{"action":"created","issue":{"url":"https://api.github.com/repos/drwetter/testssl.sh/issues/791","repository_url":"https://api.github.com/repos/drwetter/testssl.sh","labels_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/791/labels{/name}","comments_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/791/comments","events_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/791/events","html_url":"https://github.com/drwetter/testssl.sh/issues/791","id":243025816,"number":791,"title":"GREASE","user":{"login":"dcooper16","id":16493199,"avatar_url":"https://avatars7.githubusercontent.com/u/16493199?v=4","gravatar_id":"","url":"https://api.github.com/users/dcooper16","html_url":"https://github.com/dcooper16","followers_url":"https://api.github.com/users/dcooper16/followers","following_url":"https://api.github.com/users/dcooper16/following{/other_user}","gists_url":"https://api.github.com/users/dcooper16/gists{/gist_id}","starred_url":"https://api.github.com/users/dcooper16/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcooper16/subscriptions","organizations_url":"https://api.github.com/users/dcooper16/orgs","repos_url":"https://api.github.com/users/dcooper16/repos","events_url":"https://api.github.com/users/dcooper16/events{/privacy}","received_events_url":"https://api.github.com/users/dcooper16/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-07-14T15:11:04Z","updated_at":"2017-07-14T16:21:13Z","closed_at":null,"body":"This is a follow up to #494 (which is about testing whether server's properly support version negotiation):\r\n> Actually I thought it would be a good idea to reimplement a tolerance test for 2.9dev.\r\n\r\nThe IETF TLS WG adopted [draft-ietf-tls-grease](https://datatracker.ietf.org/doc/draft-ietf-tls-grease/) (Generate Random Extensions And Sustain Extensibility), which in some ways is an extension of the version tolerance test. The idea is to introduce unknown values into various places where the standard calls for servers to ignore unknown values in order to test that servers correctly ignore unknown values.\r\n\r\nAccording to one [email](https://mailarchive.ietf.org/arch/msg/tls/k1KfZGwAGnZYgAsLN2sztRw5APc) on the TLS WG mail list, this technique has already been used to discover an implementation that would have failed a version tolerance test (based on TLSv1.3's new method of version negotiation).\r\n\r\nI may be too early to implement [draft-ietf-tls-grease](https://datatracker.ietf.org/doc/draft-ietf-tls-grease/) (code points haven't been assigned yet), but we should consider whether testing of this sort should be added to testssl.sh at some point in the future."},"comment":{"url":"https://api.github.com/repos/drwetter/testssl.sh/issues/comments/315402400","html_url":"https://github.com/drwetter/testssl.sh/issues/791#issuecomment-315402400","issue_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/791","id":315402400,"user":{"login":"dcooper16","id":16493199,"avatar_url":"https://avatars7.githubusercontent.com/u/16493199?v=4","gravatar_id":"","url":"https://api.github.com/users/dcooper16","html_url":"https://github.com/dcooper16","followers_url":"https://api.github.com/users/dcooper16/followers","following_url":"https://api.github.com/users/dcooper16/following{/other_user}","gists_url":"https://api.github.com/users/dcooper16/gists{/gist_id}","starred_url":"https://api.github.com/users/dcooper16/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcooper16/subscriptions","organizations_url":"https://api.github.com/users/dcooper16/orgs","repos_url":"https://api.github.com/users/dcooper16/repos","events_url":"https://api.github.com/users/dcooper16/events{/privacy}","received_events_url":"https://api.github.com/users/dcooper16/received_events","type":"User","site_admin":false},"created_at":"2017-07-14T16:21:13Z","updated_at":"2017-07-14T16:21:13Z","body":"Yes, I think this should be a separate test. testssl.sh currently has tests to check for certain vulnerabilities (e.g., heartbleed), but otherwise it doesn't tend to check for implementation bugs that don't lead to security vulnerabilities. In fact, it does just the opposite; it silently tries to work around implementation bugs in order to correctly determine information about a server's configuration. For example, tests to determine what cipher suites a server supports are written to work around servers that have problems with ClientHello messages with more than 128 ciphers.\r\n\r\nI think we should continue that idea; have other tests work around implementation bugs and have a separate test that looks for them."}}
{"actor":{"display_login":"dcooper16"}}