Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-01-19 15:09:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Output polish, minor code polish to grading

Browse Source 
... and squash the TLS 1.2 grading cap for TLS 1.3 only server
This commit is contained in:
Dirk Wetter 2020-04-17 14:49:35 +02:00
parent 359965dc17
commit 2c10676e03
1 changed files with 32 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
testssl.sh
View File

@ -5422,7 +5422,6 @@ run_protocols() {
add_tls_offered tls1_2 yes
;; # GCM cipher in TLS 1.2: very good!
1) add_tls_offered tls1_2 no
set_grade_cap "C" "TLS 1.2 is not offered"
if "$offers_tls13"; then
out "not offered"
else
@ -5434,6 +5433,7 @@ run_protocols() {
fileout "$jsonID" "INFO" "not offered"
else
fileout "$jsonID" "MEDIUM" "not offered" # TLS 1.3, no TLS 1.2 --> no GCM, penalty
set_grade_cap "C" "TLS 1.2 or TLS 1.3 are not offered"
fi
else
prln_svrty_critical " -- connection failed rather than downgrading to $latest_supported_string"
@ -20555,10 +20555,10 @@ run_grading() {
IFS=$'\n' sorted_reasons=($(sort -ru <<<"${GRADE_CAP_REASONS[*]}"))
IFS=$'\n' sorted_warnings=($(sort -u <<<"${GRADE_WARNINGS[*]}"))
IFS=$old_ifs
fileout "grading_spec" "INFO" "SSLLabs's 'SSL Server Rating Guide' version 2009q from 2020-01-30 (near complete)"
pr_bold " Grading specification "; out "SSL Labs's 'SSL Server Rating Guide' version 2009q from 2020-01-30"; prln_warning " (near complete)"
pr_bold " Grading specs"; out ", not complete "; outln "SSL Labs's 'SSL Server Rating Guide' (version 2009q from 2020-01-30)"
pr_bold " Specification documentation "; pr_url "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
outln
fileout "grading_spec" "INFO" "SSLLabs's 'SSL Server Rating Guide' (version 2009q from 2020-01-30)"
# No point in calculating a score, if a cap of "F", "T", or "M" has been set
if [[ $GRADE_CAP == F || $GRADE_CAP == T || $GRADE_CAP == M ]]; then
@ -20662,10 +20662,10 @@ run_grading() {
fi
# If the calculated grade is bigger than the grade cap, then set grade as the cap
if [[ $GRADE_CAP != "" && ! $pre_cap_grade > $GRADE_CAP ]]; then
if [[ -n "$GRADE_CAP" && ! $pre_cap_grade > $GRADE_CAP ]]; then
final_grade=$GRADE_CAP
# For "exceptional" config, an "A+" is awarded, or "A-" for slightly less "exceptional"
elif [[ $GRADE_CAP == "" && $pre_cap_grade == A ]]; then
elif [[ -z "$GRADE_CAP" && $pre_cap_grade == A ]]; then
if [[ ${#sorted_warnings[@]} -eq 0 ]]; then
final_grade="A+"
else
@ -20675,29 +20675,24 @@ run_grading() {
final_grade=$pre_cap_grade
fi
pr_bold " Grade "
case "$final_grade" in
A*) pr_bold " Grade "
prln_svrty_best $final_grade
A*) prln_svrty_best $final_grade
fileout "grade" "OK" "$final_grade"
;;
B) pr_bold " Grade "
prln_svrty_medium $final_grade
B) prln_svrty_medium $final_grade
fileout "grade" "MEDIUM" "$final_grade"
;;
C) pr_bold " Grade "
prln_svrty_medium $final_grade
C) prln_svrty_medium $final_grade
fileout "grade" "MEDIUM" "$final_grade"
;;
D) pr_bold " Grade "
prln_svrty_high $final_grade
D) prln_svrty_high $final_grade
fileout "grade" "HIGH" "$final_grade"
;;
E) pr_bold " Grade "
prln_svrty_high $final_grade
E) prln_svrty_high $final_grade
fileout "grade" "HIGH" "$final_grade"
;;
F) pr_bold " Grade "
prln_svrty_critical $final_grade
F) prln_svrty_critical $final_grade
fileout "grade" "CRITICAL" "$final_grade"
;;
esac
@ -20738,11 +20733,11 @@ set_grading_state() {
do_heartbleed do_ccs_injection do_ticketbleed do_robot do_renego \
do_crime do_ssl_poodle do_tls_fallback_scsv do_drown do_beast \
do_rc4 do_logjam; do
[[ "${!gbl}" == true ]] && let nr_enabled++
"${!gbl}" && let nr_enabled++
done
# ... atleast one of these has to be set
[[ $do_allciphers == true || $do_cipher_per_proto == true ]] && let nr_enabled++
"$do_allciphers" || "$do_cipher_per_proto" && let nr_enabled++
# ... else we can't grade
if [[ $nr_enabled -lt 18 ]]; then