Skip to content

Commit eb75ac2

Browse files
drwetterdrwetter
committed
Slightly improved strings @ pre-socket handling
* `code2network()` was improved to just use internal bash functions, except sed * `socksend()` was renamed to `socksend_x()` to clarify that the string passed contains already a leading x We might want to try using in `code2network()` only bash internal functions like in `socksend_x()`. And maybe decide for onee format of hexbytes in the code -- with x or without.
1 parent 35cb521 commit eb75ac2

File tree

1 file changed

+40
-27
lines changed

1 file changed

+40
-27
lines changed

‎testssl.sh‎

Lines changed: 40 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -5076,7 +5076,7 @@ client_simulation_sockets() {
50765076
fi
50775077

50785078
debugme echo -n "requesting more server hello data... "
5079-
socksend "" $USLEEP_SND
5079+
socksend_x "" $USLEEP_SND
50805080
sockread 32768
50815081

50825082
next_packet=$(hexdump -v -e '16/1 "%02X"' "$SOCK_REPLY_FILE")
@@ -11958,7 +11958,7 @@ starttls_postgres_dialog() {
1195811958
local starttls_init=", x00, x00 ,x00 ,x08 ,x04 ,xD2 ,x16 ,x2F"
1195911959

1196011960
debugme echo "=== starting postgres STARTTLS dialog ==="
11961-
socksend "${starttls_init}" 0 && debugme echo "${debugpad}initiated STARTTLS" &&
11961+
socksend_x "${starttls_init}" 0 && debugme echo "${debugpad}initiated STARTTLS" &&
1196211962
starttls_io "" S 1 && debugme echo "${debugpad}received ack (=\"S\") for STARTTLS"
1196311963
ret=$?
1196411964
debugme echo "=== finished postgres STARTTLS dialog with ${ret} ==="
@@ -11982,7 +11982,7 @@ starttls_ldap_dialog() {
1198211982
x31, x2e, x34, x2e, x31, x2e, x31, x34, x36, x36, x2e, x32, x30, x30, x33, x37" # OID for STATRTTLS = "1.3.6.1.4.1.1466.20037"
1198311983

1198411984
debugme echo "=== starting LDAP STARTTLS dialog ==="
11985-
socksend "${starttls_init}" 0 && debugme echo "${debugpad}initiated STARTTLS" &&
11985+
socksend_x "${starttls_init}" 0 && debugme echo "${debugpad}initiated STARTTLS" &&
1198611986
buffer=$(sockread_fast 256)
1198711987
[[ $DEBUG -ge 4 ]] && safe_echo "$debugpad $buffer\n"
1198811988

@@ -12051,7 +12051,7 @@ starttls_mysql_dialog() {
1205112051
x00, x00, x00, x00, x00, x00, x00"
1205212052

1205312053
debugme echo "=== starting mysql STARTTLS dialog ==="
12054-
socksend "${starttls_init}" 0 && debugme echo "${debugpad}initiated STARTTLS" &&
12054+
socksend_x "${starttls_init}" 0 && debugme echo "${debugpad}initiated STARTTLS" &&
1205512055
starttls_just_read 1 "read succeeded"
1205612056
# 1 is the timeout value which only MySQL needs. Note, there seems no response whether STARTTLS
1205712057
# succeeded. We could try harder, see https://github.com/openssl/openssl/blob/master/apps/s_client.c
@@ -12076,8 +12076,8 @@ starttls_telnet_dialog() {
1207612076
"
1207712077

1207812078
debugme echo "=== starting telnet STARTTLS dialog ==="
12079-
socksend "${msg1}" 0 && debugme echo "${debugpad}initiated STARTTLS" &&
12080-
socksend "${msg2}" 1 &&
12079+
socksend_x "${msg1}" 0 && debugme echo "${debugpad}initiated STARTTLS" &&
12080+
socksend_x "${msg2}" 1 &&
1208112081
tnres=$(sockread_fast 20) && debugme echo "read succeeded"
1208212082
[[ $DEBUG -ge 6 ]] && safe_echo "$debugpad $tnres\n"
1208312083
# check for START_TLS and FOLLOWS
@@ -12249,20 +12249,34 @@ send_close_notify() {
1224912249

1225012250
debugme echo "sending close_notify..."
1225112251
if [[ $detected_tlsversion == 0300 ]]; then
12252-
socksend ",x15, x03, x00, x00, x02, x02, x00" 0
12252+
socksend_x ",x15, x03, x00, x00, x02, x02, x00" 0
1225312253
else
12254-
socksend ",x15, x03, x01, x00, x02, x02, x00" 0
12254+
socksend_x ",x15, x03, x01, x00, x02, x02, x00" 0
1225512255
fi
1225612256
}
1225712257

12258-
# Format string properly for socket
12259-
# ARG1: any commented sequence of two bytes hex, separated by commas. It can contain comments, new lines, tabs and white spaces
12258+
# Format passed multiline string properly for socket
12259+
# ARG1: any commented multiline sequence of two bytes hex, separated by commas.
12260+
# It can contain comments, new lines, tabs (shouldn't be there), blanks
12261+
#
1226012262
# NW_STR holds the global with the string prepared for printf, like '\x16\x03\x03\'
12263+
#
1226112264
code2network() {
12262-
NW_STR=$(sed -e 's/,/\\\x/g' <<< "$1" | sed -e 's/# .*$//g' -e 's/ //g' -e '/^$/d' | tr -d '\n' | tr -d '\t')
12265+
NW_STR="${1//$'\t'/}"
12266+
NW_STR=$(sed -e 's/,/\\\x/g' -e 's/# .*$//g' -e 's/ //g' -e '/^$/d' <<< "${NW_STR}")
12267+
NW_STR="${NW_STR//$'\n'/}"
1226312268
}
1226412269

12270+
1226512271
# sockets inspired by https://blog.chris007.de/using-bash-for-network-socket-operation/
12272+
# Now there are two functions which converts sequence of multiline bytes and send it to the opened
12273+
# bash sockets:
12274+
# socksend_clienthello(): uses just blocks of bytes separated by commas
12275+
# socksend_x(): uses just blocks of bytes separated by commas with leading x
12276+
#
12277+
# at some point of time this should be cleaned up
12278+
12279+
1226612280
# ARG1: hexbytes separated by commas, with a leading comma
1226712281
# ARG2: seconds to sleep
1226812282
#
@@ -12281,11 +12295,10 @@ socksend_clienthello() {
1228112295
sleep $USLEEP_SND
1228212296
}
1228312297

12284-
12285-
# ARG1: hexbytes -- preceded by x -- separated by commas, with a leading comma
12298+
# ARG1: hexbytes with leading x (thus the name) separated by commas, with a leading comma.
1228612299
# ARG2: seconds to sleep
1228712300
#
12288-
socksend() {
12301+
socksend_x() {
1228912302
local data line
1229012303

1229112304
# read line per line and strip comments (bash internal func can't handle multiline statements
@@ -15968,7 +15981,7 @@ sslv2_sockets() {
1596815981
mv "$SOCK_REPLY_FILE" "$sock_reply_file2"
1596915982

1597015983
debugme echo -n "requesting more server hello data... "
15971-
socksend "" $USLEEP_SND
15984+
socksend_x "" $USLEEP_SND
1597215985
sockread 32768
1597315986

1597415987
[[ ! -s "$SOCK_REPLY_FILE" ]] && break
@@ -16684,7 +16697,7 @@ resend_if_hello_retry_request() {
1668416697
if [[ "$server_version" == 0304 ]] || [[ 0x$server_version -ge 0x7f16 ]]; then
1668516698
# Send a dummy change cipher spec for middlebox compatibility.
1668616699
debugme echo -en "\nsending dummy change cipher spec... "
16687-
socksend ", x14, x03, x03 ,x00, x01, x01" 0
16700+
socksend_x ", x14, x03, x03 ,x00, x01, x01" 0
1668816701
fi
1668916702
debugme echo -en "\nsending second client hello... "
1669016703
second_clienthello="$(modify_clienthello "$original_clienthello" "$new_key_share" "$cookie")"
@@ -16793,7 +16806,7 @@ tls_sockets() {
1679316806
fi
1679416807

1679516808
debugme echo -n "requesting more server hello data... "
16796-
socksend "" $USLEEP_SND
16809+
socksend_x "" $USLEEP_SND
1679716810
sockread 32768
1679816811

1679916812
next_packet=$(hexdump -v -e '16/1 "%02X"' "$SOCK_REPLY_FILE")
@@ -17023,7 +17036,7 @@ send_app_data() {
1702317036
for (( i=0; i < len; i+=2 )); do
1702417037
data+=",x${res:i:2}"
1702517038
done
17026-
socksend "$data" $USLEEP_SND
17039+
socksend_x "$data" $USLEEP_SND
1702717040
}
1702817041

1702917042
# Receive application data from a TLS 1.3 channel that has already been created.
@@ -17148,7 +17161,7 @@ run_heartbleed(){
1714817161
tls_sockets "${tls_hexcode:6:2}" "" "ephemeralkey" "" "" "false"
1714917162

1715017163
[[ $DEBUG -ge 4 ]] && tmln_out "\nsending payload with TLS version $tls_hexcode:"
17151-
socksend "$heartbleed_payload" 1
17164+
socksend_x "$heartbleed_payload" 1
1715217165
sockread 16384 $HEARTBLEED_MAX_WAITSOCK
1715317166
if [[ $? -eq 3 ]]; then
1715417167
append=", timed out"
@@ -17283,7 +17296,7 @@ run_ccs_injection(){
1728317296

1728417297
# we now make a standard handshake ...
1728517298
debugme echo -n "sending client hello... "
17286-
socksend "$client_hello" 1
17299+
socksend_x "$client_hello" 1
1728717300

1728817301
debugme echo "reading server hello... "
1728917302
sockread 32768
@@ -17294,7 +17307,7 @@ run_ccs_injection(){
1729417307
fi
1729517308
rm "$SOCK_REPLY_FILE"
1729617309
# ... and then send the change cipher spec message
17297-
socksend "$ccs_message" 1 || ok_ids
17310+
socksend_x "$ccs_message" 1 || ok_ids
1729817311
sockread 4096 $CCS_MAX_WAITSOCK
1729917312
if [[ $DEBUG -ge 3 ]]; then
1730017313
tmln_out "\n1st reply: "
@@ -17304,7 +17317,7 @@ run_ccs_injection(){
1730417317
fi
1730517318
rm "$SOCK_REPLY_FILE"
1730617319

17307-
socksend "$ccs_message" 2 || ok_ids
17320+
socksend_x "$ccs_message" 2 || ok_ids
1730817321
sockread 4096 $CCS_MAX_WAITSOCK
1730917322
retval=$?
1731017323

@@ -17584,7 +17597,7 @@ run_ticketbleed() {
1758417597
for i in 1 2 3; do
1758517598
fd_socket 5 || return 6
1758617599
debugme echo -n "sending client hello... "
17587-
socksend "$client_hello" 0
17600+
socksend_x "$client_hello" 0
1758817601

1758917602
debugme echo "reading server hello (ticketbleed reply)... "
1759017603
if "$FAST_SOCKET"; then
@@ -20625,9 +20638,9 @@ run_robot() {
2062520638
hexdump -v -e '16/1 "%02x"')"
2062620639
if [[ -z "$encrypted_pms" ]]; then
2062720640
if [[ "$DETECTED_TLS_VERSION" == "0300" ]]; then
20628-
socksend ",x15, x03, x00, x00, x02, x02, x00" 0
20641+
socksend_x ",x15, x03, x00, x00, x02, x02, x00" 0
2062920642
else
20630-
socksend ",x15, x03, x01, x00, x02, x02, x00" 0
20643+
socksend_x ",x15, x03, x01, x00, x02, x02, x00" 0
2063120644
fi
2063220645
close_socket 5
2063320646
prln_fixme "Conversion of public key failed around line $((LINENO - 9))"
@@ -20658,10 +20671,10 @@ run_robot() {
2065820671

2065920672
if "$send_ccs_finished"; then
2066020673
debugme echo -en "\nsending client key exchange, change cipher spec, finished... "
20661-
socksend "$client_key_exchange$change_cipher_spec$finished" $USLEEP_SND
20674+
socksend_x "$client_key_exchange$change_cipher_spec$finished" $USLEEP_SND
2066220675
else
2066320676
debugme echo -en "\nsending client key exchange... "
20664-
socksend "$client_key_exchange" $USLEEP_SND
20677+
socksend_x "$client_key_exchange" $USLEEP_SND
2066520678
fi
2066620679
debugme echo "reading server error response..."
2066720680
start_time=$(LC_ALL=C date "+%s")

0 commit comments

Comments
 (0)