chenjintao
551a7bb1e6
Prioritize X25519 while retaining enabled curve fallbacks and log the negotiated ECDHE group. Extend ABI checks, crypto benchmarks and backend group probes, and document the updated APP package.
41 lines
2.4 KiB
Python
41 lines
2.4 KiB
Python
"""Probe TLS 1.2 full-handshake group negotiation with the firmware root CA."""
|
|
import json
|
|
from pathlib import Path
|
|
import re
|
|
import subprocess
|
|
|
|
root = Path(__file__).resolve().parents[1]
|
|
source = (root / 'ql-application/threadx/interface/custom_app/talkingq_root_ca.c').read_text()
|
|
pem = ''.join(json.loads('"' + value + '"') for value in re.findall(r'"(.*?)"', source)
|
|
if 'CERTIFICATE' in value or value.endswith(r'\n'))
|
|
output = root / 'artifacts/wss/full-handshake'
|
|
output.mkdir(parents=True, exist_ok=True)
|
|
ca = output / 'compiled-root.pem'
|
|
ca.write_text(pem)
|
|
openssl = Path('C:/Program Files/Git/usr/bin/openssl.exe')
|
|
groups = {
|
|
'sdk_order': 'P-521:brainpoolP512r1:P-384:brainpoolP384r1:P-256:brainpoolP256r1:P-224:secp224k1:P-192:secp192k1:X25519:X448',
|
|
'x25519_first': 'X25519:P-256:P-384:P-521',
|
|
'p256_first': 'P-256:X25519:P-384:P-521',
|
|
}
|
|
firmware = (root / 'ql-application/threadx/interface/custom_app/lib/librws/src/rws_socketpriv.c').read_bytes().decode('latin1')
|
|
array = re.search(r'rws_tls_preferred_curves\[\]\s*=\s*\{(.*?)\}', firmware, re.S).group(1)
|
|
names = {'CURVE25519': 'X25519', 'CURVE448': 'X448',
|
|
'SECP256R1': 'P-256', 'SECP384R1': 'P-384', 'SECP521R1': 'P-521',
|
|
'SECP224R1': 'P-224', 'SECP192R1': 'P-192',
|
|
'SECP224K1': 'secp224k1', 'SECP192K1': 'secp192k1',
|
|
'BP512R1': 'brainpoolP512r1', 'BP384R1': 'brainpoolP384r1', 'BP256R1': 'brainpoolP256r1'}
|
|
groups['firmware_policy'] = ':'.join(names[name] for name in re.findall(r'MBEDTLS_ECP_DP_(\w+)', array) if name != 'NONE')
|
|
report = {}
|
|
for name, group_list in groups.items():
|
|
result = subprocess.run([str(openssl), 's_client', '-connect', 'banban.api.talkingq.com:443',
|
|
'-servername', 'banban.api.talkingq.com', '-verify_hostname', 'banban.api.talkingq.com',
|
|
'-verify_return_error', '-CAfile', str(ca), '-no-CApath', '-no-CAstore',
|
|
'-tls1_2', '-no_ticket', '-groups', group_list, '-brief'],
|
|
input='', text=True, capture_output=True, timeout=20)
|
|
text = result.stdout + result.stderr
|
|
report[name] = {'groups': group_list, 'returncode': result.returncode, 'output': text}
|
|
print(name + ':\n' + text, flush=True)
|
|
assert result.returncode == 0 and 'Verification: OK' in text, name
|
|
(output / 'group-probe.json').write_text(json.dumps(report, indent=2))
|