Skip to content

Commit ceabb90

Browse files
NErinolaNErinola
authored
Merge pull request #230 from tls-attacker/moreConfigs
More Configs for ConfigSelector
2 parents 14c31ca + 4893556 commit ceabb90

File tree

14 files changed

+550
-437
lines changed

14 files changed

+550
-437
lines changed

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/config/ServerScannerConfig.java

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,10 @@ public class ServerScannerConfig extends ScannerConfig {
6363
@ParametersDelegate
6464
private CallbackDelegate callbackDelegate;
6565

66+
@Parameter(names = "-configSearchCooldown", required = false,
67+
description = "Pause between config tests to ensure the server finished processing the previously rejected messages")
68+
private boolean configSearchCooldown = false;
69+
6670
private List<ProbeType> probes = null;
6771

6872
public ServerScannerConfig(GeneralDelegate delegate) {
@@ -163,4 +167,12 @@ public void setCustomCAPathList(List<String> customCAPathList) {
163167
this.customCAPathList = customCAPathList;
164168
}
165169

170+
public boolean isConfigSearchCooldown() {
171+
return configSearchCooldown;
172+
}
173+
174+
public void setConfigSearchCooldown(boolean configSearchCooldown) {
175+
this.configSearchCooldown = configSearchCooldown;
176+
}
177+
166178
}

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/execution/TlsServerScanner.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,9 @@ public ServerReport scan() {
281281
if (isConnectable()) {
282282
isConnectable = true;
283283
LOGGER.debug(config.getClientDelegate().getHost() + " is connectable");
284-
configSelector.findWorkingConfig();
284+
configSelector.findWorkingConfigs();
285+
serverReport.setConfigProfileIdentifier(configSelector.getConfigProfileIdentifier());
286+
serverReport.setConfigProfileIdentifierTls13(configSelector.getConfigProfileIdentifierTls13());
285287
if (configSelector.isSpeaksProtocol()) {
286288
speaksProtocol = true;
287289
LOGGER.debug(config.getClientDelegate().getHost() + " speaks " + protocolType.getName());

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/HeartbleedProbe.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ private WorkflowTrace getTrace(Config tlsConfig) {
6060
.createWorkflowTrace(WorkflowTraceType.DYNAMIC_HANDSHAKE, RunningModeType.CLIENT);
6161
HeartbeatMessage heartbeatMessage = new HeartbeatMessage(tlsConfig);
6262
heartbeatMessage.setPayload(Modifiable.explicit(new byte[] { 1, 3 }));
63-
heartbeatMessage.setPayloadLength(Modifiable.explicit(20000));
63+
heartbeatMessage.setPayloadLength(Modifiable.explicit(10));
6464
trace.addTlsAction(new SendAction(heartbeatMessage));
6565
trace.addTlsAction(new ReceiveAction(new HeartbeatMessage()));
6666
return trace;

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/NamedGroupsProbe.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,10 @@ public NamedGroupResult executeTest() {
9292
TestResult supportsExplicitPrime = getExplicitCurveSupport(EllipticCurveType.EXPLICIT_PRIME);
9393
TestResult supportsExplicitChar2 = getExplicitCurveSupport(EllipticCurveType.EXPLICIT_CHAR2);
9494

95-
Map<NamedGroup, NamedGroupWitness> groupsTls13 = getTls13SupportedGroups();
95+
Map<NamedGroup, NamedGroupWitness> groupsTls13 = new HashMap<>();
96+
if (!configSelector.getScannerConfig().getDtlsDelegate().isDTLS()) {
97+
groupsTls13 = getTls13SupportedGroups();
98+
}
9699

97100
TestResult groupsDependOnCipherSuite = getGroupsDependOnCipherSuite(overallSupported);
98101

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/ServerReport.java

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,10 @@ public class ServerReport extends ScanReport {
183183
private long scanStartTime;
184184
private long scanEndTime;
185185

186+
// Config profile used to limit our Client Hello
187+
private String configProfileIdentifier;
188+
private String configProfileIdentifierTls13;
189+
186190
public ServerReport() {
187191
host = null;
188192
port = null;
@@ -785,6 +789,22 @@ public synchronized void setGuidelineReports(List<GuidelineReport> guidelineRepo
785789
this.guidelineReports = guidelineReports;
786790
}
787791

792+
public synchronized String getConfigProfileIdentifier() {
793+
return configProfileIdentifier;
794+
}
795+
796+
public synchronized void setConfigProfileIdentifier(String configProfileIdentifier) {
797+
this.configProfileIdentifier = configProfileIdentifier;
798+
}
799+
800+
public synchronized String getConfigProfileIdentifierTls13() {
801+
return configProfileIdentifierTls13;
802+
}
803+
804+
public synchronized void setConfigProfileIdentifierTls13(String configProfileIdentifierTls13) {
805+
this.configProfileIdentifierTls13 = configProfileIdentifierTls13;
806+
}
807+
788808
public synchronized Long getClosedAfterFinishedDelta() {
789809
return closedAfterFinishedDelta;
790810
}

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/selector/ConfigFilter.java

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
/**
2+
* TLS-Server-Scanner - A TLS configuration and analysis tool based on TLS-Attacker
3+
*
4+
* Copyright 2017-2022 Ruhr University Bochum, Paderborn University, Hackmanit GmbH
5+
*
6+
* Licensed under Apache License, Version 2.0
7+
* http://www.apache.org/licenses/LICENSE-2.0.txt
8+
*/
9+
10+
package de.rub.nds.tlsscanner.serverscanner.selector;
11+
12+
import de.rub.nds.tlsattacker.core.config.Config;
13+
import de.rub.nds.tlsattacker.core.constants.CipherSuite;
14+
import de.rub.nds.tlsattacker.core.constants.NamedGroup;
15+
import de.rub.nds.tlsattacker.core.constants.SignatureAndHashAlgorithm;
16+
import java.util.List;
17+
import java.util.stream.Collectors;
18+
19+
public class ConfigFilter {
20+
public static void applyFilterProfile(Config baseConfig, ConfigFilterType[] configFilterTypes) {
21+
for (ConfigFilterType filterType : configFilterTypes) {
22+
if (filterType.isCipherSuiteFilter()) {
23+
filterCipherSuites(baseConfig, filterType);
24+
} else if (filterType.isNamedGroupFilter()) {
25+
filterNamedGroups(baseConfig, filterType);
26+
} else if (filterType.isSignatureAlgorithmFilter()) {
27+
filterSignatureAlgorithms(baseConfig, filterType);
28+
} else {
29+
throw new IllegalArgumentException("No behavior defined for filter " + filterType);
30+
}
31+
}
32+
}
33+
34+
private static void filterCipherSuites(Config baseConfig, ConfigFilterType filterType) {
35+
List<CipherSuite> reducedCipherSuites = baseConfig.getDefaultClientSupportedCipherSuites();
36+
switch (filterType) {
37+
case CIPHERSUITE_ANON:
38+
String anonEnumSubstring = filterType.name().replace("CIPHERSUITE_", "").toLowerCase();
39+
reducedCipherSuites =
40+
reducedCipherSuites.stream().filter(cipherSuite -> !cipherSuite.name().contains(anonEnumSubstring))
41+
.collect(Collectors.toList());
42+
break;
43+
case CIPHERSUITE_ECCPWD:
44+
case CIPHERSUITE_EXPORT:
45+
case CIPHERSUITE_GREASE:
46+
case CIPHERSUITE_GOST:
47+
case CIPHERSUITE_KRB5:
48+
case CIPHERSUITE_PSK:
49+
case CIPHERSUITE_ARIA:
50+
case CIPHERSUITE_SRP:
51+
case CIPHERSUITE_CAMELLIA:
52+
case CIPHERSUITE_UNOFFICIAL:
53+
String filteredEnumSubstring = filterType.name().replace("CIPHERSUITE_", "");
54+
reducedCipherSuites = reducedCipherSuites.stream()
55+
.filter(cipherSuite -> !cipherSuite.name().contains(filteredEnumSubstring))
56+
.collect(Collectors.toList());
57+
break;
58+
case CIPHERSUITE_UNNEGOTIABLE:
59+
reducedCipherSuites = reducedCipherSuites.stream()
60+
.filter(cipherSuite -> cipherSuite.isRealCipherSuite()).collect(Collectors.toList());
61+
break;
62+
default:
63+
throw new IllegalArgumentException("No behavior defined for filter " + filterType);
64+
}
65+
baseConfig.setDefaultClientSupportedCipherSuites(reducedCipherSuites);
66+
}
67+
68+
private static void filterNamedGroups(Config baseConfig, ConfigFilterType filterType) {
69+
List<NamedGroup> reducedNamedGroups = baseConfig.getDefaultClientNamedGroups();
70+
switch (filterType) {
71+
case NAMEDGROUP_GREASE:
72+
case NAMEDGROUP_SECT:
73+
String filteredEnumSubstring = filterType.name().replace("NAMEDGROUP_", "");
74+
reducedNamedGroups = reducedNamedGroups.stream()
75+
.filter(group -> !group.name().contains(filteredEnumSubstring)).collect(Collectors.toList());
76+
break;
77+
case NAMEDGROUP_DEPRECATED:
78+
reducedNamedGroups =
79+
reducedNamedGroups.stream().filter(NamedGroup::isTls13).collect(Collectors.toList());
80+
break;
81+
default:
82+
throw new IllegalArgumentException("No behavior defined for filter " + filterType);
83+
}
84+
baseConfig.setDefaultClientNamedGroups(reducedNamedGroups);
85+
}
86+
87+
private static void filterSignatureAlgorithms(Config baseConfig, ConfigFilterType filterType) {
88+
List<SignatureAndHashAlgorithm> reducedSignatureAlgorithms =
89+
baseConfig.getDefaultClientSupportedSignatureAndHashAlgorithms();
90+
switch (filterType) {
91+
case SIGNATUREALGORITHM_ANON:
92+
case SIGNATUREALGORITHM_DSA:
93+
case SIGNATUREALGORITHM_GREASE:
94+
String filteredEnumSubstring = filterType.name().replace("SIGNATUREALGORITHM_", "");
95+
reducedSignatureAlgorithms = reducedSignatureAlgorithms.stream()
96+
.filter(algo -> !algo.name().contains(filteredEnumSubstring)).collect(Collectors.toList());
97+
break;
98+
case SIGNATUREALGORITHM_TLS13:
99+
reducedSignatureAlgorithms = reducedSignatureAlgorithms.stream()
100+
.filter(SignatureAndHashAlgorithm.getTls13SignatureAndHashAlgorithms()::contains)
101+
.collect(Collectors.toList());
102+
break;
103+
default:
104+
throw new IllegalArgumentException("No behavior defined for filter " + filterType);
105+
}
106+
baseConfig.setDefaultClientSupportedSignatureAndHashAlgorithms(reducedSignatureAlgorithms);
107+
}
108+
}

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/selector/ConfigFilterProfile.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* TLS-Server-Scanner - A TLS configuration and analysis tool based on TLS-Attacker
3+
*
4+
* Copyright 2017-2022 Ruhr University Bochum, Paderborn University, Hackmanit GmbH
5+
*
6+
* Licensed under Apache License, Version 2.0
7+
* http://www.apache.org/licenses/LICENSE-2.0.txt
8+
*/
9+
10+
package de.rub.nds.tlsscanner.serverscanner.selector;
11+
12+
public interface ConfigFilterProfile {
13+
public abstract ConfigFilterType[] getConfigFilterTypes();
14+
15+
public abstract String getIdentifier();
16+
}

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/selector/ConfigFilterType.java

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/**
2+
* TLS-Server-Scanner - A TLS configuration and analysis tool based on TLS-Attacker
3+
*
4+
* Copyright 2017-2022 Ruhr University Bochum, Paderborn University, Hackmanit GmbH
5+
*
6+
* Licensed under Apache License, Version 2.0
7+
* http://www.apache.org/licenses/LICENSE-2.0.txt
8+
*/
9+
10+
package de.rub.nds.tlsscanner.serverscanner.selector;
11+
12+
public enum ConfigFilterType {
13+
CIPHERSUITE_UNNEGOTIABLE,
14+
CIPHERSUITE_UNOFFICIAL,
15+
CIPHERSUITE_GREASE,
16+
CIPHERSUITE_KRB5,
17+
CIPHERSUITE_GOST,
18+
CIPHERSUITE_PSK,
19+
CIPHERSUITE_SRP,
20+
CIPHERSUITE_ECCPWD,
21+
CIPHERSUITE_ANON,
22+
CIPHERSUITE_ARIA,
23+
CIPHERSUITE_CAMELLIA,
24+
CIPHERSUITE_EXPORT,
25+
26+
NAMEDGROUP_GREASE,
27+
NAMEDGROUP_DEPRECATED,
28+
NAMEDGROUP_SECT,
29+
30+
SIGNATUREALGORITHM_GREASE,
31+
SIGNATUREALGORITHM_ANON,
32+
SIGNATUREALGORITHM_DSA,
33+
SIGNATUREALGORITHM_TLS13;
34+
35+
public boolean isCipherSuiteFilter() {
36+
return this.name().contains("CIPHERSUITE");
37+
}
38+
39+
public boolean isNamedGroupFilter() {
40+
return this.name().contains("NAMEDGROUP");
41+
}
42+
43+
public boolean isSignatureAlgorithmFilter() {
44+
return this.name().contains("SIGNATUREALGORITHM");
45+
}
46+
}

0 commit comments

Comments
 (0)