CryptoParser 1.2.1__tar.gz → 1.4.0__tar.gz

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/.gitignore

@@ -10,7 +10,6 @@
 /.coverage
 
 /.eggs
-/.tox
 /Pipfile
 /Pipfile.lock
 /build

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/.gitlab-ci.yml

@@ -6,62 +6,70 @@ stages:
 - deploy
 
 before_script:
-- pip install tox .[tests]
+- pip install uv
+- uv pip install --system .[tests]
 
 variables:
   GIT_SUBMODULE_DEPTH: 1
   GIT_SUBMODULE_STRATEGY: recursive
   PYTHONPATH: "submodules/cryptodatahub"
 
+.test:
+  script:
+  - coverage run -m unittest discover -v
+  - coverage report
+
 pylint:
   image: python:3.14-slim
   stage: earlytest
-  script: tox -e pylint
+  script:
+  - uv pip install --system pylint
+  - pylint --rcfile .pylintrc cryptoparser docs test
 
-pep8:
+ruff:
   image: python:3.14-slim
   stage: earlytest
-  script: tox -e pep8
+  script: uvx ruff check cryptoparser docs test
 
 python314:
+  extends: .test
   image: python:3.14-slim
   stage: earlytest
-  script: tox -e py314
 
 python39:
+  extends: .test
   image: python:3.9-slim
   stage: fulltest
-  script: tox -e py39
 
 python310:
+  extends: .test
   image: python:3.10-slim
   stage: fulltest
-  script: tox -e py310
 
 python311:
+  extends: .test
   image: python:3.11-slim
   stage: fulltest
-  script: tox -e py311
 
 python312:
+  extends: .test
   image: python:3.12-slim
   stage: fulltest
-  script: tox -e py312
 
 python313:
+  extends: .test
   image: python:3.13-slim
   stage: fulltest
-  script: tox -e py313
 
 pythonrc:
+  extends: .test
   image: python:3.15-rc-slim
   stage: fulltest
-  script: tox -e py315
 
 pypy3:
+  extends: .test
   image: pypy:3-slim
   stage: fulltest
-  script: tox -e pypy3
 
 coveralls:
   image: python:3.12-slim
@@ -75,9 +83,7 @@ coveralls:
     PYTHONPATH: "submodules/cryptodatahub"
   stage: deploy
   script:
-    - pip install coveralls
-    - pip install .
-    - pip install .[tests]
+    - uv pip install --system coveralls
     - coverage run -m unittest -v -f
     - coveralls
   only:
@@ -86,7 +92,7 @@ coveralls:
 
 obs:
   image:
-    name: coroner/python_obs:1.1.2
+    name: coroner/python_obs:1.2.5
     pull_policy: always
   stage: deploy
   variables:

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/.pylintrc

@@ -18,3 +18,4 @@ disable=
     too-many-function-args,
     too-many-ancestors,
     duplicate-code,
+    no-member,

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/CHANGELOG.rst

@@ -2,6 +2,53 @@
 Changelog
 =========
 
+------------------
+1.4.0 - 2026-07-17
+------------------
+
+Features
+========
+
+-  IKE (``ike``)
+
+   -  add getter for multiple payloads with the same type (#93)
+   -  add IKEv2 notify payload parsing for protocol extensions (#93)
+
+      -  NAT detection source IP and destination IP
+      -  set window size
+      -  use transport mode
+      -  HTTP certificate lookup supported
+      -  signature hash algorithms
+      -  intermediate exchange supported
+      -  use PPK
+      -  redirect supported
+      -  IKEv2 fragmentation supported
+      -  childless IKEv2 supported
+
+------------------
+1.3.0 - 2026-06-15
+------------------
+
+Features
+========
+
+-  Generic
+
+   -  add Debian and RPM packaging (#102)
+
+-  TLS (``tls``)
+
+   -  add JA4 tag generation for the client hello message (#100)
+   -  add JA4X tag generation for X.509 certificates (#101)
+   -  add certificate-related messages for protocol version 1.3 (#94)
+
+Notable fixes
+=============
+
+-  IKE (``ike``)
+
+   -  make IKEv2 transform key length optional for fixed-key ciphers (#99)
+
 ------------------
 1.2.1 - 2026-06-02
 ------------------

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/CryptoParser.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: CryptoParser
-Version: 1.2.1
+Version: 1.4.0
 Summary: An analysis oriented security protocol parser and generator
 Author-email: Szilárd Pfeiffer <coroner@pfeifferszilard.hu>
 Maintainer-email: Szilárd Pfeiffer <coroner@pfeifferszilard.hu>
@@ -13,7 +13,6 @@ Project-URL: Source, https://gitlab.com/coroner/cryptoparser
 Keywords: ssl,tls,gost,ja3,ldap,rdp,ssh,hsts,dns,ike
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
-Classifier: Framework :: tox
 Classifier: Intended Audience :: Information Technology
 Classifier: Intended Audience :: Science/Research
 Classifier: Intended Audience :: System Administrators
@@ -40,13 +39,15 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Requires-Dist: asn1crypto
 Requires-Dist: attrs
-Requires-Dist: cryptodatahub==1.2.1
+Requires-Dist: cryptodatahub==1.4.0
 Requires-Dist: urllib3
 Provides-Extra: tests
 Requires-Dist: pyfakefs; extra == "tests"
+Requires-Dist: coverage; extra == "tests"
 Provides-Extra: docs
 Requires-Dist: sphinx; extra == "docs"
 Requires-Dist: sphinx-sitemap; extra == "docs"
+Requires-Dist: docutils; extra == "docs"
 Dynamic: license-file
 
 .. image:: https://gitlab.com/coroner/cryptoparser/badges/master/pipeline.svg

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/CryptoParser.egg-info/SOURCES.txt

@@ -1,5 +1,4 @@
 .coveragerc
-.flake8
 .gitignore
 .gitlab-ci.yml
 .gitmodules
@@ -10,6 +9,7 @@ CONTRIBUTING.rst
 LICENSE.txt
 MANIFEST.in
 README.rst
+cryptoparser.spec
 pyproject.toml
 setup.py
 CryptoParser.egg-info/PKG-INFO
@@ -58,6 +58,12 @@ cryptoparser/tls/rdp.py
 cryptoparser/tls/record.py
 cryptoparser/tls/subprotocol.py
 cryptoparser/tls/version.py
+debian/changelog
+debian/control
+debian/copyright
+debian/rules
+debian/watch
+debian/source/format
 docs/.gitignore
 docs/changelog.rst
 docs/conf.py

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/CryptoParser.egg-info/requires.txt

@@ -1,11 +1,13 @@
 asn1crypto
 attrs
-cryptodatahub==1.2.1
+cryptodatahub==1.4.0
 urllib3
 
 [docs]
 sphinx
 sphinx-sitemap
+docutils
 
 [tests]
 pyfakefs
+coverage

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/CryptoParser.egg-info/top_level.txt

@@ -1,5 +1,7 @@
 cryptoparser
+debian
 dist
 docs
 submodules
 test
+tmp

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: CryptoParser
-Version: 1.2.1
+Version: 1.4.0
 Summary: An analysis oriented security protocol parser and generator
 Author-email: Szilárd Pfeiffer <coroner@pfeifferszilard.hu>
 Maintainer-email: Szilárd Pfeiffer <coroner@pfeifferszilard.hu>
@@ -13,7 +13,6 @@ Project-URL: Source, https://gitlab.com/coroner/cryptoparser
 Keywords: ssl,tls,gost,ja3,ldap,rdp,ssh,hsts,dns,ike
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
-Classifier: Framework :: tox
 Classifier: Intended Audience :: Information Technology
 Classifier: Intended Audience :: Science/Research
 Classifier: Intended Audience :: System Administrators
@@ -40,13 +39,15 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE.txt
 Requires-Dist: asn1crypto
 Requires-Dist: attrs
-Requires-Dist: cryptodatahub==1.2.1
+Requires-Dist: cryptodatahub==1.4.0
 Requires-Dist: urllib3
 Provides-Extra: tests
 Requires-Dist: pyfakefs; extra == "tests"
+Requires-Dist: coverage; extra == "tests"
 Provides-Extra: docs
 Requires-Dist: sphinx; extra == "docs"
 Requires-Dist: sphinx-sitemap; extra == "docs"
+Requires-Dist: docutils; extra == "docs"
 Dynamic: license-file
 
 .. image:: https://gitlab.com/coroner/cryptoparser/badges/master/pipeline.svg

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/__setup__.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 
 import importlib.metadata
 

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/common/base.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 # pylint: disable=too-many-lines
 
 import abc
@@ -14,7 +13,7 @@ import ipaddress
 try:
     from collections.abc import MutableSequence  # only works on python 3.3+
 except ImportError:  # pragma: no cover
-    from collections import MutableSequence  # pylint: disable=deprecated-class
+    from collections.abc import MutableSequence  # pylint: disable=deprecated-class
 
 from collections import OrderedDict
 
@@ -49,7 +48,7 @@ _default.default = json.JSONEncoder().default
 json.JSONEncoder.default = _default
 
 
-class SerializableTextEncoder():
+class SerializableTextEncoder:
     def __call__(self, obj, level):
         if isinstance(obj, str):
             string_result = obj
@@ -59,7 +58,7 @@ class SerializableTextEncoder():
         return False, string_result
 
 
-class Serializable():  # pylint: disable=too-few-public-methods
+class Serializable:  # pylint: disable=too-few-public-methods
     _MARKDOWN_RESULT_STRING_CLASSES = (
         ipaddress.IPv4Network,
         ipaddress.IPv6Network,
@@ -367,7 +366,7 @@ class VariantParsableExact(VariantParsableBase):
 
 
 @attr.s
-class VectorParamBase():  # pylint: disable=too-few-public-methods
+class VectorParamBase:  # pylint: disable=too-few-public-methods
     min_byte_num = attr.ib(validator=attr.validators.instance_of(int))
     max_byte_num = attr.ib(validator=attr.validators.instance_of(int))
     item_num_size = attr.ib(init=False, validator=attr.validators.instance_of(int))
@@ -863,7 +862,7 @@ class StringEnumParsableBase(ParsableBaseNoABC):
         return self._asdict().encode('ascii')
 
     def _asdict(self):
-        return getattr(self, 'value').code
+        return self.value.code
 
 
 class StringEnumParsable(StringEnumParsableBase):
@@ -946,7 +945,7 @@ class ProtocolVersionMajorMinorBase(ProtocolVersionBase):
 
 
 @attr.s
-class ListParamParsable():  # pylint: disable=too-few-public-methods
+class ListParamParsable:  # pylint: disable=too-few-public-methods
     item_class = attr.ib(validator=attr.validators.instance_of(type))
     fallback_class = attr.ib(validator=attr.validators.optional(attr.validators.instance_of(type)))
     separator_class = attr.ib(attr.validators.instance_of(ParsableBase))
@@ -994,7 +993,7 @@ class ListParsable(ArrayBase):
 class OpaqueEnumParsable(Vector):
     @classmethod
     def _parse(cls, parsable):
-        opaque, parsed_length = super(OpaqueEnumParsable, cls)._parse(parsable)
+        opaque, parsed_length = super()._parse(parsable)
         code = b''.join([bytes((opaque_item,)) for opaque_item in opaque]).decode(cls.get_encoding())
 
         try:

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/common/classes.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 
 
 from cryptodatahub.common.exception import InvalidValue

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/common/exception.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 
 import typing
 

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/common/field.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 # pylint: disable=too-many-lines
 
 import abc
@@ -540,7 +539,7 @@ class FieldValueComponentPercent(FieldValueComponentNumber):
 
 
 @attr.s
-class FieldValueComponentStringEnumParams():
+class FieldValueComponentStringEnumParams:
     code = attr.ib(validator=attr.validators.instance_of(str))
 
 

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/common/parse.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 # pylint: disable=too-many-lines
 
 import abc
@@ -19,7 +18,7 @@ from cryptoparser.common.exception import InvalidType, NotEnoughData, TooMuchDat
 import cryptoparser.common.utils
 
 
-class ParsableBaseNoABC():
+class ParsableBaseNoABC:
     @classmethod
     def parse_mutable(cls, parsable):
         parsed_object, parsed_length = cls._parse(parsable)
@@ -96,7 +95,7 @@ class ParserBase(collections.abc.Mapping):
         validator=attr.validators.instance_of((bytes, bytearray))
     )
     _parsed_length: int = attr.ib(init=False, default=0)
-    _parsed_values: typing.Dict[str, typing.Any] = attr.ib(init=False, default=None)
+    _parsed_values: dict[str, typing.Any] = attr.ib(init=False, default=None)
 
     def __attrs_post_init__(self):
         if self._parsed_values is None:
@@ -165,7 +164,7 @@ class ParserBase(collections.abc.Mapping):
         value = self._parsable[self._parsed_length:self._parsed_length + parsable_length]
         try:
             value = value.decode(encoding)
-            if converter != str:
+            if converter is not str:
                 value = converter(value)
             self._parsed_values[name] = value
         except UnicodeError as e:
@@ -760,8 +759,8 @@ class ParserBinary(ParserBase):
 
 
 @attr.s
-class ComposerBase():
-    _composed = attr.ib(init=False, default=bytes())
+class ComposerBase:
+    _composed = attr.ib(init=False, default=b'')
 
     @property
     def composed(self):
@@ -795,7 +794,7 @@ class ComposerText(ComposerBase):
         self._encoding = encoding
 
     def _compose_numeric_array(self, values, separator):
-        composed_str = str()
+        composed_str = ''
 
         for value in values:
             composed_str += f'{value:d}{separator}'
@@ -969,7 +968,7 @@ class ComposerBinary(ComposerBase):
             self.compose_numeric(len(composed), item_size)
         self._composed += composed
 
-    def compose_parsable_array(self, values, separator=bytearray()):
+    def compose_parsable_array(self, values, separator=b''):
         self._composed += separator.join(map(lambda item: item.compose(), values))
 
     def compose_bytes(self, value, item_size, converter=bytearray):

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/common/utils.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 
 import binascii
 import inspect

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/common/x509.py

@@ -1,9 +1,9 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 
 import collections
 import datetime
 import enum
+import hashlib
 
 import attr
 
@@ -19,7 +19,7 @@ from cryptoparser.common.base import (
     VectorParamParsable,
     VectorParsable,
 )
-from cryptoparser.common.parse import ComposerBinary, ParsableBase, ParserBinary
+from cryptoparser.common.parse import ComposerBinary, ComposerText, ParsableBase, ParserBinary
 
 from cryptoparser.tls.algorithm import TlsSignatureAndHashAlgorithm, TlsSignatureAndHashAlgorithmFactory
 
@@ -106,7 +106,21 @@ class SignedCertificateTimestampList(VectorParsable):
         )
 
 
+@attr.s(frozen=True)
+class TlsJA4XFingerprint(Serializable):
+    fingerprint = attr.ib(validator=attr.validators.instance_of(str))
+    fingerprint_raw = attr.ib(validator=attr.validators.instance_of(str))
+
+
+@attr.s(eq=False, init=False, frozen=True)
 class PublicKeyX509(PublicKeyX509Base):
+    ja4x = attr.ib(init=False, default=None, metadata={'human_readable_name': 'JA4X'})
+
+    def __init__(self, certificate):
+        super().__init__(certificate)
+
+        object.__setattr__(self, 'ja4x', self._ja4x())
+
     @property
     def signed_certificate_timestamps(self):
         for extension in self._certificate['tbs_certificate']['extensions']:
@@ -116,9 +130,51 @@ class PublicKeyX509(PublicKeyX509Base):
 
         return SignedCertificateTimestampList([])
 
+    @staticmethod
+    def _ja4x_sha256(oid_hexes):
+        composer = ComposerText()
+        composer.compose_string_array(oid_hexes, ',')
+        return hashlib.sha256(composer.composed).hexdigest()[:12]
+
+    @staticmethod
+    def _ja4x_relative_distinguished_name_oid_hexes(name):
+        return [
+            attribute['type'].contents.hex()
+            for relative_distinguished_name in name.chosen
+            for attribute in relative_distinguished_name
+        ]
+
+    def _ja4x(self):
+        tbs_certificate = self._certificate['tbs_certificate']
+        issuer_oid_hexes = self._ja4x_relative_distinguished_name_oid_hexes(tbs_certificate['issuer'])
+        subject_oid_hexes = self._ja4x_relative_distinguished_name_oid_hexes(tbs_certificate['subject'])
+        extension_oid_hexes = [
+            extension['extn_id'].contents.hex()
+            for extension in tbs_certificate['extensions']
+        ]
+
+        fingerprint_composer = ComposerText()
+        fingerprint_composer.compose_string_array([
+            self._ja4x_sha256(issuer_oid_hexes),
+            self._ja4x_sha256(subject_oid_hexes),
+            self._ja4x_sha256(extension_oid_hexes),
+        ], '_')
+
+        raw_composer = ComposerText()
+        raw_composer.compose_string_array(issuer_oid_hexes, ',')
+        for oid_hexes in (subject_oid_hexes, extension_oid_hexes):
+            raw_composer.compose_separator('_')
+            raw_composer.compose_string_array(oid_hexes, ',')
+
+        return TlsJA4XFingerprint(
+            fingerprint=fingerprint_composer.composed.decode('ascii'),
+            fingerprint_raw=raw_composer.composed.decode('ascii'),
+        )
+
     def _asdict(self):
         dict_value = super()._asdict()
 
         return collections.OrderedDict(list(dict_value.items()) + [
+            ('ja4x', self.ja4x),
             ('signed_certificate_timestamps', self.signed_certificate_timestamps),
         ])

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/dnsrec/record.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 
 import abc
 import collections

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/dnsrec/txt.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 # pylint: disable=too-many-lines
 
 import abc

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/httpx/parse.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 
 from cryptoparser.common.field import (
     FieldValueComponentDateTime,

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/httpx/version.py

@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# -*- coding: utf-8 -*-
 
 import enum
 

{cryptoparser-1.2.1 → cryptoparser-1.4.0}/cryptoparser/ike/ikev1.py

@@ -226,7 +226,7 @@ class Ikev1PayloadTransform(Ikev1PayloadBase):
     """
 
     transform_id: Ikev1TransformId = attr.ib(validator=attr.validators.instance_of(Ikev1TransformId))
-    attributes: typing.List[DataAttributeBase] = attr.ib(
+    attributes: list[DataAttributeBase] = attr.ib(
         validator=attr.validators.deep_iterable(
             member_validator=attr.validators.instance_of(DataAttributeBase),
         )
@@ -310,10 +310,10 @@ class Ikev1PayloadProposal(Ikev1PayloadBase):
     """
 
     protocol_id: Ikev1ProtocolId = attr.ib(validator=attr.validators.instance_of(Ikev1ProtocolId))
-    transforms: typing.List[Ikev1PayloadTransform] = attr.ib(validator=attr.validators.deep_iterable(
+    transforms: list[Ikev1PayloadTransform] = attr.ib(validator=attr.validators.deep_iterable(
         member_validator=attr.validators.instance_of(Ikev1PayloadTransform),
     ))
-    spi: bytes = attr.ib(default=bytes(), converter=bytes, validator=attr.validators.instance_of(bytes))
+    spi: bytes = attr.ib(default=b'', converter=bytes, validator=attr.validators.instance_of(bytes))
     next_payload: typing.Optional[Ikev1PayloadType] = attr.ib(
         init=False,
         default=None,
@@ -409,10 +409,10 @@ class Ikev1PayloadSecurityAssociation(Ikev1PayloadBase):
     """
 
     doi: Ikev1Doi = attr.ib(validator=attr.validators.instance_of(Ikev1Doi))
-    situation: typing.List[Ikev1Situation] = attr.ib(validator=attr.validators.deep_iterable(
+    situation: list[Ikev1Situation] = attr.ib(validator=attr.validators.deep_iterable(
         member_validator=attr.validators.instance_of(Ikev1Situation),
     ))
-    proposals: typing.List[Ikev1PayloadProposal] = attr.ib(validator=attr.validators.deep_iterable(
+    proposals: list[Ikev1PayloadProposal] = attr.ib(validator=attr.validators.deep_iterable(
         member_validator=attr.validators.instance_of(Ikev1PayloadProposal),
     ))