| Summary: | net-analyzer/testssl: bundled-openssl does not work, false positive results | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Anton Bolshakov <anton.bugs> |
| Component: | Current packages | Assignee: | Michael Palimaka (kensington) <kensington> |
| Status: | RESOLVED FIXED | ||
| Severity: | critical | CC: | jstein |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
Anton Bolshakov
2018-08-20 04:26:04 UTC
The quick workaround is to specify env variable: OPENSSL=/opt/testssl/openssl.Linux.x86_64 testssl.sh However, it is platform dependant and it might be easier to compile the required openssl library statically. We have fixed a similar bug in sslscan: https://bugs.gentoo.org/603828 Please fix asap I have created a new ebuild for the forked openssl (openssl-bad) and patched testssl ( sed -i ${PN}.sh \
-e 's|OPENSSL="$1/openssl"|OPENSSL="$1/openssl-bad"|' || die)
Feel free to use it:
https://github.com/pentoo/pentoo-overlay/commit/bd6396c83e0f9fc2dc1d45104a7b5950d596fe0f
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b9e4b6ccb7e424d708f67be1512cdb3df88ebccf commit b9e4b6ccb7e424d708f67be1512cdb3df88ebccf Author: Michael Palimaka <kensington@gentoo.org> AuthorDate: 2018-10-06 10:52:53 +0000 Commit: Michael Palimaka <kensington@gentoo.org> CommitDate: 2018-10-06 10:54:39 +0000 net-analyzer/testssl: use bundled openssl by default when enabled Closes: https://bugs.gentoo.org/664084 Signed-off-by: Michael Palimaka <kensington@gentoo.org> Package-Manager: Portage-2.3.49, Repoman-2.3.11 net-analyzer/testssl/testssl-2.9.5_p5-r1.ebuild | 60 +++++++++++++++++++++++++ 1 file changed, 60 insertions(+) Thanks for the feedback. There was previously a postinst message when USE="bundled-openssl" was enabled, however I've improved the ebuild to use the bundled binary by default when enabled. I agree that an even better solution would be to use a dedicated openssl build like your openssl-bad, unfortunately I don't have the bandwidth to take on maintaining any new packages right now. I have looked at the fix and feel it is not complete. The flag is still disabled by default and you have only applied it for amd64 platform. There are 3 linux openssl binaries provided with this package so you can apply the same for x85 and add kerberos flag for amd64. I'm afraid I'm not comfortable with enabling a USE flag that installs a binary blog by default. If we did have the custom openssl build in the tree to depend on instead that would be a different story. Handling of the x86 binary isn't in place since the ebuild isn't keyworded for x86 yet (nobody has requested it). I'm not familiar with what the difference with openssl.Linux.x86_64.krb5 is, do you have any idea? I'm a big confused, isn't it keyworded and even stable on x86? https://github.com/gentoo/gentoo/blob/master/net-analyzer/testssl/testssl-2.9.5_p5.ebuild#L15 As for the kerberos, see the following https://github.com/drwetter/testssl.sh/blob/2.9dev/bin/Readme.md The documentation says "Kerberos ciphers" : - 193(+4 GOST) ciphers including kerberos - 179(+4 GOST) ciphers without kerberos Unfortunately, upstream didn't provide it for x86 so I decided to fork openssl-bad at this point. It solved all problems at once. (In reply to Anton Bolshakov from comment #8) > I'm a big confused, isn't it keyworded and even stable on x86? > > https://github.com/gentoo/gentoo/blob/master/net-analyzer/testssl/testssl-2. > 9.5_p5.ebuild#L15 I'm not sure how I missed that! Fix incoming. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=51bd4d9ca1d701bc651d904425a043226beab092 commit 51bd4d9ca1d701bc651d904425a043226beab092 Author: Michael Palimaka <kensington@gentoo.org> AuthorDate: 2018-10-11 13:22:13 +0000 Commit: Michael Palimaka <kensington@gentoo.org> CommitDate: 2018-10-11 13:23:02 +0000 net-analyzer/testssl: revbump fixes improves bundled-openssl support Bug: https://bugs.gentoo.org/664084 Signed-off-by: Michael Palimaka <kensington@gentoo.org> Package-Manager: Portage-2.3.49, Repoman-2.3.11 net-analyzer/testssl/testssl-2.9.5_p5-r2.ebuild | 74 +++++++++++++++++++++++++ 1 file changed, 74 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=90c11d51417b23f50168756ce89a603375486331 commit 90c11d51417b23f50168756ce89a603375486331 Author: Michael Palimaka <kensington@gentoo.org> AuthorDate: 2018-10-11 13:20:17 +0000 Commit: Michael Palimaka <kensington@gentoo.org> CommitDate: 2018-10-11 13:23:01 +0000 profiles: handle net-analyzer/testssl arch-specific USE flags Bug: https://bugs.gentoo.org/664084 Signed-off-by: Michael Palimaka <kensington@gentoo.org> profiles/arch/amd64/package.use.mask | 4 ++++ profiles/arch/base/package.use.mask | 4 ++++ profiles/arch/x86/package.use.mask | 4 ++++ 3 files changed, 12 insertions(+) great, thanks! I haven't tested but it looks ok. |
