Skip to content

Commit 696ec07

Browse files
drwetterdrwetter
committed
Start working on a set of new binaries
* Update Readme * Remove Kerberos binary (will go to https://testssl.sh/) * Remove other old files
1 parent 9807bc3 commit 696ec07

5 files changed

Lines changed: 12 additions & 938 deletions

File tree

‎bin/Readme.md‎

Lines changed: 12 additions & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -2,135 +2,30 @@
22
Binaries
33
========
44

5-
All the precompiled binaries provided here have extended support for
6-
everything which is normally not in OpenSSL or LibreSSL -- 40+56 Bit,
7-
export/ANON ciphers, weak DH ciphers, weak EC curves, SSLv2 etc. -- all the dirty
8-
features needed for testing. OTOH they also come with extended support
9-
for some new / advanced cipher suites and/or features which are not in the
10-
official branch like (old version of the) CHACHA20+POLY1305 and CAMELLIA 256 bit ciphers.
5+
All the precompiled binaries provided here have extended support for weak crypto which is normally not in OpenSSL or LibreSSL: 40+56 Bit,
6+
export/ANON ciphers, weak DH ciphers, weak EC curves, SSLv2 etc. -- all the dirty features needed for testing if you just want to test with
7+
binaries. They also come with extended support for some new / advanced cipher suites and/or features which are not in the official branch like (old version of the) CHACHA20+POLY1305 and CAMELLIA 256 bit ciphers.
118

12-
The (stripped) binaries this directory are all compiled from my openssl snapshot
13-
(https://github.com/testssl/openssl-1.0.2.bad) which adds a few bits to Peter
14-
Mosman's openssl fork (https://github.com/PeterMosmans/openssl). Thx a bunch, Peter!
15-
The few bits are IPv6 support (except IPV6 proxy) and some STARTTLS backports.
9+
However testssl.sh has emerged, and some time back it is using bash sockets for checks if the binary does not support a specific feature. So since then you could also use the OpenSSL / LibreSSL binary from your vendor. Check using binaries instead of bash sockets run a bit faster though. Also the usage of these binaries became more and more of a limited value:They don't support e.g. TLS 1.3 and newer TLS 1.2 ciphers. OTOH servers which only offer SSLv2 and SSLv3 became less common and we use for the majority of checks in testssl.sh sockets and not this binary. As a result the 3.2 release will probably be the last distribution where we will include these binaries.
1610

17-
Compiled Linux and FreeBSD binaries so far come from Dirk, other
18-
contributors see ../CREDITS.md .
11+
# Security notices
1912

20-
The binaries here have the naming scheme ``openssl.$(uname).$(uname -m)``
21-
and will be picked up from testssl.sh if you run testssl.sh directly
22-
off the git directory. Otherwise you need ``testssl.sh`` to point to it
23-
via the argument (``--openssl=<here>``) or as an environment variable
24-
(``OPENSSL=<here> testssl.sh <yourargs>``).
13+
The important thing upfront: **DO NOT USE THESE BINARIES FOR PRODUCTION PUPOSES**. A lot of security restrictions have been removed because we want to test how bad the servers are.
2514

26-
The Linux binaries with the trailing ``-krb5`` come with Kerberos 5 support,
27-
they won't be picked up automatically as you need to make sure first they
28-
run (see libraries below).
2915

30-
Because I didn't want blow up the repo and waste disk spaces for others
31-
there are more binaries for other aerchitectures (ARM7l, Darwin.i386, ..
32-
here: https://testssl.sh/openssl-1.0.2k-chacha.pm.ipv6.Linux+FreeBSD.tar.gz
33-
and older ones here: https://testssl.sh/openssl-1.0.2i-chacha.pm.ipv6.contributed/ .
34-
35-
As there is not darwin64-arm64-cc in the old branch there is not binary for
36-
that architecture either. (FYI: patch isn't big but isn't easy to backport).
37-
38-
39-
In general the usage of this binaries became more and more of a limited
40-
value: It doesn't support e.g. TLS 1.3 and newer TLS 1.2 ciphers. OTOH servers
41-
which only offer SSLv2 and SSLv3 became less common and we use for the
42-
majority of checks in testssl.sh sockets and not this binary.
43-
44-
45-
Compiling and Usage Instructions
46-
================================
16+
More
17+
====
4718

4819
General
4920
-------
21+
The (stripped) binaries this directory are all compiled from the [old OpenSSL snapshot](https://github.com/testssl/openssl-1.0.2.bad) which adds a few bits to [Peter
22+
Mosman's openssl fork](https://github.com/PeterMosmans/openssl). The few bits are IPv6 support (except IPV6 proxy) and some STARTTLS backports. More, see the [README.md](https://github.com/testssl/openssl-1.0.2.bad/README.md) .
5023

51-
Both 64+32 bit Linux binaries were compiled under Ubuntu 12.04 LTS(!). Likely you
52-
cannot use them for older distributions, younger worked in all my test environments
53-
(like Debian 11 and OpenSuse Tumbleweed on Q3/2022).
54-
55-
I provide two sets of binaries:
56-
57-
* completely statically linked binaries
58-
* dynamically linked binaries, additionally with MIT Kerberos support ("krb5" in the name).
59-
They provide also KRB5-* and EXP-KRB5-* support (in OpenSSL terminology, see krb5-ciphers.txt).
60-
61-
For the latter you need a whopping bunch of kerberos runtime libraries which you maybe need to
62-
install from your distributor (libgssapi_krb5, libkrb5, libcom_err, libk5crypto, libkrb5support,
63-
libkeyutils). Despite the fact it's 2022 the openssl kerberos binary still works when compiled
64-
non-statically on a legacy VM. I didn't bother use static kerberos libs as they need to be
65-
compiled from source.
24+
Compiled Linux and FreeBSD binaries so far came from Dirk, other contributors see ../CREDITS.md . Binaries for more architectures see [contributed builds @ https://testssl.sh/](https://testssl.sh/contributed_binaries/).
6625

6726

6827
Compilation instructions
6928
------------------------
7029

71-
If you want to compile OpenSSL yourself, here are the instructions:
72-
73-
1.)
74-
git git clone https://github.com/testssl/openssl-1.0.2-bad
75-
cd openssl
76-
77-
78-
2.) configure the damned thing. Options I used (see https://github.com/testssl/testssl.sh/blob/master/utils/make-openssl.sh)
79-
80-
**for 64Bit including Kerberos ciphers:**
81-
82-
./config --prefix=/usr/ --openssldir=/etc/ssl enable-zlib enable-ssl2 enable-rc5 enable-rc2 \
83-
enable-GOST enable-cms enable-md2 enable-mdc2 enable-ec enable-ec2m enable-ecdh enable-ecdsa \
84-
enable-seed enable-camellia enable-idea enable-rfc3779 enable-ec_nistp_64_gcc_128 \
85-
--with-krb5-flavor=MIT experimental-jpake -DOPENSSL_USE_BUILD_DATE
86-
87-
**for 64Bit, static binaries:**
88-
89-
./config --prefix=/usr/ --openssldir=/etc/ssl enable-zlib enable-ssl2 enable-rc5 enable-rc2 \
90-
enable-GOST enable-cms enable-md2 enable-mdc2 enable-ec enable-ec2m enable-ecdh enable-ecdsa \
91-
enable-seed enable-camellia enable-idea enable-rfc3779 enable-ec_nistp_64_gcc_128 \
92-
-static experimental-jpake -DOPENSSL_USE_BUILD_DATE
93-
94-
**for 32 Bit including Kerberos ciphers:**
95-
96-
./config --prefix=/usr/ --openssldir=/etc/ssl enable-zlib enable-ssl2 enable-rc5 enable-rc2 \
97-
enable-GOST enable-cms enable-md2 enable-mdc2 enable-ec enable-ec2m enable-ecdh enable-ecdsa \
98-
enable-seed enable-camellia enable-idea enable-rfc3779 no-ec_nistp_64_gcc_128 \
99-
--with-krb5-flavor=MIT experimental-jpake -DOPENSSL_USE_BUILD_DATE
100-
101-
**for 32 Bit, static binaries:**
102-
103-
./config --prefix=/usr/ --openssldir=/etc/ssl enable-zlib enable-ssl2 enable-rc5 enable-rc2 \
104-
enable-GOST enable-cms enable-md2 enable-mdc2 enable-ec enable-ec2m enable-ecdh enable-ecdsa \
105-
enable-seed enable-camellia enable-idea enable-rfc3779 no-ec_nistp_64_gcc_128 \
106-
-static experimental-jpake -DOPENSSL_USE_BUILD_DATE
107-
108-
Four GOST [1][2] ciphers come via engine support automagically with this setup. Two additional GOST
109-
ciphers can be compiled in (``GOST-GOST94``, ``GOST-MD5``) with ``-DTEMP_GOST_TLS`` but as of now they make
110-
problems under some circumstances, so unless you desperately need those ciphers I would stay away from
111-
``-DTEMP_GOST_TLS``.
112-
113-
If you don't have / don't want Kerberos libraries and devel rpms/debs, just omit "--with-krb5-flavor=MIT"
114-
(see examples). If you have another Kerberos flavor you would need to figure out by yourself.
115-
116-
3.) make depend
117-
118-
4.) make
119-
120-
5.) make report (check whether it runs ok!)
121-
122-
6.) ``./apps/openssl ciphers -V 'ALL:COMPLEMENTOFALL' | wc -l`` lists for me
123-
* 193(+4 GOST) ciphers including kerberos
124-
* 179(+4 GOST) ciphers without kerberos
125-
126-
as opposed to ~162 from Ubuntu or Opensuse. Note that newer distributions provide
127-
newer ciphers which this old openssl-1.0.2-bad doesn't have. OTOH openssl-1.0.2-bad
128-
has a lot of legacy ciphers and protocols enabled which newer binaries don't have.
129-
130-
**Never use these binaries for anything other than testing!**
131-
132-
Enjoy, Dirk
133-
134-
[1] https://en.wikipedia.org/wiki/GOST_%29block_cipher%29
30+
See [https://github.com/testssl/openssl-1.0.2.bad/README.md](https://github.com/testssl/openssl-1.0.2.bad/README.md)
13531

136-
[2] http://fossies.org/linux/openssl/engines/ccgost/README.gost

0 commit comments

Comments
 (0)