Skip to content

Commit 6c555f4

Browse files
drwetterdrwetter
committed
Addressing lame DNS responses on WSL (3.0)
This commit provides a global variable to the RFC 6761 use of "invalid." which WSL clients don't seem to handle very well, see #1738, #1812. "invalid." is used as a target to find out in a couple of pre-checks what is supported by the openssl version. This PR reduces the number of ``openssl s_client -connect`` by a huge factor. For the remaining invocations the OS used is being determined and if WSL is assumed (the check is probably not 100% accurate) it uses ``127.0.0.1:0`` instead. In (unfortunately only a few) pre-tests the response was immediate. Also it is possible to use another target if needed by NXCONNECT=<mytargethere>:<myport> ./testssl.sh <URL> This is for 3.0. For 3.1dev see #1988 .
1 parent 136b941 commit 6c555f4

1 file changed

Lines changed: 37 additions & 68 deletions

File tree

‎testssl.sh‎

Lines changed: 37 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ FNAME=${FNAME:-""} # file name to read commands from
220220
FNAME_PREFIX=${FNAME_PREFIX:-""} # output filename prefix, see --outprefix
221221
APPEND=${APPEND:-false} # append to csv/json file instead of overwriting it
222222
[[ -z "$NODNS" ]] && declare NODNS # If unset it does all DNS lookups per default. "min" only for hosts or "none" at all
223+
NXCONNECT=${NXCONNECT:-invalid.} # For WSL this helps avoiding DNS requests to "invalid." which windows seem to handle delayed
223224
HAS_IPv6=${HAS_IPv6:-false} # if you have OpenSSL with IPv6 support AND IPv6 networking set it to yes
224225
ALL_CLIENTS=${ALL_CLIENTS:-false} # do you want to run all client simulation form all clients supplied by SSLlabs?
225226
OFFENSIVE=${OFFENSIVE:-true} # do you want to include offensive vulnerability tests which may cause blocking by an IDS?
@@ -4790,11 +4791,13 @@ run_client_simulation() {
47904791
return $ret
47914792
}
47924793

4793-
# generic function whether $1 is supported by s_client ($2: string to display, currently nowhere being used)
4794+
# generic function whether $1 is supported by s_client ($2: string to display)
4795+
# Currently only used for protocols that's why we saved -connect $NXCONNECT.
4796+
#TODO: we need to consider to remove the two instances from where this is called.
47944797
#
47954798
locally_supported() {
47964799
[[ -n "$2" ]] && out "$2 "
4797-
if $OPENSSL s_client "$1" -connect invalid. 2>&1 | grep -aiq "unknown option"; then
4800+
if $OPENSSL s_client "$1" 2>&1 | grep -aiq "unknown option"; then
47984801
prln_local_problem "$OPENSSL doesn't support \"s_client $1\""
47994802
return 7
48004803
fi
@@ -4814,9 +4817,9 @@ locally_supported() {
48144817
run_prototest_openssl() {
48154818
local -i ret=0
48164819
local protos proto
4820+
local passed_check=false
48174821

4818-
# check whether the protocol being tested is supported by $OPENSSL
4819-
$OPENSSL s_client "$1" -connect invalid. 2>&1 | grep -aiq "unknown option" && return 7
4822+
$OPENSSL s_client "$1" 2>&1 | grep -aiq "unknown option" && return 7
48204823
case "$1" in
48214824
-ssl2) protos="-ssl2" ;;
48224825
-ssl3) protos="-ssl3" ;;
@@ -4825,6 +4828,8 @@ run_prototest_openssl() {
48254828
-tls1_2) protos="-no_ssl2"; "$HAS_TLS13" && protos+=" -no_tls1_3" ;;
48264829
-tls1_3) protos="" ;;
48274830
esac
4831+
4832+
#FIXME: we have here HAS_SSL(2|3) and more but we don't use that
48284833
$OPENSSL s_client $(s_client_options "-state $protos $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI") >$TMPFILE 2>&1 </dev/null
48294834
sclient_connect_successful $? $TMPFILE
48304835
ret=$?
@@ -16921,6 +16926,8 @@ find_openssl_binary() {
1692116926
elif [[ -e "/mnt/c/Windows/System32/bash.exe" ]] && test_openssl_suffix "$(dirname "$(type -p openssl)")"; then
1692216927
# 2. otherwise, only if on Bash on Windows, use system binaries only.
1692316928
SYSTEM2="WSL"
16929+
# Workaround for delayed responses of Windows DNS when using "invalid.", see #1738, #1812.
16930+
[[ $NXCONNECT == invalid. ]] && NXCONNECT=127.0.0.1:0
1692416931
elif test_openssl_suffix "$TESTSSL_INSTALL_DIR"; then
1692516932
: # 3. otherwise try openssl in path of testssl.sh
1692616933
elif test_openssl_suffix "$TESTSSL_INSTALL_DIR/bin"; then
@@ -17015,92 +17022,54 @@ find_openssl_binary() {
1701517022

1701617023
# This and all other occurrences we do a little trick using "invalid." to avoid plain and
1701717024
# link level DNS lookups. See issue #1418 and https://tools.ietf.org/html/rfc6761#section-6.4
17018-
$OPENSSL s_client -ssl2 -connect invalid. 2>&1 | grep -aiq "unknown option" || \
17019-
HAS_SSL2=true
17020-
17021-
$OPENSSL s_client -ssl3 -connect invalid. 2>&1 | grep -aiq "unknown option" || \
17022-
HAS_SSL3=true
17023-
17024-
$OPENSSL s_client -tls1_3 -connect invalid. 2>&1 | grep -aiq "unknown option" || \
17025-
HAS_TLS13=true
17026-
17027-
$OPENSSL genpkey -algorithm X448 2>&1 | grep -aq "not found" || \
17028-
HAS_X448=true
17029-
17030-
$OPENSSL genpkey -algorithm X25519 2>&1 | grep -aq "not found" || \
17031-
HAS_X25519=true
1703217025

17033-
$OPENSSL s_client -no_ssl2 -connect invalid. 2>&1 | grep -aiq "unknown option" || \
17034-
HAS_NO_SSL2=true
17026+
$OPENSSL s_client -ssl2 2>&1 | grep -aiq "unknown option" || HAS_SSL2=true
17027+
$OPENSSL s_client -ssl3 2>&1 | grep -aiq "unknown option" || HAS_SSL3=true
17028+
$OPENSSL s_client -tls1_3 2>&1 | grep -aiq "unknown option" || HAS_TLS13=true
17029+
$OPENSSL s_client -no_ssl2 2>&1 | grep -aiq "unknown option" || HAS_NO_SSL2=true
1703517030

17036-
$OPENSSL s_client -noservername -connect invalid. 2>&1 | grep -aiq "unknown option" || \
17037-
HAS_NOSERVERNAME=true
17031+
$OPENSSL genpkey -algorithm X448 2>&1 | grep -aq "not found" || HAS_X448=true
17032+
$OPENSSL genpkey -algorithm X25519 2>&1 | grep -aq "not found" || HAS_X25519=true
1703817033

17039-
$OPENSSL s_client -ciphersuites -connect invalid. 2>&1 | grep -aiq "unknown option" || \
17040-
HAS_CIPHERSUITES=true
17034+
$OPENSSL pkey -help 2>&1 | grep -q Error || HAS_PKEY=true
17035+
$OPENSSL pkeyutl 2>&1 | grep -q Error || HAS_PKUTIL=true
1704117036

17042-
$OPENSSL s_client -comp -connect invalid. 2>&1 | grep -aiq "unknown option" || \
17043-
HAS_COMP=true
17037+
$OPENSSL s_client -noservername 2>&1 | grep -aiq "unknown option" || HAS_NOSERVERNAME=true
17038+
$OPENSSL s_client -ciphersuites 2>&1 | grep -aiq "unknown option" || HAS_CIPHERSUITES=true
1704417039

17045-
$OPENSSL s_client -no_comp -connect invalid. 2>&1 | grep -aiq "unknown option" || \
17046-
HAS_NO_COMP=true
17040+
$OPENSSL s_client -comp 2>&1 | grep -aiq "unknown option" || HAS_COMP=true
17041+
$OPENSSL s_client -no_comp 2>&1 | grep -aiq "unknown option" || HAS_NO_COMP=true
1704717042

1704817043
OPENSSL_NR_CIPHERS=$(count_ciphers "$(actually_supported_osslciphers 'ALL:COMPLEMENTOFALL' 'ALL')")
1704917044

17050-
if $OPENSSL s_client -curves "${curves_ossl[0]}" -connect invalid. 2>&1 | grep -aiq "unknown option"; then
17045+
if $OPENSSL s_client -curves "${curves_ossl[0]}" -connect $NXCONNECT 2>&1 | grep -aiq "unknown option"; then
1705117046
for curve in "${curves_ossl[@]}"; do
17052-
$OPENSSL s_client -groups $curve -connect invalid.:8443 2>&1 | grep -Eiaq "Error with command|unknown option|Failed to set groups"
17047+
$OPENSSL s_client -groups $curve -connect ${NXCONNECT%:*}:8443 2>&1 | grep -Eiaq "Error with command|unknown option|Failed to set groups"
1705317048
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
1705417049
done
1705517050
else
1705617051
HAS_CURVES=true
1705717052
for curve in "${curves_ossl[@]}"; do
17058-
$OPENSSL s_client -curves $curve -connect invalid. 2>&1 | grep -Eiaq "Error with command|unknown option"
17053+
$OPENSSL s_client -curves $curve -connect $NXCONNECT 2>&1 | grep -Eiaq "Error with command|unknown option"
1705917054
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
1706017055
done
1706117056
fi
1706217057

17063-
$OPENSSL pkey -help 2>&1 | grep -q Error || \
17064-
HAS_PKEY=true
17065-
17066-
$OPENSSL pkeyutl 2>&1 | grep -q Error || \
17067-
HAS_PKUTIL=true
17068-
1706917058
# For the following we feel safe enough to query the s_client help functions.
1707017059
# That was not good enough for the previous lookups
1707117060
$OPENSSL s_client -help 2>$s_client_has
17061+
grep -qw '\-alpn' $s_client_has && HAS_ALPN=true
17062+
grep -qw '\-nextprotoneg' $s_client_has && HAS_NPN=true
17063+
grep -qw '\-fallback_scsv' $s_client_has && HAS_FALLBACK_SCSV=true
17064+
grep -q '\-proxy' $s_client_has && HAS_PROXY=true
17065+
grep -q '\-xmpp' $s_client_has && HAS_XMPP=true
1707217066

1707317067
$OPENSSL s_client -starttls foo 2>$s_client_starttls_has
17074-
17075-
grep -qw '\-alpn' $s_client_has && \
17076-
HAS_ALPN=true
17077-
17078-
grep -qw '\-nextprotoneg' $s_client_has && \
17079-
HAS_NPN=true
17080-
17081-
grep -qw '\-fallback_scsv' $s_client_has && \
17082-
HAS_FALLBACK_SCSV=true
17083-
17084-
grep -q '\-proxy' $s_client_has && \
17085-
HAS_PROXY=true
17086-
17087-
grep -q '\-xmpp' $s_client_has && \
17088-
HAS_XMPP=true
17089-
17090-
grep -q 'postgres' $s_client_starttls_has && \
17091-
HAS_POSTGRES=true
17092-
17093-
grep -q 'mysql' $s_client_starttls_has && \
17094-
HAS_MYSQL=true
17095-
17096-
grep -q 'lmtp' $s_client_starttls_has && \
17097-
HAS_LMTP=true
17098-
17099-
grep -q 'nntp' $s_client_starttls_has && \
17100-
HAS_NNTP=true
17101-
17102-
grep -q 'irc' $s_client_starttls_has && \
17103-
HAS_IRC=true
17068+
grep -q 'postgres' $s_client_starttls_has && HAS_POSTGRES=true
17069+
grep -q 'mysql' $s_client_starttls_has && HAS_MYSQL=true
17070+
grep -q 'lmtp' $s_client_starttls_has && HAS_LMTP=true
17071+
grep -q 'nntp' $s_client_starttls_has && HAS_NNTP=true
17072+
grep -q 'irc' $s_client_starttls_has && HAS_IRC=true
1710417073

1710517074
$OPENSSL enc -chacha20 -K 12345678901234567890123456789012 -iv 01000000123456789012345678901234 > /dev/null 2> /dev/null <<< "test"
1710617075
[[ $? -eq 0 ]] && HAS_CHACHA20=true
@@ -18472,7 +18441,7 @@ determine_optimal_proto() {
1847218441
elif "$all_failed" && ! "$ALL_FAILED_SOCKETS"; then
1847318442
if ! "$HAS_TLS13" && "$TLS13_ONLY"; then
1847418443
pr_magenta " $NODE:$PORT appears to support TLS 1.3 ONLY. You better use --openssl=<path_to_openssl_supporting_TLS_1.3>"
18475-
if ! "$OSSL_SHORTCUT" || [[ ! -x /usr/bin/openssl ]] || /usr/bin/openssl s_client -tls1_3 -connect invalid. 2>&1 | grep -aiq "unknown option"; then
18444+
if ! "$OSSL_SHORTCUT" || [[ ! -x /usr/bin/openssl ]] || /usr/bin/openssl s_client -tls1_3 2>&1 | grep -aiq "unknown option"; then
1847618445
outln
1847718446
ignore_no_or_lame " Type \"yes\" to proceed and accept all scan problems" "yes"
1847818447
[[ $? -ne 0 ]] && exit $ERR_CLUELESS

0 commit comments

Comments
 (0)