diff --git a/services/scanners/https/https_scanner.py b/services/scanners/https/https_scanner.py index 63cf79f97c..9d78455361 100755 --- a/services/scanners/https/https_scanner.py +++ b/services/scanners/https/https_scanner.py @@ -53,14 +53,14 @@ def process_results(results): report = {"error": "missing"} else: - # Assumes that HTTPS would be technically present, with or without issues - if results["Downgrades HTTPS"]: + if results["Valid HTTPS"]: + https = "Valid HTTPS" # Yes + elif results["HTTPS Bad Chain"]: + https = "Bad Chain" # Yes + elif results["Downgrades HTTPS"]: https = "Downgrades HTTPS" # No else: - if results["Valid HTTPS"]: - https = "Valid HTTPS" # Yes - elif results["HTTPS Bad Chain"]: - https = "Bad Chain" # Yes + https = "No HTTPS" report["implementation"] = https diff --git a/services/scanners/results/result_processor.py b/services/scanners/results/result_processor.py index 3ebd9cb85a..ef11877d6b 100755 --- a/services/scanners/results/result_processor.py +++ b/services/scanners/results/result_processor.py @@ -198,9 +198,7 @@ def process_ssl(results, guidance, domain_key, uuid, db): acceptable_curves = [] weak_curves = [] - if results.get("error") == "missing": - negative_tags.append("ssl2") - elif results.get("error") == "unreachable": + if results.get("error") == "unreachable": neutral_tags.append("ssl9") else: for cipher in results["cipher_list"]: diff --git a/services/scanners/ssl/requirements.txt b/services/scanners/ssl/requirements.txt index 29ca91d33e..c82365b024 100755 --- a/services/scanners/ssl/requirements.txt +++ b/services/scanners/ssl/requirements.txt @@ -10,3 +10,4 @@ pretend uvloop httptools scapy +sockets diff --git a/services/scanners/ssl/ssl_scanner.py b/services/scanners/ssl/ssl_scanner.py index 3098475656..9c120939f6 100755 --- a/services/scanners/ssl/ssl_scanner.py +++ b/services/scanners/ssl/ssl_scanner.py @@ -15,6 +15,7 @@ from starlette.applications import Starlette from starlette.routing import Route, Mount, WebSocketRoute from starlette.responses import Response +from socket import gaierror from sslyze.server_connectivity import ServerConnectivityTester from sslyze.errors import ConnectionToServerFailed, ServerHostnameCouldNotBeResolved from sslyze.plugins.scan_commands import ScanCommand @@ -114,16 +115,24 @@ def get_supported_tls(highest_supported, domain): def scan_ssl(domain): try: server_info = get_server_info(domain) + + highest_tls_supported = str( + server_info.tls_probing_result.highest_tls_version_supported + ).split(".")[1] + + tls_supported = get_supported_tls(highest_tls_supported, domain) except ConnectionToServerFailed as e: logging.error(f"Failed to connect to {domain}: {e.error_message}") RES_QUEUE.put({}) return - - highest_tls_supported = str( - server_info.tls_probing_result.highest_tls_version_supported - ).split(".")[1] - - tls_supported = get_supported_tls(highest_tls_supported, domain) + except ServerHostnameCouldNotBeResolved as e: + logging.error(f"{domain} could not be resolved: {e.error_message}") + RES_QUEUE.put({}) + return + except gaierror as e: + logging.error(f"Could not retrieve address info for {domain} {e.error_message}") + RES_QUEUE.put({}) + return scanner = Scanner() @@ -212,8 +221,9 @@ def scan_ssl(domain): logging.info("Parsing Elliptic Curve Scan results...") res["supports_ecdh_key_exchange"] = result.supports_ecdh_key_exchange res["supported_curves"] = [] - for curve in result.supported_curves: - res["supported_curves"].append(curve.name) + if result.supported_curves: + for curve in result.supported_curves: + res["supported_curves"].append(curve.name) RES_QUEUE.put(res) @@ -222,11 +232,8 @@ def process_results(results): logging.info("Processing SSL scan results...") report = {} - # Get cipher/protocol data via sslyze for a host. - if results == {}: - report = {"error": "missing"} - + report = {"error": "unreachable"} else: for version in [ "SSL_2_0", @@ -250,7 +257,7 @@ def process_results(results): report["supports_ecdh_key_exchange"] = results.get( "supports_ecdh_key_exchange", False ) - report["supported_curves"] = results["supported_curves"] + report["supported_curves"] = results.get("supported_curves", []) logging.info(f"Processed SSL scan results: {str(report)}") return report @@ -294,34 +301,8 @@ async def scan(scan_request): logging.info("Performing scan...") - try: - p = Process(target=scan_ssl, args=(domain,)) - wait_timeout(p, TIMEOUT) - - except ServerHostnameCouldNotBeResolved as e: - logging.error(f"The designated domain could not be resolved: ({type(e).__name__}: {str(e)})") - dispatch_results( - { - "scan_type": "ssl", - "uuid": uuid, - "domain_key": domain_key, - "results": {"error": "unreachable"}, - }, - server_client, - ) - return Response("Designated domain could not be resolved", status_code=500) - - except ScanTimeoutException: - dispatch_results( - { - "scan_type": "ssl", - "uuid": uuid, - "domain_key": domain_key, - "results": {"error": "unreachable"}, - }, - server_client, - ) - return Response("Timeout occurred while scanning", status_code=500) + p = Process(target=scan_ssl, args=(domain,)) + wait_timeout(p, TIMEOUT) scan_results = RES_QUEUE.get()