Add cipher endpoints

Author: pimterry

src/endpoints/groups.ts

@@ -128,8 +128,15 @@ export const tlsVersions: EndpointGroup = {
     description: 'Endpoints that only accept specific TLS versions. These can be used together, to simulate a server supporting any specific combination of versions.'
 };
 
+export const tlsCiphers: EndpointGroup = {
+    id: 'ciphers',
+    name: 'Cipher Suites',
+    description: 'Endpoints that offer only a specific weak or legacy cipher suite (over TLS 1.2), to test how your client handles it. A well-configured client should refuse to connect.'
+};
+
 export const tlsGroupOrder: EndpointGroup[] = [
     tlsCertificateModes,
     tlsProtocolNegotiation,
-    tlsVersions
+    tlsVersions,
+    tlsCiphers
 ];

src/endpoints/tls-index.ts

@@ -23,6 +23,7 @@ export interface TlsEndpoint {
 
 export * from './tls/alpn-specifiers.js';
 export * from './tls/cert-modes.js';
+export * from './tls/ciphers.js';
 export * from './tls/example.js';
 export * from './tls/no-tls.js';
 export * from './tls/tls-versions.js';

src/endpoints/tls/ciphers.ts

@@ -0,0 +1,80 @@
+import { TlsEndpoint } from '../tls-index.js';
+import { tlsCiphers } from '../groups.js';
+
+// Each of these offers only a specific weak/legacy cipher, capped at TLS 1.2. The cap matters:
+// none of these ciphers (static RSA, CBC, NULL, weak DH) exist in TLS 1.3, which only has AEAD
+// suites with ephemeral key exchange. `@SECLEVEL=0` drops OpenSSL's security-level so the weak
+// suites can be used. A client only connects if it's willing to negotiate the weak cipher.
+
+// A deliberately weak 1024-bit DH group for the Logjam-style weak-DH test, pre-generated
+// because generating one per process is slow. It's intentionally weak - nothing to protect.
+const WEAK_DH_PARAMS = `-----BEGIN DH PARAMETERS-----
+MIGHAoGBAPwIcVZU2Dt7WtCI8hhI8wECGgMidZpXASdKXwAQReA+739EGI4HUmM4
+qkm2vyhAReLHc4UALQI8SKV5G7WDHKIAZi0sDofR3qitV2Z44aVk0u4Z3M8S1NA9
+aSgcv6Iz0BQPADQkEq28bRT0i3/A+K6DuHbC98RtnhqF+OuaHXJ/AgEC
+-----END DH PARAMETERS-----`;
+
+export const staticRsa: TlsEndpoint = {
+    sniPart: 'static-rsa',
+    configureTlsOptions() {
+        return {
+            ciphers: 'AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA@SECLEVEL=0',
+            maxVersion: 'TLSv1.2'
+        };
+    },
+    meta: {
+        path: 'static-rsa',
+        description: 'Uses RSA key exchange only, so the connection has no forward secrecy.',
+        examples: ['https://static-rsa.testserver.host/'],
+        group: tlsCiphers
+    }
+};
+
+export const cbc: TlsEndpoint = {
+    sniPart: 'cbc',
+    configureTlsOptions() {
+        return {
+            ciphers: 'ECDHE-RSA-AES128-SHA:AES128-SHA@SECLEVEL=0',
+            maxVersion: 'TLSv1.2'
+        };
+    },
+    meta: {
+        path: 'cbc',
+        description: 'Uses a CBC-mode cipher suite (as opposed to an AEAD suite like AES-GCM).',
+        examples: ['https://cbc.testserver.host/'],
+        group: tlsCiphers
+    }
+};
+
+export const nullCipher: TlsEndpoint = {
+    sniPart: 'null-cipher',
+    configureTlsOptions() {
+        return {
+            ciphers: 'NULL-SHA:NULL-SHA256@SECLEVEL=0',
+            maxVersion: 'TLSv1.2'
+        };
+    },
+    meta: {
+        path: 'null-cipher',
+        description: 'Uses a NULL cipher. The handshake is authenticated, but application data is unencrypted.',
+        examples: ['https://null-cipher.testserver.host/'],
+        group: tlsCiphers
+    }
+};
+
+export const weakDh: TlsEndpoint = {
+    sniPart: 'weak-dh',
+    configureTlsOptions() {
+        return {
+            ciphers: 'DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA@SECLEVEL=0',
+            maxVersion: 'TLSv1.2',
+            dhparam: WEAK_DH_PARAMS
+        };
+    },
+    meta: {
+        path: 'weak-dh',
+        description: 'Uses ephemeral Diffie-Hellman key exchange with a weak 1024-bit group.',
+        examples: ['https://weak-dh.testserver.host/'],
+        group: tlsCiphers
+    }
+};

test/tls-ciphers.spec.ts

@@ -0,0 +1,76 @@
+import * as net from 'net';
+import * as tls from 'tls';
+
+import { expect } from 'chai';
+import { DestroyableServer, makeDestroyable } from 'destroyable-server';
+
+import { createTestServer } from './test-helpers.js';
+
+describe("TLS cipher endpoints", () => {
+
+    let server: DestroyableServer;
+    let port: number;
+
+    beforeEach(async () => {
+        server = makeDestroyable(await createTestServer());
+        await new Promise<void>((resolve) => server.listen(resolve));
+        port = (server.address() as net.AddressInfo).port;
+    });
+    afterEach(async () => { await server.destroy(); });
+
+    // Offers the given legacy cipher (and, by not capping the version, TLS 1.3 too) so we can
+    // check both that the endpoint negotiates the weak cipher AND that it caps at TLS 1.2.
+    const negotiate = (servername: string, ciphers: string) =>
+        new Promise<{ name: string, version: string | null }>((resolve, reject) => {
+            const conn = tls.connect({
+                port, host: '127.0.0.1', servername, rejectUnauthorized: false,
+                ciphers: `${ciphers}@SECLEVEL=0`
+            });
+            conn.on('secureConnect', () => {
+                const info = { name: conn.getCipher().name, version: conn.getProtocol() };
+                conn.destroy();
+                resolve(info);
+            });
+            conn.on('error', reject);
+        });
+
+    it("static-rsa negotiates an RSA-key-exchange suite over TLS 1.2", async () => {
+        const { name, version } = await negotiate('static-rsa.localhost', 'AES128-GCM-SHA256:AES128-SHA');
+        expect(version).to.equal('TLSv1.2');
+        expect(name).to.match(/^AES(128|256)-/); // no ECDHE-/DHE- prefix => static RSA
+    });
+
+    it("cbc negotiates a CBC-mode suite over TLS 1.2", async () => {
+        const { name, version } = await negotiate('cbc.localhost', 'ECDHE-RSA-AES128-SHA');
+        expect(version).to.equal('TLSv1.2');
+        expect(name).to.equal('ECDHE-RSA-AES128-SHA'); // -SHA (not -SHA256/-GCM) => CBC
+    });
+
+    it("null-cipher negotiates a NULL cipher over TLS 1.2", async () => {
+        const { name, version } = await negotiate('null-cipher.localhost', 'NULL-SHA');
+        expect(version).to.equal('TLSv1.2');
+        expect(name).to.match(/NULL/);
+    });
+
+    it("weak-dh negotiates ephemeral DH over TLS 1.2", async () => {
+        const { name, version } = await negotiate('weak-dh.localhost', 'DHE-RSA-AES128-SHA');
+        expect(version).to.equal('TLSv1.2');
+        expect(name).to.match(/^DHE-/);
+    });
+
+    it("refuses a client that won't offer the weak cipher", async () => {
+        // A default modern client offers no NULL cipher, so it can't connect to null-cipher.
+        const outcome = await new Promise<'connected' | 'failed'>((resolve) => {
+            const conn = tls.connect({ port, host: '127.0.0.1', servername: 'null-cipher.localhost', rejectUnauthorized: false });
+            conn.on('secureConnect', () => { conn.destroy(); resolve('connected'); });
+            conn.on('error', () => resolve('failed'));
+        });
+        expect(outcome).to.equal('failed');
+    });
+
+    it("treats two cipher endpoints as a conflict", async () => {
+        let rejected = false;
+        await negotiate('static-rsa--null-cipher.localhost', 'AES128-SHA').catch(() => { rejected = true; });
+        expect(rejected).to.equal(true);
+    });
+});