Skip to content

Commit e1d7456

Browse files
mmaehrenmmaehren
committed
added Named Curve witnesses to Site Report for detail level ALL
1 parent 8437478 commit e1d7456

File tree

3 files changed

+85
-36
lines changed

3 files changed

+85
-36
lines changed

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/NamedCurvesProbe.java

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ public NamedCurvesProbe(ScannerConfig config, ParallelExecutor parallelExecutor)
7171
@Override
7272
public ProbeResult executeTest() {
7373
try {
74-
List<NamedGroup> groupsRsa = new LinkedList<>();
74+
Map<NamedGroup, NamedCurveWitness> groupsRsa = new HashMap<>();
7575
Map<NamedGroup, NamedCurveWitness> groupsEcdsaStatic = new HashMap<>();
7676
Map<NamedGroup, NamedCurveWitness> groupsEcdsaEphemeral = new HashMap<>();
7777
Map<NamedGroup, NamedCurveWitness> groupsTls13 = new HashMap<>();
@@ -108,14 +108,14 @@ public ProbeResult executeTest() {
108108
}
109109
}
110110

111-
private List<NamedGroup> getSupportedNamedGroupsRsa() {
111+
private Map<NamedGroup, NamedCurveWitness> getSupportedNamedGroupsRsa() {
112112

113113
Config tlsConfig = getBasicConfig();
114114
tlsConfig.setDefaultClientSupportedCiphersuites(getEcRsaCiphersuites());
115115
List<NamedGroup> toTestList = new ArrayList<>(Arrays.asList(NamedGroup.values()));
116116
TlsContext context;
117117
NamedGroup selectedGroup = null;
118-
List<NamedGroup> supportedNamedCurves = new LinkedList<>();
118+
Map<NamedGroup, NamedCurveWitness> supportedNamedCurves = new HashMap<>();
119119
do {
120120
context = testCurves(toTestList, tlsConfig);
121121

@@ -127,7 +127,7 @@ private List<NamedGroup> getSupportedNamedGroupsRsa() {
127127
break;
128128
}
129129

130-
supportedNamedCurves.add(selectedGroup);
130+
supportedNamedCurves.put(selectedGroup, new NamedCurveWitness(context.getSelectedCipherSuite()));
131131
toTestList.remove(selectedGroup);
132132
}
133133
} while (context != null && toTestList.size() > 0);
@@ -177,10 +177,10 @@ private Map<NamedGroup, NamedCurveWitness> getSupportedNamedGroupsEcdsa(List<Cip
177177
}
178178
if (cipherSuites.get(0).isEphemeral()) {
179179
namedCurveMap.put(selectedGroup, new NamedCurveWitness(null, certificateGroup, null,
180-
certificateSigGroup));
180+
certificateSigGroup, context.getSelectedCipherSuite()));
181181
} else {
182182
namedCurveMap.put(selectedGroup, new NamedCurveWitness(certificateGroup, null,
183-
certificateSigGroup, null));
183+
certificateSigGroup, null, context.getSelectedCipherSuite()));
184184

185185
}
186186

@@ -392,7 +392,7 @@ private Map<NamedGroup, NamedCurveWitness> getTls13SupportedGroups() {
392392
}
393393

394394
namedCurveMap.put(selectedGroup, new NamedCurveWitness(null, certificateGroup, null,
395-
certificateSigGroup));
395+
certificateSigGroup, context.getSelectedCipherSuite()));
396396
toTestList.remove(selectedGroup);
397397
}
398398
} while (context != null && !toTestList.isEmpty());
@@ -433,11 +433,11 @@ public TlsContext getTls13SupportedGroup(List<NamedGroup> groups) {
433433
}
434434
}
435435

436-
private Map<NamedGroup, NamedCurveWitness> composeFullMap(List<NamedGroup> rsaGroups,
436+
private Map<NamedGroup, NamedCurveWitness> composeFullMap(Map<NamedGroup, NamedCurveWitness> rsaGroups,
437437
Map<NamedGroup, NamedCurveWitness> groupsEcdsaStatic,
438438
Map<NamedGroup, NamedCurveWitness> groupsEcdsaEphemeral) {
439439
List<NamedGroup> foundOverall = new LinkedList();
440-
for (NamedGroup group : rsaGroups) {
440+
for (NamedGroup group : rsaGroups.keySet()) {
441441
if (!foundOverall.contains(group)) {
442442
foundOverall.add(group);
443443
}
@@ -456,16 +456,16 @@ private Map<NamedGroup, NamedCurveWitness> composeFullMap(List<NamedGroup> rsaGr
456456
HashMap<NamedGroup, NamedCurveWitness> groupMap = new HashMap<>();
457457
for (NamedGroup group : foundOverall) {
458458
NamedCurveWitness witness = new NamedCurveWitness();
459-
if (rsaGroups.contains(group)) {
460-
witness.setFoundUsingRsaCipher(true);
459+
if (rsaGroups.containsKey(group)) {
460+
witness.getCipherSuites().addAll(rsaGroups.get(group).getCipherSuites());
461461
}
462462
if (groupsEcdsaStatic.containsKey(group)) {
463-
witness.setFoundUsingEcdsaStaticCipher(true);
463+
witness.getCipherSuites().addAll(groupsEcdsaStatic.get(group).getCipherSuites());
464464
witness.setEcdsaPkGroupStatic(groupsEcdsaStatic.get(group).getEcdsaPkGroupStatic());
465465
witness.setEcdsaSigGroupStatic(groupsEcdsaStatic.get(group).getEcdsaSigGroupStatic());
466466
}
467467
if (groupsEcdsaEphemeral.containsKey(group)) {
468-
witness.setFoundUsingEcdsaEphemeralCipher(true);
468+
witness.getCipherSuites().addAll(groupsEcdsaEphemeral.get(group).getCipherSuites());
469469
witness.setEcdsaPkGroupEphemeral(groupsEcdsaEphemeral.get(group).getEcdsaPkGroupEphemeral());
470470
witness.setEcdsaSigGroupEphemeral(groupsEcdsaEphemeral.get(group).getEcdsaSigGroupEphemeral());
471471
}
@@ -476,10 +476,10 @@ private Map<NamedGroup, NamedCurveWitness> composeFullMap(List<NamedGroup> rsaGr
476476
}
477477

478478
private TestResult getGroupsDependOnCiphersuite(Map<NamedGroup, NamedCurveWitness> overallSupported,
479-
List<NamedGroup> groupsRsa, Map<NamedGroup, NamedCurveWitness> groupsEcdsaStatic,
479+
Map<NamedGroup, NamedCurveWitness> groupsRsa, Map<NamedGroup, NamedCurveWitness> groupsEcdsaStatic,
480480
Map<NamedGroup, NamedCurveWitness> groupsEcdsaEphemeral) {
481481
for (NamedGroup group : overallSupported.keySet()) {
482-
if (((testUsingRsa && !groupsRsa.contains(group))
482+
if (((testUsingRsa && !groupsRsa.containsKey(group))
483483
|| (testUsingEcdsaStatic && !groupsEcdsaStatic.containsKey(group)) || (testUsingEcdsaEphemeral && !groupsEcdsaEphemeral
484484
.containsKey(group))) && group.isCurve()) {
485485
return TestResult.TRUE;

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/namedcurve/NamedCurveWitness.java

Lines changed: 42 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,17 @@
88
*/
99
package de.rub.nds.tlsscanner.serverscanner.probe.namedcurve;
1010

11+
import de.rub.nds.tlsattacker.core.constants.AlgorithmResolver;
12+
import de.rub.nds.tlsattacker.core.constants.CertificateKeyType;
1113
import de.rub.nds.tlsattacker.core.constants.CipherSuite;
14+
import de.rub.nds.tlsattacker.core.constants.KeyExchangeAlgorithm;
1215
import de.rub.nds.tlsattacker.core.constants.NamedGroup;
16+
import java.util.HashSet;
17+
import java.util.Set;
1318

1419
public class NamedCurveWitness {
15-
private boolean foundUsingRsaCipher = false;
16-
private boolean foundUsingEcdsaStaticCipher = false;
17-
private boolean foundUsingEcdsaEphemeralCipher = false;
20+
21+
private Set<CipherSuite> cipherSuites;
1822

1923
// the curves used to generate an ecdsa sig inside the key ex. message
2024
private NamedGroup ecdsaPkGroupStatic;
@@ -25,15 +29,22 @@ public class NamedCurveWitness {
2529
private NamedGroup ecdsaSigGroupEphemeral;
2630

2731
public NamedCurveWitness() {
28-
32+
cipherSuites = new HashSet<>();
2933
}
3034

3135
public NamedCurveWitness(NamedGroup ecdsaPkGroupStatic, NamedGroup ecdsaPkGroupEphemeral,
32-
NamedGroup ecdsaSigGroupStatic, NamedGroup ecdsaSigGroupEphemeral) {
36+
NamedGroup ecdsaSigGroupStatic, NamedGroup ecdsaSigGroupEphemeral, CipherSuite cipherSuite) {
3337
this.ecdsaPkGroupStatic = ecdsaPkGroupStatic;
3438
this.ecdsaPkGroupEphemeral = ecdsaPkGroupEphemeral;
3539
this.ecdsaSigGroupStatic = ecdsaSigGroupStatic;
3640
this.ecdsaSigGroupEphemeral = ecdsaSigGroupEphemeral;
41+
cipherSuites = new HashSet<>();
42+
cipherSuites.add(cipherSuite);
43+
}
44+
45+
public NamedCurveWitness(CipherSuite cipherSuite) {
46+
cipherSuites = new HashSet<>();
47+
cipherSuites.add(cipherSuite);
3748
}
3849

3950
public NamedGroup getEcdsaPkGroupStatic() {
@@ -53,27 +64,30 @@ public NamedGroup getEcdsaSigGroupEphemeral() {
5364
}
5465

5566
public boolean isFoundUsingRsaCipher() {
56-
return foundUsingRsaCipher;
57-
}
58-
59-
public void setFoundUsingRsaCipher(boolean foundUsingRsaCipher) {
60-
this.foundUsingRsaCipher = foundUsingRsaCipher;
67+
for (CipherSuite cipherSuite : cipherSuites) {
68+
if (AlgorithmResolver.getCertificateKeyType(cipherSuite) == CertificateKeyType.RSA) {
69+
return true;
70+
}
71+
}
72+
return false;
6173
}
6274

6375
public boolean isFoundUsingEcdsaStaticCipher() {
64-
return foundUsingEcdsaStaticCipher;
65-
}
66-
67-
public void setFoundUsingEcdsaStaticCipher(boolean foundUsingEcdsaStaticCipher) {
68-
this.foundUsingEcdsaStaticCipher = foundUsingEcdsaStaticCipher;
76+
for (CipherSuite cipherSuite : cipherSuites) {
77+
if (AlgorithmResolver.getKeyExchangeAlgorithm(cipherSuite) == KeyExchangeAlgorithm.ECDH_ECDSA) {
78+
return true;
79+
}
80+
}
81+
return false;
6982
}
7083

7184
public boolean isFoundUsingEcdsaEphemeralCipher() {
72-
return foundUsingEcdsaEphemeralCipher;
73-
}
74-
75-
public void setFoundUsingEcdsaEphemeralCipher(boolean foundUsingEcdsaEphemeralCipher) {
76-
this.foundUsingEcdsaEphemeralCipher = foundUsingEcdsaEphemeralCipher;
85+
for (CipherSuite cipherSuite : cipherSuites) {
86+
if (AlgorithmResolver.getKeyExchangeAlgorithm(cipherSuite) == KeyExchangeAlgorithm.ECDHE_ECDSA) {
87+
return true;
88+
}
89+
}
90+
return false;
7791
}
7892

7993
public void setEcdsaPkGroupStatic(NamedGroup ecdsaPkGroupStatic) {
@@ -92,4 +106,12 @@ public void setEcdsaSigGroupEphemeral(NamedGroup ecdsaSigGroupEphemeral) {
92106
this.ecdsaSigGroupEphemeral = ecdsaSigGroupEphemeral;
93107
}
94108

109+
public Set<CipherSuite> getCipherSuites() {
110+
return cipherSuites;
111+
}
112+
113+
public void setCipherSuites(Set<CipherSuite> cipherSuites) {
114+
this.cipherSuites = cipherSuites;
115+
}
116+
95117
}

‎TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/SiteReportPrinter.java

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040
import de.rub.nds.tlsscanner.serverscanner.probe.handshakeSimulation.SimulatedClientResult;
4141
import de.rub.nds.tlsscanner.serverscanner.probe.invalidCurve.InvalidCurveResponse;
4242
import de.rub.nds.tlsscanner.serverscanner.probe.mac.CheckPattern;
43+
import de.rub.nds.tlsscanner.serverscanner.probe.namedcurve.NamedCurveWitness;
4344
import de.rub.nds.tlsscanner.serverscanner.probe.padding.KnownPaddingOracleVulnerability;
4445
import de.rub.nds.tlsscanner.serverscanner.probe.padding.PaddingOracleStrength;
4546
import de.rub.nds.tlsscanner.serverscanner.rating.PropertyResultRatingInfluencer;
@@ -68,6 +69,7 @@
6869
import java.util.LinkedHashMap;
6970
import java.util.LinkedList;
7071
import java.util.List;
72+
import java.util.Map;
7173
import java.util.Objects;
7274
import java.util.concurrent.TimeUnit;
7375
import javax.xml.bind.JAXBException;
@@ -1572,7 +1574,32 @@ public StringBuilder appendCurves(StringBuilder builder) {
15721574
prettyAppendHeading(builder, "Supported Named Groups");
15731575
if (report.getSupportedNamedGroups().size() > 0) {
15741576
for (NamedGroup group : report.getSupportedNamedGroups()) {
1575-
builder.append(group.name()).append("\n");
1577+
builder.append(group.name());
1578+
if (detail == ScannerDetail.ALL) {
1579+
builder.append("\n Found using:");
1580+
NamedCurveWitness witness = report.getSupportedNamedGroupsWitnesses().get(group);
1581+
for (CipherSuite cipher : witness.getCipherSuites()) {
1582+
builder.append("\n ").append(cipher.toString());
1583+
}
1584+
builder.append("\n ECDSA Required Groups:");
1585+
if (witness.getEcdsaPkGroupEphemeral() != null && witness.getEcdsaPkGroupEphemeral() != group) {
1586+
builder.append("\n ").append(witness.getEcdsaPkGroupEphemeral())
1587+
.append(" (Ephemeral Certificate Public Key)");
1588+
}
1589+
if (witness.getEcdsaSigGroupEphemeral() != null && witness.getEcdsaSigGroupEphemeral() != group) {
1590+
builder.append("\n ").append(witness.getEcdsaSigGroupEphemeral())
1591+
.append(" (Ephemeral Certificate Signature)");
1592+
}
1593+
if (witness.getEcdsaPkGroupStatic() != null && witness.getEcdsaPkGroupStatic() != group) {
1594+
builder.append("\n ").append(witness.getEcdsaPkGroupStatic())
1595+
.append(" (Static Certificate Public Key)");
1596+
}
1597+
if (witness.getEcdsaSigGroupStatic() != null && witness.getEcdsaSigGroupStatic() != group) {
1598+
builder.append("\n ").append(witness.getEcdsaSigGroupStatic())
1599+
.append(" (Static Certificate Signature)");
1600+
}
1601+
}
1602+
builder.append("\n");
15761603
}
15771604
if (report.getResult(AnalyzedProperty.GROUPS_DEPEND_ON_CIPHER) == TestResult.TRUE) {
15781605
prettyAppend(builder, "Not all Groups are supported for all Cipher Suites");

0 commit comments

Comments
 (0)