Repository navigation
Handshake error keeps an openssl command for a 47-byte IPv6 address after every TLS alert (#38) - #41
Merged
Merged
Conversation
…fter every TLS alert (#38) When the openssl commands in the error for a scan that completed no handshake do not all fit in the 500 bytes the CLI prints, the error names the key exchange groups this scanner does not offer and the cipher suites the handshake lacks in one sentence, then gives the commands that fit whole. Under GODEBUG=fips140=on,tlsmlkem=0, where the scanner offers none of the three hybrid groups, that sentence left no room for a command for the address [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]:65535 after alert 113 (bad certificate status response) or alert 121 (encrypted client hello required): the first command would have ended at byte 501, so the 350-byte error gave none. The cipher suites in that sentence are now introduced with "like" instead of "such as", which takes 3 bytes off it. After alert 113 the error for that address is 498 bytes and ends with the command for X25519MLKEM768. The wording of an error whose commands all fit is not changed. TestAHandshakeFailureKeepsACommandForA47ByteIPv6Address builds the error for three 47-byte IPv6 addresses after each of the 256 alert values, io.EOF and io.ErrUnexpectedEOF. It fails 6 times on the earlier code, after alerts 113 and 121 for each address, and passes with this change. Fixes #38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request lands 1 commit in internal/scanner.
Included
Verified on this exact tree
git ls-files --others -- '*_test.go': no output (git ls-files -- '*_test.go' | wc -l: 102)go mod verify:all modules verifiedgo build ./...: exit 0go vet ./...: exit 0gofmt -s -l .: 0 files listedgolangci-lint run --timeout=5m --concurrency=4 ./...(golangci-lint 2.12.2, empty cache directory):0 issues.go test -p 4 -race -count=1 -timeout 9m -v -skip '^TestAZoneScopedLinkLocalTargetIsScanned$|^TestAnUnreachableIPv6AddressIsWrittenInBrackets$/^zone-scoped_link-local$' ./...: exit 0, 6 of 6 packagesok; 960=== RUN, 959--- PASS, 0--- FAIL, 1--- SKIP--- SKIP:TestFIPSChildScanNamesTheHybridGroupsItCannotOffer, messageruns in the child process that TestAFIPSBuildWithoutMLKEMNamesTheHybridGroupsItCannotOffer starts;TestAFIPSBuildWithoutMLKEMNamesTheHybridGroupsItCannotOffer:--- PASSTestAHandshakeFailureKeepsACommandForA47ByteIPv6Address:--- PASS-skipabove:TestAZoneScopedLinkLocalTargetIsScannedandTestAnUnreachableIPv6AddressIsWrittenInBrackets/zone-scoped_link-local, the two callers oflistenOnALinkLocalAddress(internal/scanner/zone_scoped_target_test.go:70)Not included
None
Closes
Fixes #38
How to merge
Rebase and merge, so that each change stays its own commit on
main.