Control: SSL/TLS servers should support TLS fallback SCSV for preventing protocol downgrade attacks

Description

A Signaling Cipher Suite Value (SCSV) helps in preventing protocol downgrade attacks on the Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) protocols. If enabled, the server makes sure that the strongest protocol that both client and server understand is used. It is recommended that the server should support more than 1 protocol version, excluding SSL v2.

Usage

Run the control in your terminal:

powerpipe control run net_insights.control.ssl_use_tls_fallback_scsv

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run net_insights.control.ssl_use_tls_fallback_scsv --share

Steampipe Tables

net_tls_connection

Params

Args	Name	Default	Description	Variable
$1	domain_names	`["github.com","microsoft.com"]`	DNS domain names.	domain_names

SQL

with domain_list as (
  select domain, concat(domain, ':443') as address from jsonb_array_elements_text(to_jsonb($1::text[])) as domain
),
tls_connections as (
  select
    address,
    version,
    fallback_scsv_supported
  from
    net_tls_connection
  where
    address in (select address from domain_list)
    and handshake_completed
),
tls_connection_version_count as (
  select
    address,
    version,
    count(*)
  from
    tls_connections
  group by address, version
)
select
  d.domain as resource,
  case
    when (select count(*) from tls_connection_version_count where address = d.address) < 2 then 'info'
    when (select count(*) from tls_connections where address = d.address and fallback_scsv_supported) > 0 then 'ok'
    else 'alarm'
  end as status,
  case
    when (select count(*) from tls_connection_version_count where address = d.address) < 2 then d.domain || ' requires support for at least 2 protocols.'
    when (select count(*) from tls_connections where address = d.address and fallback_scsv_supported) > 0 then d.domain || ' supports TLS fallback SCSV.'
    else d.domain || ' doesn''t support TLS fallback SCSV.'
  end as reason
from
  domain_list as d;