tls: reject invalid ServerKeyExchange signature in TLS client

scapy/layers/tls/automaton_cli.py

@@ -474,7 +474,17 @@ def missing_ServerKeyExchange(self):
 
     @ATMT.state()
     def HANDLED_SERVERKEYEXCHANGE(self):
-        pass
+        if (not self.cur_session.prcs.key_exchange.anonymous and
+                not self.cur_session.server_kx_sig_valid):
+            raise self.INVALID_SERVERKEYEXCHANGE()
+
+    @ATMT.state()
+    def INVALID_SERVERKEYEXCHANGE(self):
+        self.vprint("Invalid ServerKeyExchange signature!")
+        self.add_record()
+        self.add_msg(TLSAlert(level=2, descr=51))
+        self.flush_records()
+        raise self.FINAL(reason=self.INVALID_SERVERKEYEXCHANGE)
 
     def should_handle_CertificateRequest(self):
         """

scapy/layers/tls/handshake.py

@@ -1104,6 +1104,7 @@ def post_dissection(self, pkt):
                 s.server_certs and len(s.server_certs) > 0):
             m = s.client_random + s.server_random + raw(self.params)
             sig_test = self.sig._verify_sig(m, s.server_certs[0])
+            s.server_kx_sig_valid = sig_test
             if not sig_test:
                 pkt_info = pkt.firstlayer().summary()
                 log_runtime.info("TLS: invalid ServerKeyExchange signature [%s]", pkt_info)  # noqa: E501

scapy/layers/tls/session.py

@@ -429,6 +429,7 @@ def __init__(self,
         self.server_key = None
         self.server_rsa_key = None
         self.server_cert_verify_valid = None
+        self.server_kx_sig_valid = None
         # self.server_ecdsa_key = None
 
         # A dictionary containing keys extracted from a NSS Keys Log using

test/scapy/layers/tls/tlsclientserver.uts

@@ -71,6 +71,10 @@ def run_tls_test_server(expected_data, q, curve=None, cookie=False, client_auth=
         elif sigalgo == "ed25519":
             mycert = scapy_path("/test/scapy/layers/tls/pki/srv_cert_ed25519.pem")
             mykey = scapy_path("/test/scapy/layers/tls/pki/srv_key_ed25519.pem")
+        elif sigalgo == "rsa_wrong_key":
+            # Sign with a key that doesn't match the certificate
+            mycert = scapy_path("/test/scapy/layers/tls/pki/srv_cert.pem")
+            mykey = scapy_path("/test/scapy/layers/tls/pki/cli_key.pem")
         else:
             raise ValueError
         print(mykey)
@@ -383,6 +387,14 @@ test_tls_client("009e", "0303")
 
 test_tls_client("c016", "0303")
 
+= Testing TLS client with TLS 1.2 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 and an invalid ServerKeyExchange signature
+
+try:
+    test_tls_client("c02f", "0303", sigalgo="rsa_wrong_key")
+    assert False, "Client should have rejected the ServerKeyExchange"
+except ValueError as ex:
+    assert "INVALID_SERVERKEYEXCHANGE" in str(ex)
+
 = Testing TLS server and client with TLS 1.3 and TLS_AES_128_GCM_SHA256
 
 test_tls_client("1301", "0304")