Documentation
¶
Overview ¶
Package handshake contains hand-crafted, low-level TLS/SSL handshake probes for legacy protocol versions that Go's crypto/tls refuses to negotiate (SSLv2 and SSLv3). These probes operate purely at the record layer: they emit a minimal ClientHello and interpret only the first few bytes of the server's reply. They do NOT implement cryptography — they only decide whether the server is willing to speak the legacy protocol at all.
Detecting SSLv3 is required for POODLE; SSLv2 for DROWN.
License: MIT.
Index ¶
- func ProbeCBCPaddingOracles(ctx context.Context, addr, host string, timeout time.Duration) (gd, zombie, sleeping, cve bool)
- func ProbeExportDH(ctx context.Context, addr string, timeout time.Duration) bool
- func ProbeExportRSA(ctx context.Context, addr string, timeout time.Duration) bool
- func ProbeFallbackSCSVMissing(ctx context.Context, addr string, fallbackVersion uint16, ...) bool
- func ProbeInsecureRenegotiation(ctx context.Context, addr string, timeout time.Duration) bool
- func ProbeROBOT(ctx context.Context, addr, host string, timeout time.Duration) bool
- func ProbeSSL2(ctx context.Context, addr string, timeout time.Duration) bool
- func ProbeSSL3(ctx context.Context, addr string, timeout time.Duration) bool
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ProbeCBCPaddingOracles ¶ added in v0.4.0
func ProbeCBCPaddingOracles(ctx context.Context, addr, host string, timeout time.Duration) (gd, zombie, sleeping, cve bool)
ProbeCBCPaddingOracles reports the four CBC padding-oracle verdicts (in order: GoldenDoodle, ZombiePoodle, SleepingPoodle, CVE-2019-1559). It is fully fail-safe: if the server negotiates no CBC suite, if the hand-rolled handshake cannot be established, or if results are not cleanly reproducible, every verdict is false. host is the SNI name; addr is "host:port".
func ProbeExportDH ¶ added in v0.2.0
ProbeExportDH reports whether the server is willing to negotiate a DHE_EXPORT cipher suite (Logjam, CVE-2015-4000). It offers ONLY the export DHE suites in a TLS 1.0 ClientHello; a ServerHello reply means vulnerable.
func ProbeExportRSA ¶ added in v0.2.0
ProbeExportRSA reports whether the server is willing to negotiate an RSA_EXPORT cipher suite (FREAK, CVE-2015-0204). It offers ONLY the export RSA suites in a TLS 1.0 ClientHello; if the server answers with a ServerHello it selected one of them and is vulnerable.
func ProbeFallbackSCSVMissing ¶ added in v0.2.0
func ProbeFallbackSCSVMissing(ctx context.Context, addr string, fallbackVersion uint16, timeout time.Duration) bool
ProbeFallbackSCSVMissing reports whether the server FAILS to honour TLS_FALLBACK_SCSV (RFC 7507) — i.e. whether downgrade protection is MISSING.
fallbackVersion must be a real version strictly below the server's highest supported version (the caller discovers this from the protocol probe). We send a ClientHello pinned to fallbackVersion that ALSO advertises the special FALLBACK_SCSV (0x5600) signalling suite. A server that implements the mitigation MUST reply with a fatal inappropriate_fallback alert (level 0x02, desc 0x56) => mitigation present => returns false. If instead it completes a ServerHello at the lower version, the mitigation is absent => returns true.
Fail safe: timeout / reset / any ambiguous reply => false (do not claim the mitigation is missing without evidence).
func ProbeInsecureRenegotiation ¶ added in v0.2.0
ProbeInsecureRenegotiation reports whether the server lacks RFC 5746 secure renegotiation support.
Under RFC 5746 a server includes renegotiation_info in its ServerHello ONLY if the client signalled support (either via the renegotiation_info extension or the TLS_EMPTY_RENEGOTIATION_INFO_SCSV 0x00ff). So we MUST advertise support ourselves: we send a TLS 1.2 ClientHello carrying an empty renegotiation_info extension. Then we parse the ServerHello's extensions:
- server echoes renegotiation_info => secure renegotiation supported => false
- server omits it => no RFC 5746 support => true
Fail safe: timeout / reset / alert / any parse ambiguity => false (we never claim a server is insecure without a clean ServerHello to inspect).
func ProbeROBOT ¶ added in v0.3.0
ProbeROBOT reports whether the server is vulnerable to ROBOT. It is fully self-contained and fail-safe: any prerequisite miss, transport error, or ambiguous/noisy result yields false (never a false positive).
host is the SNI server name; addr is "host:port".
func ProbeSSL2 ¶
ProbeSSL2 reports whether the server speaks SSLv2 (the prerequisite for DROWN, CVE-2016-0800).
SSLv2 does not use the modern 5-byte TLS record header. Instead it frames messages with a 2-byte (or 3-byte) header: in the common 2-byte form the high bit of the first byte is set and the remaining 15 bits are the record length. We send a real SSLv2 CLIENT-HELLO (message type 0x01, version 0x0002, a list of 3-byte cipher-specs and a challenge) and look for an SSLv2 SERVER-HELLO (message type 0x04) in the reply. Anything else — a TLS alert, a TLS record, a reset, a timeout, or an ambiguous response — is treated as "not supported" (fail safe), so we never raise a false DROWN.
The probe is capped to a short window like ProbeSSL3: a server that speaks SSLv2 answers immediately; silence means it does not.
func ProbeSSL3 ¶
ProbeSSL3 reports whether the server accepts an SSLv3 handshake.
It opens a raw TCP connection, sends a minimal SSLv3 ClientHello (record version 0x0300), and inspects the first bytes of the reply. The server is considered to support SSLv3 only if it answers with an SSLv3 handshake record (content type 0x16, record version 0x0300) carrying a ServerHello. A TLS alert, a connection reset, a timeout, or any non-SSLv3 record version is treated as "not supported" (fail safe).
Types ¶
This section is empty.
Source Files