> def on_tls_request ( self , record ) : <EOL> """<STR_LIT>""" <EOL> return record . to_bytes ( ) <EOL> def on_tls_response ( self , record ) : <EOL> """<STR_LIT>""" <EOL> return record . to_bytes ( ) <EOL> def on_ssl ( self , client_hello ) : <EOL> self . ssl = True <EOL> self . client_buffer = _TlsRecordHandler . _TlsRecordBuffer ( ) <EOL> self . server_buffer = _TlsRecordHandler . _TlsRecordBuffer ( ) <EOL> def _handle_message ( self , message , buffer , record_fn ) : <EOL> """<STR_LIT>""" <EOL> out = "<STR_LIT>" <EOL> message = buffer . buffer + message <EOL> buffer . buffer = "<STR_LIT>" <EOL> remaining = message <EOL> while remaining : <EOL> record = None <EOL> try : <EOL> record , remaining = tls . parse_tls ( remaining , throw_on_incomplete = True ) <EOL> except tls . types . TlsNotEnoughDataError : <EOL> if buffer . should_buffer : <EOL> buffer . buffer = remaining <EOL> if len ( buffer . buffer ) >= buffer . MAX_BUFFER : <EOL> buffer . buffer = "<STR_LIT>" <EOL> return out <EOL> if not record : <EOL> return out <EOL> record_bytes = record_fn ( record ) <EOL> if record_bytes : <EOL> out += record_bytes <EOL> if record . content_type == record . CONTENT_TYPE . CHANGE_CIPHER_SPEC : <EOL> buffer . should_buffer = False <EOL> return out <EOL> def on_request ( self , request ) : <EOL> if not self . ssl : <EOL> return request <EOL> return self . _handle_message ( request , self . client_buffer , self . on_tls_request ) <EOL> def on_response ( self , response ) : <EOL> if not self . ssl : <EOL> return response <EOL> return self . _handle_message ( response , self . server_buffer , self . on_tls_response ) <EOL> @ handler . passive ( handlers ) <EOL> class InsecureCipherDetectionHandler ( DataHandler ) : <EOL> name = "<STR_LIT>" <EOL> description = "<STR_LIT>" <EOL> def _handle_bad_ciphers ( self , ciphers , message ) : <EOL> self . log ( logging . ERROR , message ) <EOL> self . log_attack_event ( data = ciphers ) <EOL> self . connection . vuln_notify ( vuln . VULN_WEAK_CIPHER ) <EOL> def on_ssl ( self , client_hello ) : <EOL> anon_ciphers = [ str ( c ) for c in client_hello . ciphers if "<STR_LIT>" in str ( c ) ] <EOL> if anon_ciphers : <EOL> self . _handle_bad_ciphers ( anon_ciphers , <EOL> "<STR_LIT>" % <EOL> ( "<STR_LIT:U+002CU+0020>" . join ( anon_ciphers ) ) ) <EOL> null_ciphers = [ str ( c ) for c in client_hello . ciphers if "<STR_LIT>" in str ( c ) ] <EOL> if null_ciphers : <EOL> self . _handle_bad_ciphers ( null_ciphers , <EOL> "<STR_LIT>" % <EOL> ( "<STR_LIT:U+002CU+0020>" . join ( null_ciphers ) ) ) <EOL> integ_ciphers = [ str ( c ) for c in client_hello . ciphers if str ( c ) . endswith ( "<STR_LIT>" ) ] <EOL> if integ_ciphers : <EOL> self . _handle_bad_ciphers ( integ_ciphers , <EOL> "<STR_LIT>" % <EOL> ( "<STR_LIT:U+002CU+0020>" . join ( integ_ciphers ) ) ) <EOL> export_ciphers = [ str ( c ) for c in client_hello . ciphers if "<STR_LIT>" in str ( c ) ] <EOL> if export_ciphers : <EOL> self . _handle_bad_ciphers ( integ_ciphers , <EOL> "<STR_LIT>" % <EOL> ( "<STR_LIT:U+002CU+0020>" . join ( export_ciphers ) ) ) <EOL> @ handler . passive ( handlers ) <EOL> class WeakTLSVersionDetectionHandler ( DataHandler ) : <EOL> name = "<STR_LIT>" <EOL> description = "<STR_LIT>" <EOL> def on_ssl ( self , client_hello ) : <EOL> if isinstance ( client_hello , ssl2 . types . ClientHello ) : <EOL> self . log ( logging . ERROR , "<STR_LIT>" ) <EOL> self . log_attack_event ( data = "<STR_LIT>" ) <EOL> self . connection . vuln_notify ( vuln . VULN_WEAK_TLS_VERSION ) <EOL> return <EOL> if ( isinstance ( client_hello , tls . types . ClientHello ) and <EOL> client_hello . version . major == <NUM_LIT:3> and <EOL> client_hello . version . minor == <NUM_LIT:0> ) : <EOL> fallback = ( "<STR_LIT>" in <EOL> [ str ( c ) for c in client_hello . ciphers ] ) <EOL> if fallback : <EOL> self . log ( logging . WARNING , <EOL> "<STR_LIT>" ) <EOL> else : <EOL> self . log ( logging . ERROR , <EOL> "<STR_LIT>" ) <EOL> self . log_attack_event ( data = "<STR_LIT>" ) </s>
