osquery / osquery/osquery

Disable TLS 1.0/1.1 support in `curl_certificate` table

Open
#8,886 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

hardening networking
Dominant language
C++
Stars
23.6k
Forks
2.6k
Avg merge
6d 7h
Merged PRs (30d)
14

Description

I see the runtime configuration is sufficient to prevent TLS 1.0/1.1 negotiation. In osquery/remote/transports/tls.cpp:172-173:

https://github.com/osquery/osquery/blob/3ea7d4a5283d28442f55beb4340222d8437d8b91/osquery/remote/transports/tls.cpp#L172-L173

This prevents osquery from ever negotiating those protocols on its TLS connections.

The curl table also inherits all these TLS transport options, via osquery::http::Client.

https://github.com/osquery/osquery/blob/3ea7d4a5283d28442f55beb4340222d8437d8b91/osquery/tables/networking/curl.cpp#L45

But it looks like curl_certificate table does not set the options to disable TLS 1.0/1.1.

https://github.com/osquery/osquery/blob/3ea7d4a5283d28442f55beb4340222d8437d8b91/osquery/tables/networking/curl_certificate.cpp#L289

There is no subsequent call to SSL_CTX_set_options() to disable TLS 1.0/1.1, and no cipher suite is configured. The context uses whatever OpenSSL's compiled-in defaults provide. Since the build does not pass no-tls1 or no-tls1_1 to OpenSSL's configure, TLS 1.0 and 1.1 remain negotiable from curl_certificate.

So disabling TLS 1.0 and 1.1 in the build, like PR #8213 would do, would also be good defense-in-depth by passing no-tls1 and no-tls1_1 to the OpenSSL configure step.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Compare the TLS setup in osquery/remote/transports/tls.cpp:172-173 and osquery/tables/networking/curl.cpp:45 with the SSL context created at osquery/tables/networking/curl_certificate.cpp:289. Verify how curl_certificate configures protocol options and the OpenSSL build settings related to PR #8213; done means TLS 1.0 and 1.1 cannot be negotiated through this table.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.