[BUG / possible BUG] - Website with a '401 Unauthorized' message gets stuck under certain conditions

[accampato]

Hi all,
I would like to report a possible minor bug.

When testssl is started to check a site protected by authentication, testssl gets stuck and does not handle the error condition.

I am running version testssl.sh version 3.2rc4 from https://testssl.sh/dev/

Command line / docker command to reproduce:

testssl.sh 75.244.67.234:7547 -> website NO SSL with auth, testssl is stuck
testssl.sh 50.87.116.68:2077 -> website NO SSL with auth, testssl is stuck
testssl.sh 200.72.40.109:12426 -> website SSL with auth, testssl is OK

System

OS: Ubuntu 24.10
Platform: Linux 6.11.0-18-generic x86_64

Additional context
The program seems to be getting stuck inside the determine_optimal_sockets_params function, when a NO SSL target is requested.

[dcooper16]

The program is not getting stuck, it is just very slow. If you look at the documentation, for --connect-timeout and --openssl-timeout, it notes that testssl.sh may hang for around 2 minutes for each attempt to connect to a site that isn't actually available. Multiply that by multiple connection attempts and the result is that it will take a very long time before testssl.sh prompts that the provided URI does not appear to be a TLS enabled server.

[accampato]

Hi @dcooper16, thanks for your reply.

Ok, good that it's not stuck but it behavior is a bit strange, also because in this case the site is available and it's just with authentication.

So I have two different behavior for two NO SSL site:
./testssl.sh 62.149.128.154:80 -> takes 15s to complete with warning "The results might look ok but they could be nonsense. Really proceed ? ("yes" to continue)"
and for
./testssl.sh 75.244.67.234:7547 -> take very very long time, just to say that could be nonsense...

I can use also timeout options, but in that case also if I set a 30sec (reasonable) timeout, it takes almost 6 min to complete.

[dcooper16]

Ok, good that it's not stuck but it behavior is a bit strange, also because in this case the site is available and it's just with authentication.

It seems that all of your examples are of websites. So, they support HTTP queries, but not HTTP over SSL/TLS. However, testssl.sh isn't limited to websites. It tries to test SSL/TLS implementations regardless of what protocol is running on top of the SSL/TLS (e.g., HTTP, LDAP, SMTP, IMAP).

From testssl.sh's point of view, the difference between the two sites is how they respond to SSL/TLS queries (ClientHello messages). In one case, the server quickly responds with an HTTP Bad Request message. In the other case the server does not respond at all. So, in one case testssl.sh gets a response that doesn't make sense as an SSL/TLS message, and so it relatively quickly determines that it is not an SSL/TLS server. In the other case, testssl.sh takes a very long time since with each attempt it is waits a long time for a response (any response).

It seems unlikely to me that one server's lack of response to an SSL/TLS ClientHello has anything to do with HTTP-level authentication, but I don't know. In the case of SSL/TLS, the SSL/TLS connection is (at least partially) established before the server requests authentication, so testssl.sh can test such servers even if authentication is required to actually connect to the server.

[accampato]

Now it's clearer, thank you.
I did some tests with OpenSSL, and the 'slow' site responds to the SSL/TLS Client Hello after a long time, with a cleartext 'HTTP/1.1 401 Unauthorized'.
I’m not sure if this is due to the HTTP authentication implementation or the specific website configuration. I tested other HTTP websites with Basic Auth and observed the same behavior, but I didn’t verify the web server version.

In any case, I don't think there's anything that can be done from a testssl perspective.

Thanks for your effort. What do you think—shall we close the issue?