Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix sslyze crash on some domains in nassl handshake #108

Open
wants to merge 1 commit into
base: release
Choose a base branch
from

Conversation

moubarakelmahdi1
Copy link

This pull request fixes two blocking errors in nassl that occur when running sslyze on certain domain names.
When the "last octet invalid" and "bad signature" errors occur together, or when the "first octet invalid" and "bad signature" errors occur together, the thread stops and the SoftTimeLimitExceeded error is thrown on our threads.

Exception in thread Thread-3:
Traceback (most recent call last):
...
File "/home/***/.venv/***/lib/python3.10/site-packages/nassl/ssl_client.py", line 194, in do_handshake
    self._ssl.do_handshake()
nassl._nassl.OpenSSLError: error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid
error:1417B07B:SSL routines:tls_process_cert_verify:bad signature

I have forked the project and made the necessary change to fix these errors.

These changes should prevent the blocking errors from occurring and allow sslyze to run successfully on certain domain names. I have tested these changes locally and they appear to be working as expected.

…and "bad signature" error or "last octet invalide" and "bad signature" error
@moubarakelmahdi1 moubarakelmahdi1 changed the title Fix sslyze crash on some domains using sslyze Fix sslyze crash on some domains in nassl handshake Mar 27, 2023
@moubarakelmahdi1
Copy link
Author

"https://vpn.neoen.com/"
"https://vpn.routin1883.com/"
Here are some domains where you can loop and try to reproduce the error

@nabla-c0d3
Copy link
Owner

Hello,
Thanks for the details and the PR. Unfortunately your changes will not solve the underlying issue, which is that the server is unreliable and will sometimes close the connection early (resulting in this "octet invalid" error).

I don't see a fix for this as the server can't be scanned in a reliable way: sometimes connections will succeed and sometimes they won't.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants