sslyze: init at 3.0.7 #89034

veehaitch · 2020-05-27T16:55:53Z

Motivation for this change

Adds the Python package / application sslyze: SSLyze is a fast and powerful SSL/TLS scanning library.

SSLyze relies on Nassl which uses OpenSSL 1.1. but also OpenSSL 1.0.2e. This legacy version of OpenSSL is—with good reason—marked as insecure in Nixpkgs. In this particular case, however, it is unwanted that OpenSSL 1.0.2e refuses to evaluate due to the known vulnerabilities attribute; SSLyze is a security scanner which leverages OpenSSL 1.0.2e on purpose. As a result, to install Nassl or SSLyze, one has to explicitly allow the evaluation of OpenSSL 1.0.2e globally. It would be great if we could allow evaluation just for the Nassl Python package. I'm not sure, however, if this is possible at all without duplicating the derivation of OpenSSL 1.0.2e.

Things done

jonringer · 2020-05-27T17:01:26Z

Thanks for opening up your first PR to nixpkgs :)

jonringer

is sslyze meant to be used more as a command line utility or an importable python package?

pkgs/development/python-modules/nassl/default.nix

jonringer · 2020-05-27T17:06:08Z

pkgs/development/python-modules/nassl/default.nix

+    cp ${zlibStatic.out}/lib/libz.a deps/zlib-1.2.11/
+  '';
+
+  propagatedBuildInputs = [ tls-parser pytest ];


couldn't find anything in their setup.py about dependencies, but this should probably be:

Suggested change

propagatedBuildInputs = [ tls-parser pytest ];

propagatedBuildInputs = [ tls-parser ];

checkInputs = [ pytest ];

Apparently, pytest is required in the setuptoolsCheckPhase.

that should be fine...

It should not be propagated still.

You're right! I've removed pytest from the propagatedBuildInputs

pkgs/development/python-modules/sslyze/default.nix

veehaitch · 2020-05-27T17:12:24Z

is sslyze meant to be used more as a command line utility or an importable python package?

Actually, both :)

jonringer · 2020-05-27T21:42:21Z

Actually, both :)

Then you'll probably want to do something similar to https://github.com/NixOS/nixpkgs/blob/master/doc/languages-frameworks/python.section.md#topythonapplication-function in which you export the package as a top-level attribute as well

veehaitch · 2020-05-27T21:44:02Z

Actually, both :)

Then you'll probably want to do something similar to https://github.com/NixOS/nixpkgs/blob/master/doc/languages-frameworks/python.section.md#topythonapplication-function in which you export the package as a top-level attribute as well

I guess I already did that :)

https://github.com/NixOS/nixpkgs/pull/89034/files#diff-036410e9211b4336186fc613f7200b12R22115

pkgs/development/python-modules/sslyze/default.nix

pkgs/development/python-modules/tls-parser/default.nix

pkgs/development/python-modules/nassl/nix-ssl-cert-file.patch

pkgs/development/python-modules/sslyze/default.nix

pkgs/development/python-modules/tls-parser/default.nix

jonringer · 2020-05-28T21:55:18Z

pkgs/development/python-modules/nassl/default.nix

+  opensslLegacyStatic = (openssl_1_0_2.override nasslOpensslArgs).overrideAttrs (
+    oldAttrs: rec {
+      name = "openssl-${version}";
+      version = "1.0.2e";
+      src = fetchurl {
+        url = "https://www.openssl.org/source/${name}.tar.gz";
+        sha256 = "1zqb1rff1wikc62a7vj5qxd1k191m8qif5d05mwdxz2wnzywlg72";
+      };
+      configureFlags = oldAttrs.configureFlags ++ nasslOpensslFlagsCommon;
+      patches = [ ];
+      buildInputs = oldAttrs.buildInputs ++ [ zlibStatic ];
+    }
+  );


Is there any support for newer versions of openssl?

$ nix-build ./nixpkgs/ -A python3Packages.sslyze error: Package ‘openssl-1.0.2e’ in /home/jon/.cache/nixpkgs-review/pr-89034-2/nixpkgs/pkgs/development/libraries/openssl/default.nix:135 is marked as insecure, refusing to evaluate. Known issues: - Support for OpenSSL 1.0.2 ended with 2019. You can install it anyway by whitelisting this package, using the following methods: a) for `nixos-rebuild` you can add ‘openssl-1.0.2e’ to `nixpkgs.config.permittedInsecurePackages` in the configuration.nix, like so: { nixpkgs.config.permittedInsecurePackages = [ "openssl-1.0.2e" ]; } b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add ‘openssl-1.0.2e’ to `permittedInsecurePackages` in ~/.config/nixpkgs/config.nix, like so: { permittedInsecurePackages = [ "openssl-1.0.2e" ]; } (use '--show-trace' to show detailed location information)

Good point! I've mentioned this in the initial comment on this PR:

SSLyze relies on Nassl which uses OpenSSL 1.1. but also OpenSSL 1.0.2e. This legacy version of OpenSSL is—with good reason—marked as insecure in Nixpkgs. In this particular case, however, it is unwanted that OpenSSL 1.0.2e refuses to evaluate due to the known vulnerabilities attribute; SSLyze is a security scanner which leverages OpenSSL 1.0.2e on purpose. As a result, to install Nassl or SSLyze, one has to explicitly allow the evaluation of OpenSSL 1.0.2e globally. It would be great if we could allow evaluation just for the Nassl Python package. I'm not sure, however, if this is possible at all without duplicating the derivation of OpenSSL 1.0.2e.

is there a way to use 1.1 instead? seems like it's compatible, but there's also a lot going on here so I'm not sure. And commit messages are great when doing git bisect or git log, but not great from a user's perspective when using the package through nix (as they will just get the error I got).

Excellent idea! This works now without the openssl-1.0.2e warning / limitation 👍

veehaitch · 2020-05-29T20:26:12Z

@jonringer Tests are now enabled for sslyze and its dependencies 🙂

jonringer · 2020-06-04T21:29:00Z

pkgs/development/python-modules/nassl/default.nix

+  opensslStatic = (openssl.override nasslOpensslArgs).overrideAttrs (
+    oldAttrs: rec {
+      name = "openssl-${version}";
+      version = "1.1.1";
+      src = fetchurl {
+        url = "https://www.openssl.org/source/${name}.tar.gz";
+        sha256 = "0gbab2fjgms1kx5xjvqx8bxhr98k4r8l2fa8vw7kvh491xd8fdi8";
+      };
+      configureFlags = oldAttrs.configureFlags ++ nasslOpensslFlagsCommon ++ [
+        "enable-weak-ssl-ciphers"
+        "enable-tls1_3"
+        "no-async"
+      ];
+      patches = [ ./nix-ssl-cert-file.patch ];
+      buildInputs = oldAttrs.buildInputs ++ [ zlibStatic cacert ];
+    }
+  );
+  opensslLegacyStatic = (openssl.override nasslOpensslArgs).overrideAttrs (
+    oldAttrs: rec {
+      name = "openssl-${version}";
+      version = "1.0.2e";
+      src = fetchurl {
+        url = "https://www.openssl.org/source/${name}.tar.gz";
+        sha256 = "1zqb1rff1wikc62a7vj5qxd1k191m8qif5d05mwdxz2wnzywlg72";
+      };
+      configureFlags = oldAttrs.configureFlags ++ nasslOpensslFlagsCommon;
+      patches = [ ];
+      buildInputs = oldAttrs.buildInputs ++ [ zlibStatic ];
+      # openssl_1_0_2 needs `withDocs = false`
+      outputs = lib.remove "doc" oldAttrs.outputs;
+    }
+  );


This all seems to be pretty fragile to me, and I'm not a big fan of continuing usage of openssl1.0 which has has known CVEs open.

opinions? @jtojnar @mweinelt @vcunat

Would it be possible to patch the library to link against system openssl instead of building a local static copy? Maybe open an issue upstream.

The downside of missing this is not being able to scan for things that were removed (SSLv3?) from more recent OpenSSL versions AFAIUI. I'm not sure there is an actual need to scan for legacy stuff, but others might disagree.

I've looked into the testssl.sh package and it is shipped without a legacy OpenSSL package.

Thanks for your comments!

I've already tried to

build Nassl without the legacy OpenSSL version potentially accepting a lack of functionality. Unfortunately, there's no flag and the code depends on the legacy version on quite a few places.

use the Nixpkgs OpenSSL version (i.e., at the time of writing, 1.1.1g). With this version, however, Nassl tests started to fail.

AFAICS, Nassl depends on these specific versions of both the legacy and modern OpenSSL library.

Could you try opening an issue upstream about linking against system openssl?

Sure! Here you go: nabla-c0d3/nassl#64

By that thread it seems the 1.0.2 security issues won't be a problem in here.

I'm not sure how to proceed here. Support for using the system OpenSSL (and, hence, dynamic linking) would require upstream work but would still require custom compile flags. However, as @vcunat already pointed out, we'd likely use this build of OpenSSL for Nassl only; this raises the question if static linking is actually an issue here. All the same applies for the legacy version.

For 1.1 it also can't use our nixpkgs-wide build? (perhaps due to missing "enable-weak-ssl-ciphers")

I've tried that and, unfortunately, tests started to fail.

NB: I've just updated tls-parser and sslyze to the latest upstream version.

vcunat

OK, I suppose.

veehaitch requested review from FRidh and jonringer as code owners May 27, 2020 16:55

ofborg bot added the 6.topic: python label May 27, 2020

veehaitch mentioned this pull request May 27, 2020

NixOS for Pentesting Overview #81418

Open

ofborg bot added 8.has: package (new) 10.rebuild-darwin: 1-10 10.rebuild-linux: 1-10 labels May 27, 2020

jonringer reviewed May 27, 2020

View reviewed changes

ofborg bot added the 11.by: package-maintainer label May 27, 2020

jonringer reviewed May 28, 2020

View reviewed changes

veehaitch requested a review from jonringer June 4, 2020 20:42

jonringer reviewed Jun 4, 2020

View reviewed changes

veehaitch mentioned this pull request Jun 5, 2020

Support for dynamic linking of OpenSSL nabla-c0d3/nassl#64

Closed

veehaitch requested a review from vcunat June 18, 2020 07:00

veehaitch added 3 commits June 18, 2020 23:02

pythonPackage.tls-parser: init at 1.2.2

343f689

python3Package.nassl: init at 3.0.0

9a243a6

python3Package.sslyze: init at 3.0.7

9ec1297

veehaitch changed the title ~~sslyze: init at 3.0.4~~ sslyze: init at 3.0.7 Jun 18, 2020

vcunat approved these changes Jun 22, 2020

View reviewed changes

vcunat merged commit e896ebc into NixOS:master Jun 22, 2020

veehaitch deleted the sslyze branch June 22, 2020 23:14

veehaitch mentioned this pull request Jun 23, 2020

python3Packages.tlsprofiler: init at 1.0 #91380

Closed

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sslyze: init at 3.0.7 #89034

sslyze: init at 3.0.7 #89034

veehaitch commented May 27, 2020 •

edited

jonringer commented May 27, 2020

jonringer left a comment

jonringer May 27, 2020

veehaitch May 27, 2020

jonringer May 28, 2020

jtojnar Jun 4, 2020

veehaitch Jun 5, 2020

veehaitch commented May 27, 2020

jonringer commented May 27, 2020

veehaitch commented May 27, 2020

jonringer May 28, 2020

veehaitch May 28, 2020

jonringer May 28, 2020

veehaitch May 29, 2020

veehaitch commented May 29, 2020

jonringer Jun 4, 2020

jtojnar Jun 4, 2020

mweinelt Jun 4, 2020

veehaitch Jun 5, 2020

jtojnar Jun 5, 2020

veehaitch Jun 5, 2020

vcunat Jun 10, 2020

veehaitch Jun 10, 2020

vcunat Jun 18, 2020

veehaitch Jun 18, 2020

vcunat left a comment

-  propagatedBuildInputs = [ tls-parser pytest ];
+  propagatedBuildInputs = [ tls-parser ];
+  checkInputs = [ pytest ];

sslyze: init at 3.0.7 #89034

sslyze: init at 3.0.7 #89034

Conversation

veehaitch commented May 27, 2020 • edited

Motivation for this change

Things done

jonringer commented May 27, 2020

jonringer left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

veehaitch commented May 27, 2020

jonringer commented May 27, 2020

veehaitch commented May 27, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

veehaitch commented May 29, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vcunat left a comment

Choose a reason for hiding this comment

veehaitch commented May 27, 2020 •

edited