Age | Commit message (Collapse) | Author | Files | Lines |
|
6ef945d Doxygen: Hide anonymous namespaces from documentation by default (Jeffrey)
|
|
f7d50cb EPEE: Remove gzip_encoding.h (Jeffrey)
|
|
63c7f8b EPEE: Remove hmac-md5 (Jeffrey)
|
|
002bf9c Fix typo: SERIALIZE_TYPE_DUOBLE (Jeffrey)
|
|
Bonus: little doc fix for net_ssl.h
|
|
9209880 add a sanity check to RPC input data size (moneromooo-monero)
|
|
d1cb9c3 Remove serialization/enableable (Jeffrey)
|
|
|
|
|
|
reported by m31007
|
|
At the request of @mj-xmr: https://github.com/monero-project/monero/pull/8211#discussion_r822868321
|
|
Relevant commit in old PR:
1b798a7042070cc8063bd341ebf7025da554b632
|
|
Relevant commit from old PR:
330df2952cb2863a591158b984c0fb7f652887ac
|
|
Relevant commit from old PR:
bd0a5119957d3ef9130a0b82599e1696995ef235
|
|
Relevant commit on old PR:
2499269696192ce30dd125ddee90a80d4326dff9
|
|
Relevant commits on the old cleanup PR:
36933c7f5c7778e2d7fbfea5361c11fb41070467
21e43de0f300ee47b7e597098908601bf591950b
3c678bb1cedfd7b865ac2e7aaf014de4bfb3eb3d
|
|
Actions:
1. Remove unused functions from misc_os_dependent.h
2. Move three remaining functions, get_gmt_time, get_ns_count, and get_tick_count into time_helper.h
3. Remove unused functions from time_helper.h
4. Refactor get_ns_count and get_internet_time_str and get_time_interval_string
5. Remove/add includes as needed
Relevant commits on the old PR:
a9fbe52b02ffab451e90c977459fea4642731cd1
9a59b131c4ed1be8afe238fff3780fe203c65a46
7fa9e2817df9b9ef3f0290f7f86357939829e588
|
|
Remove unused include statements or unused definitions.
|
|
Here lies dozens of unused files. This commit is ONLY file deletions except
for the removing of a couple of #includes and removing filenames from CmakeLists
where appropriate.
|
|
|
|
Currently working on an EPEE [ser/de]ialization library for Rust and at first glance, EPEE seemed to have support for optional wrappers. However, after looking into it, this feature appears to be half-baked and unused. Furthermore, adding support for optional values would be better suited to implement at the storage level, in my opinion. That would make parsing DOMs easier and less error-prone. If anyone is currently using this code, please comment. Thanks!
At the time of writing, this PR has no merge conflicts with #8211
|
|
1ce9e9c Remove dead code from parserse_base_utils and fix unit tests (Jeffrey)
|
|
17772ef Eliminate dependence on boost::interprocess #8223 (Jeffrey)
|
|
da9aa1f Copyright: Update to 2022 (mj-xmr)
|
|
* Remove `match_string()`, `match_number()`, and `match_word()`
* Remove `match_word_with_extrasymb()` and `match_word_til_equal_mark()`
* Adapt unit test for `match_number()` to `match_number2()`
* Adapt unit test for `match_string()` to `match_string2()`
Note: the unit tests were testing for the old version of the functions, and
the interfaces for these functions changed slightly, so I had to also edit
the tests.
As of writing, this PR has no merge conflicts with #8211
Additional changes during review:
* Explicitly set up is_[float/signed]_val to be changed before each call
* Structify the tests and fix uninitialized variables
|
|
In this repo, `boost::interprocess` was being used soley to make `uint32_t` operations atomic. So I replaced each instance of
`boost::interprocess::ipcdetail::atomic(...)32` with `std::atomic` methods. I replaced member declarations as applicable. For example,
when I needed to change a `volatile uint32_t` into a `std::atomic<uint32_t>`. Sometimes, a member was being used a boolean flag, so
I replaced it with `std::atomic<bool>`.
You may notice that I didn't touch `levin_client_async.h`. That is because this file is entirely unused and will be deleted in PR monero-project#8211.
Additional changes from review:
* Make some local variables const
* Change postfix operators to prefix operators where value was not need
|
|
|
|
|
|
Fixes issues reported in #8120
|
|
b0ec9f8 epee: avoid ADL selecting C++14 std::quoted (selsta)
|
|
|
|
|
|
Co-authored-by: Jason Rhinelander <jason@imaginary.ca>
|
|
ec6b4cf support cors wildcard (woodser)
|
|
426dbf4 fix median overflow bug (koe)
|
|
0ac9a04 epee: tidying post-incrementation -> pre-incrementation (mj-xmr)
|
|
|
|
|
|
|
|
bf96055 Make SSL key/cert storage backward-compatible (Nathan Dorfman)
|
|
|
|
|
|
This is required to build on OpenBSD (which uses LibreSSL). It also allows building against versions of OpenSSL before 1.0.2.
|
|
|
|
08e4497 Improve cryptonote (block and tx) binary read performance (Lee Clagett)
|
|
b4fe7c2 epee linkage dynamic; move monero_add_library to main CMakeLists.txt (mj-xmr)
|
|
44cc6d6 Fix boost 1.76.0 compatibility (loqs)
|
|
d772f13 epee: include public openssl header in cmake (selsta)
|
|
Add missing header boost/mpl/contains.hpp
monero-project/monero/issues/7728
|
|
cbd54ea cmake: set 3.5 as minimum version (selsta)
|
|
451b5a5 clang: fix -Wrange-loop-analysis warnings (selsta)
|
|
15e6275 CMake: new macro - finding all headers (extract from epee) (mj-xmr)
|
|
|
|
|
|
|
|
|
|
679d055 Remove payload copy in all outgoing p2p messages (Lee Clagett)
|
|
|
|
This reverts commit 63c7ca07fba2f063c760f786a986fb3e02fb040e, reversing
changes made to 2218e23e84a89e9a1e4c0be5d50f891ab836754f.
|
|
23aae55 Remove payload copy in all outgoing p2p messages (Lee Clagett)
|
|
673c6d2 Reduce compilation time of epee/portable_storage_template_helper.h (mj-xmr)
|
|
|
|
0f2b5af Reduced executable size; reduced call sequence to 'allowed' log function (Lee Clagett)
|
|
2935a0c async_protocol_handler_config: fix deadlock (anon)
c877705 async_protocol_handler_config: add deadlock demo (anon)
|
|
|
|
240d382 Epee: add headers to project files (via glob), to be able to search for them easily. (mj-xmr)
|
|
b900fa0 Fix compiler warning for in keyvalue_serialization.h (mj-xmr)
|
|
9867a91 Store RPC SSL key/cert for consistent authentication between runs (Lee Clagett)
|
|
daf023d epee: don't log raw packet data (moneromooo-monero)
|
|
249eae5 Allow byte_stream->byte_slice conversion to shrink unused buffer space (Lee Clagett)
|
|
|
|
556af11 epee: return HTTP error 400 (Bad request) on deserialization error (moneromooo-monero)
|
|
easily.
Use case: IDEs
|
|
It's better than 404 (Not found)
|
|
|
|
|
|
545b982 Remove unnecessary atomic operations in levin code (Lee Clagett)
|
|
df2f00f boosted_tcp_server: fix connection lifetime (anon)
3833624 boosted_tcp_server: add segfault demo (anon)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
f2ad539 readline_buffer: Avoid consecutive duplicates in the history (codesoap)
|
|
|
|
b9092dd epee: also limit number of strings in portable_storage (moneromooo-monero)
|
|
They require at least 24 bytes
|
|
b652d598d add a max levin packet size by command type (moneromooo-monero)
|
|
|
|
|
|
|
|
61b6e4cc6 Add aggressive restrictions to pre-handshake p2p buffer limit (Lee Clagett)
|
|
8e2caf3fb portable_storage: check object limit where appropriate (moneromooo)
|
|
20bdbd7aa portable_storage: forbid unnamed sections (xiphon)
|
|
also fix pedantic off by one in check
|
|
353f93ee1 portable_storage: remove array element limit (moneromooo-monero)
|
|
f7ab8bc6d ssl: buffered handshake detection (anon)
|
|
|
|
some people don't want it
|
|
|
|
|
|
95575cda6 epee: fix some issues using connections after shutdown (moneromooo-monero)
|
|
7f407c027 portable_storage: add some sanity checks on data size (moneromooo-monero)
|
|
c0c75ac19 Fixed issues found by static analysis (SChernykh)
|
|
|
|
especially when allocated size is >> serialized data size
|
|
|
|
|
|
|
|
|
|
7414e2bac Change epee binary output from std::stringstream to byte_stream (Lee Clagett)
|
|
08eb0949f Change to more efficient allocation strategy in byte_stream (Lee Clagett)
|
|
- rolling_median: tried to free uninitialized pointer in a constructor
- net_node.inl: erase-remove idiom was used incorrectly. remove_if doesn't actually remove elements, see http://cpp.sh/6fcjv
- bulletproofs.cc: call to sizeof() instead of vector.size(), luckily it only impacts performance and not code logic there
|
|
|
|
|
|
c5f6629 epee: tighten the URL parsing regexp a little (moneromooo-monero)
|
|
fixes massive amounts of time spent on pathological inputs
Found by OSS-Fuzz
|
|
|
|
|
|
|
|
|
|
|
|
05ad4fa39 epee: further defending against exceptions in command handlers (moneromooo-monero)
|
|
13eee1d6a rpc: reject wrong sized txid (moneromooo-monero)
92e6b7df2 easylogging++: fix crash with reentrant logging (moneromooo-monero)
6dd95d530 epee: guard against exceptions in RPC handlers (moneromooo-monero)
90016ad74 blockchain: guard against exceptions in add_new_block/children (moneromooo-monero)
|
|
86abf558c epee: Remove unused functions in local_ip.h (Jean Pierre Dudey)
|
|
85efc88c1 Fix overflow issue in epee:misc_utils::rolling_median_t and median(), with unit test (koe)
|
|
76c16822d wallet2_api: implement runtime proxy configuration (xiphon)
|
|
|
|
|
|
|
|
unit test
|
|
Signed-off-by: Jean Pierre Dudey <me@jeandudey.tech>
|
|
|
|
72cdfa4a2 fix a few typos in error messages (moneromooo-monero)
|
|
8656a8c9f remove double includes (sumogr)
|
|
5ef0607da Update copyright year to 2020 (SomaticFanatic)
|
|
3721d56 epee: fix array underflow in unicode parsing (moneromooo-monero)
|
|
78d435a rpc: don't display invalid json errors on default log level (moneromooo-monero)
|
|
15538f7 ByteSlice: Fix persisting ptr to std::moved SSO buffer (Doy-lee)
|
|
Reported by minerscan
Also independently found by OSS-Fuzz just recently
|
|
85164a8 epee: use memwipe rather than memset for md5 secrets (moneromooo-monero)
|
|
29e563b Fixed bugs for take_slice and byte_stream->byte_slice (vtnerd)
|
|
|
|
It's not something the user needs to know, and will display
attacker controlled data
|
|
The Bug:
1. Construct `byte_slice.portion_` with `epee::span(buffer)` which copies a pointer to the SSO buffer to `byte_slice.portion_`
2. It constructs `byte_slice.storage_` with `std::move(buffer)` (normally this swap pointers, but SSO means a memcpy and clear on the original SSO buffer)
3. `slice.data()` returns a pointer from `slice.portion_` that points to the original SSO cleared buffer, `slice.storage_` has the actual string.
|
|
Reported by adrelanos
|
|
That's used by HTTP auth now
|
|
|
|
|
|
|
|
Update copyright year to 2020
|
|
|
|
e509ede trezor: adapt to new passphrase mechanism (ph4r05)
|
|
- choice where to enter passphrase is now made on the host
- use wipeable string in the comm stack
- wipe passphrase memory
- protocol optimizations, prepare for new firmware version
- minor fixes and improvements
- tests fixes, HF12 support
|
|
0dbdba8 epee: avoid spamming 'Generating SSL certificate' in the logs (xiphon)
|
|
3031deb Bump downloaded boost version to 1.72 (omartijn)
6079042 Use boost::asio::ssl::context::sslv23 for backwards compatibility (omartijn)
|
|
81c5943 Remove temporary std::string creation in some hex->bin calls (vtnerd)
5fcc23a Move hex->bin conversion to monero copyright files and with less includes (vtnerd)
3387f0e Reduce template bloat in hex->bin for ZMQ json (vtnerd)
|
|
c61abf8 remove empty statements (shopglobal)
|
|
0078ce7 wipeable_string: split - treat CR, LF and Tabs as separators (xiphon)
|
|
|
|
f9441c5 Fixed string_ref usage bug in epee::from_hex::vector (vtnerd)
|
|
- Add abstract_http_client.h which http_client.h extends.
- Replace simple_http_client with abstract_http_client in wallet2,
message_store, message_transporter, and node_rpc_proxy.
- Import and export wallet data in wallet2.
- Use #if defined __EMSCRIPTEN__ directives to skip incompatible code.
|
|
When a handshake fails, it can fail due to timeout or destroyed
connection, in which case the connection will be, or already is,
closed, and we don't want to do it twice.
Additionally, when closing a connection directly from the top
level code, ensure the connection is gone from the m_connects
list so it won't be used again.
AFAICT this is now clean in netstat, /proc/PID/fd and print_cn.
This fixes a noisy (but harmless) exception.
|
|
760ecf2 console_handler: do not let exception past the dor (moneromooo-monero)
09c8111 threadpool: lock mutex in create (moneromooo-monero)
e377977 tx_pool: catch theoretical error in get_block_reward (moneromooo-monero)
|
|
5002a03 Explicitly define copy assignment operator (omartijn)
|
|
|
|
|
|
0f78b06e Various improvements to the ZMQ JSON-RPC handling: (Lee Clagett)
|
|
352bd132 abstract_tcp_server2: guard against negative timeouts (moneromooo-monero)
|
|
4771a7ae p2p: remove obsolete local time in handshake (moneromooo-monero)
2fbbc4a2 p2p: avoid sending the same peer list over and over (moneromooo-monero)
3004835b epee: remove backward compatible endian specific address serialization (moneromooo-monero)
39a343d7 p2p: remove backward compatible peer list (moneromooo-monero)
60631802 p2p: simplify last_seen serialization now we have optional stores (moneromooo-monero)
9467b2e4 cryptonote_protocol: omit top 64 bits of difficulty when 0 (moneromooo-monero)
b595583f serialization: do not write optional fields with default value (moneromooo-monero)
5f98b46d p2p: remove obsolete local time from TIMED_SYNC (moneromooo-monero)
|
|
All the insecure protocols that this enables are then disabled, so they
cannot be actually used. The end-result is the same.
|
|
|
|
|
|
- Finding handling function in ZMQ JSON-RPC now uses binary search
- Temporary `std::vector`s in JSON output now use `epee::span` to
prevent allocations.
- Binary -> hex in JSON output no longer allocates temporary buffer
- C++ structs -> JSON skips intermediate DOM creation, and instead
write directly to an output stream.
|
|
a9bdc6e4 Improved performance for epee serialization: (Lee Clagett)
|
|
021cf733 ssl: server-side: allow multiple version of TLS (Bertrand Jacquin)
|
|
Cleaning up a little around the code base.
|
|
|
|
Coverity 208373
|
|
2d1afceb net_ssl: load default certificates in CA mode on Windows (moneromooo-monero)
|
|
e896cca8 epee: reorder a couple init list fields to match declaration (moneromooo-monero)
|
|
The implicit copy assignment operator was deprecated because the class
has an explicit copy constructor. According to the standard:
The generation of the implicitly-defined copy assignment operator is
deprecated (since C++11) if T has a user-declared destructor or
user-declared copy constructor.
Recent versions of gcc (9.1+) and clang (10.0) warn about this.
|
|
|
|
|
|
|
|
6efeefbc epee: set application/json MIME type on json errors (moneromooo-monero)
|
|
b2ad757f Replace memset with memwipe. (Bert Peters)
|
|
584d057f epee: fix console_handlers_binder race, wait for thread to finish (xiphon)
|
|
feef1c6a epee: fix peer ids being truncated on display (moneromooo-monero)
|
|
|
|
boost::asio::ssl::context is created using specifically TLSv1.2, which
blocks the ability to use superior version of TLS like TLSv1.3.
Filtering is also made specially later in the code to remove unsafe
version for TLS such SSLv2, SSLv3 etc..
This change is removing double filtering to allow TLSv1.2 and above to
be used.
testssl.sh 3.0rc5 now reports the following (please note monerod was
built with USE_EXTRA_EC_CERT):
$ ./testssl.sh --openssl=/usr/bin/openssl \
--each-cipher --cipher-per-proto \
--server-defaults --server-preference \
--vulnerable --heartbleed --ccs --ticketbleed \
--robot --renegotiation --compression --breach \
--poodle --tls-fallback --sweet32 --beast --lucky13 \
--freak --logjam --drown --pfs --rc4 --full \
--wide --hints 127.0.0.1:38081
Using "OpenSSL 1.1.1d 10 Sep 2019" [~80 ciphers]
on ip-10-97-15-6:/usr/bin/openssl
(built: "Dec 3 21:14:51 2019", platform: "linux-x86_64")
Start 2019-12-03 21:51:25 -->> 127.0.0.1:38081 (127.0.0.1) <<--
rDNS (127.0.0.1): --
Service detected: HTTP
Testing protocols via sockets except NPN+ALPN
SSLv2 not offered (OK)
SSLv3 not offered (OK)
TLS 1 not offered
TLS 1.1 not offered
TLS 1.2 offered (OK)
TLS 1.3 offered (OK): final
NPN/SPDY not offered
ALPN/HTTP2 not offered
Testing for server implementation bugs
No bugs found.
Testing cipher categories
NULL ciphers (no encryption) not offered (OK)
Anonymous NULL Ciphers (no authentication) not offered (OK)
Export ciphers (w/o ADH+NULL) not offered (OK)
LOW: 64 Bit + DES, RC[2,4] (w/o export) not offered (OK)
Triple DES Ciphers / IDEA not offered (OK)
Average: SEED + 128+256 Bit CBC ciphers not offered
Strong encryption (AEAD ciphers) offered (OK)
Testing robust (perfect) forward secrecy, (P)FS -- omitting Null Authentication/Encryption, 3DES, RC4
PFS is offered (OK), ciphers follow (client/browser support is important here)
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
-----------------------------------------------------------------------------------------------------------------------------
x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 X448
Testing server preferences
Has server cipher order? yes (OK)
Negotiated protocol TLSv1.3
Negotiated cipher TLS_AES_256_GCM_SHA384, 253 bit ECDH (X25519)
Cipher order
TLSv1.2: ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256
TLSv1.3: TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256
Testing server defaults (Server Hello)
TLS extensions (standard) "renegotiation info/#65281" "EC point formats/#11" "supported versions/#43" "key share/#51" "max fragment length/#1" "extended master secret/#23"
Session Ticket RFC 5077 hint no -- no lifetime advertised
SSL Session ID support yes
Session Resumption Tickets no, ID: no
TLS clock skew Random values, no fingerprinting possible
Server Certificate #1 (in response to request w/o SNI)
Signature Algorithm SHA256 with RSA
Server key size RSA 4096 bits
Server key usage --
Server extended key usage --
Serial / Fingerprints 01 / SHA1 132E42981812F5575FA0AE64922B18A81B38C03F
SHA256 EBA3CC4AA09DEF26706E64A70DB4BC8D723533BB67EAE12B503A845019FB61DC
Common Name (CN) (no CN field in subject)
subjectAltName (SAN) missing (NOT ok) -- Browsers are complaining
Issuer
Trust (hostname) certificate does not match supplied URI
Chain of trust NOT ok (self signed)
EV cert (experimental) no
"eTLS" (visibility info) not present
Certificate Validity (UTC) 181 >= 60 days (2019-12-03 21:51 --> 2020-06-02 21:51)
# of certificates provided 1
Certificate Revocation List --
OCSP URI --
NOT ok -- neither CRL nor OCSP URI provided
OCSP stapling not offered
OCSP must staple extension --
DNS CAA RR (experimental) not offered
Certificate Transparency --
Server Certificate #2 (in response to request w/o SNI)
Signature Algorithm ECDSA with SHA256
Server key size EC 256 bits
Server key usage --
Server extended key usage --
Serial / Fingerprints 01 / SHA1 E17B765DD8124525B1407E827B89A31FB167647D
SHA256 AFB7F44B1C33831F521357E5AEEB813044CB02532143E92D35650A3FF792A7C3
Common Name (CN) (no CN field in subject)
subjectAltName (SAN) missing (NOT ok) -- Browsers are complaining
Issuer
Trust (hostname) certificate does not match supplied URI
Chain of trust NOT ok (self signed)
EV cert (experimental) no
"eTLS" (visibility info) not present
Certificate Validity (UTC) 181 >= 60 days (2019-12-03 21:51 --> 2020-06-02 21:51)
# of certificates provided 1
Certificate Revocation List --
OCSP URI --
NOT ok -- neither CRL nor OCSP URI provided
OCSP stapling not offered
OCSP must staple extension --
DNS CAA RR (experimental) not offered
Certificate Transparency --
Testing HTTP header response @ "/"
HTTP Status Code 404 Not found (Hint: supply a path which doesn't give a "404 Not found")
HTTP clock skew Got no HTTP time, maybe try different URL?
Strict Transport Security not offered
Public Key Pinning --
Server banner Epee-based
Application banner --
Cookie(s) (none issued at "/") -- maybe better try target URL of 30x
Security headers --
Reverse Proxy banner --
Testing vulnerabilities
Heartbleed (CVE-2014-0160) not vulnerable (OK), no heartbeat extension
CCS (CVE-2014-0224) not vulnerable (OK)
Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK), no session ticket extension
ROBOT Server does not support any cipher suites that use RSA key transport
Secure Renegotiation (CVE-2009-3555) not vulnerable (OK)
Secure Client-Initiated Renegotiation not vulnerable (OK)
CRIME, TLS (CVE-2012-4929) not vulnerable (OK)
BREACH (CVE-2013-3587) no HTTP compression (OK) - only supplied "/" tested
POODLE, SSL (CVE-2014-3566) not vulnerable (OK)
TLS_FALLBACK_SCSV (RFC 7507) No fallback possible, no protocol below TLS 1.2 offered (OK)
SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK)
FREAK (CVE-2015-0204) not vulnerable (OK)
DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK)
make sure you don't use this certificate elsewhere with SSLv2 enabled services
https://censys.io/ipv4?q=EBA3CC4AA09DEF26706E64A70DB4BC8D723533BB67EAE12B503A845019FB61DC could help you to find out
LOGJAM (CVE-2015-4000), experimental not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
BEAST (CVE-2011-3389) no SSL3 or TLS1 (OK)
LUCKY13 (CVE-2013-0169), experimental not vulnerable (OK)
RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK)
Testing ciphers per protocol via OpenSSL plus sockets against the server, ordered by encryption strength
Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)
-----------------------------------------------------------------------------------------------------------------------------
SSLv2
SSLv3
TLS 1
TLS 1.1
TLS 1.2
xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS 1.3
x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384
x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256
x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256
Running client simulations (HTTP) via sockets
Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy
------------------------------------------------------------------------------------------------
Android 4.2.2 No connection
Android 4.4.2 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
Android 5.0.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256)
Android 6.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 256 bit ECDH (P-256)
Android 7.0 TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 253 bit ECDH (X25519)
Android 8.1 (native) No connection
Android 9.0 (native) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519)
Chrome 65 Win 7 TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 253 bit ECDH (X25519)
Chrome 74 (Win 10) No connection
Firefox 62 Win 7 TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 253 bit ECDH (X25519)
Firefox 66 (Win 8.1/10) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519)
IE 6 XP No connection
IE 7 Vista No connection
IE 8 Win 7 No connection
IE 8 XP No connection
IE 11 Win 7 No connection
IE 11 Win 8.1 No connection
IE 11 Win Phone 8.1 No connection
IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519)
Edge 17 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 253 bit ECDH (X25519)
Opera 60 (Win 10) No connection
Safari 9 iOS 9 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
Safari 9 OS X 10.11 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
Safari 10 OS X 10.12 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
Apple ATS 9 iOS 9 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
Tor 17.0.9 Win 7 No connection
Java 6u45 No connection
Java 7u25 No connection
Java 8u161 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
Java 9.0.4 TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
OpenSSL 1.0.1l TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
OpenSSL 1.0.2e TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384 256 bit ECDH (P-256)
OpenSSL 1.1.0j (Debian) TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 253 bit ECDH (X25519)
OpenSSL 1.1.1b (Debian) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519)
Thunderbird (60.6) TLSv1.3 TLS_AES_256_GCM_SHA384 253 bit ECDH (X25519)
|
|
Because it always does things wonkily doens't it
|
|
This is a bug waiting to happen
|
|
|
|
|
|
|
|
|