@@ -16076,23 +16076,22 @@ run_renego() {
1607616076 fi
1607716077 case "$sec_client_renego" in
1607816078 0) # We try again if server is HTTP. This could be either a node.js server or something else.
16079- # Mitigations (default values) for:
16080- # - node.js allows 3x R and then blocks. So then 4x should be tested.
16081- # - F5 BIG-IP ADS allows 5x R and then blocks. So then 6x should be tested.
16079+ # Mitigations (default values) for:
16080+ # - node.js allows 3x R and then blocks. So then 4x should be tested.
16081+ # - F5 BIG-IP ADS allows 5x R and then blocks. So then 6x should be tested.
1608216082 # This way we save a couple seconds as we weeded out the ones which are more robust
16083- # Amount of times tested before breaking is set in SSL_RENEG_ATTEMPTS.
16083+ # Amount of times tested before breaking is set in SSL_RENEG_ATTEMPTS.
1608416084 if [[ $SERVICE != HTTP ]]; then
1608516085 pr_svrty_medium "VULNERABLE (NOT ok)"; outln ", potential DoS threat"
1608616086 fileout "$jsonID" "MEDIUM" "VULNERABLE, potential DoS threat" "$cve" "$cwe" "$hint"
1608716087 else
16088- (for ((i=0; i < ssl_reneg_attempts; i++ )); do echo R; sleep 1; done) | \
16088+ (for ((i=0; i < ssl_reneg_attempts; i++ )); do echo R; sleep 1; done) | \
1608916089 $OPENSSL s_client $(s_client_options "$proto $legacycmd $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY") >$TMPFILE 2>>$ERRFILE
1609016090 case $? in
16091- 0) pr_svrty_high "VULNERABLE (NOT ok)"; outln ", DoS threat ($ssl_reneg_attempts attempts)"
16091+ 0) pr_svrty_high "VULNERABLE (NOT ok)"; outln ", DoS threat ($ssl_reneg_attempts attempts)"
1609216092 fileout "$jsonID" "HIGH" "VULNERABLE, DoS threat" "$cve" "$cwe" "$hint"
1609316093 ;;
16094- 1) pr_svrty_good "not vulnerable (OK)"
16095- outln " -- mitigated (disconnect within $ssl_reneg_attempts)"
16094+ 1) pr_svrty_good "not vulnerable (OK)"; outln " -- mitigated (disconnect within $ssl_reneg_attempts)"
1609616095 fileout "$jsonID" "OK" "not vulnerable, mitigated" "$cve" "$cwe"
1609716096 ;;
1609816097 *) prln_warning "FIXME (bug): $sec_client_renego ($ssl_reneg_attempts tries)"
0 commit comments