Skip to content

Commit 551e314

Browse files
ic0nsic0ns
authored
Merge pull request #80 from RUB-NDS/esni_evaluation
Esni probe
2 parents 8148def + 70f8ab4 commit 551e314

File tree

8 files changed

+195
-11
lines changed

8 files changed

+195
-11
lines changed

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/Main.java

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,16 @@
1010

1111
import com.beust.jcommander.JCommander;
1212
import com.beust.jcommander.ParameterException;
13+
1314
import de.rub.nds.tlsattacker.core.config.delegate.GeneralDelegate;
1415
import de.rub.nds.tlsattacker.core.exceptions.ConfigurationException;
1516
import de.rub.nds.tlsscanner.serverscanner.config.ScannerConfig;
1617
import de.rub.nds.tlsscanner.serverscanner.constants.AnsiColor;
17-
import de.rub.nds.tlsscanner.serverscanner.leak.InformationLeakReport;
18-
import de.rub.nds.tlsscanner.serverscanner.leak.InformationLeakTest;
1918
import de.rub.nds.tlsscanner.serverscanner.report.SiteReport;
2019
import java.io.IOException;
21-
import java.util.LinkedList;
22-
import java.util.List;
2320
import org.apache.logging.log4j.LogManager;
2421
import org.apache.logging.log4j.Logger;
2522

26-
/**
27-
*
28-
* @author Robert Merget <[email protected]>
29-
*/
3023
public class Main {
3124

3225
private static final Logger LOGGER = LogManager.getLogger();

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/TlsScanner.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@
1313
import de.rub.nds.tlsattacker.core.constants.StarttlsType;
1414
import de.rub.nds.tlsattacker.core.workflow.NamedThreadFactory;
1515
import de.rub.nds.tlsattacker.core.workflow.ParallelExecutor;
16+
import de.rub.nds.tlsscanner.probe.EsniProbe;
1617
import de.rub.nds.tlsscanner.serverscanner.config.ScannerConfig;
17-
import de.rub.nds.tlsscanner.serverscanner.constants.ProbeType;
1818
import de.rub.nds.tlsscanner.serverscanner.probe.*;
1919
import de.rub.nds.tlsscanner.serverscanner.report.SiteReport;
2020
import de.rub.nds.tlsscanner.serverscanner.report.after.AfterProbe;
@@ -106,6 +106,7 @@ private void fillDefaultProbeLists() {
106106
probeList.add(new CcaSupportProbe(config, parallelExecutor));
107107
probeList.add(new CcaRequiredProbe(config, parallelExecutor));
108108
probeList.add(new CcaProbe(config, parallelExecutor));
109+
probeList.add(new EsniProbe(config, parallelExecutor));
109110
afterList.add(new Sweet32AfterProbe());
110111
afterList.add(new PoodleAfterProbe());
111112
afterList.add(new FreakAfterProbe());

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/constants/ProbeType.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
* @author Robert Merget - [email protected]
1414
*/
1515
public enum ProbeType {
16+
ESNI,
1617
CERTIFICATE,
1718
OCSP,
1819
CIPHERSUITE_ORDER,

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/EsniProbe.java

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
/**
2+
* TLS-Scanner - A TLS configuration and analysis tool based on TLS-Attacker.
3+
*
4+
* Copyright 2017-2019 Ruhr University Bochum / Hackmanit GmbH
5+
*
6+
* Licensed under Apache License 2.0
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*/
9+
package de.rub.nds.tlsscanner.probe;
10+
11+
import java.util.Arrays;
12+
import java.util.LinkedList;
13+
import java.util.List;
14+
15+
import de.rub.nds.tlsattacker.core.config.Config;
16+
import de.rub.nds.tlsattacker.core.constants.CipherSuite;
17+
import de.rub.nds.tlsattacker.core.constants.HandshakeMessageType;
18+
import de.rub.nds.tlsattacker.core.constants.NamedGroup;
19+
import de.rub.nds.tlsattacker.core.constants.ProtocolVersion;
20+
import de.rub.nds.tlsattacker.core.constants.RunningModeType;
21+
import de.rub.nds.tlsattacker.core.constants.SignatureAndHashAlgorithm;
22+
import de.rub.nds.tlsattacker.core.state.State;
23+
import de.rub.nds.tlsattacker.core.state.TlsContext;
24+
import de.rub.nds.tlsattacker.core.workflow.ParallelExecutor;
25+
import de.rub.nds.tlsattacker.core.workflow.WorkflowTrace;
26+
import de.rub.nds.tlsattacker.core.workflow.WorkflowTraceUtil;
27+
import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowConfigurationFactory;
28+
import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowTraceType;
29+
import de.rub.nds.tlsscanner.serverscanner.report.result.EsniResult;
30+
import de.rub.nds.tlsscanner.serverscanner.config.ScannerConfig;
31+
import de.rub.nds.tlsscanner.serverscanner.constants.ProbeType;
32+
import de.rub.nds.tlsscanner.serverscanner.probe.TlsProbe;
33+
import de.rub.nds.tlsscanner.serverscanner.rating.TestResult;
34+
import de.rub.nds.tlsscanner.serverscanner.report.SiteReport;
35+
import de.rub.nds.tlsscanner.serverscanner.report.result.ProbeResult;
36+
import de.rub.nds.tlsscanner.serverscanner.report.result.SniResult;
37+
38+
public class EsniProbe extends TlsProbe {
39+
40+
public EsniProbe(ScannerConfig scannerConfig, ParallelExecutor parallelExecutor) {
41+
super(parallelExecutor, ProbeType.ESNI, scannerConfig);
42+
}
43+
44+
@Override
45+
public ProbeResult executeTest() {
46+
Config tlsConfig = getScannerConfig().createConfig();
47+
tlsConfig.setHighestProtocolVersion(ProtocolVersion.TLS13);
48+
tlsConfig.setSupportedVersions(ProtocolVersion.TLS13);
49+
tlsConfig.setUseFreshRandom(true);
50+
tlsConfig.setQuickReceive(true);
51+
tlsConfig.setDefaultClientSupportedCiphersuites(this.getClientSupportedCiphersuites());
52+
tlsConfig.setSupportedSignatureAndHashAlgorithms(this.getTls13SignatureAndHashAlgorithms());
53+
tlsConfig.setEnforceSettings(false);
54+
tlsConfig.setEarlyStop(true);
55+
tlsConfig.setStopReceivingAfterFatal(true);
56+
tlsConfig.setStopActionsAfterFatal(true);
57+
58+
tlsConfig.setDefaultClientNamedGroups(NamedGroup.ECDH_X25519);
59+
tlsConfig.setDefaultSelectedNamedGroup(NamedGroup.ECDH_X25519);
60+
tlsConfig.setAddECPointFormatExtension(false);
61+
tlsConfig.setAddEllipticCurveExtension(true);
62+
tlsConfig.setAddSignatureAndHashAlgorithmsExtension(true);
63+
tlsConfig.setAddSupportedVersionsExtension(true);
64+
tlsConfig.setAddKeyShareExtension(true);
65+
tlsConfig.setClientSupportedEsniCiphersuites(this.getClientSupportedCiphersuites());
66+
tlsConfig.getClientSupportedEsniNamedGroups().addAll(this.getImplementedGroups());
67+
tlsConfig.setAddServerNameIndicationExtension(false);
68+
tlsConfig.setAddEncryptedServerNameIndicationExtension(true);
69+
70+
WorkflowTrace trace = new WorkflowConfigurationFactory(tlsConfig).createWorkflowTrace(WorkflowTraceType.HELLO,
71+
RunningModeType.CLIENT);
72+
State state = new State(tlsConfig, trace);
73+
executeState(state);
74+
75+
TlsContext context = state.getTlsContext();
76+
boolean isDnsKeyRecordAvailable = context.getEsniRecordBytes() != null;
77+
boolean isReceivedCorrectNonce = context.getEsniServerNonce() != null
78+
&& Arrays.equals(context.getEsniServerNonce(), context.getEsniClientNonce());
79+
if (!WorkflowTraceUtil.didReceiveMessage(HandshakeMessageType.SERVER_HELLO, trace)) {
80+
return new SniResult(TestResult.ERROR_DURING_TEST);
81+
} else if (isDnsKeyRecordAvailable && isReceivedCorrectNonce) {
82+
return (new EsniResult(TestResult.TRUE));
83+
} else {
84+
return (new EsniResult(TestResult.FALSE));
85+
}
86+
}
87+
88+
@Override
89+
public boolean canBeExecuted(SiteReport report) {
90+
return true;
91+
}
92+
93+
@Override
94+
public void adjustConfig(SiteReport report) {
95+
}
96+
97+
@Override
98+
public ProbeResult getCouldNotExecuteResult() {
99+
return new SniResult(TestResult.COULD_NOT_TEST);
100+
}
101+
102+
private List<CipherSuite> getClientSupportedCiphersuites() {
103+
List<CipherSuite> cipherSuites = new LinkedList<>();
104+
cipherSuites.add(CipherSuite.TLS_AES_128_GCM_SHA256);
105+
cipherSuites.add(CipherSuite.TLS_AES_256_GCM_SHA384);
106+
return cipherSuites;
107+
}
108+
109+
private List<SignatureAndHashAlgorithm> getTls13SignatureAndHashAlgorithms() {
110+
List<SignatureAndHashAlgorithm> algos = new LinkedList<>();
111+
algos.add(SignatureAndHashAlgorithm.RSA_SHA256);
112+
algos.add(SignatureAndHashAlgorithm.RSA_SHA384);
113+
algos.add(SignatureAndHashAlgorithm.RSA_SHA512);
114+
algos.add(SignatureAndHashAlgorithm.ECDSA_SHA256);
115+
algos.add(SignatureAndHashAlgorithm.ECDSA_SHA384);
116+
algos.add(SignatureAndHashAlgorithm.ECDSA_SHA512);
117+
algos.add(SignatureAndHashAlgorithm.RSA_PSS_PSS_SHA256);
118+
algos.add(SignatureAndHashAlgorithm.RSA_PSS_PSS_SHA384);
119+
algos.add(SignatureAndHashAlgorithm.RSA_PSS_PSS_SHA512);
120+
algos.add(SignatureAndHashAlgorithm.RSA_PSS_RSAE_SHA256);
121+
algos.add(SignatureAndHashAlgorithm.RSA_PSS_RSAE_SHA384);
122+
algos.add(SignatureAndHashAlgorithm.RSA_PSS_RSAE_SHA512);
123+
return algos;
124+
}
125+
126+
private List<NamedGroup> getImplementedGroups() {
127+
List<NamedGroup> list = new LinkedList();
128+
list.add(NamedGroup.ECDH_X25519);
129+
list.add(NamedGroup.ECDH_X448);
130+
list.add(NamedGroup.SECP160K1);
131+
list.add(NamedGroup.SECP160R1);
132+
list.add(NamedGroup.SECP160R2);
133+
list.add(NamedGroup.SECP192K1);
134+
list.add(NamedGroup.SECP192R1);
135+
list.add(NamedGroup.SECP224K1);
136+
list.add(NamedGroup.SECP224R1);
137+
list.add(NamedGroup.SECP256K1);
138+
list.add(NamedGroup.SECP256R1);
139+
list.add(NamedGroup.SECP384R1);
140+
list.add(NamedGroup.SECP521R1);
141+
list.add(NamedGroup.SECT163K1);
142+
list.add(NamedGroup.SECT163R1);
143+
list.add(NamedGroup.SECT163R2);
144+
list.add(NamedGroup.SECT193R1);
145+
list.add(NamedGroup.SECT193R2);
146+
list.add(NamedGroup.SECT233K1);
147+
list.add(NamedGroup.SECT233R1);
148+
list.add(NamedGroup.SECT239K1);
149+
list.add(NamedGroup.SECT283K1);
150+
list.add(NamedGroup.SECT283R1);
151+
list.add(NamedGroup.SECT409K1);
152+
list.add(NamedGroup.SECT409R1);
153+
list.add(NamedGroup.SECT571K1);
154+
list.add(NamedGroup.SECT571R1);
155+
return list;
156+
}
157+
158+
}

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/AnalyzedProperty.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
public enum AnalyzedProperty {
1212

13+
SUPPORTS_ESNI(AnalyzedPropertyCategory.ESNI),
1314
SUPPORTS_SSL_2(AnalyzedPropertyCategory.VERSIONS),
1415
SUPPORTS_SSL_3(AnalyzedPropertyCategory.VERSIONS),
1516
SUPPORTS_TLS_1_0(AnalyzedPropertyCategory.VERSIONS),
@@ -214,7 +215,6 @@ public enum AnalyzedProperty {
214215
REUSES_GCM_NONCES(AnalyzedPropertyCategory.FRESHNESS),
215216
REQUIRES_SNI(AnalyzedPropertyCategory.SNI),
216217
HAS_GNU_TLS_MAGIC_BYTES(AnalyzedPropertyCategory.SESSION_TICKET),
217-
218218
/**
219219
* CCA Properties
220220
*/

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/AnalyzedPropertyCategory.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,9 @@
99
package de.rub.nds.tlsscanner.serverscanner.report;
1010

1111
public enum AnalyzedPropertyCategory {
12-
SESSION_TICKET,
12+
ESNI,
1313
VERSIONS,
14+
SESSION_TICKET,
1415
CIPHER_SUITES,
1516
EXTENSIONS,
1617
SESSION_RESUMPTION,

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/SiteReportPrinter.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1316,6 +1316,7 @@ public StringBuilder appendExtensions(StringBuilder builder) {
13161316
prettyAppend(builder, "Tokenbinding", AnalyzedProperty.SUPPORTS_TOKENBINDING);
13171317
prettyAppend(builder, "Certificate Status Request", AnalyzedProperty.SUPPORTS_CERTIFICATE_STATUS_REQUEST);
13181318
prettyAppend(builder, "Certificate Status Request v2", AnalyzedProperty.SUPPORTS_CERTIFICATE_STATUS_REQUEST_V2);
1319+
prettyAppend(builder, "ESNI", AnalyzedProperty.SUPPORTS_ESNI);
13191320

13201321
if (report.getResult(AnalyzedProperty.SUPPORTS_TOKENBINDING) == TestResult.TRUE) {
13211322
prettyAppendHeading(builder, "Tokenbinding Version");

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/result/EsniResult.java

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* TLS-Scanner - A TLS configuration and analysis tool based on TLS-Attacker.
3+
*
4+
* Copyright 2017-2019 Ruhr University Bochum / Hackmanit GmbH
5+
*
6+
* Licensed under Apache License 2.0
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*/
9+
package de.rub.nds.tlsscanner.serverscanner.report.result;
10+
11+
import de.rub.nds.tlsscanner.serverscanner.constants.ProbeType;
12+
import de.rub.nds.tlsscanner.serverscanner.rating.TestResult;
13+
import de.rub.nds.tlsscanner.serverscanner.report.AnalyzedProperty;
14+
import de.rub.nds.tlsscanner.serverscanner.report.SiteReport;
15+
import de.rub.nds.tlsscanner.serverscanner.report.result.ProbeResult;
16+
17+
public class EsniResult extends ProbeResult {
18+
private TestResult receivedCorrectNonce;
19+
20+
public EsniResult(TestResult receivedCorrectNonce) {
21+
super(ProbeType.ESNI);
22+
this.receivedCorrectNonce = receivedCorrectNonce;
23+
}
24+
25+
@Override
26+
public void mergeData(SiteReport report) {
27+
report.putResult(AnalyzedProperty.SUPPORTS_ESNI, receivedCorrectNonce);
28+
}
29+
}

0 commit comments

Comments
 (0)