mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-01-03 23:39:45 +01:00
- optical cleanups for #265
- don't do browser tests for non-HTTP services
This commit is contained in:
Dirk
parent
e68fcc9dad
commit
2871aaaee3
28
testssl.sh
28
testssl.sh
@ -1426,6 +1426,12 @@ run_client_simulation() {
|
||||
local warning=()
|
||||
local i=0
|
||||
|
||||
# doesn't make sense for other services
|
||||
if [[ $SERVICE != "HTTP" ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
# FIXME: At a certain time we should put the following to an external file
|
||||
names+=("Android 2.3.7 ")
|
||||
short+=("android_237")
|
||||
protos+=("-no_tls1_2 -no_tls1_1 -no_ssl2")
|
||||
@ -1594,7 +1600,7 @@ run_client_simulation() {
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE11 / Win Phone 8.1 Upd ")
|
||||
names+=("IE11 / Win Phone 8.1 Update")
|
||||
short+=("ie10_winphone_81_update")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA")
|
||||
@ -1672,7 +1678,8 @@ run_client_simulation() {
|
||||
ciphers+=("ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DH-DSS-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DH-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DH-RSA-AES256-SHA:DH-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:DH-RSA-CAMELLIA256-SHA:DH-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DH-DSS-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DH-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DH-RSA-AES128-SHA:DH-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DH-RSA-SEED-SHA:DH-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:DH-RSA-CAMELLIA128-SHA:DH-DSS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:IDEA-CBC-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DH-RSA-DES-CBC3-SHA:DH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DH-RSA-DES-CBC-SHA:DH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("Tests are based on OpenSSL1.01, therefore ciphers 0xe and 0xb are missing")
|
||||
#warning+=("Tests are based on OpenSSL 1.01, therefore ciphers 0xe and 0xb are missing")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 5.1.9/ OSX 10.6.8 ")
|
||||
short+=("safari519_osx1068")
|
||||
@ -1750,15 +1757,9 @@ run_client_simulation() {
|
||||
pr_headlineln " Running browser simulations (experimental) "
|
||||
outln
|
||||
|
||||
if [[ $OSSL_VER_MAJOR.$OSSL_VER_MINOR == "1.1.0" ]]; then
|
||||
pr_litemagentaln "Your $OPENSSL is too new, needed is version 1.0.2"
|
||||
return 7
|
||||
elif [[ $OSSL_VER_MAJOR.$OSSL_VER_MINOR != "1.0.2" ]]; then
|
||||
pr_litemagentaln "Your $OPENSSL is too old, needed is version >=1.0.2"
|
||||
fi
|
||||
debugme outln
|
||||
i=0
|
||||
for name in "${short[@]}"; do
|
||||
#FIXME: printf formatting would look better, especially if we want a wide option here
|
||||
out "${names[i]} "
|
||||
$OPENSSL s_client -cipher ${ciphers[i]} ${protos[i]} $STARTTLS $BUGS $PROXY -connect $NODEIP:$PORT ${sni[i]} </dev/null >$TMPFILE 2>$ERRFILE
|
||||
debugme echo "$OPENSSL s_client -cipher ${ciphers[i]} ${protos[i]} $STARTTLS $BUGS $PROXY -connect $NODEIP:$PORT ${sni[i]} </dev/null"
|
||||
@ -1800,7 +1801,7 @@ run_client_simulation() {
|
||||
fi
|
||||
debugme cat $TMPFILE
|
||||
fi
|
||||
i=$i+1
|
||||
i=$((i+1))
|
||||
done
|
||||
tmpfile_handle $FUNCNAME.txt
|
||||
return 0
|
||||
@ -4519,6 +4520,9 @@ $PROG_NAME <options> URI ("$PROG_NAME URI" does everything except -E)
|
||||
-P, --server-preference displays the server's picks: protocol+cipher
|
||||
-x, --single-cipher <pattern> tests matched <pattern> of ciphers
|
||||
(if <pattern> not a number: word match)
|
||||
-c, --client-simulation test client simulations, see which client negotiates with cipher and protocol
|
||||
-H, --header, --headers tests HSTS, HPKP, server/app banner, security headers, cookie, reverse proxy, IPv4 address
|
||||
|
||||
-U, --vulnerable tests all vulnerabilities
|
||||
-B, --heartbleed tests for heartbleed vulnerability
|
||||
-I, --ccs, --ccs-injection tests for CCS injection vulnerability
|
||||
@ -4532,8 +4536,6 @@ $PROG_NAME <options> URI ("$PROG_NAME URI" does everything except -E)
|
||||
-J, --logjam tests for LOGJAM vulnerability
|
||||
-s, --pfs, --fs, --nsa checks (perfect) forward secrecy settings
|
||||
-4, --rc4, --appelbaum which RC4 ciphers are being offered?
|
||||
-H, --header, --headers tests HSTS, HPKP, server/app banner, security headers, cookie, reverse proxy, IPv4 address
|
||||
-c, --client-simulation test client simulations, see which client negotiates wich cipher and protocol
|
||||
|
||||
special invocations:
|
||||
|
||||
@ -5880,4 +5882,4 @@ fi
|
||||
exit $?
|
||||
|
||||
|
||||
# $Id: testssl.sh,v 1.434 2015/12/29 16:07:02 dirkw Exp $
|
||||
# $Id: testssl.sh,v 1.435 2016/01/15 14:53:02 dirkw Exp $
|
||||
|
||||
Loading…
Reference in New Issue
Block a user