Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-01-06 00:39:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #461 from dcooper16/tls_sockets_and_no_SNI

Browse Source 
Fix tls_sockets() when SNI empty
This commit is contained in:
Dirk Wetter 2016-09-02 08:50:35 +02:00 committed by GitHub
commit caec8029f2
1 changed files with 27 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
testssl.sh
View File

@ -5747,20 +5747,22 @@ socksend_tls_clienthello() {
fi fi
done done
#formatted example for SNI if [[ -n "$SNI" ]]; then
#00 00 # extension server_name #formatted example for SNI
#00 1a # length = the following +2 = server_name length + 5 #00 00 # extension server_name
#00 18 # server_name list_length = server_name length +3 #00 1a # length = the following +2 = server_name length + 5
#00 # server_name type (hostname) #00 18 # server_name list_length = server_name length +3
#00 15 # server_name length #00 # server_name type (hostname)
#66 66 66 66 66 66 2e 66 66 66 66 66 66 66 66 66 66 2e 66 66 66 target.mydomain1.tld # server_name target #00 15 # server_name length
len_servername=${#NODE} #66 66 66 66 66 66 2e 66 66 66 66 66 66 66 66 66 66 2e 66 66 66 target.mydomain1.tld # server_name target
hexdump_format_str="$len_servername/1 \"%02x,\"" len_servername=${#NODE}
servername_hexstr=$(printf $NODE | hexdump -v -e "${hexdump_format_str}" | sed 's/,$//') hexdump_format_str="$len_servername/1 \"%02x,\""
# convert lengths we need to fill in from dec to hex: servername_hexstr=$(printf $NODE | hexdump -v -e "${hexdump_format_str}" | sed 's/,$//')
len_servername_hex=$(printf "%02x\n" $len_servername) # convert lengths we need to fill in from dec to hex:
len_sni_listlen=$(printf "%02x\n" $((len_servername+3))) len_servername_hex=$(printf "%02x\n" $len_servername)
len_sni_ext=$(printf "%02x\n" $((len_servername+5))) len_sni_listlen=$(printf "%02x\n" $((len_servername+3)))
len_sni_ext=$(printf "%02x\n" $((len_servername+5)))
fi
extension_signature_algorithms=" extension_signature_algorithms="
00, 0d, # Type: signature_algorithms , see RFC 5246 00, 0d, # Type: signature_algorithms , see RFC 5246
@ -5790,16 +5792,20 @@ socksend_tls_clienthello() {
01, 00" 01, 00"
all_extensions=" all_extensions="
00, 00 # extension server_name $extension_heartbeat
,00, $len_sni_ext # length SNI EXT
,00, $len_sni_listlen # server_name list_length
,00 # server_name type (hostname)
,00, $len_servername_hex # server_name length. We assume len(hostname) < FF - 9
,$servername_hexstr # server_name target
,$extension_heartbeat
,$extension_session_ticket ,$extension_session_ticket
,$extension_next_protocol" ,$extension_next_protocol"
if [[ -n "$SNI" ]]; then
all_extensions="$all_extensions
,00, 00 # extension server_name
,00, $len_sni_ext # length SNI EXT
,00, $len_sni_listlen # server_name list_length
,00 # server_name type (hostname)
,00, $len_servername_hex # server_name length. We assume len(hostname) < FF - 9
,$servername_hexstr" # server_name target
fi
# RFC 5246 says that clients MUST NOT offer the signature algorithms # RFC 5246 says that clients MUST NOT offer the signature algorithms
# extension if they are offering TLS versions prior to 1.2. # extension if they are offering TLS versions prior to 1.2.
if [[ "0x$tls_low_byte" -ge "0x03" ]]; then if [[ "0x$tls_low_byte" -ge "0x03" ]]; then