search

zmap / zcrypto

Liberal Go TLS + X.509 Library for Research
Other
134 stars 83 forks source link

use branch master and feature/tlsv1.3 to scan the same ip+port, the results of secure_renegotiation and scts are different #342

Open chushuai opened 2 years ago

chushuai commented 2 years ago

Use branch master and feature/tlsv1.3 to scan the same ip+port, The results of secure_renegotiation and scts are different 

func TestTls(t *testing.T){
    tests := []string{ "138.201.124.182:10250"}
    for _, test := range tests {
        conn, err := Dial("tcp", test, &Config{
            InsecureSkipVerify: true,
        })
        data, _ := json.Marshal(conn.GetHandshakeLog())
        fmt.Println(string(data))
        if err != nil {
            fmt.Println("failed to connect: " + err.Error())
        }
    }

}

image

mzpqnxow commented 1 year ago

The tls1.3 branch includes tls1.3 support and also includes other enhancements- anything added to the upstream golang tls code since the (very old) tls implementation was lifted from upstream- at least 5 years ago

This includes (at least) early renegotiation handling. I'm not certain but I believe the portable ciphers profile is also exclusive to the tls1.3 branch for no particular reason aside from the fact that those interested in "better" tls support were using that branch

You can see part of this if you track the zcrypto portion of https://github.com/zmap/zgrab2/pull/334

tl; dr; this is expected behavior as far as I know