Skip to content

Commit 3df1337

Browse files
ic0nsic0ns
committed
Updated printingscheme and added tls13 cert status again
1 parent b0725f6 commit 3df1337

File tree

3 files changed

+96
-5
lines changed

3 files changed

+96
-5
lines changed

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/OcspProbe.java

Lines changed: 62 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,13 @@
4242
import java.util.Random;
4343

4444
import static de.rub.nds.tlsattacker.core.certificate.ocsp.OCSPResponseTypes.NONCE;
45+
import de.rub.nds.tlsattacker.core.constants.NamedGroup;
46+
import de.rub.nds.tlsattacker.core.constants.PskKeyExchangeMode;
47+
import de.rub.nds.tlsattacker.core.constants.SignatureAndHashAlgorithm;
48+
import de.rub.nds.tlsattacker.core.protocol.message.CertificateMessage;
49+
import de.rub.nds.tlsattacker.core.protocol.message.cert.CertificateEntry;
50+
import de.rub.nds.tlsattacker.core.protocol.message.extension.CertificateStatusRequestExtensionMessage;
51+
import de.rub.nds.tlsattacker.core.protocol.message.extension.ExtensionMessage;
4552
import de.rub.nds.tlsscanner.serverscanner.config.ScannerConfig;
4653
import de.rub.nds.tlsscanner.serverscanner.constants.ProbeType;
4754
import de.rub.nds.tlsscanner.serverscanner.report.SiteReport;
@@ -62,6 +69,7 @@ public class OcspProbe extends TlsProbe {
6269
private OCSPResponse firstResponse;
6370
private OCSPResponse secondResponse;
6471
private OCSPResponse httpGetResponse;
72+
private List<NamedGroup> tls13NamedGroups;
6573

6674
public static final int NONCE_TEST_VALUE_1 = 42;
6775
public static final int NONCE_TEST_VALUE_2 = 1337;
@@ -84,9 +92,12 @@ public ProbeResult executeTest() {
8492
getMustStaple(serverCertChain);
8593
getStapledResponse(tlsConfig);
8694
performRequest(serverCertChain);
87-
95+
List<CertificateStatusRequestExtensionMessage> tls13CertStatus = null;
96+
if (tls13NamedGroups != null) {
97+
tls13CertStatus = getCertificateStatusFromCertificateEntryExtension();
98+
}
8899
return new OcspResult(supportsOcsp, supportsStapling, mustStaple, supportsNonce, stapledResponse,
89-
firstResponse, secondResponse, httpGetResponse);
100+
firstResponse, secondResponse, httpGetResponse, tls13CertStatus);
90101
}
91102

92103
private void getMustStaple(Certificate certChain) {
@@ -222,16 +233,63 @@ private Config initTlsConfig() {
222233

223234
@Override
224235
public boolean canBeExecuted(SiteReport report) {
225-
return report.getCertificateChain() != null;
236+
// We also need the tls13 groups to perform a tls13 handshake
237+
return report.getCertificateChain() != null && report.isProbeAlreadyExecuted(ProbeType.NAMED_GROUPS);
226238
}
227239

228240
@Override
229241
public void adjustConfig(SiteReport report) {
230242
serverCertChain = report.getCertificateChain().getCertificate();
243+
tls13NamedGroups = report.getSupportedTls13Groups();
244+
}
245+
246+
private List<CertificateStatusRequestExtensionMessage> getCertificateStatusFromCertificateEntryExtension() {
247+
List<CertificateStatusRequestExtensionMessage> certificateStatuses = new LinkedList<>();
248+
Config tlsConfig = getScannerConfig().createConfig();
249+
tlsConfig.setQuickReceive(true);
250+
tlsConfig.setDefaultClientSupportedCiphersuites(CipherSuite.getImplementedTls13CipherSuites());
251+
tlsConfig.setHighestProtocolVersion(ProtocolVersion.TLS13);
252+
tlsConfig.setSupportedVersions(ProtocolVersion.TLS13);
253+
tlsConfig.setEnforceSettings(false);
254+
tlsConfig.setEarlyStop(true);
255+
tlsConfig.setStopReceivingAfterFatal(true);
256+
tlsConfig.setStopActionsAfterFatal(true);
257+
tlsConfig.setWorkflowTraceType(WorkflowTraceType.HELLO);
258+
tlsConfig.setDefaultClientNamedGroups(tls13NamedGroups);
259+
tlsConfig.setAddECPointFormatExtension(false);
260+
tlsConfig.setAddEllipticCurveExtension(true);
261+
tlsConfig.setAddSignatureAndHashAlgorithmsExtension(true);
262+
tlsConfig.setAddSupportedVersionsExtension(true);
263+
tlsConfig.setAddKeyShareExtension(true);
264+
tlsConfig.setAddServerNameIndicationExtension(true);
265+
tlsConfig.setAddCertificateStatusRequestExtension(true);
266+
tlsConfig.setUseFreshRandom(true);
267+
tlsConfig.setDefaultClientSupportedSignatureAndHashAlgorithms(SignatureAndHashAlgorithm
268+
.getTls13SignatureAndHashAlgorithms());
269+
State state = new State(tlsConfig);
270+
List<PskKeyExchangeMode> pskKex = new LinkedList<>();
271+
pskKex.add(PskKeyExchangeMode.PSK_DHE_KE);
272+
pskKex.add(PskKeyExchangeMode.PSK_KE);
273+
tlsConfig.setPSKKeyExchangeModes(pskKex);
274+
tlsConfig.setAddPSKKeyExchangeModesExtension(true);
275+
executeState(state);
276+
if (WorkflowTraceUtil.didReceiveMessage(HandshakeMessageType.CERTIFICATE, state.getWorkflowTrace())) {
277+
CertificateMessage certificateMessage = (CertificateMessage) WorkflowTraceUtil.getFirstReceivedMessage(
278+
HandshakeMessageType.CERTIFICATE, state.getWorkflowTrace());
279+
List<CertificateEntry> certificateEntries = certificateMessage.getCertificatesListAsEntry();
280+
for (CertificateEntry certificateEntry : certificateEntries) {
281+
for (ExtensionMessage extensionMessage : certificateEntry.getExtensions()) {
282+
if (extensionMessage instanceof CertificateStatusRequestExtensionMessage) {
283+
certificateStatuses.add((CertificateStatusRequestExtensionMessage) extensionMessage);
284+
}
285+
}
286+
}
287+
}
288+
return certificateStatuses;
231289
}
232290

233291
@Override
234292
public ProbeResult getCouldNotExecuteResult() {
235-
return new OcspResult(null, false, false, false, null, null, null, null);
293+
return new OcspResult(null, false, false, false, null, null, null, null, null);
236294
}
237295
}

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/PrintingScheme.java

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,16 @@ public static PrintingScheme getDefaultPrintingScheme(boolean useColors) {
9191
attackEncodingMap.put(TestResult.UNCERTAIN, "uncertain - requires manual testing");
9292
attackEncodingMap.put(TestResult.UNSUPPORTED, "unsupported by TLS-Scanner");
9393

94+
HashMap<TestResult, String> freshnessMap = new HashMap<>();
95+
freshnessMap.put(TestResult.COULD_NOT_TEST, "could not test (no)");
96+
freshnessMap.put(TestResult.ERROR_DURING_TEST, "error");
97+
freshnessMap.put(TestResult.FALSE, "false");
98+
freshnessMap.put(TestResult.NOT_TESTED_YET, "not tested yet");
99+
freshnessMap.put(TestResult.TIMEOUT, "timeout");
100+
freshnessMap.put(TestResult.TRUE, "true");
101+
freshnessMap.put(TestResult.UNCERTAIN, "uncertain - requires manual testing");
102+
freshnessMap.put(TestResult.UNSUPPORTED, "unsupported by TLS-Scanner");
103+
94104
ColorEncoding attacks = getDefaultColorEncoding(AnsiColor.RED, AnsiColor.GREEN);
95105

96106
HashMap<AnalyzedProperty, ColorEncoding> colorMap = new HashMap<>();
@@ -297,6 +307,8 @@ public static PrintingScheme getDefaultPrintingScheme(boolean useColors) {
297307

298308
HashMap<AnalyzedPropertyCategory, TextEncoding> textMap = new HashMap<>();
299309
textMap.put(AnalyzedPropertyCategory.ATTACKS, new TextEncoding(attackEncodingMap));
310+
textMap.put(AnalyzedPropertyCategory.FRESHNESS, new TextEncoding(freshnessMap));
311+
textMap.put(AnalyzedPropertyCategory.FFDHE, new TextEncoding(freshnessMap));
300312
PrintingScheme scheme = new PrintingScheme(colorMap, textMap, defaultTextEncoding, defaultColorEncoding,
301313
useColors);
302314
return scheme;

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/result/OcspResult.java

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
import de.rub.nds.tlsattacker.core.certificate.ocsp.CertificateStatus;
1212
import de.rub.nds.tlsattacker.core.certificate.ocsp.OCSPResponse;
13+
import de.rub.nds.tlsattacker.core.protocol.message.extension.CertificateStatusRequestExtensionMessage;
1314
import de.rub.nds.tlsscanner.serverscanner.constants.ProbeType;
1415
import de.rub.nds.tlsscanner.serverscanner.probe.OcspProbe;
1516
import de.rub.nds.tlsscanner.serverscanner.rating.TestResult;
@@ -20,6 +21,7 @@
2021
import java.time.Duration;
2122
import java.time.LocalDateTime;
2223
import java.time.format.DateTimeFormatter;
24+
import java.util.List;
2325
import java.util.Locale;
2426

2527
/**
@@ -37,9 +39,11 @@ public class OcspResult extends ProbeResult {
3739
private final OCSPResponse secondResponse;
3840
private final OCSPResponse httpGetResponse;
3941

42+
private final List<CertificateStatusRequestExtensionMessage> tls13CertStatus;
43+
4044
public OcspResult(Boolean supportsOcsp, boolean supportsStapling, boolean mustStaple, boolean supportsNonce,
4145
OCSPResponse stapledResponse, OCSPResponse firstResponse, OCSPResponse secondResponse,
42-
OCSPResponse httpGetResponse) {
46+
OCSPResponse httpGetResponse, List<CertificateStatusRequestExtensionMessage> tls13CertStatus) {
4347
super(ProbeType.OCSP);
4448
this.supportsOcsp = supportsOcsp;
4549
this.supportsStapling = supportsStapling;
@@ -49,6 +53,7 @@ public OcspResult(Boolean supportsOcsp, boolean supportsStapling, boolean mustSt
4953
this.firstResponse = firstResponse;
5054
this.secondResponse = secondResponse;
5155
this.httpGetResponse = httpGetResponse;
56+
this.tls13CertStatus = tls13CertStatus;
5257
}
5358

5459
@Override
@@ -140,5 +145,21 @@ else if (secondResponse != null) {
140145
report.putResult(AnalyzedProperty.SUPPORTS_NONCE, TestResult.FALSE);
141146
}
142147
}
148+
149+
if (tls13CertStatus != null) {
150+
if (tls13CertStatus.size() == 1) {
151+
report.putResult(AnalyzedProperty.SUPPORTS_CERTIFICATE_STATUS_REQUEST_TLS13, TestResult.TRUE);
152+
report.putResult(AnalyzedProperty.STAPLING_TLS13_MULTIPLE_CERTIFICATES, TestResult.FALSE);
153+
} else if (tls13CertStatus.size() > 1) {
154+
report.putResult(AnalyzedProperty.SUPPORTS_CERTIFICATE_STATUS_REQUEST_TLS13, TestResult.TRUE);
155+
report.putResult(AnalyzedProperty.STAPLING_TLS13_MULTIPLE_CERTIFICATES, TestResult.TRUE);
156+
} else {
157+
report.putResult(AnalyzedProperty.SUPPORTS_CERTIFICATE_STATUS_REQUEST_TLS13, TestResult.FALSE);
158+
report.putResult(AnalyzedProperty.STAPLING_TLS13_MULTIPLE_CERTIFICATES, TestResult.FALSE);
159+
}
160+
} else {
161+
report.putResult(AnalyzedProperty.SUPPORTS_CERTIFICATE_STATUS_REQUEST_TLS13, TestResult.COULD_NOT_TEST);
162+
report.putResult(AnalyzedProperty.STAPLING_TLS13_MULTIPLE_CERTIFICATES, TestResult.COULD_NOT_TEST);
163+
}
143164
}
144165
}

0 commit comments

Comments
 (0)