CryptoParser 1.2.0__tar.gz → 1.3.0__tar.gz

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/.gitlab-ci.yml

@@ -86,7 +86,7 @@ coveralls:
 
 obs:
   image:
-    name: coroner/python_obs:1.0.0
+    name: coroner/python_obs:1.2.5
     pull_policy: always
   stage: deploy
   variables:

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/CHANGELOG.rst

@@ -2,6 +2,41 @@
 Changelog
 =========
 
+------------------
+1.3.0 - 2026-06-15
+------------------
+
+Features
+========
+
+-  Generic
+
+   -  add Debian and RPM packaging (#102)
+
+-  TLS (``tls``)
+
+   -  add JA4 tag generation for the client hello message (#100)
+   -  add JA4X tag generation for X.509 certificates (#101)
+   -  add certificate-related messages for protocol version 1.3 (#94)
+
+Notable fixes
+=============
+
+-  IKE (``ike``)
+
+   -  make IKEv2 transform key length optional for fixed-key ciphers (#99)
+
+------------------
+1.2.1 - 2026-06-02
+------------------
+
+Features
+========
+
+-  DNS (``dnsrec``)
+
+   -  add SSHFP DNS resource record parsing (#98)
+
 ------------------
 1.2.0 - 2026-05-05
 ------------------

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/CryptoParser.egg-info/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: CryptoParser
-Version: 1.2.0
+Version: 1.3.0
 Summary: An analysis oriented security protocol parser and generator
 Author-email: Szilárd Pfeiffer <coroner@pfeifferszilard.hu>
 Maintainer-email: Szilárd Pfeiffer <coroner@pfeifferszilard.hu>
-License-Expression: MPL-2.0
+License: MPL-2.0
 Project-URL: Homepage, https://gitlab.com/coroner/cryptoparser
 Project-URL: Changelog, https://cryptoparser.readthedocs.io/en/latest/changelog
 Project-URL: Documentation, https://cryptoparser.readthedocs.io/en/latest/
@@ -40,13 +40,15 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Requires-Dist: asn1crypto
 Requires-Dist: attrs
-Requires-Dist: cryptodatahub==1.2.0
+Requires-Dist: cryptodatahub==1.3.0
 Requires-Dist: urllib3
 Provides-Extra: tests
 Requires-Dist: pyfakefs; extra == "tests"
+Requires-Dist: coverage; extra == "tests"
 Provides-Extra: docs
 Requires-Dist: sphinx; extra == "docs"
 Requires-Dist: sphinx-sitemap; extra == "docs"
+Requires-Dist: docutils; extra == "docs"
 Dynamic: license-file
 
 .. image:: https://gitlab.com/coroner/cryptoparser/badges/master/pipeline.svg

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/CryptoParser.egg-info/SOURCES.txt

@@ -10,6 +10,7 @@ CONTRIBUTING.rst
 LICENSE.txt
 MANIFEST.in
 README.rst
+cryptoparser.spec
 pyproject.toml
 setup.py
 CryptoParser.egg-info/PKG-INFO
@@ -58,6 +59,12 @@ cryptoparser/tls/rdp.py
 cryptoparser/tls/record.py
 cryptoparser/tls/subprotocol.py
 cryptoparser/tls/version.py
+debian/changelog
+debian/control
+debian/copyright
+debian/rules
+debian/watch
+debian/source/format
 docs/.gitignore
 docs/changelog.rst
 docs/conf.py

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/CryptoParser.egg-info/requires.txt

@@ -1,11 +1,13 @@
 asn1crypto
 attrs
-cryptodatahub==1.2.0
+cryptodatahub==1.3.0
 urllib3
 
 [docs]
 sphinx
 sphinx-sitemap
+docutils
 
 [tests]
 pyfakefs
+coverage

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/CryptoParser.egg-info/top_level.txt

@@ -1,7 +1,6 @@
-build
 cryptoparser
+debian
 dist
 docs
-htmlcov
 submodules
 test

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: CryptoParser
-Version: 1.2.0
+Version: 1.3.0
 Summary: An analysis oriented security protocol parser and generator
 Author-email: Szilárd Pfeiffer <coroner@pfeifferszilard.hu>
 Maintainer-email: Szilárd Pfeiffer <coroner@pfeifferszilard.hu>
-License-Expression: MPL-2.0
+License: MPL-2.0
 Project-URL: Homepage, https://gitlab.com/coroner/cryptoparser
 Project-URL: Changelog, https://cryptoparser.readthedocs.io/en/latest/changelog
 Project-URL: Documentation, https://cryptoparser.readthedocs.io/en/latest/
@@ -40,13 +40,15 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Requires-Dist: asn1crypto
 Requires-Dist: attrs
-Requires-Dist: cryptodatahub==1.2.0
+Requires-Dist: cryptodatahub==1.3.0
 Requires-Dist: urllib3
 Provides-Extra: tests
 Requires-Dist: pyfakefs; extra == "tests"
+Requires-Dist: coverage; extra == "tests"
 Provides-Extra: docs
 Requires-Dist: sphinx; extra == "docs"
 Requires-Dist: sphinx-sitemap; extra == "docs"
+Requires-Dist: docutils; extra == "docs"
 Dynamic: license-file
 
 .. image:: https://gitlab.com/coroner/cryptoparser/badges/master/pipeline.svg

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/cryptoparser/__setup__.py

@@ -12,4 +12,4 @@ __description__ = metadata['Summary']
 __author__ = metadata['Author']
 __author_email__ = metadata['Author-email']
 __url__ = 'https://gitlab.com/coroner/' + __technical_name__
-__license__ = metadata['License']
+__license__ = metadata.get('License-Expression') or metadata['License']

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/cryptoparser/common/x509.py

@@ -4,6 +4,7 @@
 import collections
 import datetime
 import enum
+import hashlib
 
 import attr
 
@@ -19,7 +20,7 @@ from cryptoparser.common.base import (
     VectorParamParsable,
     VectorParsable,
 )
-from cryptoparser.common.parse import ComposerBinary, ParsableBase, ParserBinary
+from cryptoparser.common.parse import ComposerBinary, ComposerText, ParsableBase, ParserBinary
 
 from cryptoparser.tls.algorithm import TlsSignatureAndHashAlgorithm, TlsSignatureAndHashAlgorithmFactory
 
@@ -55,7 +56,7 @@ class SignedCertificateTimestamp(ParsableBase, Serializable):
     )
     timestamp = attr.ib(validator=attr.validators.instance_of(datetime.datetime))
     extensions = attr.ib(
-        validator=attr.validators.deep_iterable(member_validator=attr.validators.instance_of(CtExtensions))
+        validator=attr.validators.instance_of(CtExtensions)
     )
     signature_algorithm = attr.ib(validator=attr.validators.in_(TlsSignatureAndHashAlgorithm))
     signature = attr.ib(
@@ -106,7 +107,21 @@ class SignedCertificateTimestampList(VectorParsable):
         )
 
 
+@attr.s(frozen=True)
+class TlsJA4XFingerprint(Serializable):
+    fingerprint = attr.ib(validator=attr.validators.instance_of(str))
+    fingerprint_raw = attr.ib(validator=attr.validators.instance_of(str))
+
+
+@attr.s(eq=False, init=False, frozen=True)
 class PublicKeyX509(PublicKeyX509Base):
+    ja4x = attr.ib(init=False, default=None, metadata={'human_readable_name': 'JA4X'})
+
+    def __init__(self, certificate):
+        super().__init__(certificate)
+
+        object.__setattr__(self, 'ja4x', self._ja4x())
+
     @property
     def signed_certificate_timestamps(self):
         for extension in self._certificate['tbs_certificate']['extensions']:
@@ -116,9 +131,51 @@ class PublicKeyX509(PublicKeyX509Base):
 
         return SignedCertificateTimestampList([])
 
+    @staticmethod
+    def _ja4x_sha256(oid_hexes):
+        composer = ComposerText()
+        composer.compose_string_array(oid_hexes, ',')
+        return hashlib.sha256(composer.composed).hexdigest()[:12]
+
+    @staticmethod
+    def _ja4x_relative_distinguished_name_oid_hexes(name):
+        return [
+            attribute['type'].contents.hex()
+            for relative_distinguished_name in name.chosen
+            for attribute in relative_distinguished_name
+        ]
+
+    def _ja4x(self):
+        tbs_certificate = self._certificate['tbs_certificate']
+        issuer_oid_hexes = self._ja4x_relative_distinguished_name_oid_hexes(tbs_certificate['issuer'])
+        subject_oid_hexes = self._ja4x_relative_distinguished_name_oid_hexes(tbs_certificate['subject'])
+        extension_oid_hexes = [
+            extension['extn_id'].contents.hex()
+            for extension in tbs_certificate['extensions']
+        ]
+
+        fingerprint_composer = ComposerText()
+        fingerprint_composer.compose_string_array([
+            self._ja4x_sha256(issuer_oid_hexes),
+            self._ja4x_sha256(subject_oid_hexes),
+            self._ja4x_sha256(extension_oid_hexes),
+        ], '_')
+
+        raw_composer = ComposerText()
+        raw_composer.compose_string_array(issuer_oid_hexes, ',')
+        for oid_hexes in (subject_oid_hexes, extension_oid_hexes):
+            raw_composer.compose_separator('_')
+            raw_composer.compose_string_array(oid_hexes, ',')
+
+        return TlsJA4XFingerprint(
+            fingerprint=fingerprint_composer.composed.decode('ascii'),
+            fingerprint_raw=raw_composer.composed.decode('ascii'),
+        )
+
     def _asdict(self):
         dict_value = super()._asdict()
 
         return collections.OrderedDict(list(dict_value.items()) + [
+            ('ja4x', self.ja4x),
             ('signed_certificate_timestamps', self.signed_certificate_timestamps),
         ])

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/cryptoparser/dnsrec/record.py

@@ -18,7 +18,13 @@ from cryptodatahub.common.key import (
     PublicKeyParamsRsa,
 )
 
-from cryptodatahub.dnsrec.algorithm import DnsRrType, DnsSecAlgorithm, DnsSecDigestType
+from cryptodatahub.dnsrec.algorithm import (
+    DnsRrType,
+    DnsSecAlgorithm,
+    DnsSecDigestType,
+    SshFpAlgorithm,
+    SshFpFingerprintType,
+)
 
 from cryptoparser.common.base import NumericRangeParsableBase, OneByteEnumParsable, Serializable, TwoByteEnumParsable
 from cryptoparser.common.exception import NotEnoughData
@@ -478,6 +484,56 @@ class DnsRecordMx(ParsableBase):
         return composer.composed_bytes
 
 
+class SshFpAlgorithmFactory(OneByteEnumParsable):
+    @classmethod
+    def get_enum_class(cls):
+        return SshFpAlgorithm
+
+    @abc.abstractmethod
+    def compose(self):
+        raise NotImplementedError()
+
+
+class SshFpFingerprintTypeFactory(OneByteEnumParsable):
+    @classmethod
+    def get_enum_class(cls):
+        return SshFpFingerprintType
+
+    @abc.abstractmethod
+    def compose(self):
+        raise NotImplementedError()
+
+
+@attr.s
+class DnsRecordSshfp(ParsableBase, Serializable):
+    HEADER_SIZE = 2
+
+    algorithm = attr.ib(validator=attr.validators.instance_of(SshFpAlgorithm))
+    fingerprint_type = attr.ib(validator=attr.validators.instance_of(SshFpFingerprintType))
+    fingerprint = attr.ib(validator=attr.validators.instance_of((bytes, bytearray)))
+
+    @classmethod
+    def _parse(cls, parsable):
+        if len(parsable) < cls.HEADER_SIZE:
+            raise NotEnoughData(cls.HEADER_SIZE - len(parsable))
+
+        parser = ParserBinary(parsable)
+        parser.parse_parsable('algorithm', SshFpAlgorithmFactory)
+        parser.parse_parsable('fingerprint_type', SshFpFingerprintTypeFactory)
+        parser.parse_raw('fingerprint', parser.unparsed_length)
+
+        return cls(**parser), parser.parsed_length
+
+    def compose(self):
+        composer = ComposerBinary()
+
+        composer.compose_numeric_enum_coded(self.algorithm)
+        composer.compose_numeric_enum_coded(self.fingerprint_type)
+        composer.compose_raw(self.fingerprint)
+
+        return composer.composed_bytes
+
+
 @attr.s
 class DnsRecordTxt(ParsableBase):
     HEADER_SIZE = 1

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/cryptoparser/ike/ikev2.py

@@ -347,7 +347,8 @@ class TransformAttributes(Transform):
     @classmethod
     def _parse(cls, parsable):
         header_parser = cls._parse_header(parsable)
-        attributes, attributes_length = cls._parse_attributes(header_parser.unparsed)
+        attributes_size = header_parser['transform_length'] - cls.HEADER_SIZE
+        attributes, attributes_length = cls._parse_attributes(header_parser.unparsed[:attributes_size])
 
         transform = cls(
             transform_id=header_parser['transform_id'],
@@ -408,7 +409,10 @@ class Ikev2TransformDhGroup(TransformNoAttributes):
 class Ikev2TransformEncryptionAlgorithm(TransformAttributes):
     """Transform payload parser for encryption algorithm."""
 
-    key_length: int = attr.ib(validator=attr.validators.instance_of(int))
+    key_length: typing.Optional[int] = attr.ib(
+        default=None,
+        validator=attr.validators.optional(attr.validators.instance_of(int)),
+    )
 
     @classmethod
     def get_transform_type(cls):
@@ -420,6 +424,8 @@ class Ikev2TransformEncryptionAlgorithm(TransformAttributes):
 
     @classmethod
     def _parse_attributes(cls, parsable):
+        if not parsable:
+            return {'key_length': None}, 0
         parser = ParserBinary(parsable)
 
         parser.parse_parsable('key_length', TransformAttributeKeyLength)
@@ -427,6 +433,8 @@ class Ikev2TransformEncryptionAlgorithm(TransformAttributes):
         return {'key_length': parser['key_length'].value}, parser.parsed_length
 
     def _get_attributes(self):
+        if self.key_length is None:
+            return []
         return [TransformAttributeKeyLength(value=self.key_length)]
 
 

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/cryptoparser/ike/isakmp.py

@@ -7,11 +7,11 @@ import typing
 import attr
 
 from cryptodatahub.ike.algorithm import Ikev1PayloadType, Ikev2PayloadType, Ikev1ExchangeType, Ikev2ExchangeType
+from cryptodatahub.ike.version import IkeVersion
 
 from cryptoparser.common.parse import ParsableBase, ParserBinary, ComposerBinary
 from cryptoparser.common.exception import NotEnoughData, InvalidType
-
-from cryptoparser.ike.version import IsakmpProtocolVersion, IsakmpVersion
+from cryptoparser.ike.version import IsakmpProtocolVersion
 from cryptoparser.ike.ikev1 import (
     Ikev1PayloadBase,
     IKEV1_PAYLOAD_CLASSES_BY_TYPE,
@@ -112,10 +112,10 @@ class IsakmpMessage(ParsableBase):
         parser.parse_numeric('responder_spi', 8)
         parser.parse_raw('next_payload', 1)
         parser.parse_parsable('version', IsakmpProtocolVersion)
-        if parser['version'].major == IsakmpVersion.V1:
+        if parser['version'].major == IkeVersion.V1:
             next_payload_type = Ikev1PayloadType
             parser.parse_numeric_enum_coded('exchange_type', Ikev1ExchangeType)
-        elif parser['version'].major == IsakmpVersion.V2:
+        elif parser['version'].major == IkeVersion.V2:
             next_payload_type = Ikev2PayloadType
             parser.parse_numeric_enum_coded('exchange_type', Ikev2ExchangeType)
         else:
@@ -130,10 +130,10 @@ class IsakmpMessage(ParsableBase):
         parser.parse_numeric('length', 4)
 
         version = parser['version']
-        if version.major == IsakmpVersion.V1:
+        if version.major == IkeVersion.V1:
             payload_classes = IKEV1_PAYLOAD_CLASSES_BY_TYPE
             payload_none = Ikev1PayloadType.NONE
-        elif version.major == IsakmpVersion.V2:
+        elif version.major == IkeVersion.V2:
             payload_classes = IKEV2_PAYLOAD_CLASSES_BY_TYPE
             payload_none = Ikev2PayloadType.NONE
         else:
@@ -168,14 +168,14 @@ class IsakmpMessage(ParsableBase):
         header_composer.compose_numeric(self.initiator_spi, 8)
         header_composer.compose_numeric(self.responder_spi, 8)
 
-        if self.version.major == IsakmpVersion.V1:
+        if self.version.major == IkeVersion.V1:
             payload_none = Ikev1PayloadType.NONE
             payload_type_security_association = (
                 self.payloads[0].get_payload_type()
                 if self.payloads
                 else payload_none
             )
-        elif self.version.major == IsakmpVersion.V2:
+        elif self.version.major == IkeVersion.V2:
             payload_none = Ikev2PayloadType.NONE
             # First payload can be a cookie notification payload
             payload_type_security_association = self.payloads[0].get_payload_type()

{cryptoparser-1.2.0 → cryptoparser-1.3.0}/cryptoparser/ike/version.py

@@ -2,56 +2,50 @@
 """ISAKMP version handling."""
 
 import abc
-import enum
 
 import attr
 
 from cryptodatahub.common.grade import GradeableSimple, Grade
+from cryptodatahub.ike.version import IkeVersion
 
 from cryptoparser.common.parse import ParsableBase, ParserBinary, ComposerBinary
 from cryptoparser.common.exception import NotEnoughData, InvalidType
 from cryptoparser.common.base import OneByteEnumParsable
 
 
-class IsakmpVersion(enum.IntEnum):
-    """ISAKMP version."""
-    V1 = 0x01  # ISAKMP v1
-    V2 = 0x02  # ISAKMP v2 (IKEv2)
-
-    @property
-    def identifier(self):
-        """Get version identifier."""
-        return f"ikev{self.value}"
-
-
 class IsakmpVersionFactory(OneByteEnumParsable):
     """ISAKMP version."""
     @classmethod
     def get_enum_class(cls):
-        return IsakmpVersion
+        return IkeVersion
 
     @abc.abstractmethod
     def compose(self):
         raise NotImplementedError()
 
 
-@attr.s(frozen=True)
+@attr.s(frozen=True, order=False)
 class IsakmpProtocolVersion(ParsableBase, GradeableSimple):
     """ISAKMP protocol version parser."""
     HEADER_SIZE = 1
 
-    major: IsakmpVersion = attr.ib(validator=attr.validators.instance_of(IsakmpVersion))
+    major = attr.ib(validator=attr.validators.instance_of(IkeVersion))
     minor: int = attr.ib(validator=attr.validators.instance_of(int))
 
+    def __lt__(self, other):
+        if self.major.value.code != other.major.value.code:
+            return self.major.value.code < other.major.value.code
+        return self.minor < other.minor
+
     @property
     def grade(self):
-        if self.major == IsakmpVersion.V1:
+        if self.major == IkeVersion.V1:
             return Grade.DEPRECATED
 
         return Grade.SECURE
 
     def __str__(self):
-        return f"IKEv{self.major.value} ({self.minor})"
+        return f"IKEv{self.major.value.code} ({self.minor})"
 
     @classmethod
     def _parse(cls, parsable):
@@ -64,18 +58,18 @@ class IsakmpProtocolVersion(ParsableBase, GradeableSimple):
         major_version = (parser['version'] >> 4) & 0x0f
         minor_version = parser['version'] & 0x0f
 
-        if major_version not in [v.value for v in IsakmpVersion]:
+        if major_version not in [v.value.code for v in IkeVersion]:
             raise InvalidType()
 
         return cls(
-            major=IsakmpVersion(major_version),
+            major=next(v for v in IkeVersion if v.value.code == major_version),
             minor=minor_version,
         ), parser.parsed_length
 
     def compose(self):
         composer = ComposerBinary()
 
-        version = (self.major.value << 4) | self.minor
+        version = (self.major.value.code << 4) | self.minor
         composer.compose_numeric(version, 1)
 
         return composer.composed_bytes
@@ -83,4 +77,4 @@ class IsakmpProtocolVersion(ParsableBase, GradeableSimple):
     @property
     def version(self):
         """Get version as string."""
-        return f"{self.major.value}.{self.minor}"
+        return f"{self.major.value.code}.{self.minor}"