diff --git a/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/CipherSuiteProbe.java b/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/CipherSuiteProbe.java index ae0853ee2..e10df2269 100644 --- a/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/CipherSuiteProbe.java +++ b/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/CipherSuiteProbe.java @@ -14,11 +14,13 @@ import de.rub.nds.tlsattacker.core.constants.CipherSuite; import de.rub.nds.tlsattacker.core.constants.ProtocolVersion; import de.rub.nds.tlsattacker.core.constants.RunningModeType; +import de.rub.nds.tlsattacker.core.protocol.message.AckMessage; import de.rub.nds.tlsattacker.core.protocol.message.FinishedMessage; import de.rub.nds.tlsattacker.core.state.State; import de.rub.nds.tlsattacker.core.workflow.ParallelExecutor; import de.rub.nds.tlsattacker.core.workflow.WorkflowTrace; import de.rub.nds.tlsattacker.core.workflow.action.ReceiveTillAction; +import de.rub.nds.tlsattacker.core.workflow.action.SendAction; import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowConfigurationFactory; import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowTraceType; import de.rub.nds.tlsscanner.clientscanner.config.ClientScannerConfig; @@ -54,7 +56,7 @@ protected void executeTest() { while (!toTestList.isEmpty()) { Config config; - if (version.isTLS13()) { + if (version.is13()) { config = getTls13Config(); } else { config = getBaseConfig(); @@ -70,6 +72,9 @@ protected void executeTest() { .createWorkflowTrace( WorkflowTraceType.HELLO, RunningModeType.SERVER); trace.addTlsAction(new ReceiveTillAction(new FinishedMessage())); + if (config.getHighestProtocolVersion().isDTLS13()) { + trace.addTlsAction(new SendAction(new AckMessage())); + } State state = new State(config, trace); statesToExecute.add(state); @@ -109,7 +114,9 @@ private Config getBaseConfig() { private Config getTls13Config() { Config config = getBaseConfig(); + config.setHighestProtocolVersion(ProtocolVersion.TLS13); config.setSupportedVersions(ProtocolVersion.TLS13); + scannerConfig.getDtlsDelegate().applyDelegate(config); config.setAddECPointFormatExtension(false); config.setAddEllipticCurveExtension(true); config.setAddSignatureAndHashAlgorithmsExtension(true); diff --git a/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/NamedGroupsProbe.java b/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/NamedGroupsProbe.java index 9564010ba..970e7e8c5 100644 --- a/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/NamedGroupsProbe.java +++ b/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/NamedGroupsProbe.java @@ -19,6 +19,7 @@ import de.rub.nds.tlsattacker.core.constants.KeyExchangeAlgorithm; import de.rub.nds.tlsattacker.core.constants.NamedGroup; import de.rub.nds.tlsattacker.core.constants.ProtocolVersion; +import de.rub.nds.tlsattacker.core.protocol.message.AckMessage; import de.rub.nds.tlsattacker.core.protocol.message.ClientHelloMessage; import de.rub.nds.tlsattacker.core.protocol.message.FinishedMessage; import de.rub.nds.tlsattacker.core.protocol.message.HandshakeMessage; @@ -31,6 +32,8 @@ import de.rub.nds.tlsattacker.core.workflow.WorkflowTraceConfigurationUtil; import de.rub.nds.tlsattacker.core.workflow.WorkflowTraceResultUtil; import de.rub.nds.tlsattacker.core.workflow.action.ReceiveAction; +import de.rub.nds.tlsattacker.core.workflow.action.SendAction; +import de.rub.nds.tlsattacker.core.workflow.action.executor.ActionOption; import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowConfigurationFactory; import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowTraceType; import de.rub.nds.tlsscanner.clientscanner.config.ClientScannerConfig; @@ -48,6 +51,7 @@ public class NamedGroupsProbe extends TlsClientProbe { private final List ffdheToTest = new LinkedList<>(); private final List advertisedKeyShareGroups = new LinkedList<>(); + private List advertisedNamedGroups; private List supportedDheCipherSuites; private List supportedEcdheCipherSuites; private List supportedTls13CipherSuites; @@ -93,6 +97,7 @@ private List getCurvesToTest() { private List getTls13GroupsToTest() { List groupList = getCurvesToTest(); NamedGroup.getImplemented().stream().filter(NamedGroup::isDhGroup).forEach(groupList::add); + groupList.retainAll(advertisedNamedGroups); return groupList; } @@ -125,6 +130,8 @@ private List getSupportedGroupsTls13( setSharedConfigFields(config, group, cipherSuites); config.setHighestProtocolVersion(ProtocolVersion.TLS13); config.setDefaultSelectedProtocolVersion(ProtocolVersion.TLS13); + config.setSupportedVersions(ProtocolVersion.TLS13); + scannerConfig.getDtlsDelegate().applyDelegate(config); config.setAddKeyShareExtension(true); config.setAddSupportedVersionsExtension(true); WorkflowTrace workflowTrace; @@ -132,7 +139,14 @@ private List getSupportedGroupsTls13( workflowTrace = new WorkflowConfigurationFactory(config) .createDynamicHelloWorkflow(config.getDefaultServerConnection()); - workflowTrace.addTlsAction(new ReceiveAction(new FinishedMessage())); + ReceiveAction receiveFinished = new ReceiveAction(new FinishedMessage()); + if (config.getHighestProtocolVersion().isDTLS13()) { + receiveFinished.addActionOption(ActionOption.IGNORE_ACK_MESSAGES); + } + workflowTrace.addTlsAction(receiveFinished); + if (config.getHighestProtocolVersion().isDTLS13()) { + workflowTrace.addTlsAction(new SendAction(new AckMessage())); + } } else { workflowTrace = new WorkflowConfigurationFactory(config) @@ -191,6 +205,7 @@ public void setSharedConfigFields( @Override public void adjustConfig(ClientReport report) { + advertisedNamedGroups = report.getClientAdvertisedNamedGroupsList(); report.getClientAdvertisedNamedGroupsList().stream() .filter(NamedGroup::isDhGroup) .forEach(ffdheToTest::add); @@ -219,6 +234,8 @@ public Requirement getRequirements() { new PropertyTrueRequirement<>( TlsAnalyzedProperty.SUPPORTS_ECDHE), new PropertyTrueRequirement<>( - TlsAnalyzedProperty.SUPPORTS_TLS_1_3)))); + TlsAnalyzedProperty.SUPPORTS_TLS_1_3), + new PropertyTrueRequirement<>( + TlsAnalyzedProperty.SUPPORTS_DTLS_1_3)))); } } diff --git a/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/ProtocolVersionProbe.java b/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/ProtocolVersionProbe.java index f135773d1..469364f11 100644 --- a/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/ProtocolVersionProbe.java +++ b/TLS-Client-Scanner/src/main/java/de/rub/nds/tlsscanner/clientscanner/probe/ProtocolVersionProbe.java @@ -17,11 +17,13 @@ import de.rub.nds.tlsattacker.core.constants.CompressionMethod; import de.rub.nds.tlsattacker.core.constants.ProtocolVersion; import de.rub.nds.tlsattacker.core.constants.RunningModeType; +import de.rub.nds.tlsattacker.core.protocol.message.AckMessage; import de.rub.nds.tlsattacker.core.protocol.message.FinishedMessage; import de.rub.nds.tlsattacker.core.state.State; import de.rub.nds.tlsattacker.core.workflow.ParallelExecutor; import de.rub.nds.tlsattacker.core.workflow.WorkflowTrace; import de.rub.nds.tlsattacker.core.workflow.action.ReceiveTillAction; +import de.rub.nds.tlsattacker.core.workflow.action.SendAction; import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowConfigurationFactory; import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowTraceType; import de.rub.nds.tlsscanner.clientscanner.config.ClientScannerConfig; @@ -45,6 +47,7 @@ public ProtocolVersionProbe(ParallelExecutor executor, ClientScannerConfig scann TlsAnalyzedProperty.SUPPORTS_DTLS_1_0_DRAFT, TlsAnalyzedProperty.SUPPORTS_DTLS_1_0, TlsAnalyzedProperty.SUPPORTS_DTLS_1_2, + TlsAnalyzedProperty.SUPPORTS_DTLS_1_3, TlsAnalyzedProperty.SUPPORTS_SSL_2, TlsAnalyzedProperty.SUPPORTS_SSL_3, TlsAnalyzedProperty.SUPPORTS_TLS_1_0, @@ -63,7 +66,7 @@ protected void executeTest() { LOGGER.debug("Testing version {}", version); Config config; - if (version.isTLS13()) { + if (version.is13()) { config = getTls13Config(); } else { config = getBaseConfig(); @@ -94,7 +97,11 @@ protected void executeTest() { private List getSuitableCipherSuites(ProtocolVersion version) { List suitableCiphersuites = clientAdvertisedCipherSuites.stream() - .filter(suite -> suite.isSupportedInProtocol(version)) + .filter( + suite -> + version.is13() + ? suite.isTls13() + : suite.isSupportedInProtocol(version)) .collect(Collectors.toList()); if (suitableCiphersuites.isEmpty()) { CipherSuite fallbackCipherSuite; @@ -122,6 +129,9 @@ private State getStateForTest(Config config, List suitableCiphersui new WorkflowConfigurationFactory(config) .createWorkflowTrace(WorkflowTraceType.HELLO, RunningModeType.SERVER); trace.addTlsAction(new ReceiveTillAction(new FinishedMessage())); + if (config.getHighestProtocolVersion().isDTLS13()) { + trace.addTlsAction(new SendAction(new AckMessage())); + } return new State(config, trace); } @@ -135,6 +145,8 @@ private Config getBaseConfig() { private Config getTls13Config() { Config config = getBaseConfig(); + config.setHighestProtocolVersion(ProtocolVersion.TLS13); + scannerConfig.getDtlsDelegate().applyDelegate(config); config.setAddRenegotiationInfoExtension(false); config.setAddECPointFormatExtension(false); config.setAddEllipticCurveExtension(true); @@ -163,6 +175,9 @@ protected void mergeData(ClientReport report) { if (version == ProtocolVersion.DTLS12) { put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_2, TestResults.TRUE); } + if (version == ProtocolVersion.DTLS13) { + put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_3, TestResults.TRUE); + } if (version == ProtocolVersion.SSL2) { put(TlsAnalyzedProperty.SUPPORTS_SSL_2, TestResults.TRUE); } @@ -193,6 +208,9 @@ protected void mergeData(ClientReport report) { if (version == ProtocolVersion.DTLS12) { put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_2, TestResults.FALSE); } + if (version == ProtocolVersion.DTLS13) { + put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_3, TestResults.FALSE); + } if (version == ProtocolVersion.SSL2) { put(TlsAnalyzedProperty.SUPPORTS_SSL_2, TestResults.FALSE); } @@ -221,6 +239,9 @@ protected void mergeData(ClientReport report) { if (!toTestList.contains(ProtocolVersion.DTLS12)) { put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_2, TestResults.COULD_NOT_TEST); } + if (!toTestList.contains(ProtocolVersion.DTLS13)) { + put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_3, TestResults.COULD_NOT_TEST); + } if (!toTestList.contains(ProtocolVersion.SSL2)) { put(TlsAnalyzedProperty.SUPPORTS_SSL_2, TestResults.COULD_NOT_TEST); @@ -254,6 +275,7 @@ public void adjustConfig(ClientReport report) { toTestList.add(ProtocolVersion.DTLS10_DRAFT); toTestList.add(ProtocolVersion.DTLS10); toTestList.add(ProtocolVersion.DTLS12); + toTestList.add(ProtocolVersion.DTLS13); } else { toTestList.add(ProtocolVersion.SSL2); toTestList.add(ProtocolVersion.SSL3); diff --git a/TLS-Scanner-Core/src/main/java/de/rub/nds/tlsscanner/core/config/delegate/DtlsDelegate.java b/TLS-Scanner-Core/src/main/java/de/rub/nds/tlsscanner/core/config/delegate/DtlsDelegate.java index ae3932dae..f9c5cef80 100644 --- a/TLS-Scanner-Core/src/main/java/de/rub/nds/tlsscanner/core/config/delegate/DtlsDelegate.java +++ b/TLS-Scanner-Core/src/main/java/de/rub/nds/tlsscanner/core/config/delegate/DtlsDelegate.java @@ -37,8 +37,13 @@ public void setDTLS(boolean dtls) { @Override public void applyDelegate(Config config) throws ConfigurationException { if (dtls) { - config.setHighestProtocolVersion(ProtocolVersion.DTLS12); - config.setDefaultSelectedProtocolVersion(ProtocolVersion.DTLS12); + ProtocolVersion version = + config.getHighestProtocolVersion().is13() + ? ProtocolVersion.DTLS13 + : ProtocolVersion.DTLS12; + config.setHighestProtocolVersion(version); + config.setDefaultSelectedProtocolVersion(version); + config.setSupportedVersions(version); if (config.getDefaultClientConnection() == null) { config.setDefaultClientConnection(new OutboundConnection()); @@ -51,7 +56,11 @@ public void applyDelegate(Config config) throws ConfigurationException { config.setDefaultLayerConfiguration(StackConfiguration.DTLS); config.setWorkflowExecutorType(WorkflowExecutorType.DTLS); - config.setFinishWithCloseNotify(true); + config.setFinishWithCloseNotify(!version.isDTLS13()); + if (version.isDTLS13()) { + config.setTls13BackwardsCompatibilityMode(false); + config.setDtlsCookieExchange(false); + } config.setIgnoreRetransmittedCssInDtls(true); config.setAddRetransmissionsToWorkflowTraceInDtls(true); } diff --git a/TLS-Scanner-Core/src/main/java/de/rub/nds/tlsscanner/core/probe/ciphersuite/CipherSuiteEvaluationHelper.java b/TLS-Scanner-Core/src/main/java/de/rub/nds/tlsscanner/core/probe/ciphersuite/CipherSuiteEvaluationHelper.java index e2bf7529e..99ac651bb 100644 --- a/TLS-Scanner-Core/src/main/java/de/rub/nds/tlsscanner/core/probe/ciphersuite/CipherSuiteEvaluationHelper.java +++ b/TLS-Scanner-Core/src/main/java/de/rub/nds/tlsscanner/core/probe/ciphersuite/CipherSuiteEvaluationHelper.java @@ -139,7 +139,7 @@ public List getToTestCipherSuitesByVersion( if (version == ProtocolVersion.SSL3) { return (List) CipherSuite.SSL3_SUPPORTED_CIPHERSUITES; } - if (version == ProtocolVersion.TLS13) { + if (version.is13()) { return CipherSuite.getImplementedTls13CipherSuites(); } List realCipherSuites = @@ -415,6 +415,9 @@ public void configureVersions(TlsScanReport report) { if (report.getResult(TlsAnalyzedProperty.SUPPORTS_DTLS_1_2) == TestResults.TRUE) { getProtocolVersions().add(ProtocolVersion.DTLS12); } + if (report.getResult(TlsAnalyzedProperty.SUPPORTS_DTLS_1_3) == TestResults.TRUE) { + getProtocolVersions().add(ProtocolVersion.DTLS13); + } if (report.getResult(TlsAnalyzedProperty.SUPPORTS_SSL_3) == TestResults.TRUE) { getProtocolVersions().add(ProtocolVersion.SSL3); } diff --git a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CertificateProbe.java b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CertificateProbe.java index e44ce7c2a..ec86ce9eb 100644 --- a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CertificateProbe.java +++ b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CertificateProbe.java @@ -120,7 +120,8 @@ public void adjustConfig(ServerReport report) { if (report.getResult(TlsAnalyzedProperty.SUPPORTS_GOST) == TestResults.FALSE) { scanForGostCert = false; } - if (report.getResult(TlsAnalyzedProperty.SUPPORTS_TLS_1_3) != TestResults.TRUE) { + if (report.getResult(TlsAnalyzedProperty.SUPPORTS_TLS_1_3) != TestResults.TRUE + && report.getResult(TlsAnalyzedProperty.SUPPORTS_DTLS_1_3) != TestResults.TRUE) { scanForTls13 = false; } } diff --git a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CipherSuiteProbe.java b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CipherSuiteProbe.java index 849235520..f2d6189c5 100644 --- a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CipherSuiteProbe.java +++ b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CipherSuiteProbe.java @@ -45,7 +45,7 @@ protected void executeTest() { evaluationHelper.setPairLists(new LinkedList<>()); for (ProtocolVersion version : evaluationHelper.getProtocolVersions()) { LOGGER.debug("Testing: {}", version); - if (version.isTLS13()) { + if (version.is13()) { evaluationHelper .getPairLists() .add(new VersionSuiteListPair(version, getSupportedTls13CipherSuites())); diff --git a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CommonBugProbe.java b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CommonBugProbe.java index cf2ae109a..308ce9616 100644 --- a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CommonBugProbe.java +++ b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/CommonBugProbe.java @@ -23,6 +23,7 @@ import de.rub.nds.tlsattacker.core.constants.ProtocolVersion; import de.rub.nds.tlsattacker.core.constants.SignatureAndHashAlgorithm; import de.rub.nds.tlsattacker.core.protocol.message.ClientHelloMessage; +import de.rub.nds.tlsattacker.core.protocol.message.FinishedMessage; import de.rub.nds.tlsattacker.core.protocol.message.HelloVerifyRequestMessage; import de.rub.nds.tlsattacker.core.protocol.message.ServerHelloDoneMessage; import de.rub.nds.tlsattacker.core.protocol.message.ServerHelloMessage; @@ -169,7 +170,11 @@ private WorkflowTrace getWorkflowTrace(Config config, ClientHelloMessage clientH trace.addTlsAction(new ReceiveAction(new HelloVerifyRequestMessage())); trace.addTlsAction(new SendAction(clientHello)); } - trace.addTlsAction(new ReceiveTillAction(new ServerHelloDoneMessage())); + trace.addTlsAction( + new ReceiveTillAction( + config.getHighestProtocolVersion().is13() + ? new FinishedMessage() + : new ServerHelloDoneMessage())); return trace; } @@ -180,8 +185,11 @@ private TestResult getResult(Config config, WorkflowTrace trace, boolean checkFo return checkForTrue == (WorkflowTraceResultUtil.didReceiveMessage( trace, HandshakeMessageType.SERVER_HELLO_DONE) - || (state.getTlsContext().getSelectedProtocolVersion() - == ProtocolVersion.TLS13 + || ((state.getTlsContext().getSelectedProtocolVersion() + == ProtocolVersion.TLS13 + || state.getTlsContext() + .getSelectedProtocolVersion() + == ProtocolVersion.DTLS13) && (WorkflowTraceResultUtil.didReceiveMessage( trace, HandshakeMessageType.FINISHED)))) ? TestResults.TRUE diff --git a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ExtensionProbe.java b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ExtensionProbe.java index 8cee5570a..b40578d1b 100644 --- a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ExtensionProbe.java +++ b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ExtensionProbe.java @@ -82,7 +82,10 @@ public List getSupportedExtensions() { } } if (supportsTls13) { - commonExtensions = getCommonExtension(ProtocolVersion.TLS13, CipherSuite::isTls13); + commonExtensions = + getCommonExtension( + configSelector.getTls13BaseConfig().getHighestProtocolVersion(), + CipherSuite::isTls13); if (commonExtensions != null) { allSupportedExtensions.addAll(commonExtensions); } @@ -107,7 +110,7 @@ private boolean supportsSni() { private List getCommonExtension( ProtocolVersion highestVersion, Predicate cipherSuitePredicate) { Config tlsConfig; - if (highestVersion.isTLS13()) { + if (highestVersion.is13()) { tlsConfig = configSelector.getTls13BaseConfig(); } else { tlsConfig = configSelector.getBaseConfig(); @@ -169,7 +172,9 @@ public Requirement getRequirements() { @Override public void adjustConfig(ServerReport report) { supportsTls13 = - TestResults.TRUE.equals(report.getResult(TlsAnalyzedProperty.SUPPORTS_TLS_1_3)); + TestResults.TRUE.equals(report.getResult(TlsAnalyzedProperty.SUPPORTS_TLS_1_3)) + || TestResults.TRUE.equals( + report.getResult(TlsAnalyzedProperty.SUPPORTS_DTLS_1_3)); supportsPreTls13 = report.getResult(TlsAnalyzedProperty.SUPPORTS_TLS_1_0) == TestResults.TRUE || report.getResult(TlsAnalyzedProperty.SUPPORTS_TLS_1_1) diff --git a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ProtocolVersionProbe.java b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ProtocolVersionProbe.java index caf21c27b..eba619404 100644 --- a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ProtocolVersionProbe.java +++ b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ProtocolVersionProbe.java @@ -40,6 +40,7 @@ public ProtocolVersionProbe(ConfigSelector configSelector, ParallelExecutor para TlsAnalyzedProperty.SUPPORTS_DTLS_1_0_DRAFT, TlsAnalyzedProperty.SUPPORTS_DTLS_1_0, TlsAnalyzedProperty.SUPPORTS_DTLS_1_2, + TlsAnalyzedProperty.SUPPORTS_DTLS_1_3, TlsAnalyzedProperty.SUPPORTS_SSL_2, TlsAnalyzedProperty.SUPPORTS_SSL_3, TlsAnalyzedProperty.SUPPORTS_TLS_1_0, @@ -53,11 +54,15 @@ public ProtocolVersionProbe(ConfigSelector configSelector, ParallelExecutor para protected void executeTest() { supportedProtocolVersions = new LinkedList<>(); unsupportedProtocolVersions = new LinkedList<>(); + ProtocolVersion version13 = + configSelector.getScannerConfig().getDtlsDelegate().isDTLS() + ? ProtocolVersion.DTLS13 + : ProtocolVersion.TLS13; if (configSelector.foundWorkingTls13Config()) { // the ConfigSelector is currently better at determining 1.3 support - supportedProtocolVersions.add(ProtocolVersion.TLS13); + supportedProtocolVersions.add(version13); } else { - unsupportedProtocolVersions.add(ProtocolVersion.TLS13); + unsupportedProtocolVersions.add(version13); } for (ProtocolVersion version : toTestList) { @@ -137,9 +142,11 @@ private boolean isSSL2Supported() { public void adjustConfig(ServerReport report) { toTestList = new LinkedList<>(); if (configSelector.getScannerConfig().getDtlsDelegate().isDTLS()) { - toTestList.add(ProtocolVersion.DTLS10_DRAFT); - toTestList.add(ProtocolVersion.DTLS10); - toTestList.add(ProtocolVersion.DTLS12); + if (configSelector.foundWorkingConfig()) { + toTestList.add(ProtocolVersion.DTLS10_DRAFT); + toTestList.add(ProtocolVersion.DTLS10); + toTestList.add(ProtocolVersion.DTLS12); + } } else { toTestList.add(ProtocolVersion.SSL2); if (configSelector.foundWorkingConfig()) { @@ -161,6 +168,7 @@ protected void mergeData(ServerReport report) { put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_0_DRAFT, TestResults.COULD_NOT_TEST); put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_0, TestResults.COULD_NOT_TEST); put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_2, TestResults.COULD_NOT_TEST); + put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_3, TestResults.COULD_NOT_TEST); put(TlsAnalyzedProperty.SUPPORTS_SSL_2, TestResults.COULD_NOT_TEST); put(TlsAnalyzedProperty.SUPPORTS_SSL_3, TestResults.COULD_NOT_TEST); put(TlsAnalyzedProperty.SUPPORTS_TLS_1_0, TestResults.COULD_NOT_TEST); @@ -179,6 +187,9 @@ protected void mergeData(ServerReport report) { if (version == ProtocolVersion.DTLS12) { put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_2, TestResults.TRUE); } + if (version == ProtocolVersion.DTLS13) { + put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_3, TestResults.TRUE); + } if (version == ProtocolVersion.SSL2) { put(TlsAnalyzedProperty.SUPPORTS_SSL_2, TestResults.TRUE); } @@ -209,6 +220,9 @@ protected void mergeData(ServerReport report) { if (version == ProtocolVersion.DTLS12) { put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_2, TestResults.FALSE); } + if (version == ProtocolVersion.DTLS13) { + put(TlsAnalyzedProperty.SUPPORTS_DTLS_1_3, TestResults.FALSE); + } if (version == ProtocolVersion.SSL2) { put(TlsAnalyzedProperty.SUPPORTS_SSL_2, TestResults.FALSE); } diff --git a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ResumptionProbe.java b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ResumptionProbe.java index 89588f392..4b7ac59f9 100644 --- a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ResumptionProbe.java +++ b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/ResumptionProbe.java @@ -71,10 +71,15 @@ public ResumptionProbe(ConfigSelector configSelector, ParallelExecutor parallelE protected void executeTest() { this.respectsPskModes = TestResults.TRUE; if (configSelector.getScannerConfig().getDtlsDelegate().isDTLS()) { - supportsDtlsCookieExchangeInResumption = getSupportsDtlsCookieExchangeInResumption(); + supportsDtlsCookieExchangeInResumption = + configSelector.foundWorkingConfig() + ? getSupportsDtlsCookieExchangeInResumption() + : TestResults.CANNOT_BE_TESTED; supportsDtlsCookieExchangeInSessionTicketResumption = - getSupportsDtlsCookieExchangeInSessionTicketResumption(); + configSelector.foundWorkingConfig() + ? getSupportsDtlsCookieExchangeInSessionTicketResumption() + : TestResults.CANNOT_BE_TESTED; issuesTls13SessionTicketAfterHandshake = issuesTls13SessionTicketWithApplicationData = supportsTls13PskDhe = diff --git a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/SignatureAndHashAlgorithmProbe.java b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/SignatureAndHashAlgorithmProbe.java index 5d3471ea1..93828dd74 100644 --- a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/SignatureAndHashAlgorithmProbe.java +++ b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/probe/SignatureAndHashAlgorithmProbe.java @@ -63,7 +63,7 @@ protected void executeTest() { Set supportedSke = new HashSet<>(); Set supportedTls13 = new HashSet<>(); for (ProtocolVersion version : versions) { - if (version.isTLS13()) { + if (version.is13()) { supportedTls13.addAll(testForVersion(version, CipherSuite::isTls13)); } else { supportedSke.addAll( @@ -80,7 +80,7 @@ private Set testForVersion( Set> tested = new HashSet<>(); Config tlsConfig = - version.isTLS13() + version.is13() ? configSelector.getTls13BaseConfig() : configSelector.getBaseConfig(); tlsConfig.setWorkflowTraceType(WorkflowTraceType.DYNAMIC_HELLO); @@ -91,7 +91,7 @@ private Set testForVersion( Queue> testQueue = new LinkedList<>(); testQueue.add( - version.isTLS13() + version.is13() ? SignatureAndHashAlgorithm.getTls13SignatureAndHashAlgorithms() : Arrays.asList(SignatureAndHashAlgorithm.values())); @@ -107,7 +107,7 @@ private Set testForVersion( state = testAlgorithms(testSet, tlsConfig); if (state != null) { SignatureAndHashAlgorithm selected = - version.isTLS13() + version.is13() ? getSelectedSignatureAndHashAlgorithmCV(state) : getSelectedSignatureAndHashAlgorithmSke(state); if (selected == null) { @@ -192,7 +192,8 @@ public Requirement getRequirements() { .and( new ProtocolVersionRequirement(ProtocolVersion.TLS12) .or(new ProtocolVersionRequirement<>(ProtocolVersion.TLS13)) - .or(new ProtocolVersionRequirement<>(ProtocolVersion.DTLS12))); + .or(new ProtocolVersionRequirement<>(ProtocolVersion.DTLS12)) + .or(new ProtocolVersionRequirement<>(ProtocolVersion.DTLS13))); } @Override @@ -201,7 +202,7 @@ public void adjustConfig(ServerReport report) { for (ProtocolVersion version : report.getSupportedProtocolVersions()) { if (version.equals(ProtocolVersion.DTLS12) || version.equals(ProtocolVersion.TLS12) - || version.isTLS13()) { + || version.is13()) { versions.add(version); } } diff --git a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/ServerReportPrinter.java b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/ServerReportPrinter.java index eb595e354..56c0b350d 100644 --- a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/ServerReportPrinter.java +++ b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/report/ServerReportPrinter.java @@ -2528,6 +2528,7 @@ public StringBuilder appendProtocolVersions(StringBuilder builder) { prettyAppendHeading(builder, "Versions"); prettyAppend(builder, "DTLS 1.0", TlsAnalyzedProperty.SUPPORTS_DTLS_1_0); prettyAppend(builder, "DTLS 1.2", TlsAnalyzedProperty.SUPPORTS_DTLS_1_2); + prettyAppend(builder, "DTLS 1.3", TlsAnalyzedProperty.SUPPORTS_DTLS_1_3); prettyAppend(builder, "SSL 2.0", TlsAnalyzedProperty.SUPPORTS_SSL_2); prettyAppend(builder, "SSL 3.0", TlsAnalyzedProperty.SUPPORTS_SSL_3); prettyAppend(builder, "TLS 1.0", TlsAnalyzedProperty.SUPPORTS_TLS_1_0); diff --git a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/selector/ConfigSelector.java b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/selector/ConfigSelector.java index 3ed853478..8d231cab7 100644 --- a/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/selector/ConfigSelector.java +++ b/TLS-Server-Scanner/src/main/java/de/rub/nds/tlsscanner/serverscanner/selector/ConfigSelector.java @@ -120,9 +120,7 @@ public boolean findWorkingConfigs() { if (!scannerConfig.getQuicDelegate().isQuic()) { findWorkingConfig(); } - if (!scannerConfig.getDtlsDelegate().isDTLS()) { - findWorkingTls13Config(); - } + findWorkingTls13Config(); return workingConfig != null || workingTl13Config != null; } @@ -315,7 +313,7 @@ private void repairSni(Config config) { */ public Config repairConfig(Config config) { restrictBasicFeatures(config); - if (config.getHighestProtocolVersion().isTLS13()) { + if (config.getHighestProtocolVersion().is13()) { adjustKeyShareFields(config); } else { adjustEccExtensionsPreTls13(config); @@ -420,7 +418,7 @@ public void setDefaultSelectedCipherSuites(Config config) { */ public void restrictBasicFeatures(Config config) { Config relevantConfig = - config.getHighestProtocolVersion().isTLS13() ? workingTl13Config : workingConfig; + config.getHighestProtocolVersion().is13() ? workingTl13Config : workingConfig; if (relevantConfig != null) { config.setDefaultClientSupportedCipherSuites( config.getDefaultClientSupportedCipherSuites().stream()