check if client doesn't advertise in TLS 1.3 groups forbidden in TLS 1.3

[tomato42]

fixes #389
tested by tlsfuzzer/tlsfuzzer#540

---

This change is 

[t184256]

Unless you also intend to error out on other reserved values, I'd prefer 'obsolete' or 'obsoleted' over 'forbidden', to match the terminology more closely.

Reviewable status: 0 of 2 files reviewed, 2 unresolved discussions (waiting on @t184256 and @tomato42)

---

tlslite/constants.py, line 360 at r1 (raw file):

# groups forbidden by RFC 8443 section B.3.1.5

RFC 8446 section B.3.1.4 ?

---

tlslite/constants.py, line 364 at r1 (raw file):

TLS_1_3_FORBIDDEN_GROUPS.update(range(0x1A, 0x1D))
TLS_1_3_FORBIDDEN_GROUPS.update([0xff01, 0xff02])
TLS_1_3_FORBIDDEN_GROUPS = frozenset(TLS_1_3_FORBIDDEN_GROUPS)

I think both frozenset().union(*iterables) and frozenset(itertools.chain(*iterables)) are more readable than a chain of .update()s and a cast.
Also, one more range > tuple > list.

[tomato42]

Unless you also intend to error out on other reserved values

yes, we should error out on other values like that; while it departs from the terminology used in TLS 1.3 RFC it makes it much clearer what is the expected behaviour

Reviewable status: 0 of 2 files reviewed, 2 unresolved discussions (waiting on @t184256 and @tomato42)

---

tlslite/constants.py, line 360 at r1 (raw file):

Previously, t184256 (Alexander Sosedkin) wrote…

RFC 8446 section B.3.1.4 ?

Done.

---

tlslite/constants.py, line 364 at r1 (raw file):

Previously, t184256 (Alexander Sosedkin) wrote…

I think both frozenset().union(*iterables) and frozenset(itertools.chain(*iterables)) are more readable than a chain of .update()s and a cast.
Also, one more range > tuple > list.

true, didn't think of update() accepting multiple iterables

[t184256]

Reviewed 1 of 2 files at r1, 1 of 1 files at r2.
Reviewable status: complete! all files reviewed, all discussions resolved