Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Loosening ASN.1 parsing #364

Closed
mzpqnxow opened this issue Sep 7, 2023 · 1 comment
Closed

Loosening ASN.1 parsing #364

mzpqnxow opened this issue Sep 7, 2023 · 1 comment

Comments

@mzpqnxow
Copy link
Contributor

mzpqnxow commented Sep 7, 2023 •
edited
Loading

This is a placeholder for an issue reported in the zgrab2 issues @ zmap/zgrab2#378 by @rony0724

Unruly certificates cause a failure for the HTTPS endpoint in question. This should also apply to other TLS protocols (imaps, ftps, etc)

Failing is not unreasonable behavior but it might be useful to handle illegal ASN.1 more gracefully, perhaps silently ignoring any blobs that aren't technically legal but also do not break the entire stream

There are two approaches that come to mind, they aren't mutually exclusive:

  1. Returning the valid portions of the ASN.1 via an opt-in "loose" argument at the highest level ASN.1 interface(s)
  2. Investigate any known real-world cases that break the parser and see if they should be handled explicitly on a case-by-case basis. There's at least one example in the referenced zgrab2 issue but being 5 months old, it may no longer be available. I'm sure some other examples can be identified

I don't have time to look into this now and I can't even guess as whether the changes would have to be made inside ASN.1 parsing logic (blech) or via a higher level interface to ASN.1 parsing. I like to think there is a strict=false argument in some interface that causes unexpected objects to be quietly skipped but that may be too optimistic

Unless there are any objections I would like to leave the issue open, despite it not being a defect. Maybe someone else will have time to look at it, or maybe I'll come back when I have time

Thanks!

EDIT: this seems relevant to my interests... may be an easy task afterall
Seanstoppable added a commit to Seanstoppable/zgrab2 that referenced this issue Oct 14, 2023
@Seanstoppable
Add permissive parsing TLS option
c21c361 
This is driven by  zmap#378, zmap/zcrypto#364 and
zmap#334

This allows a number of scans to actually succeed, rather than fail out
when parsing the certificate

Example without permissive parsing:

```
echo FAILING_IP | ./zgrab2 http -p 443 --use-https
INFO[0000] started grab at 2023-09-21T21:25:29-05:00
{"ip":"FAILING_IP","data":{"http":{"status":"unknown-error","protocol":"http","result":{},"timestamp":"2023-09-21T21:25:29-05:00","error":"tls: failed to parse certificate from server: asn1: structure error: explicitly tagged member didn't match"}}}
INFO[0001] finished grab at 2023-09-21T21:25:29-05:00
{"statuses":{"http":{"successes":0,"failures":1}},"start":"2023-09-21T21:25:29-05:00","end":"2023-09-21T21:25:29-05:00","duration":"987.606886ms"}
```

With Permissive parsing:

```
echo FAILING_IP | ./zgrab2 http -p 443 --use-https --permissive-parsing
INFO[0000] started grab at 2023-09-21T21:25:34-05:00
{"ip":"FAILING_UP","data":{"http":{"status":"application-error","protocol":"http","result":{"response":{"status_line":"302 Found","status_code":302,"protocol":{"name":"HTTP/1.1","major":1,"minor":1},"headers":{"content_length":["0"],
... all the HTTP and TLS handshake log data
```
@Seanstoppable Seanstoppable mentioned this issue Nov 28, 2023
Merged
zakird pushed a commit to zmap/zgrab2 that referenced this issue Feb 18, 2024
@Seanstoppable
Permissive TLS parsing (#400)
413c2ce 
* Add permissive parsing TLS option

This is driven by  #378, zmap/zcrypto#364 and
#334

This allows a number of scans to actually succeed, rather than fail out
when parsing the certificate

Example without permissive parsing:

```
echo FAILING_IP | ./zgrab2 http -p 443 --use-https
INFO[0000] started grab at 2023-09-21T21:25:29-05:00
{"ip":"FAILING_IP","data":{"http":{"status":"unknown-error","protocol":"http","result":{},"timestamp":"2023-09-21T21:25:29-05:00","error":"tls: failed to parse certificate from server: asn1: structure error: explicitly tagged member didn't match"}}}
INFO[0001] finished grab at 2023-09-21T21:25:29-05:00
{"statuses":{"http":{"successes":0,"failures":1}},"start":"2023-09-21T21:25:29-05:00","end":"2023-09-21T21:25:29-05:00","duration":"987.606886ms"}
```

With Permissive parsing:

```
echo FAILING_IP | ./zgrab2 http -p 443 --use-https --permissive-parsing
INFO[0000] started grab at 2023-09-21T21:25:34-05:00
{"ip":"FAILING_UP","data":{"http":{"status":"application-error","protocol":"http","result":{"response":{"status_line":"302 Found","status_code":302,"protocol":{"name":"HTTP/1.1","major":1,"minor":1},"headers":{"content_length":["0"],
... all the HTTP and TLS handshake log data
```

* Make permissive parsing the default/no option
@mzpqnxow
Copy link
Contributor Author

mzpqnxow commented Aug 4, 2024

I think this can be closed thanks to zmap/zgrab2#400

@mzpqnxow mzpqnxow closed this as completed Aug 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@mzpqnxow