Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-01-10 00:02:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Mitigate inconsistent test results for ROBOT (3.2)

Browse Source 
As reported a longer while back in #2083 there were trailing bytes when receiving a TLS alert by the ROBOT check.

This PR corrects and thus normalizes the length of the TLS alert message to the correct value, supposed the length in the TLS alert is two bytes and it is an TLS alert. PR for 3.3dev was #2969 .

Also this PR now uses a separate variable for the timeout. Using a separate global variable may offer some possibility for tuning the check when the latency to the target is high. This is still subject of research.
The variable is 10 seconds here to be in line with MAX_WAITSOCK which (name) was used previously.
This commit is contained in:
Dirk Wetter
2025-12-20 13:43:06 +01:00
parent e4566796a6
commit 2ab0f3153f
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
testssl.sh
View File

@@ -207,6 +207,7 @@ MAX_HEADER_FAIL=${MAX_HEADER_FAIL:-2} # If this many failures for HTTP GET are
MAX_WAITSOCK=${MAX_WAITSOCK:-10} # waiting at max 10 seconds for socket reply. There shouldn't be any reason to change this. MAX_WAITSOCK=${MAX_WAITSOCK:-10} # waiting at max 10 seconds for socket reply. There shouldn't be any reason to change this.
CCS_MAX_WAITSOCK=${CCS_MAX_WAITSOCK:-5} # for the two CCS payload (each). There shouldn't be any reason to change this. CCS_MAX_WAITSOCK=${CCS_MAX_WAITSOCK:-5} # for the two CCS payload (each). There shouldn't be any reason to change this.
HEARTBLEED_MAX_WAITSOCK=${HEARTBLEED_MAX_WAITSOCK:-8} # for the heartbleed payload. There shouldn't be any reason to change this. HEARTBLEED_MAX_WAITSOCK=${HEARTBLEED_MAX_WAITSOCK:-8} # for the heartbleed payload. There shouldn't be any reason to change this.
ROBOT_TIMEOUT=${ROBOT_TIMEOUT:10} # Initial timeout for ROBOT check
STARTTLS_SLEEP=${STARTTLS_SLEEP:-10} # max time wait on a socket for STARTTLS. MySQL has a fixed value of 1 which can't be overwritten (#914) STARTTLS_SLEEP=${STARTTLS_SLEEP:-10} # max time wait on a socket for STARTTLS. MySQL has a fixed value of 1 which can't be overwritten (#914)
FAST_STARTTLS=${FAST_STARTTLS:-true} # at the cost of reliability decrease the handshakes for STARTTLS FAST_STARTTLS=${FAST_STARTTLS:-true} # at the cost of reliability decrease the handshakes for STARTTLS
USLEEP_SND=${USLEEP_SND:-0.1} # sleep time for general socket send USLEEP_SND=${USLEEP_SND:-0.1} # sleep time for general socket send
@@ -20400,7 +20401,7 @@ run_robot() {
local -i i subret len iteration testnum pubkeybytes local -i i subret len iteration testnum pubkeybytes
local pubkeybits local pubkeybits
local vulnerable=false send_ccs_finished=true local vulnerable=false send_ccs_finished=true
local -i start_time end_time robottimeout=$MAX_WAITSOCK local -i start_time end_time robottimeout=$ROBOT_TIMEOUT
local cve="CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168" local cve="CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168"
local cwe="CWE-203" local cwe="CWE-203"
local jsonID="ROBOT" local jsonID="ROBOT"
@@ -20571,6 +20572,11 @@ run_robot() {
end_time=$(LC_ALL=C date "+%s") end_time=$(LC_ALL=C date "+%s")
resp=$(hexdump -v -e '16/1 "%02x"' "$SOCK_REPLY_FILE") resp=$(hexdump -v -e '16/1 "%02x"' "$SOCK_REPLY_FILE")
response[testnum]="${resp%%[!0-9A-F]*}" response[testnum]="${resp%%[!0-9A-F]*}"
# TLS alert length seems to vary sometimes within this loop which leads to
# wrong test results, see #2083. Thus we cut this here to length 14, if
# it's a TLS alert with the length of 2
[[ ${response[testnum]::2} == 15 ]] && [[ ${response[testnum]:10:2} == 02 ]] &&
response[testnum]=${response[testnum]::14}
# The first time a response is received to a client key # The first time a response is received to a client key
# exchange message, measure the amount of time it took to # exchange message, measure the amount of time it took to
# receive a response and set the timeout value for future # receive a response and set the timeout value for future