mainGnuTLS - Support: sr #107532, gnutls-cli-debug [incorrecttly]...

 
 

sr #107532: gnutls-cli-debug [incorrecttly] reports SRP support for Windows Server 2003/IIS 6.0

Submitter:  Jeffrey Walton <noloader>
Submitted:  Mon 22 Nov 2010 08:07:27 AM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 22 Nov 2010 10:53:21 AM UTC, comment #3: 

Hi Nikos,

> Is this the output of 2.11.x gnutls-cli?

I believe it was a distribution's version (Ubuntu). I suspect it was 2.8.5, but don't know for sure.

I performed the process of installing Nettle and GnuTLS a second time. Instead of make bootstrap (per http://git.savannah.gnu.org/cgit/gnutls.git/tree/README-alpha), I used configure this time around. gnutls-cli-debug now runs and claims version 2.11.5.

Jeff

Jeffrey Walton <noloader>
Mon 22 Nov 2010 09:30:59 AM UTC, comment #2: 


> Is this the output of 2.11.x gnutls-cli?

Good question. I managed to shoot myself out of the water since reporting and your subsequent question.

Below are the effects of a 'configure/make/make install' cycle from the bleeding edge gear fetched with git.

Jeff

$ gnutls-cli-debug --version
gnutls-cli-debug: /usr/lib/libgnutls.so.26: version `GNUTLS_2_12' not found (required by gnutls-cli-debug)

Jeffrey Walton <noloader>
Mon 22 Nov 2010 08:45:42 AM UTC, comment #1: 

Is this the output of 2.11.x gnutls-cli?

Nikos Mavrogiannopoulos <nmav>
Group administrator
Mon 22 Nov 2010 08:07:27 AM UTC, original submission:  

I believe "Checking for SRP authentication support (TLS extension)... yes' is incorrect. The actual target of the probe was redacted below.

$ gnutls-cli-debug -p 443 www.example.com
Resolving 'www.example.com'...
Connecting to 'www.xxx.yyy.zzz:443'...
Checking for TLS 1.1 support... no
Checking fallback from TLS 1.1 to... TLS 1.0
Checking for TLS 1.0 support... yes
Checking for SSL 3.0 support... yes
Checking for HTTPS server name... not checked
Checking for version rollback bug in RSA PMS... no
Checking for version rollback bug in Client Hello... no
Checking whether we need to disable TLS 1.0... N/A
Checking whether the server ignores the RSA PMS version... yes
Checking whether the server can accept Hello Extensions... yes
Checking whether the server can accept cipher suites not in SSL 3.0 spec... yes
Checking whether the server can accept a bogus TLS record version in the client hello... yes
Checking for certificate information... N/A
Checking for trusted CAs... N/A
Checking whether the server understands TLS closure alerts... no
Checking whether the server supports session resumption... yes
Checking for export-grade ciphersuite support... yes
Checking RSA-export ciphersuite info... N/A
Checking for anonymous authentication support... no
Checking anonymous Diffie-Hellman group info... N/A
Checking for ephemeral Diffie-Hellman support... no
Checking ephemeral Diffie-Hellman group info... N/A
Checking for AES cipher support (TLS extension)... no
Checking for CAMELLIA cipher support (TLS extension)... no
Checking for 3DES cipher support... yes
Checking for ARCFOUR 128 cipher support... yes
Checking for ARCFOUR 40 cipher support... yes
Checking for MD5 MAC support... yes
Checking for SHA1 MAC support... yes
Checking for LZO compression support (GnuTLS extension)... no
Checking for max record size (TLS extension)... no
Checking for SRP authentication support (TLS extension)... yes
Checking for OpenPGP authentication support (TLS extension)... no

Jeffrey Walton <noloader>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by noloader (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-12-19 nmav Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code