Skip to content

Commit 24d0362

Browse files
ic0nsic0ns
authored
Merge pull request #83 from RUB-NDS/releasepreps
Releasepreps
2 parents 469d4f8 + bb0d234 commit 24d0362

27 files changed

+627
-808
lines changed

‎Dockerfile

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
FROM maven:3.6.1-jdk-8 AS build-image
22
WORKDIR /build
3-
3+
RUN git clone https://github.com/RUB-NDS/ASN.1-Tool.git && cd ASN.1-Tool && mvn clean install && cd ..
4+
RUN git clone https://github.com/RUB-NDS/X509-Attacker.git && cd X509-Attacker && mvn clean install && cd ..
45
RUN git clone https://github.com/RUB-NDS/TLS-Scanner.git --recurse-submodules
56

67
RUN git clone https://github.com/RUB-NDS/TLS-Attacker.git && \

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/TlsScanner.java

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,6 @@ private void fillDefaultProbeLists() {
8888
probeList.add(new DirectRaccoonProbe(config, parallelExecutor));
8989
probeList.add(new CiphersuiteOrderProbe(config, parallelExecutor));
9090
probeList.add(new ExtensionProbe(config, parallelExecutor));
91-
probeList.add(new Tls13Probe(config, parallelExecutor));
9291
probeList.add(new TokenbindingProbe(config, parallelExecutor));
9392
probeList.add(new HttpHeaderProbe(config, parallelExecutor));
9493
probeList.add(new ECPointFormatProbe(config, parallelExecutor));
@@ -102,7 +101,7 @@ private void fillDefaultProbeLists() {
102101
probeList.add(new InvalidCurveProbe(config, parallelExecutor));
103102
probeList.add(new DrownProbe(config, parallelExecutor));
104103
probeList.add(new EarlyCcsProbe(config, parallelExecutor));
105-
probeList.add(new MacProbe(config, parallelExecutor));
104+
// probeList.add(new MacProbe(config, parallelExecutor));
106105
probeList.add(new CcaSupportProbe(config, parallelExecutor));
107106
probeList.add(new CcaRequiredProbe(config, parallelExecutor));
108107
probeList.add(new CcaProbe(config, parallelExecutor));

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/config/ScannerConfig.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ public class ScannerConfig extends TLSDelegateConfig {
4141
private ScannerDetail scanDetail = ScannerDetail.NORMAL;
4242

4343
@Parameter(names = "-reportDetail", required = false, description = "How detailed do you want the report to be?")
44-
private ScannerDetail reportDetail = ScannerDetail.ALL;
44+
private ScannerDetail reportDetail = ScannerDetail.NORMAL;
4545

4646
@Parameter(names = "-threads", required = false, description = "The maximum number of threads used to execute TLS probes located in the scanning queue. This is also the maximum number of threads communicating with the analyzed server.")
4747
private int overallThreads = 1;

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CiphersuiteProbe.java

Lines changed: 103 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,16 @@
1616
import de.rub.nds.tlsattacker.core.constants.NamedGroup;
1717
import de.rub.nds.tlsattacker.core.constants.ProtocolMessageType;
1818
import de.rub.nds.tlsattacker.core.constants.ProtocolVersion;
19+
import de.rub.nds.tlsattacker.core.constants.SignatureAndHashAlgorithm;
1920
import de.rub.nds.tlsattacker.core.protocol.message.AlertMessage;
2021
import de.rub.nds.tlsattacker.core.state.State;
2122
import de.rub.nds.tlsattacker.core.workflow.ParallelExecutor;
2223
import de.rub.nds.tlsattacker.core.workflow.WorkflowTraceUtil;
2324
import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowTraceType;
2425
import de.rub.nds.tlsscanner.serverscanner.config.ScannerConfig;
2526
import de.rub.nds.tlsscanner.serverscanner.constants.ProbeType;
27+
import de.rub.nds.tlsscanner.serverscanner.rating.TestResult;
28+
import de.rub.nds.tlsscanner.serverscanner.report.AnalyzedProperty;
2629
import de.rub.nds.tlsscanner.serverscanner.report.SiteReport;
2730
import de.rub.nds.tlsscanner.serverscanner.report.result.CiphersuiteProbeResult;
2831
import de.rub.nds.tlsscanner.serverscanner.report.result.ProbeResult;
@@ -39,10 +42,6 @@ public class CiphersuiteProbe extends TlsProbe {
3942
public CiphersuiteProbe(ScannerConfig config, ParallelExecutor parallelExecutor) {
4043
super(parallelExecutor, ProbeType.CIPHERSUITE, config);
4144
protocolVersions = new LinkedList<>();
42-
protocolVersions.add(ProtocolVersion.SSL3);
43-
protocolVersions.add(ProtocolVersion.TLS10);
44-
protocolVersions.add(ProtocolVersion.TLS11);
45-
protocolVersions.add(ProtocolVersion.TLS12);
4645
}
4746

4847
@Override
@@ -51,33 +50,97 @@ public ProbeResult executeTest() {
5150
List<VersionSuiteListPair> pairLists = new LinkedList<>();
5251
for (ProtocolVersion version : protocolVersions) {
5352
LOGGER.debug("Testing:" + version.name());
54-
List<CipherSuite> toTestList = new LinkedList<>();
55-
List<CipherSuite> versionSupportedSuites = new LinkedList<>();
56-
if (version == ProtocolVersion.SSL3) {
57-
toTestList.addAll(CipherSuite.SSL3_SUPPORTED_CIPHERSUITES);
58-
versionSupportedSuites = getSupportedCipherSuitesWithIntolerance(toTestList, version);
53+
if (version.isTLS13()) {
54+
pairLists.add(new VersionSuiteListPair(version, getSupportedCiphersuites()));
5955
} else {
60-
toTestList.addAll(Arrays.asList(CipherSuite.values()));
61-
toTestList.remove(CipherSuite.TLS_FALLBACK_SCSV);
62-
toTestList.remove(CipherSuite.TLS_EMPTY_RENEGOTIATION_INFO_SCSV);
63-
versionSupportedSuites = getSupportedCipherSuitesWithIntolerance(toTestList, version);
64-
if (versionSupportedSuites.isEmpty()) {
65-
versionSupportedSuites = getSupportedCipherSuitesWithIntolerance(version);
56+
List<CipherSuite> toTestList = new LinkedList<>();
57+
List<CipherSuite> versionSupportedSuites = new LinkedList<>();
58+
if (version == ProtocolVersion.SSL3) {
59+
toTestList.addAll(CipherSuite.SSL3_SUPPORTED_CIPHERSUITES);
60+
versionSupportedSuites = getSupportedCipherSuitesWithIntolerance(toTestList, version);
61+
} else {
62+
toTestList.addAll(Arrays.asList(CipherSuite.values()));
63+
toTestList.remove(CipherSuite.TLS_FALLBACK_SCSV);
64+
toTestList.remove(CipherSuite.TLS_EMPTY_RENEGOTIATION_INFO_SCSV);
65+
versionSupportedSuites = getSupportedCipherSuitesWithIntolerance(toTestList, version);
66+
if (versionSupportedSuites.isEmpty()) {
67+
versionSupportedSuites = getSupportedCipherSuitesWithIntolerance(version);
68+
}
69+
}
70+
if (versionSupportedSuites.size() > 0) {
71+
pairLists.add(new VersionSuiteListPair(version, versionSupportedSuites));
6672
}
6773
}
68-
if (versionSupportedSuites.size() > 0) {
69-
pairLists.add(new VersionSuiteListPair(version, versionSupportedSuites));
70-
}
71-
7274
}
73-
7475
return new CiphersuiteProbeResult(pairLists);
7576
} catch (Exception E) {
7677
LOGGER.error("Could not scan for " + getProbeName(), E);
7778
return new CiphersuiteProbeResult(null);
7879
}
7980
}
8081

82+
private List<CipherSuite> getSupportedCiphersuites() {
83+
CipherSuite selectedSuite = null;
84+
List<CipherSuite> toTestList = new LinkedList<>();
85+
List<CipherSuite> supportedSuits = new LinkedList<>();
86+
for (CipherSuite suite : CipherSuite.values()) {
87+
if (suite.isTLS13()) {
88+
toTestList.add(suite);
89+
}
90+
}
91+
do {
92+
selectedSuite = getSelectedCiphersuite(toTestList);
93+
94+
if (selectedSuite != null) {
95+
if (!toTestList.contains(selectedSuite)) {
96+
LOGGER.warn("Server chose a CipherSuite we did not propose!");
97+
// TODO write to sitereport
98+
break;
99+
}
100+
supportedSuits.add(selectedSuite);
101+
toTestList.remove(selectedSuite);
102+
}
103+
} while (selectedSuite != null && !toTestList.isEmpty());
104+
return supportedSuits;
105+
}
106+
107+
private CipherSuite getSelectedCiphersuite(List<CipherSuite> toTestList) {
108+
Config tlsConfig = getScannerConfig().createConfig();
109+
tlsConfig.setQuickReceive(true);
110+
tlsConfig.setDefaultClientSupportedCiphersuites(toTestList);
111+
tlsConfig.setHighestProtocolVersion(ProtocolVersion.TLS13);
112+
tlsConfig.setSupportedVersions(ProtocolVersion.TLS13);
113+
tlsConfig.setEnforceSettings(false);
114+
tlsConfig.setEarlyStop(true);
115+
tlsConfig.setStopReceivingAfterFatal(true);
116+
tlsConfig.setStopActionsAfterFatal(true);
117+
tlsConfig.setWorkflowTraceType(WorkflowTraceType.HELLO);
118+
tlsConfig.setDefaultClientNamedGroups(NamedGroup.getImplemented());
119+
tlsConfig.setAddECPointFormatExtension(false);
120+
tlsConfig.setAddEllipticCurveExtension(true);
121+
tlsConfig.setAddSignatureAndHashAlgorithmsExtension(true);
122+
tlsConfig.setAddSupportedVersionsExtension(true);
123+
tlsConfig.setAddKeyShareExtension(true);
124+
tlsConfig.setAddServerNameIndicationExtension(true);
125+
tlsConfig.setAddCertificateStatusRequestExtension(true);
126+
tlsConfig.setUseFreshRandom(true);
127+
tlsConfig.setDefaultClientSupportedSignatureAndHashAlgorithms(SignatureAndHashAlgorithm
128+
.getTls13SignatureAndHashAlgorithms());
129+
130+
State state = new State(tlsConfig);
131+
executeState(state);
132+
if (WorkflowTraceUtil.didReceiveMessage(HandshakeMessageType.SERVER_HELLO, state.getWorkflowTrace())) {
133+
return state.getTlsContext().getSelectedCipherSuite();
134+
} else if (WorkflowTraceUtil.didReceiveMessage(HandshakeMessageType.HELLO_RETRY_REQUEST,
135+
state.getWorkflowTrace())) {
136+
return state.getTlsContext().getSelectedCipherSuite();
137+
} else {
138+
LOGGER.debug("Did not receive ServerHello Message");
139+
LOGGER.debug(state.getWorkflowTrace().toString());
140+
return null;
141+
}
142+
}
143+
81144
public List<CipherSuite> getSupportedCipherSuitesWithIntolerance(ProtocolVersion version) {
82145
return getSupportedCipherSuitesWithIntolerance(new ArrayList<>(CipherSuite.getImplemented()), version);
83146
}
@@ -149,11 +212,30 @@ public List<CipherSuite> getSupportedCipherSuitesWithIntolerance(List<CipherSuit
149212

150213
@Override
151214
public boolean canBeExecuted(SiteReport report) {
152-
return true;
215+
if (report.isProbeAlreadyExecuted(ProbeType.PROTOCOL_VERSION)) {
216+
return true;
217+
} else {
218+
return false;
219+
}
153220
}
154221

155222
@Override
156223
public void adjustConfig(SiteReport report) {
224+
if (report.getResult(AnalyzedProperty.SUPPORTS_SSL_3) == TestResult.TRUE) {
225+
protocolVersions.add(ProtocolVersion.SSL3);
226+
}
227+
if (report.getResult(AnalyzedProperty.SUPPORTS_TLS_1_0) == TestResult.TRUE) {
228+
protocolVersions.add(ProtocolVersion.TLS10);
229+
}
230+
if (report.getResult(AnalyzedProperty.SUPPORTS_TLS_1_1) == TestResult.TRUE) {
231+
protocolVersions.add(ProtocolVersion.TLS11);
232+
}
233+
if (report.getResult(AnalyzedProperty.SUPPORTS_TLS_1_2) == TestResult.TRUE) {
234+
protocolVersions.add(ProtocolVersion.TLS12);
235+
}
236+
if (report.getResult(AnalyzedProperty.SUPPORTS_TLS_1_3) == TestResult.TRUE) {
237+
protocolVersions.add(ProtocolVersion.TLS13);
238+
}
157239
}
158240

159241
@Override

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CompressionsProbe.java

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -100,16 +100,6 @@ private CompressionMethod testCompressionMethods(List<CompressionMethod> compres
100100
}
101101
}
102102

103-
private List<CipherSuite> getEcCiphersuites() {
104-
List<CipherSuite> suiteList = new LinkedList<>();
105-
for (CipherSuite suite : CipherSuite.values()) {
106-
if (suite.name().contains("ECDH")) {
107-
suiteList.add(suite);
108-
}
109-
}
110-
return suiteList;
111-
}
112-
113103
@Override
114104
public boolean canBeExecuted(SiteReport report) {
115105
return true;

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/DirectRaccoonProbe.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ public ProbeResult executeTest() {
7676
return new DirectRaccoonResult(testResultList);
7777
} catch (Exception E) {
7878
LOGGER.error("Could not scan for " + getProbeName(), E);
79-
return new DirectRaccoonResult(null);
79+
return new DirectRaccoonResult(TestResult.ERROR_DURING_TEST);
8080
}
8181
}
8282

@@ -189,6 +189,6 @@ public void adjustConfig(SiteReport report) {
189189

190190
@Override
191191
public ProbeResult getCouldNotExecuteResult() {
192-
return new DirectRaccoonResult(null);
192+
return new DirectRaccoonResult(TestResult.COULD_NOT_TEST);
193193
}
194194
}

0 commit comments

Comments
 (0)