Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 05:38:16 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3130 from dcooper16/declare_jsonID_32

Browse Source 
Declare jsonID
This commit is contained in:
Dirk Wetter
2026-08-31 10:09:40 +02:00
committed by GitHub
parent a7ed926104 b407524c44
commit 6555311656
1 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testssl.sh
+13 -9
View File
@@ -2423,6 +2423,7 @@ s_client_options() {
# #
service_detection() { service_detection() {
local -i was_killed local -i was_killed
local jsonID
if [[ "$CLIENT_AUTH" != required ]]; then if [[ "$CLIENT_AUTH" != required ]]; then
if ! "$HAS_TLS13" && "$TLS13_ONLY"; then if ! "$HAS_TLS13" && "$TLS13_ONLY"; then
@@ -10258,6 +10259,7 @@ run_server_defaults() {
local -a -i success local -a -i success
local cn_nosni cn_sni sans_nosni sans_sni san tls_extensions extn client_auth_ca local cn_nosni cn_sni sans_nosni sans_sni san tls_extensions extn client_auth_ca
local using_sockets=true local using_sockets=true
local jsonID
"$SSL_NATIVE" && using_sockets=false "$SSL_NATIVE" && using_sockets=false
@@ -17887,6 +17889,7 @@ run_crime() {
local cve="CVE-2012-4929" local cve="CVE-2012-4929"
local cwe="CWE-310" local cwe="CWE-310"
local hint="" local hint=""
local jsonID
# In a nutshell: don't offer TLS/SPDY compression. This tests for CRIME Vulnerability on HTTPS only, # In a nutshell: don't offer TLS/SPDY compression. This tests for CRIME Vulnerability on HTTPS only,
# not SPDY or ALPN (yet). Please note that it is an attack where you need client side control, so in # not SPDY or ALPN (yet). Please note that it is an attack where you need client side control, so in
@@ -18160,6 +18163,7 @@ run_sweet32() {
local ssl2_sweet=false local ssl2_sweet=false
local using_sockets=true local using_sockets=true
local tls1_1_vulnerable=false local tls1_1_vulnerable=false
local jsonID="SWEET32"
[[ $VULN_COUNT -le $VULN_THRESHLD ]] && outln && pr_headlineln " Testing for SWEET32 (Birthday Attacks on 64-bit Block Ciphers) " && outln [[ $VULN_COUNT -le $VULN_THRESHLD ]] && outln && pr_headlineln " Testing for SWEET32 (Birthday Attacks on 64-bit Block Ciphers) " && outln
pr_bold " SWEET32"; out " (${cve// /, }) " pr_bold " SWEET32"; out " (${cve// /, }) "
@@ -18206,7 +18210,7 @@ run_sweet32() {
if [[ $(( nr_supported_ciphers + nr_ssl2_supported_ciphers )) -le $nr_cipher_minimal ]]; then if [[ $(( nr_supported_ciphers + nr_ssl2_supported_ciphers )) -le $nr_cipher_minimal ]]; then
pr_local_problem "Only ${nr_supported_ciphers}+${nr_ssl2_supported_ciphers} \"SWEET32 ciphers\" found in your $OPENSSL." pr_local_problem "Only ${nr_supported_ciphers}+${nr_ssl2_supported_ciphers} \"SWEET32 ciphers\" found in your $OPENSSL."
outln " Test skipped" outln " Test skipped"
fileout "SWEET32" "WARN" "Not tested, lack of local support ($((nr_supported_ciphers + nr_ssl2_supported_ciphers)) ciphers only)" "$cve" "$cwe" "$hint" fileout "$jsonID" "WARN" "Not tested, lack of local support ($((nr_supported_ciphers + nr_ssl2_supported_ciphers)) ciphers only)" "$cve" "$cwe" "$hint"
return 1 return 1
fi fi
for proto in -no_ssl2 -tls1_1 -tls1 -ssl3; do for proto in -no_ssl2 -tls1_1 -tls1 -ssl3; do
@@ -18239,36 +18243,36 @@ run_sweet32() {
fi fi
if [[ $sclient_success -eq 0 ]] && "$ssl2_sweet" ; then if [[ $sclient_success -eq 0 ]] && "$ssl2_sweet" ; then
pr_svrty_low "VULNERABLE"; out ", uses 64 bit block ciphers for SSLv2 and above" pr_svrty_low "VULNERABLE"; out ", uses 64 bit block ciphers for SSLv2 and above"
fileout "SWEET32" "LOW" "uses 64 bit block ciphers for SSLv2 and above" "$cve" "$cwe" "$hint" fileout "$jsonID" "LOW" "uses 64 bit block ciphers for SSLv2 and above" "$cve" "$cwe" "$hint"
"$tls1_1_vulnerable" && set_grade_cap "C" "Uses 64 bit block ciphers with TLS 1.1 (vulnerable to SWEET32)" "$tls1_1_vulnerable" && set_grade_cap "C" "Uses 64 bit block ciphers with TLS 1.1 (vulnerable to SWEET32)"
elif [[ $sclient_success -eq 0 ]]; then elif [[ $sclient_success -eq 0 ]]; then
pr_svrty_low "VULNERABLE"; out ", uses 64 bit block ciphers" pr_svrty_low "VULNERABLE"; out ", uses 64 bit block ciphers"
fileout "SWEET32" "LOW" "uses 64 bit block ciphers" "$cve" "$cwe" "$hint" fileout "$jsonID" "LOW" "uses 64 bit block ciphers" "$cve" "$cwe" "$hint"
"$tls1_1_vulnerable" && set_grade_cap "C" "Uses 64 bit block ciphers with TLS 1.1 (vulnerable to SWEET32)" "$tls1_1_vulnerable" && set_grade_cap "C" "Uses 64 bit block ciphers with TLS 1.1 (vulnerable to SWEET32)"
elif "$ssl2_sweet"; then elif "$ssl2_sweet"; then
pr_svrty_low "VULNERABLE"; out ", uses 64 bit block ciphers with SSLv2 only" pr_svrty_low "VULNERABLE"; out ", uses 64 bit block ciphers with SSLv2 only"
fileout "SWEET32" "LOW" "uses 64 bit block ciphers with SSLv2 only" "$cve" "$cwe" "$hint" fileout "$jsonID" "LOW" "uses 64 bit block ciphers with SSLv2 only" "$cve" "$cwe" "$hint"
else else
pr_svrty_best "not vulnerable (OK)"; pr_svrty_best "not vulnerable (OK)";
if "$using_sockets"; then if "$using_sockets"; then
fileout "SWEET32" "OK" "not vulnerable" "$cve" "$cwe" fileout "$jsonID" "OK" "not vulnerable" "$cve" "$cwe"
else else
if [[ "$nr_supported_ciphers" -ge 38 ]]; then if [[ "$nr_supported_ciphers" -ge 38 ]]; then
# Likely only PSK/KRB5 ciphers are missing: display discrepancy but no warning # Likely only PSK/KRB5 ciphers are missing: display discrepancy but no warning
if "$HAS_SSL2"; then if "$HAS_SSL2"; then
out ", $nr_supported_ciphers/$nr_sweet32_ciphers (SSLv2: $nr_ssl2_sweet32_ciphers/$nr_ssl2_supported_ciphers) local ciphers" out ", $nr_supported_ciphers/$nr_sweet32_ciphers (SSLv2: $nr_ssl2_sweet32_ciphers/$nr_ssl2_supported_ciphers) local ciphers"
fileout "SWEET32" "OK" "not vulnerable ($nr_supported_ciphers of $nr_sweet32_ciphers (SSLv2: $nr_ssl2_sweet32_ciphers/$nr_ssl2_supported_ciphers)) local ciphers" "$cve" "$cwe" fileout "$jsonID" "OK" "not vulnerable ($nr_supported_ciphers of $nr_sweet32_ciphers (SSLv2: $nr_ssl2_sweet32_ciphers/$nr_ssl2_supported_ciphers)) local ciphers" "$cve" "$cwe"
else else
out ", $nr_supported_ciphers/$nr_sweet32_ciphers local ciphers" out ", $nr_supported_ciphers/$nr_sweet32_ciphers local ciphers"
fileout "SWEET32" "OK" "not vulnerable ($nr_supported_ciphers of $nr_sweet32_ciphers local ciphers" "$cve" "$cwe" fileout "$jsonID" "OK" "not vulnerable ($nr_supported_ciphers of $nr_sweet32_ciphers local ciphers" "$cve" "$cwe"
fi fi
else else
if "$HAS_SSL2"; then if "$HAS_SSL2"; then
pr_warning ", $nr_supported_ciphers/$nr_sweet32_ciphers (SSLv2: $nr_ssl2_sweet32_ciphers/$nr_ssl2_supported_ciphers) local ciphers" pr_warning ", $nr_supported_ciphers/$nr_sweet32_ciphers (SSLv2: $nr_ssl2_sweet32_ciphers/$nr_ssl2_supported_ciphers) local ciphers"
fileout "SWEET32" "WARN" "not vulnerable but ($nr_supported_ciphers of $nr_sweet32_ciphers (SSLv2: $nr_ssl2_sweet32_ciphers/$nr_ssl2_supported_ciphers)) local ciphers only" "$cve" "$cwe" fileout "$jsonID" "WARN" "not vulnerable but ($nr_supported_ciphers of $nr_sweet32_ciphers (SSLv2: $nr_ssl2_sweet32_ciphers/$nr_ssl2_supported_ciphers)) local ciphers only" "$cve" "$cwe"
else else
pr_warning ", $nr_supported_ciphers/$nr_sweet32_ciphers local ciphers" pr_warning ", $nr_supported_ciphers/$nr_sweet32_ciphers local ciphers"
fileout "SWEET32" "WARN" "not vulnerable but ($nr_supported_ciphers of $nr_sweet32_ciphers) local ciphers only" "$cve" "$cwe" fileout "$jsonID" "WARN" "not vulnerable but ($nr_supported_ciphers of $nr_sweet32_ciphers) local ciphers only" "$cve" "$cwe"
fi fi
fi fi
fi fi