Skip to content

Commit 51f7d4a

Browse files
ic0nsic0ns
committed
Fixed various intolerances and bugs
1 parent 433be67 commit 51f7d4a

File tree

9 files changed

+67
-24
lines changed

9 files changed

+67
-24
lines changed

‎pom.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,12 @@
99
<dependency>
1010
<groupId>de.rub.nds.tlsattacker</groupId>
1111
<artifactId>TLS-Core</artifactId>
12-
<version>2.1</version>
12+
<version>2.2</version>
1313
</dependency>
1414
<dependency>
1515
<groupId>de.rub.nds.tlsattacker</groupId>
1616
<artifactId>Attacks</artifactId>
17-
<version>2.1</version>
17+
<version>2.2</version>
1818
</dependency>
1919
<dependency>
2020
<groupId>junit</groupId>

‎src/main/java/de/rub/nds/tlsscanner/config/ScannerConfig.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,9 @@ public void setImplementation(boolean implementation) {
7676

7777
@Override
7878
public Config createConfig() {
79-
Config config = super.createConfig(); //To change body of generated methods, choose Tools | Templates.
79+
Config config = super.createConfig();
8080
config.setSniHostname(clientDelegate.getHost());
81+
config.getDefaultClientConnection().setTimeout(1000);
8182
return config;
8283
}
8384

‎src/main/java/de/rub/nds/tlsscanner/constants/ProbeType.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,5 @@ public enum ProbeType {
2828
SIGNATURE_AND_HASH,
2929
EXTENSIONS,
3030
COMPRESSIONS,
31+
INTOLERANCES,
3132
}

‎src/main/java/de/rub/nds/tlsscanner/probe/CertificateProbe.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import de.rub.nds.tlsscanner.constants.ProbeType;
1212
import de.rub.nds.tlsscanner.report.result.CertificateResult;
1313
import de.rub.nds.tlsattacker.core.config.Config;
14+
import de.rub.nds.tlsattacker.core.constants.CipherSuite;
1415
import de.rub.nds.tlsattacker.core.util.CertificateFetcher;
1516
import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowTraceType;
1617
import de.rub.nds.tlsscanner.config.ScannerConfig;
@@ -37,9 +38,10 @@ public ProbeResult executeTest() {
3738
tlsConfig.setEarlyStop(true);
3839
tlsConfig.setWorkflowTraceType(WorkflowTraceType.HELLO);
3940
tlsConfig.setAddServerNameIndicationExtension(true);
41+
tlsConfig.setDefaultClientSupportedCiphersuites(CipherSuite.values());
4042
tlsConfig.setStopActionsAfterFatal(true);
4143
Certificate serverCert = CertificateFetcher.fetchServerCertificate(tlsConfig);
4244
List<CertificateReport> reportList = CertificateReportGenerator.generateReports(serverCert);
43-
return new CertificateResult(getType(), reportList);
45+
return new CertificateResult(getType(), reportList, serverCert);
4446
}
4547
}

‎src/main/java/de/rub/nds/tlsscanner/probe/CiphersuiteProbe.java

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import de.rub.nds.tlsscanner.config.ScannerConfig;
2828
import de.rub.nds.tlsscanner.report.result.ProbeResult;
2929
import de.rub.nds.tlsscanner.report.result.VersionSuiteListPair;
30+
import java.util.ArrayList;
3031
import java.util.Arrays;
3132
import java.util.LinkedList;
3233
import java.util.List;
@@ -55,17 +56,25 @@ public ProbeResult executeTest() {
5556
List<CipherSuite> toTestList = new LinkedList<>();
5657
toTestList.addAll(Arrays.asList(CipherSuite.values()));
5758
toTestList.remove(CipherSuite.TLS_FALLBACK_SCSV);
58-
List<CipherSuite> versionSupportedSuites = getSupportedCipherSuitesFromList(toTestList, version);
59+
List<CipherSuite> versionSupportedSuites = getSupportedCipherSuitesWithIntolerance(toTestList, version);
60+
if (versionSupportedSuites.isEmpty()) {
61+
versionSupportedSuites = getSupportedCipherSuitesWithIntolerance(version);
62+
}
5963
if (versionSupportedSuites.size() > 0) {
6064
pairLists.add(new VersionSuiteListPair(version, versionSupportedSuites));
6165
}
66+
6267
}
6368

6469
return new CiphersuiteProbeResult(pairLists);
6570

6671
}
6772

68-
public List<CipherSuite> getSupportedCipherSuitesFromList(List<CipherSuite> toTestList, ProtocolVersion version) {
73+
public List<CipherSuite> getSupportedCipherSuitesWithIntolerance(ProtocolVersion version) {
74+
return getSupportedCipherSuitesWithIntolerance(new ArrayList<>(CipherSuite.getImplemented()), version);
75+
}
76+
77+
public List<CipherSuite> getSupportedCipherSuitesWithIntolerance(List<CipherSuite> toTestList, ProtocolVersion version) {
6978
List<CipherSuite> listWeSupport = new LinkedList<>(toTestList);
7079
List<CipherSuite> supported = new LinkedList<>();
7180

‎src/main/java/de/rub/nds/tlsscanner/probe/ProtocolVersionProbe.java

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,17 +70,27 @@ public ProbeResult executeTest() {
7070
List<ProtocolVersion> supportedVersionList = new LinkedList<>();
7171
List<ProtocolVersion> unsupportedVersionList = new LinkedList<>();
7272
for (ProtocolVersion version : toTestList) {
73-
if (isProtocolVersionSupported(version)) {
73+
if (isProtocolVersionSupported(version, false)) {
7474

7575
supportedVersionList.add(version);
7676
} else {
7777
unsupportedVersionList.add(version);
7878
}
7979
}
80+
if (supportedVersionList.isEmpty()) {
81+
unsupportedVersionList = new LinkedList<>();
82+
for (ProtocolVersion version : toTestList) {
83+
if (isProtocolVersionSupported(version, true)) {
84+
supportedVersionList.add(version);
85+
} else {
86+
unsupportedVersionList.add(version);
87+
}
88+
}
89+
}
8090
return new ProtocolVersionResult(supportedVersionList, unsupportedVersionList);
8191
}
8292

83-
public boolean isProtocolVersionSupported(ProtocolVersion toTest) {
93+
public boolean isProtocolVersionSupported(ProtocolVersion toTest, boolean intolerance) {
8494
if (toTest == ProtocolVersion.SSL2) {
8595
return isSSL2Supported();
8696
}
@@ -89,8 +99,12 @@ public boolean isProtocolVersionSupported(ProtocolVersion toTest) {
8999
}
90100
Config tlsConfig = getScannerConfig().createConfig();
91101
List<CipherSuite> cipherSuites = new LinkedList<>();
92-
cipherSuites.addAll(Arrays.asList(CipherSuite.values()));
93-
cipherSuites.remove(CipherSuite.TLS_FALLBACK_SCSV);
102+
if (intolerance) {
103+
cipherSuites.addAll(CipherSuite.getImplemented());
104+
} else {
105+
cipherSuites.addAll(Arrays.asList(CipherSuite.values()));
106+
cipherSuites.remove(CipherSuite.TLS_FALLBACK_SCSV);
107+
}
94108
tlsConfig.setDefaultSelectedProtocolVersion(toTest);
95109
tlsConfig.setQuickReceive(true);
96110
tlsConfig.setDefaultClientSupportedCiphersuites(cipherSuites);
@@ -172,6 +186,7 @@ private boolean isTls13Supported(ProtocolVersion toTest) {
172186
tlsConfig.setAddSignatureAndHashAlgrorithmsExtension(true);
173187
tlsConfig.setAddSupportedVersionsExtension(true);
174188
tlsConfig.setAddKeyShareExtension(true);
189+
tlsConfig.setAddServerNameIndicationExtension(true);
175190
tlsConfig.setUseRandomUnixTime(true);
176191
tlsConfig.setSupportedSignatureAndHashAlgorithms(getTls13SignatureAndHashAlgorithms());
177192
State state = new State(tlsConfig);

‎src/main/java/de/rub/nds/tlsscanner/report/SiteReport.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ public class SiteReport {
162162
private Boolean extensionIntolerance;
163163
private Boolean cipherSuiteIntolerance;
164164
private Boolean supportedCurvesIntolerance;
165+
private Boolean clientHelloSizeIntolerance;
165166

166167
public SiteReport(String host) {
167168
this.host = host;
@@ -1376,6 +1377,14 @@ public void setVersionSuitePairs(List<VersionSuiteListPair> versionSuitePairs) {
13761377
this.versionSuitePairs = versionSuitePairs;
13771378
}
13781379

1380+
public Boolean getClientHelloSizeIntolerance() {
1381+
return clientHelloSizeIntolerance;
1382+
}
1383+
1384+
public void setClientHelloSizeIntolerance(Boolean clientHelloSizeIntolerance) {
1385+
this.clientHelloSizeIntolerance = clientHelloSizeIntolerance;
1386+
}
1387+
13791388
@Override
13801389
public String toString() {
13811390
return getStringReport();

‎src/main/java/de/rub/nds/tlsscanner/report/result/CertificateResult.java

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,45 +10,48 @@
1010
import de.rub.nds.tlsscanner.probe.certificate.CertificateReport;
1111
import de.rub.nds.tlsscanner.report.SiteReport;
1212
import java.util.List;
13+
import org.bouncycastle.crypto.tls.Certificate;
1314

1415
/**
1516
*
1617
* @author Robert Merget <[email protected]>
1718
*/
1819
public class CertificateResult extends ProbeResult {
19-
20+
2021
private List<CertificateReport> reportList;
21-
22+
2223
private boolean expiredCertificates = false;
2324
private boolean notYetValidCertificates = false;
2425
private boolean weakHashAlgorithms = false;
2526
private boolean weakSignatureAlgorithms = false;
2627
private boolean matchesDomain = false;
2728
private boolean isTrusted = true;
2829
private boolean containsBlacklisted = false;
29-
30-
public CertificateResult(ProbeType type, List<CertificateReport> reportList) {
30+
private Certificate certs;
31+
32+
public CertificateResult(ProbeType type, List<CertificateReport> reportList, Certificate certs) {
3133
super(type);
3234
this.reportList = reportList;
35+
this.certs = certs;
3336
}
34-
37+
3538
@Override
3639
public void merge(SiteReport report) {
3740
report.setCertificateReports(reportList);
41+
report.setCertificate(certs);
3842
for (CertificateReport certReport : reportList) {
3943
CertificateJudger judger = new CertificateJudger(certReport.getCertificate(), certReport, report.getHost());
4044
expiredCertificates |= judger.checkExpired();
4145
notYetValidCertificates |= judger.checkNotYetValid();
4246
weakHashAlgorithms |= judger.isWeakHashAlgo(certReport);
4347
weakSignatureAlgorithms |= judger.isWeakSigAlgo(certReport);
44-
45-
48+
4649
}
4750
report.setCertificateExpired(expiredCertificates);
4851
report.setCertificateNotYetValid(notYetValidCertificates);
4952
report.setCertificateHasWeakHashAlgorithm(weakHashAlgorithms);
5053
report.setCertificateHasWeakSignAlgorithm(weakSignatureAlgorithms);
51-
54+
5255
}
53-
56+
5457
}

‎src/main/java/de/rub/nds/tlsscanner/report/result/ProtocolVersionResult.java

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,22 @@
1515
* @author Robert Merget <[email protected]>
1616
*/
1717
public class ProtocolVersionResult extends ProbeResult {
18-
18+
1919
private final List<ProtocolVersion> supportedProtocolVersions;
20-
20+
2121
private final List<ProtocolVersion> unsupportedProtocolVersions;
22-
22+
2323
public ProtocolVersionResult(List<ProtocolVersion> supportedProtocolVersions, List<ProtocolVersion> unsupportedProtocolVersions) {
2424
super(ProbeType.CIPHERSUITE);
2525
this.supportedProtocolVersions = supportedProtocolVersions;
2626
this.unsupportedProtocolVersions = unsupportedProtocolVersions;
2727
}
28-
28+
2929
@Override
3030
public void merge(SiteReport report) {
31+
if (supportedProtocolVersions.size() > 0) {
32+
report.setSupportsSslTls(true);
33+
}
3134
report.setVersions(supportedProtocolVersions);
3235
for (ProtocolVersion version : supportedProtocolVersions) {
3336
if (version == ProtocolVersion.DTLS10) {
@@ -138,5 +141,5 @@ public void merge(SiteReport report) {
138141
}
139142
report.setVersions(supportedProtocolVersions);
140143
}
141-
144+
142145
}

0 commit comments

Comments
 (0)