Skip to content

Commit 700f7de

Browse files
authored
Fixed SupportedGroupsExtension missing in FFDHE group scan (#251)
1 parent 96a8890 commit 700f7de

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/NamedGroupsProbe.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,11 @@ private Map<NamedGroup, NamedGroupWitness> getSupportedNamedCurvesEcdsa(List<Cip
215215
private TlsContext testGroups(List<NamedGroup> groupList, Config tlsConfig) {
216216
tlsConfig.setDefaultClientNamedGroups(groupList);
217217
configSelector.repairConfig(tlsConfig);
218+
if (groupList.stream().anyMatch(NamedGroup::isDhGroup)) {
219+
// usually, we do not want this extension if no ecc cipher suites
220+
// are listed but it is required to test for listed FFDHE groups
221+
tlsConfig.setAddEllipticCurveExtension(true);
222+
}
218223
State state = new State(tlsConfig);
219224
executeState(state);
220225
if (WorkflowTraceUtil.didReceiveMessage(HandshakeMessageType.SERVER_HELLO, state.getWorkflowTrace())) {

0 commit comments

Comments
 (0)