Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Various TLS changes #193

Merged
merged 8 commits into from
Mar 25, 2020
15 changes: 13 additions & 2 deletions pyrdp/core/ssl.py
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,16 @@ class ClientTLSContext(ssl.ClientContextFactory):
"""

def getContext(self):
context = SSL.Context(SSL.TLSv1_METHOD)
# Allow the MITM to connect to an RDP Server with ANY TLS version supported by the installed
# OpenSSL version. See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784153
# It was removed from OpenSSL, but PyOpenSSL has not changed their constant names yet.
context = SSL.Context(SSL.SSLv23_METHOD)
context.set_options(SSL.OP_DONT_INSERT_EMPTY_FRAGMENTS)
context.set_options(SSL.OP_TLS_BLOCK_PADDING_BUG)

# We disable TLS 1.3 because the way to decrypt TLS 1.3 traffic differs from
# previous TLS versions and is not yet supported by PyRDP.
obilodeau marked this conversation as resolved.
Show resolved Hide resolved
context.set_options(SSL.OP_NO_TLSv1_3)
return context


Expand All @@ -47,5 +54,9 @@ def __init__(self, method):
self.set_options(SSL.OP_DONT_INSERT_EMPTY_FRAGMENTS)
self.set_options(SSL.OP_TLS_BLOCK_PADDING_BUG)

# See comment in ClientTLSContext
self.set_options(SSL.OP_NO_TLSv1_3)

# See comment in ClientTLSContext
ssl.DefaultOpenSSLContextFactory.__init__(self, privateKeyFileName, certificateFileName, SSL.SSLv23_METHOD,
TPDUSSLContext)
TPDUSSLContext)
2 changes: 1 addition & 1 deletion setup.py
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
'names',
'pyasn1',
'pycryptodome',
'pyopenssl',
'pyopenssl==19.1',
Res260 marked this conversation as resolved.
Show resolved Hide resolved
'pytz',
'rsa',
'service_identity',
Expand Down