Fingerprint enhancements and new fingerprints #35
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
tomato42
commented
Aug 31, 2016
•
tomato42
commented
- make servers that support ALPN not crash tls_prober (update to pytls version that supports ALPN alerts)
- make writing fingerprints to files deterministic, ease future fingerprints updates by sorting probe results by name
- sort all existing results in fingerprint files by name (will make reading diffs for fingerprints much easier)
- suggestion on how to setup GnuTLS, NSS and OpenSSL for testing (so that most settings are enabled to provide most unique fingerprint possible)
- add fingerprint for new botan (fixes Fingerprints for botan missing #28)
- add fingerprints for few recent versions of NSS (fixes Fingerprints for NSS missing #27)
- update few OpenSSL fingerprints, add new ones (should fix Mis-fingerprinting with certain OpenSSL configurations #10)
- add fingerprints from RHEL 4, RHEL 5 and RHEL 6's version of GnuTLS, NSS and OpenSSL
- add fingerprints for IIS, RDP and LDAP running on Windows 2008R2 SP1 and 2012R2 in default configuration (together with the above should fix Servers that only support DH/ECDH #14)
tomato42
changed the title
tomato42
force-pushed
the
fingerprints
branch
from
f86054e
to
78d8cd4
Compare
tomato42
changed the title
tomato42
force-pushed
the
fingerprints
branch
from
78d8cd4
to
7983a16
Compare
Merged
s/UnexpectedMesage/UnexpectedMessage/
to make diff-ing fingerprints in future easy, it's good to keep the order of probe results deterministic, so sort them alphabetically by name
to make creating easily diffable extensions of existing fingerprints sort the results of particular probes in existing figerprints command used to modify files: for file in *; do tmp="$(mktemp)" (head -n 2 "$file" && tail -n +3 "$file" | LANG=C sort -d ) > "$tmp" mv "$tmp" "$file" done
make all the fingerprints have a format of <name of the library><space><version of the library>
Change in SNIWrongName result is caused by server having a SNI host configured Note that the server was running without SRP as SRP limits the server to TLSv1.0 (see next commit)
there seems to be a serious bug in OpenSSL in this version causing it to disable TLSv1.1 and TLSv1.2 support if SRP is enabled since this causes creation of completely different probe results, create a separate fingerprint
I don't know where the differences in Heartbea and Heartbleed come from SNIWrongName is different because SNI was configured on the server note that SRP was disabled as it causes TLS1.1 and TLS1.2 to not work
1.0.2 seems to have a bug that disables TLSv1.1 and TLSv1.2 when SRP is enabled, creating completely different fingerprints for many probes
tomato42
force-pushed
the
fingerprints
branch
from
7983a16
to
32590a9
Compare
default configuration, TLSv1.2 only configuration and TLS1.0-TLS1.2 configuration
|
Thank you! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.