Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-10-30 21:35:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Improving DH params check

Browse Source 
PR #1114 brought #1139 a good step forward. This commit adds
a few tweaks to it:

* the groups in run_pfs() are now also italic, except FFDHE groups
* renaming FF groups to DH groups to provide consistency with the
  remainder of testssl.sh
* JSON identifier was renamed from DHE_groups to DH_GROUPS

Open points:

* in run_logjam() there's no warning at all regarding e.g. dh512.badssl.com.
  Reading the Logjam paper in section 3.5., first couple of paragraphs we
  should warn at least against 512 bits here too.

* how do we treat/label 768 bit and 1024 bit in run_logjam() which comes from
  unknown groups? Looks like the paper only was concerned about precompuation.

* In run_logjam() is the bit length not colored but in run_pfs() it is.

* Notation: when do we label FF groups / DH parameter ephemeral?

* Code in run_pfs() and run_logjam() can be merged more.
This commit is contained in:
Dirk
2018-11-05 18:41:51 +01:00
parent de684885fe
commit 474c28e42b
1 changed files with 10 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
testssl.sh
View File

@@ -8721,7 +8721,7 @@ run_pfs() {
sclient_connect_successful $? $TMPFILE || break sclient_connect_successful $? $TMPFILE || break
temp=$(awk -F': ' '/^Server Temp Key/ { print $2 }' "$TMPFILE") temp=$(awk -F': ' '/^Server Temp Key/ { print $2 }' "$TMPFILE")
curve_found="${temp%%,*}" curve_found="${temp%%,*}"
if [[ "$curve_found" == "ECDH" ]]; then if [[ "$curve_found" == ECDH ]]; then
curve_found="${temp#*, }" curve_found="${temp#*, }"
curve_found="${curve_found%%,*}" curve_found="${curve_found%%,*}"
fi fi
@@ -8738,14 +8738,14 @@ run_pfs() {
protos_to_try="03" protos_to_try="03"
"$pfs_tls13_offered" && protos_to_try="04 03" "$pfs_tls13_offered" && protos_to_try="04 03"
for proto in $protos_to_try; do for proto in $protos_to_try; do
if [[ "$proto" == "03" ]]; then if [[ "$proto" == 03 ]]; then
ecdhe_cipher_list_hex="$(strip_inconsistent_ciphers "03" "$ecdhe_cipher_list_hex")" ecdhe_cipher_list_hex="$(strip_inconsistent_ciphers "03" "$ecdhe_cipher_list_hex")"
[[ -z "$ecdhe_cipher_list_hex" ]] && continue [[ -z "$ecdhe_cipher_list_hex" ]] && continue
fi fi
while true; do while true; do
curves_to_test="" curves_to_test=""
for (( i=0; i < nr_curves; i++ )); do for (( i=0; i < nr_curves; i++ )); do
if ! "${curves_deprecated[i]}" || [[ "$proto" == "03" ]]; then if ! "${curves_deprecated[i]}" || [[ "$proto" == 03 ]]; then
! "${supported_curve[i]}" && curves_to_test+=", ${curves_hex[i]}" ! "${supported_curve[i]}" && curves_to_test+=", ${curves_hex[i]}"
fi fi
done done
@@ -8863,15 +8863,17 @@ run_pfs() {
fi fi
if [[ -n "$curves_offered" ]]; then if [[ -n "$curves_offered" ]]; then
if [[ ! "$curves_offered" =~ ffdhe ]] || [[ ! "$curves_offered" =~ \ ]]; then if [[ ! "$curves_offered" =~ ffdhe ]] || [[ ! "$curves_offered" =~ \ ]]; then
pr_bold " Finite field group offered: " pr_bold " DH group offered: "
else else
pr_bold " Finite field groups offered: " pr_bold " DH group offered: "
fi fi
if [[ "$curves_offered" =~ ffdhe ]]; then if [[ "$curves_offered" =~ ffdhe ]]; then
# ok not to display them in italics:
pr_svrty_good "$curves_offered" pr_svrty_good "$curves_offered"
quality=6 quality=6
else else
out "$curves_offered (" pr_italic "$curves_offered"
out " ("
pr_dh_quality "$len_dh_p" "$len_dh_p bits" pr_dh_quality "$len_dh_p" "$len_dh_p bits"
quality=$? quality=$?
out ")" out ")"
@@ -8885,9 +8887,9 @@ run_pfs() {
6|7) quality_str="OK" ;; 6|7) quality_str="OK" ;;
esac esac
if [[ "$curves_offered" =~ Unknown ]]; then if [[ "$curves_offered" =~ Unknown ]]; then
fileout "DHE_groups" "$quality_str" "$curves_offered ($len_dh_p bits)" fileout "DH_groups" "$quality_str" "$curves_offered ($len_dh_p bits)"
else else
fileout "DHE_groups" "$quality_str" "$curves_offered" fileout "DH_groups" "$quality_str" "$curves_offered"
fi fi
fi fi
fi fi
@@ -8895,11 +8897,6 @@ run_pfs() {
tmpfile_handle ${FUNCNAME[0]}.txt tmpfile_handle ${FUNCNAME[0]}.txt
"$using_sockets" && HAS_DH_BITS="$has_dh_bits" "$using_sockets" && HAS_DH_BITS="$has_dh_bits"
#if "$pfs_offered"; then
# return 0
#else
# :
#fi
return 0 return 0
} }