Skip to content

Commit 3aae8c4

Browse files
ic0nsic0ns
authored
Merge pull request #446 from RUB-NDS/falsepositive_fix
Falsepositive fix
2 parents 5b87840 + 99af5aa commit 3aae8c4

File tree

8 files changed

+91
-11
lines changed

8 files changed

+91
-11
lines changed

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/impl/PaddingOracleAttacker.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import de.rub.nds.tlsattacker.core.workflow.WorkflowExecutor;
3434
import de.rub.nds.tlsattacker.core.workflow.WorkflowExecutorFactory;
3535
import de.rub.nds.tlsattacker.core.workflow.WorkflowTrace;
36+
import de.rub.nds.tlsattacker.core.workflow.action.GenericReceiveAction;
3637
import de.rub.nds.tlsattacker.core.workflow.action.ReceiveAction;
3738
import de.rub.nds.tlsattacker.core.workflow.action.SendAction;
3839
import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowConfigurationFactory;
@@ -72,8 +73,7 @@ public State executeTlsFlow(Record record) {
7273
sendAction.setRecords(new LinkedList<AbstractRecord>());
7374
sendAction.getRecords().add(record);
7475
trace.addTlsAction(sendAction);
75-
AlertMessage alertMessage = new AlertMessage(tlsConfig);
76-
trace.addTlsAction(new ReceiveAction(alertMessage));
76+
trace.addTlsAction(new GenericReceiveAction());
7777
tlsConfig.setWorkflowExecutorShouldClose(false);
7878
State state = new State(tlsConfig, trace);
7979

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/pkcs1/BleichenbacherWorkflowGenerator.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
import de.rub.nds.tlsattacker.core.protocol.message.FinishedMessage;
1818
import de.rub.nds.tlsattacker.core.protocol.message.RSAClientKeyExchangeMessage;
1919
import de.rub.nds.tlsattacker.core.workflow.WorkflowTrace;
20+
import de.rub.nds.tlsattacker.core.workflow.action.GenericReceiveAction;
2021
import de.rub.nds.tlsattacker.core.workflow.action.ReceiveAction;
2122
import de.rub.nds.tlsattacker.core.workflow.action.SendAction;
2223
import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowConfigurationFactory;
@@ -54,7 +55,7 @@ public static WorkflowTrace generateWorkflow(Config tlsConfig, BleichenbacherWor
5455
default:
5556
break;
5657
}
57-
trace.addTlsAction(new ReceiveAction(new AlertMessage(tlsConfig)));
58+
trace.addTlsAction(new GenericReceiveAction());
5859

5960
return trace;
6061
}

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/config/Config.java‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -405,7 +405,7 @@ public static Config createConfig(InputStream stream) {
405405
/**
406406
* If we generate ClientHello with the SignatureAndHashAlgorithm extension
407407
*/
408-
private Boolean addSignatureAndHashAlgorithmsExtension = false;
408+
private Boolean addSignatureAndHashAlgorithmsExtension = true;
409409

410410
/**
411411
* If we generate ClientHello with the SupportedVersion extension
@@ -989,6 +989,30 @@ public static Config createConfig(InputStream stream) {
989989
HashAlgorithm.SHA1));
990990
supportedSignatureAndHashAlgorithms
991991
.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.RSA, HashAlgorithm.MD5));
992+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.ECDSA,
993+
HashAlgorithm.SHA512));
994+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.ECDSA,
995+
HashAlgorithm.SHA384));
996+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.ECDSA,
997+
HashAlgorithm.SHA256));
998+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.ECDSA,
999+
HashAlgorithm.SHA224));
1000+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.ECDSA,
1001+
HashAlgorithm.SHA1));
1002+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.ECDSA,
1003+
HashAlgorithm.MD5));
1004+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.DSA,
1005+
HashAlgorithm.SHA512));
1006+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.DSA,
1007+
HashAlgorithm.SHA384));
1008+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.DSA,
1009+
HashAlgorithm.SHA256));
1010+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.DSA,
1011+
HashAlgorithm.SHA224));
1012+
supportedSignatureAndHashAlgorithms.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.DSA,
1013+
HashAlgorithm.SHA1));
1014+
supportedSignatureAndHashAlgorithms
1015+
.add(new SignatureAndHashAlgorithm(SignatureAlgorithm.DSA, HashAlgorithm.MD5));
9921016
defaultClientSupportedCompressionMethods = new LinkedList<>();
9931017
defaultClientSupportedCompressionMethods.add(CompressionMethod.NULL);
9941018
defaultServerSupportedCompressionMethods = new LinkedList<>();

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/protocol/message/ServerHelloMessage.java‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,9 +83,6 @@ public ServerHelloMessage(Config tlsConfig) {
8383
extension.getServerNameList().add(pair);
8484
addExtension(extension);
8585
}
86-
if (tlsConfig.isAddSignatureAndHashAlgrorithmsExtension() && !tlsConfig.getHighestProtocolVersion().isTLS13()) {
87-
addExtension(new SignatureAndHashAlgorithmsExtensionMessage());
88-
}
8986
if (tlsConfig.isAddKeyShareExtension()) {
9087
if (tlsConfig.getHighestProtocolVersion() != ProtocolVersion.TLS13
9188
&& tlsConfig.getHighestProtocolVersion().getMinor() < 0x17) {

‎TLS-Core/src/main/resources/default_config.xml‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,54 @@
3939
<hashAlgorithm>MD5</hashAlgorithm>
4040
<signatureAlgorithm>RSA</signatureAlgorithm>
4141
</supportedSignatureAndHashAlgorithms>
42+
<supportedSignatureAndHashAlgorithms>
43+
<hashAlgorithm>SHA512</hashAlgorithm>
44+
<signatureAlgorithm>ECDSA</signatureAlgorithm>
45+
</supportedSignatureAndHashAlgorithms>
46+
<supportedSignatureAndHashAlgorithms>
47+
<hashAlgorithm>SHA384</hashAlgorithm>
48+
<signatureAlgorithm>ECDSA</signatureAlgorithm>
49+
</supportedSignatureAndHashAlgorithms>
50+
<supportedSignatureAndHashAlgorithms>
51+
<hashAlgorithm>SHA256</hashAlgorithm>
52+
<signatureAlgorithm>ECDSA</signatureAlgorithm>
53+
</supportedSignatureAndHashAlgorithms>
54+
<supportedSignatureAndHashAlgorithms>
55+
<hashAlgorithm>SHA224</hashAlgorithm>
56+
<signatureAlgorithm>ECDSA</signatureAlgorithm>
57+
</supportedSignatureAndHashAlgorithms>
58+
<supportedSignatureAndHashAlgorithms>
59+
<hashAlgorithm>SHA1</hashAlgorithm>
60+
<signatureAlgorithm>ECDSA</signatureAlgorithm>
61+
</supportedSignatureAndHashAlgorithms>
62+
<supportedSignatureAndHashAlgorithms>
63+
<hashAlgorithm>MD5</hashAlgorithm>
64+
<signatureAlgorithm>ECDSA</signatureAlgorithm>
65+
</supportedSignatureAndHashAlgorithms>
66+
<supportedSignatureAndHashAlgorithms>
67+
<hashAlgorithm>SHA512</hashAlgorithm>
68+
<signatureAlgorithm>DSA</signatureAlgorithm>
69+
</supportedSignatureAndHashAlgorithms>
70+
<supportedSignatureAndHashAlgorithms>
71+
<hashAlgorithm>SHA384</hashAlgorithm>
72+
<signatureAlgorithm>DSA</signatureAlgorithm>
73+
</supportedSignatureAndHashAlgorithms>
74+
<supportedSignatureAndHashAlgorithms>
75+
<hashAlgorithm>SHA256</hashAlgorithm>
76+
<signatureAlgorithm>DSA</signatureAlgorithm>
77+
</supportedSignatureAndHashAlgorithms>
78+
<supportedSignatureAndHashAlgorithms>
79+
<hashAlgorithm>SHA224</hashAlgorithm>
80+
<signatureAlgorithm>DSA</signatureAlgorithm>
81+
</supportedSignatureAndHashAlgorithms>
82+
<supportedSignatureAndHashAlgorithms>
83+
<hashAlgorithm>SHA1</hashAlgorithm>
84+
<signatureAlgorithm>DSA</signatureAlgorithm>
85+
</supportedSignatureAndHashAlgorithms>
86+
<supportedSignatureAndHashAlgorithms>
87+
<hashAlgorithm>MD5</hashAlgorithm>
88+
<signatureAlgorithm>DSA</signatureAlgorithm>
89+
</supportedSignatureAndHashAlgorithms>
4290
<defaultClientSupportedCiphersuites>TLS_RSA_WITH_3DES_EDE_CBC_SHA</defaultClientSupportedCiphersuites>
4391
<defaultClientSupportedCiphersuites>TLS_RSA_WITH_AES_128_CBC_SHA</defaultClientSupportedCiphersuites>
4492
<defaultClientSupportedCiphersuites>TLS_RSA_WITH_NULL_MD5</defaultClientSupportedCiphersuites>
@@ -704,7 +752,7 @@
704752
<addHeartbeatExtension>false</addHeartbeatExtension>
705753
<addMaxFragmentLengthExtenstion>false</addMaxFragmentLengthExtenstion>
706754
<addServerNameIndicationExtension>false</addServerNameIndicationExtension>
707-
<addSignatureAndHashAlgorithmsExtension>false</addSignatureAndHashAlgorithmsExtension>
755+
<addSignatureAndHashAlgorithmsExtension>true</addSignatureAndHashAlgorithmsExtension>
708756
<addSupportedVersionsExtension>false</addSupportedVersionsExtension>
709757
<addKeyShareExtension>false</addKeyShareExtension>
710758
<addEarlyDataExtension>false</addEarlyDataExtension>

‎TLS-Core/src/test/java/de/rub/nds/tlsattacker/core/config/delegate/GeneralDelegateTest.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import de.rub.nds.tlsattacker.core.config.Config;
1313
import org.apache.commons.lang3.builder.EqualsBuilder;
1414
import org.apache.logging.log4j.Level;
15+
import org.junit.After;
1516
import static org.junit.Assert.assertFalse;
1617
import static org.junit.Assert.assertTrue;
1718
import org.junit.Before;
@@ -29,6 +30,12 @@ public void setUp() {
2930
this.jcommander = new JCommander(delegate);
3031
}
3132

33+
@After
34+
public void tearDown() {
35+
this.delegate.setLogLevel(Level.OFF);
36+
delegate.applyDelegate(Config.createConfig());
37+
}
38+
3239
/**
3340
* Test of isHelp method, of class GeneralDelegate.
3441
*/

‎TLS-Core/src/test/java/de/rub/nds/tlsattacker/core/util/CertificateFetcherTest.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,13 @@
1919
import java.security.KeyPair;
2020
import java.security.KeyStore;
2121
import java.security.PublicKey;
22+
import java.security.Security;
2223
import java.security.cert.Certificate;
2324
import java.security.cert.CertificateFactory;
2425
import java.util.Random;
2526
import org.apache.logging.log4j.LogManager;
2627
import org.apache.logging.log4j.Logger;
28+
import org.bouncycastle.jce.provider.BouncyCastleProvider;
2729
import org.junit.After;
2830
import org.junit.AfterClass;
2931
import static org.junit.Assert.assertEquals;
@@ -74,10 +76,8 @@ public static void tearDownClass() {
7476

7577
@Before
7678
public void setUp() {
79+
Security.addProvider(new BouncyCastleProvider());
7780
config = Config.createConfig();
78-
GeneralDelegate generalDelegate = new GeneralDelegate();
79-
// Setup security provider
80-
generalDelegate.applyDelegate(config);
8181
ClientDelegate clientDelegate = new ClientDelegate();
8282
clientDelegate.setHost("localhost:" + SERVER_PORT);
8383
clientDelegate.applyDelegate(config);

‎TLS-Core/src/test/java/de/rub/nds/tlsattacker/core/workflow/WorkflowTraceSerializerTest.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,7 @@ public void serializeWithSingleConnectionTest() {
129129
sb.append(" <extensions>\n");
130130
sb.append(" <ECPointFormat/>\n");
131131
sb.append(" <EllipticCurves/>\n");
132+
sb.append(" <SignatureAndHashAlgorithmsExtension/>\n");
132133
sb.append(" <RenegotiationInfoExtension/>\n");
133134
sb.append(" </extensions>\n");
134135
sb.append(" </ClientHello>\n");
@@ -176,6 +177,7 @@ public void serializeWithSingleCustomConnectionTest() {
176177
sb.append(" <extensions>\n");
177178
sb.append(" <ECPointFormat/>\n");
178179
sb.append(" <EllipticCurves/>\n");
180+
sb.append(" <SignatureAndHashAlgorithmsExtension/>\n");
179181
sb.append(" <RenegotiationInfoExtension/>\n");
180182
sb.append(" </extensions>\n");
181183
sb.append(" </ClientHello>\n");
@@ -235,6 +237,7 @@ public void serializeWithMultipleCustomConnectionTest() {
235237
sb.append(" <extensions>\n");
236238
sb.append(" <ECPointFormat/>\n");
237239
sb.append(" <EllipticCurves/>\n");
240+
sb.append(" <SignatureAndHashAlgorithmsExtension/>\n");
238241
sb.append(" <RenegotiationInfoExtension/>\n");
239242
sb.append(" </extensions>\n");
240243
sb.append(" </ClientHello>\n");

0 commit comments

Comments
 (0)