blob: 0f76cf5083d4132aab784f2153aaa96c82d41526 [file] [log] [blame]
Joe Subbiania16ccac2021-07-22 18:52:17 +01001#!/usr/bin/env python3
2
3# translate_ciphers.py
4#
5# Copyright The Mbed TLS Contributors
6# SPDX-License-Identifier: Apache-2.0
7#
8# Licensed under the Apache License, Version 2.0 (the "License"); you may
9# not use this file except in compliance with the License.
10# You may obtain a copy of the License at
11#
12# http://www.apache.org/licenses/LICENSE-2.0
13#
14# Unless required by applicable law or agreed to in writing, software
15# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17# See the License for the specific language governing permissions and
18# limitations under the License.
19#
20# Purpose
21#
Joe Subbiani0fadf8e2021-07-27 15:22:26 +010022# Translate ciphersuite names in MBedTLS format to OpenSSL and GNUTLS
Joe Subbiania16ccac2021-07-22 18:52:17 +010023# standards.
24#
25# Format and analyse strings past in via input arguments to match
26# the expected strings utilised in compat.sh.
27#
Joe Subbiani0fadf8e2021-07-27 15:22:26 +010028# sys.argv[1] should be "g" or "o" for GNUTLS or OpenSSL.
Joe Subbiania16ccac2021-07-22 18:52:17 +010029# sys.argv[2] should be a string containing one or more
30# ciphersuite names.
31
Joe Subbiani3ad58322021-07-21 16:48:54 +010032import re
Joe Subbiani97cd5992021-07-22 16:08:29 +010033import sys
Joe Subbiani83944842021-07-20 18:26:03 +010034
Joe Subbiani0fadf8e2021-07-27 15:22:26 +010035def translate_gnutls(m_cipher):
Joe Subbiani3ad58322021-07-21 16:48:54 +010036 # Remove "TLS-"
37 # Replace "-WITH-" with ":+"
38 # Remove "EDE"
Joe Subbiani83944842021-07-20 18:26:03 +010039 m_cipher = "+" + m_cipher[4:]
40 m_cipher = m_cipher.replace("-WITH-", ":+")
41 m_cipher = m_cipher.replace("-EDE", "")
Joe Subbiani3ad58322021-07-21 16:48:54 +010042
43 # SHA == SHA1, if the last 3 chars are SHA append 1
44 if m_cipher[-3:] == "SHA":
Joe Subbiani83944842021-07-20 18:26:03 +010045 m_cipher = m_cipher+"1"
Joe Subbiani3ad58322021-07-21 16:48:54 +010046
47 # CCM or CCM-8 should be followed by ":+AEAD"
48 if "CCM" in m_cipher:
Joe Subbiani83944842021-07-20 18:26:03 +010049 m_cipher = m_cipher+":+AEAD"
Joe Subbiani3ad58322021-07-21 16:48:54 +010050
51 # Replace the last "-" with ":+"
52 # Replace "GCM:+SHAxyz" with "GCM:+AEAD"
Joe Subbiani83944842021-07-20 18:26:03 +010053 else:
54 index=m_cipher.rindex("-")
55 m_cipher = m_cipher[:index]+":+"+m_cipher[index+1:]
Joe Subbiani3ad58322021-07-21 16:48:54 +010056 m_cipher = re.sub(r"GCM\:\+SHA\d\d\d", "GCM:+AEAD", m_cipher)
Joe Subbiani83944842021-07-20 18:26:03 +010057
58 return m_cipher
Joe Subbiani3ad58322021-07-21 16:48:54 +010059
Joe Subbiani83944842021-07-20 18:26:03 +010060def translate_ossl(m_cipher):
Joe Subbiani3ad58322021-07-21 16:48:54 +010061 # Remove "TLS-"
62 # Remove "WITH"
Joe Subbiani83944842021-07-20 18:26:03 +010063 m_cipher = m_cipher[4:]
64 m_cipher = m_cipher.replace("-WITH", "")
Joe Subbiani3ad58322021-07-21 16:48:54 +010065
66 # Remove the "-" from "ABC-xyz"
Joe Subbiani83944842021-07-20 18:26:03 +010067 m_cipher = m_cipher.replace("AES-", "AES")
68 m_cipher = m_cipher.replace("CAMELLIA-", "CAMELLIA")
69 m_cipher = m_cipher.replace("ARIA-", "ARIA")
Joe Subbiani83944842021-07-20 18:26:03 +010070
Joe Subbiani3ad58322021-07-21 16:48:54 +010071 # Remove "RSA" if it is at the beginning
Joe Subbiani83944842021-07-20 18:26:03 +010072 if m_cipher[:4] == "RSA-":
73 m_cipher = m_cipher[4:]
74
Joe Subbiani3ad58322021-07-21 16:48:54 +010075 # For all circumstances outside of PSK
76 if "PSK" not in m_cipher:
77 m_cipher = m_cipher.replace("-EDE", "")
78 m_cipher = m_cipher.replace("3DES-CBC", "DES-CBC3")
79
80 # Remove "CBC" if it is not prefixed by DES
81 if "CBC" in m_cipher:
82 index = m_cipher.rindex("CBC")
83 if m_cipher[index-4:index-1] != "DES":
84 m_cipher = m_cipher.replace("CBC-", "")
85
86 # ECDHE-RSA-ARIA does not exist in OpenSSL
Joe Subbiani83944842021-07-20 18:26:03 +010087 m_cipher = m_cipher.replace("ECDHE-RSA-ARIA", "ECDHE-ARIA")
88
Joe Subbiani3ad58322021-07-21 16:48:54 +010089 # POLY1305 should not be followed by anything
90 if "POLY1305" in m_cipher:
Joe Subbiani83944842021-07-20 18:26:03 +010091 index = m_cipher.rindex("POLY1305")
92 m_cipher=m_cipher[:index+8]
Joe Subbiani3ad58322021-07-21 16:48:54 +010093
94 # If DES is being used, Replace DHE with EDH
95 if "DES" in m_cipher and "DHE" in m_cipher and "ECDHE" not in m_cipher:
96 m_cipher = m_cipher.replace("DHE", "EDH")
Joe Subbiani83944842021-07-20 18:26:03 +010097
98 return m_cipher
Joe Subbiani97cd5992021-07-22 16:08:29 +010099
Joe Subbiani0fadf8e2021-07-27 15:22:26 +0100100def format_ciphersuite_names(mode, ciphers):
101 #ciphers = ciphers.split()
102 #t_ciphers = []
103 #if mode == "g":
104 # for i in ciphers:
105 # t_ciphers.append(translate_gnutls(i))
106 #elif mode == "o":
107 # for i in ciphers:
108 # t_ciphers.append(translate_ossl(i))
109 #else:
110 # print("Incorrect use of argument 1, should be either \"g\" or \"o\"")
111 # exit(1)
112 #return " ".join(t_ciphers)
113 try:
114 t = {"g": translate_gnutls, "o": translate_ossl}[mode]
115 return " ".join(t(c) for c in ciphers.split())
116 except Exception as E:
117 if E != mode: print(E)
118 else: print("Incorrect use of argument 1, should be either \"g\" or \"o\"")
119 sys.exit(1)
Joe Subbiani97cd5992021-07-22 16:08:29 +0100120
121def main():
Joe Subbiani0fadf8e2021-07-27 15:22:26 +0100122 if len(sys.argv) != 3:
123 print("""Incorrect number of arguments.
124The first argument with either an \"o\" for OpenSSL or \"g\" for GNUTLS.
125The second argument should a single space seperated string of MBedTLS ciphersuite names""")
126 sys.exit(1)
127 print(format_ciphersuite_names(sys.argv[1], sys.argv[2]))
128 sys.exit(0)
Joe Subbiani97cd5992021-07-22 16:08:29 +0100129
130if __name__ == "__main__":
Joe Subbiania16ccac2021-07-22 18:52:17 +0100131 main()