mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-01-09 10:10:57 +01:00
Merge remote-tracking branch 'upstream/master'
This commit is contained in:
David Cooper
commit
7a3514b003
12
CREDITS.md
12
CREDITS.md
@ -1,5 +1,4 @@
|
||||
|
||||
|
||||
##### Credits also to
|
||||
|
||||
* Peter Mosmans
|
||||
@ -17,6 +16,10 @@
|
||||
- lots of cleanups
|
||||
- Shellcheck static analysis
|
||||
|
||||
* Frank Breedijk
|
||||
- Detection of insecure redirect
|
||||
- client simulation
|
||||
|
||||
* Jean Marsault
|
||||
- client auth: ideas, code snipplets
|
||||
|
||||
@ -68,13 +71,12 @@
|
||||
* Dmitri S
|
||||
- inspiration & help for Darwin port
|
||||
|
||||
* Frank Breedijk
|
||||
- Detection of insecure redirect
|
||||
|
||||
* Bug reports:
|
||||
- Viktor Szépe, Olivier Paroz, Jan H. Terstegge, Lorenz Adena, Jonathon Rossi, Stefan Stidl
|
||||
|
||||
##### Last but not least:
|
||||
|
||||
OpenSSL team for providing openssl.
|
||||
* OpenSSL team for providing openssl.
|
||||
|
||||
* Ivan Ristic for the liberal license which made it possible to use the client data
|
||||
|
||||
|
||||
@ -332,22 +332,6 @@ xC0A8 TLS_PSK_WITH_AES_128_CCM_8
|
||||
xC0A9 TLS_PSK_WITH_AES_256_CCM_8
|
||||
xC0AA TLS_PSK_DHE_WITH_AES_128_CCM_8
|
||||
xC0AB TLS_PSK_DHE_WITH_AES_256_CCM_8
|
||||
xC09C TLS_RSA_WITH_AES_128_CCM
|
||||
xC09D TLS_RSA_WITH_AES_256_CCM
|
||||
xC09E TLS_DHE_RSA_WITH_AES_128_CCM
|
||||
xC09F TLS_DHE_RSA_WITH_AES_256_CCM
|
||||
xC0A0 TLS_RSA_WITH_AES_128_CCM_8
|
||||
xC0A1 TLS_RSA_WITH_AES_256_CCM_8
|
||||
xC0A2 TLS_DHE_RSA_WITH_AES_128_CCM_8
|
||||
xC0A3 TLS_DHE_RSA_WITH_AES_256_CCM_8
|
||||
xC0A4 TLS_PSK_WITH_AES_128_CCM
|
||||
xC0A5 TLS_PSK_WITH_AES_256_CCM
|
||||
xC0A6 TLS_DHE_PSK_WITH_AES_128_CCM
|
||||
xC0A7 TLS_DHE_PSK_WITH_AES_256_CCM
|
||||
xC0A8 TLS_PSK_WITH_AES_128_CCM_8
|
||||
xC0A9 TLS_PSK_WITH_AES_256_CCM_8
|
||||
xC0AA TLS_PSK_DHE_WITH_AES_128_CCM_8
|
||||
xC0AB TLS_PSK_DHE_WITH_AES_256_CCM_80
|
||||
xC0AC TLS_ECDHE_ECDSA_WITH_AES_128_CCM
|
||||
xC0AD TLS_ECDHE_ECDSA_WITH_AES_256_CCM
|
||||
xC0AE TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
|
||||
|
||||
4096
etc/mozilla.pem
4096
etc/mozilla.pem
File diff suppressed because it is too large
Load Diff
451
testssl.sh
451
testssl.sh
@ -20,10 +20,21 @@
|
||||
# license permitted.
|
||||
# If you enclose this script or parts of it in your software, it has to
|
||||
# be accompanied by the same license (see link) and the place where to get
|
||||
# the recent version of this program. Do not violate the license!
|
||||
# the recent version of this program. Do not violate the license andif
|
||||
# you do not agree to all of these terms, do not use it in the first place.
|
||||
#
|
||||
# USAGE WITHOUT ANY WARRANTY, THE SOFTWARE IS PROVIDED "AS IS". USE IT AT
|
||||
# your OWN RISK!
|
||||
# OpenSSL which is being used and maybe distributed via one of this projects'
|
||||
# web site is subject to their licensing: https://www.openssl.org/source/license.txt
|
||||
#
|
||||
# The client simulation data comes from SSLlabs and is licensed to the 'Qualys SSL Labs
|
||||
# Terms of Use' (v2.2), see https://www.ssllabs.com/downloads/Qualys_SSL_Labs_Terms_of_Use.pdf,
|
||||
# stating a CC BY 3.0 US license: https://creativecommons.org/licenses/by/3.0/us/
|
||||
#
|
||||
# Please note: USAGE WITHOUT ANY WARRANTY, THE SOFTWARE IS PROVIDED "AS IS".
|
||||
#
|
||||
# USE IT AT your OWN RISK!
|
||||
# Seriously! The threat is you run this code on your computer and input could be /
|
||||
# is being supplied via untrusted sources.
|
||||
|
||||
# HISTORY:
|
||||
# Back in 2006 it all started with a few openssl commands...
|
||||
@ -1229,6 +1240,15 @@ sockread() {
|
||||
return $ret
|
||||
}
|
||||
|
||||
#FIXME: fill the following two:
|
||||
openssl2rfc() {
|
||||
:
|
||||
}
|
||||
|
||||
rfc2openssl() {
|
||||
:
|
||||
}
|
||||
|
||||
|
||||
show_rfc_style(){
|
||||
local rfcname
|
||||
@ -1414,6 +1434,399 @@ run_cipher_per_proto(){
|
||||
return 0
|
||||
}
|
||||
|
||||
run_client_simulation() {
|
||||
# Runs browser simulations. Browser capabilities gathered from:
|
||||
# https://www.ssllabs.com/ssltest/clients.html on 10 jan 2016
|
||||
local names=()
|
||||
local short=()
|
||||
local protos=()
|
||||
local ciphers=()
|
||||
local tlsvers=()
|
||||
local sni=()
|
||||
local warning=()
|
||||
local i=0
|
||||
|
||||
# doesn't make sense for other services
|
||||
if [[ $SERVICE != "HTTP" ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
# FIXME: At a certain time we should put the following to an external file
|
||||
names+=("Android 2.3.7 ")
|
||||
short+=("android_237")
|
||||
protos+=("-no_tls1_2 -no_tls1_1 -no_ssl2")
|
||||
ciphers+=("RC4-MD5:RC4-SHA:AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:EXP-RC4-MD5:EXP-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("")
|
||||
warning+=("")
|
||||
|
||||
names+=("Android 4.0.4 ")
|
||||
short+=("android_404")
|
||||
protos+=("-no_tls1_2 -no_tls1_1 -no_ssl2")
|
||||
ciphers+=("CDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Android 4.1.1 ")
|
||||
short+=("android_411")
|
||||
protos+=("-no_tls1_2 -no_tls1_1 -no_ssl2")
|
||||
ciphers+=("ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:SRP-DSS-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Android 4.2.2 ")
|
||||
short+=("android_422")
|
||||
protos+=("-no_tls1_2 -no_tls1_1 -no_ssl2")
|
||||
ciphers+=("ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:SRP-DSS-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Android 4.3 ")
|
||||
short+=("android_43")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:SRP-DSS-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Android 4.4.2 ")
|
||||
short+=("android_442")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("CDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tl1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Android 5.0.0 ")
|
||||
short+=("android_500")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-GCM-SHA256:AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Baidu Jan 2015 ")
|
||||
short+=("baidu_jan_2015")
|
||||
protos+=("-no_tls1_2 -no_tls1_1 -no_ssl2")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:CAMELLIA256-SHA:AES256-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:ECDH-RSA-RC4-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-RC4-SHA:ECDH-ECDSA-AES128-SHA:SEED-SHA:CAMELLIA128-SHA:RC4-MD5:RC4-SHA:AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("BingPreview Jan 2015 ")
|
||||
short+=("bingpreview_jan_2015")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:SRP-DSS-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:IDEA-CBC-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Chrome 47 / OSX ")
|
||||
short+=("chrome_47_osx")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:AES128-GCM-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Firefox 31.3.0ESR / Win7 ")
|
||||
short+=("firefox_3130esr_win7")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:EDH-RSA-DES-CBC3-SHA:AES128-SHA:CAMELLIA128-SHA:AES256-SHA:CAMELLIA256-SHA:DES-CBC3-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Firefox 42 / OSX ")
|
||||
short+=("firefox_42_osx")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("GoogleBot Feb 2015 ")
|
||||
short+=("googlebot_feb_2015")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:RC4-SHA:RC4-MD5:AES128-SHA:DES-CBC3-SHA:AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE6 / XP ")
|
||||
short+=("ie6_xp")
|
||||
protos+=("-no_tls1")
|
||||
tlsvers+=("")
|
||||
ciphers+=("RC4-MD5:RC4-SHA:DES-CBC3-SHA:RC4-MD5:DES-CBC3-MD5:RC2-CBC-MD5:DES-CBC-SHA:DES-CBC-MD5:EXP1024-RC4-SHA:EXP1024-DES-CBC-SHA:EXP-RC4-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC2-CBC-MD5:EDH-DSS-DES-CBC3-SHA:EDH-DSS-DES-CBC-SHA:EXP1024-DHE-DSS-DES-CBC-SHA")
|
||||
sni+=("")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE7 / Vista ")
|
||||
short+=("ie7_vista")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-DSS-AES128-SHA:DHE-DSS-AES256-SHA:EDH-DSS-DES-CBC3-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE8 / XP ")
|
||||
short+=("ie8_xp")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("RC4-MD5:RC4-SHA:DES-CBC3-SHA:DES-CBC-SHA:EXP1024-RC4-SHA:EXP1024-DES-CBC-SHA:EXP-RC4-MD5:EXP-RC2-CBC-MD5:EDH-DSS-DES-CBC3-SHA:EDH-DSS-DES-CBC-SHA:EXP1024-DHE-DSS-DES-CBC-SHA")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE8-10 / Win7 ")
|
||||
short+=("ie10_win7")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE11 / Win7 ")
|
||||
short+=("ie11_win7")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE11 / Win8.1 ")
|
||||
short+=("ie11_win81")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE10 / Win Phone 8.0 ")
|
||||
short+=("ie10_winphone_80")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES128-SHA:DHE-DSS-AES256-SHA:EDH-DSS-DES-CBC3-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE11 / Win Phone 8.1 ")
|
||||
short+=("ie10_winphone_81")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("AES128-SHA256:AES128-SHA:AES256-SHA256:AES256-SHA:DES-CBC3-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES128-SHA256:DHE-DSS-AES128-SHA:DHE-DSS-AES256-SHA256:DHE-DSS-AES256-SHA:EDH-DSS-DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE11 / Win Phone 8.1 Update")
|
||||
short+=("ie10_winphone_81_update")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("IE11 / Win10 ")
|
||||
short+=("ie11_win10")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Edge 13 / Win10 ")
|
||||
short+=("edge13_win10")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-AES128-SHA:EDH-DSS-DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Edge 12 / Win Phone 10 ")
|
||||
short+=("edge13_winphone10")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-AES128-SHA:EDH-DSS-DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Java 6u45 ")
|
||||
short+=("java6u45")
|
||||
protos+=("-no_tls1_2 -no_tls1_1")
|
||||
ciphers+=("RC4-MD5:RC4-MD5:RC4-SHA:AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA:DES-CBC3-MD5:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC-SHA:DES-CBC-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:EXP-RC4-MD5:EXP-RC4-MD5:EXP-DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("")
|
||||
warning+=("")
|
||||
|
||||
names+=("Java 7u25 ")
|
||||
short+=("java7u25")
|
||||
protos+=("-no_ssl2 -no_tls1_2 -no_tls1_1")
|
||||
ciphers+=("ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:AES128-SHA:ECDH-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Java 8u31 ")
|
||||
short+=("java8u31")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:AES128-SHA:ECDH-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("OpenSSL 0.9.8y ")
|
||||
short+=("openssl098y")
|
||||
protos+=("-no_ssl2 -no_tls1_2 -no_tls1_1")
|
||||
ciphers+=("DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:IDEA-CBC-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("OpenSSL 1.0.1l ")
|
||||
short+=("openssl101l")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:IDEA-CBC-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("OpenSSL 1.0.2 ")
|
||||
short+=("openssl102")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DH-DSS-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DH-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DH-RSA-AES256-SHA:DH-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:DH-RSA-CAMELLIA256-SHA:DH-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DH-DSS-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:DH-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DH-RSA-AES128-SHA:DH-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DH-RSA-SEED-SHA:DH-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:DH-RSA-CAMELLIA128-SHA:DH-DSS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:IDEA-CBC-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DH-RSA-DES-CBC3-SHA:DH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DH-RSA-DES-CBC-SHA:DH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
#warning+=("Tests are based on OpenSSL 1.01, therefore ciphers 0xe and 0xb are missing")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 5.1.9/ OSX 10.6.8 ")
|
||||
short+=("safari519_osx1068")
|
||||
protos+=("-no_ssl2 -no_tls1_2 -no_tls1_1")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-RC4-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDH-ECDSA-AES128-SHA:ECDH-ECDSA-AES256-SHA:ECDH-ECDSA-RC4-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-RSA-AES128-SHA:ECDH-RSA-AES256-SHA:ECDH-RSA-RC4-SHA:ECDH-RSA-DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5:AES256-SHA:DES-CBC3-SHA:DES-CBC-SHA:EXP-RC4-MD5:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC3-SHA:EDH-DSS-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA")
|
||||
tlsvers+=("-tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 6 / iOS 6.0.1 ")
|
||||
short+=("safari6_ios601")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES256-SHA384:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA:ECDH-ECDSA-AES256-SHA:ECDH-ECDSA-RC4-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-RSA-AES128-SHA:ECDH-RSA-AES256-SHA:ECDH-RSA-RC4-SHA:ECDH-RSA-DES-CBC3-SHA:AES256-SHA256:AES128-SHA256:AES128-SHA:RC4-SHA:RC4-MD5:AES256-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA:ECDHE-ECDSA-NULL-SHA:ECDHE-RSA-NULL-SHA:ECDH-ECDSA-NULL-SHA:ECDH-RSA-NULL-SHA:NULL-SHA256:NULL-SHA:NULL-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 6.0.4/ OS X 10.8.4 ")
|
||||
short+=("safari604_osx1084")
|
||||
protos+=("-no_ssl2 -no_tls1_2 -no_tls1_1")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDH-ECDSA-AES128-SHA:ECDH-ECDSA-AES256-SHA:ECDH-ECDSA-RC4-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-RSA-AES128-SHA:ECDH-RSA-AES256-SHA:ECDH-RSA-RC4-SHA:ECDH-RSA-DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5:AES256-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 7 / iOS 7.1 ")
|
||||
short+=("safari7_ios71")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES256-SHA384:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES256-SHA:ECDH-ECDSA-AES128-SHA:ECDH-ECDSA-RC4-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-RSA-AES256-SHA:ECDH-RSA-AES128-SHA:ECDH-RSA-RC4-SHA:ECDH-RSA-DES-CBC3-SHA:AES256-SHA256:AES128-SHA256:AES128-SHA:RC4-SHA:RC4-MD5:AES256-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 7 / OS X 10.9 ")
|
||||
short+=("safari7_osx109")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES256-SHA384:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES256-SHA:ECDH-ECDSA-AES128-SHA:ECDH-ECDSA-RC4-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-RSA-AES256-SHA:ECDH-RSA-AES128-SHA:ECDH-RSA-RC4-SHA:ECDH-RSA-DES-CBC3-SHA:AES256-SHA256:AES128-SHA256:AES128-SHA:RC4-SHA:RC4-MD5:AES256-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 8 / iOS 8.4 ")
|
||||
short+=("safari8_ios84")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256:ECDH-ECDSA-AES256-SHA:ECDH-ECDSA-AES128-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-RSA-AES256-SHA384:ECDH-RSA-AES128-SHA256:ECDH-RSA-AES256-SHA:ECDH-RSA-AES128-SHA:ECDH-RSA-DES-CBC3-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 8 / OS X 10.10 ")
|
||||
short+=("safari8_osx1010")
|
||||
protos+=("-no_ssl2")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256:ECDH-ECDSA-AES256-SHA:ECDH-ECDSA-AES128-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-RSA-AES256-SHA384:ECDH-RSA-AES128-SHA256:ECDH-RSA-AES256-SHA:ECDH-RSA-AES128-SHA:ECDH-RSA-DES-CBC3-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 9 / iOS 9 ")
|
||||
short+=("safari9_ios9")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
names+=("Safari 9 / OS X 10.11 ")
|
||||
short+=("safari9_osx1011")
|
||||
protos+=("-no_ssl2 -no_ssl3")
|
||||
ciphers+=("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:RC4-SHA:RC4-MD5")
|
||||
tlsvers+=("-tls1_2 -tls1_1 -tls1")
|
||||
sni+=("$SNI")
|
||||
warning+=("")
|
||||
|
||||
outln
|
||||
pr_headlineln " Running browser simulations (experimental) "
|
||||
outln
|
||||
|
||||
debugme outln
|
||||
for name in "${short[@]}"; do
|
||||
#FIXME: printf formatting would look better, especially if we want a wide option here
|
||||
out " ${names[i]} "
|
||||
$OPENSSL s_client -cipher ${ciphers[i]} ${protos[i]} $STARTTLS $BUGS $PROXY -connect $NODEIP:$PORT ${sni[i]} </dev/null >$TMPFILE 2>$ERRFILE
|
||||
debugme echo "$OPENSSL s_client -cipher ${ciphers[i]} ${protos[i]} $STARTTLS $BUGS $PROXY -connect $NODEIP:$PORT ${sni[i]} </dev/null"
|
||||
sclient_connect_successful $? $TMPFILE
|
||||
sclient_success=$?
|
||||
if [[ $sclient_success -ne 0 ]]; then
|
||||
outln "No connection"
|
||||
else
|
||||
proto=$(grep -aw "Protocol" $TMPFILE | sed -e 's/^.*Protocol.*://' -e 's/ //g')
|
||||
if [[ "$proto" == "TLSv1.2" ]]; then
|
||||
# OpenSSL reports TLS1.2 even if the connection is TLS1.1 or TLS1.0 Need to figure out which one it is...
|
||||
for tls in ${tlsvers[i]}; do
|
||||
$OPENSSL s_client $tls -cipher ${ciphers[i]} ${protos[i]} $STARTTLS $BUGS $PROXY -connect $NODEIP:$PORT ${sni[i]} </dev/null >$TMPFILE 2>$ERRFILE
|
||||
debugme echo "$OPENSSL s_client $tls -cipher ${ciphers[i]} ${protos[i]} $STARTTLS $BUGS $PROXY -connect $NODEIP:$PORT ${sni[i]} </dev/null"
|
||||
sclient_connect_successful $? $TMPFILE
|
||||
sclient_success=$?
|
||||
if [[ $sclient_success -eq 0 ]]; then
|
||||
case "$tls" in
|
||||
"-tls1_2")
|
||||
break
|
||||
;;
|
||||
"-tls1_1")
|
||||
proto="TLSv1.1"
|
||||
break
|
||||
;;
|
||||
"-tls1")
|
||||
proto="TLSv1.0"
|
||||
break
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
done
|
||||
fi
|
||||
cipher=$(grep -wa Cipher $TMPFILE | egrep -avw "New|is" | sed -e 's/ //g' -e 's/^Cipher://')
|
||||
outln "$proto $cipher"
|
||||
if [[ "${warning[i]}" != "" ]]; then
|
||||
out " "
|
||||
outln "${warning[i]}"
|
||||
fi
|
||||
debugme cat $TMPFILE
|
||||
fi
|
||||
i=$((i+1))
|
||||
done
|
||||
tmpfile_handle $FUNCNAME.txt
|
||||
return 0
|
||||
}
|
||||
|
||||
# generic function whether $1 is supported by s_client ($2: string to display)
|
||||
locally_supported() {
|
||||
[[ -n "$2" ]] && out "$2 "
|
||||
@ -1931,7 +2344,7 @@ determine_trust() {
|
||||
debugme outln "${verify_retcode[i]}"
|
||||
else
|
||||
trust[i]=false
|
||||
debugme pr_litered "not trusted"
|
||||
debugme pr_red "not trusted"
|
||||
debugme outln "${verify_retcode[i]}"
|
||||
fi
|
||||
i=$(($i + 1))
|
||||
@ -1942,21 +2355,23 @@ determine_trust() {
|
||||
pr_litegreen "Ok "
|
||||
# at least one failed
|
||||
else
|
||||
pr_litered "NOT ok"
|
||||
pr_red "NOT ok"
|
||||
# all failed (we assume with the same issue)
|
||||
if ! ${trust[1]} && ! ${trust[2]} && ! ${trust[3]} && ! ${trust[4]}; then
|
||||
verify_retcode_helper "${verify_retcode[2]}"
|
||||
else
|
||||
# is one ok and the others not?
|
||||
if ${trust[1]} || ${trust[2]} || ${trust[3]} || ${trust[4]}; then
|
||||
pr_litered ":"
|
||||
pr_red ":"
|
||||
out "\n$spaces"
|
||||
pr_red "FAILED:"
|
||||
for i in 1 2 3 4; do
|
||||
if ${trust[i]}; then
|
||||
ok_was="${certificate_file[i]} $ok_was"
|
||||
else
|
||||
#code="$(verify_retcode_helper ${verify_retcode[i]})"
|
||||
#notok_was="${certificate_file[i]} $notok_was"
|
||||
pr_litered " ${certificate_file[i]}:"
|
||||
pr_litered " ${certificate_file[i]} "
|
||||
verify_retcode_helper "${verify_retcode[i]}"
|
||||
fi
|
||||
done
|
||||
@ -3941,6 +4356,7 @@ run_beast(){
|
||||
outln " -- and no higher protocols as mitigation supported"
|
||||
fi
|
||||
fi
|
||||
$first && pr_litegreenln "no CBC ciphers found for any protocol (OK)"
|
||||
|
||||
tmpfile_handle $FUNCNAME.txt
|
||||
return 0
|
||||
@ -4206,6 +4622,9 @@ $PROG_NAME <options> URI ("$PROG_NAME URI" does everything except -E)
|
||||
-P, --server-preference displays the server's picks: protocol+cipher
|
||||
-x, --single-cipher <pattern> tests matched <pattern> of ciphers
|
||||
(if <pattern> not a number: word match)
|
||||
-c, --client-simulation test client simulations, see which client negotiates with cipher and protocol
|
||||
-H, --header, --headers tests HSTS, HPKP, server/app banner, security headers, cookie, reverse proxy, IPv4 address
|
||||
|
||||
-U, --vulnerable tests all vulnerabilities
|
||||
-B, --heartbleed tests for heartbleed vulnerability
|
||||
-I, --ccs, --ccs-injection tests for CCS injection vulnerability
|
||||
@ -4219,7 +4638,6 @@ $PROG_NAME <options> URI ("$PROG_NAME URI" does everything except -E)
|
||||
-J, --logjam tests for LOGJAM vulnerability
|
||||
-s, --pfs, --fs, --nsa checks (perfect) forward secrecy settings
|
||||
-4, --rc4, --appelbaum which RC4 ciphers are being offered?
|
||||
-H, --header, --headers tests HSTS, HPKP, server/app banner, security headers, cookie, reverse proxy, IPv4 address
|
||||
|
||||
special invocations:
|
||||
|
||||
@ -4261,6 +4679,7 @@ Need HTML output? Just pipe through "aha" (ANSI HTML Adapter: github.com/theZiz/
|
||||
|
||||
"$PROG_NAME <options> <URI> | aha >output.html"
|
||||
EOF
|
||||
#' Fix syntax highlight on sublime
|
||||
exit $1
|
||||
}
|
||||
|
||||
@ -4378,7 +4797,7 @@ EOF
|
||||
pr_bold "$bb"
|
||||
outln "\n"
|
||||
outln " Using \"$($OPENSSL version 2>/dev/null)\" [~$nr_ciphers ciphers]"
|
||||
out "on $HNAME:"
|
||||
out " on $HNAME:"
|
||||
|
||||
[[ -n "$GIT_REL" ]] && \
|
||||
cwd=$(/bin/pwd) || \
|
||||
@ -4937,7 +5356,7 @@ display_rdns_etc() {
|
||||
if "$LOCAL_A"; then
|
||||
outln " A record via /etc/hosts "
|
||||
elif [[ -n "$CMDLINE_IP" ]]; then
|
||||
outln " A record via --ip=$CMDLINE_IP parameter"
|
||||
outln " A record via supplied IP \"$CMDLINE_IP\""
|
||||
fi
|
||||
if [[ -n "$rDNS" ]]; then
|
||||
if $HAS_IPv6; then
|
||||
@ -5072,6 +5491,7 @@ initialize_globals() {
|
||||
do_tls_fallback_scsv=false
|
||||
do_test_just_one=false
|
||||
do_tls_sockets=false
|
||||
do_client_simulation=false
|
||||
}
|
||||
|
||||
|
||||
@ -5098,6 +5518,7 @@ set_scanning_defaults() {
|
||||
do_http2=true
|
||||
do_ssl_poodle=true
|
||||
do_tls_fallback_scsv=true
|
||||
do_client_simulation=true
|
||||
VULN_COUNT=10
|
||||
}
|
||||
|
||||
@ -5108,7 +5529,7 @@ query_globals() {
|
||||
for gbl in do_allciphers do_vulnerabilities do_beast do_breach do_ccs_injection do_cipher_per_proto do_crime \
|
||||
do_freak do_logjam do_header do_heartbleed do_mx_all_ips do_pfs do_protocols do_rc4 do_renego \
|
||||
do_std_cipherlists do_server_defaults do_server_preference do_spdy do_http2 do_ssl_poodle do_tls_fallback_scsv \
|
||||
do_test_just_one do_tls_sockets do_mass_testing; do
|
||||
do_client_simulation do_test_just_one do_tls_sockets do_mass_testing ; do
|
||||
[[ "${!gbl}" == "true" ]] && let true_nr++
|
||||
done
|
||||
return $true_nr
|
||||
@ -5121,7 +5542,7 @@ debug_globals() {
|
||||
for gbl in do_allciphers do_vulnerabilities do_beast do_breach do_ccs_injection do_cipher_per_proto do_crime \
|
||||
do_freak do_logjam do_header do_heartbleed do_rc4 do_mx_all_ips do_pfs do_protocols do_rc4 do_renego \
|
||||
do_std_cipherlists do_server_defaults do_server_preference do_spdy do_http2 do_ssl_poodle do_tls_fallback_scsv \
|
||||
do_test_just_one do_tls_sockets do_mass_testing; do
|
||||
do_client_simulation do_test_just_one do_tls_sockets do_mass_testing; do
|
||||
printf "%-22s = %s\n" $gbl "${!gbl}"
|
||||
done
|
||||
printf "%-22s : %s\n" URI: "$URI"
|
||||
@ -5228,6 +5649,9 @@ parse_cmd_line() {
|
||||
-H|--header|--headers)
|
||||
do_header=true
|
||||
;;
|
||||
-c|--client-simulation)
|
||||
do_client_simulation=true
|
||||
;;
|
||||
-U|--vulnerable)
|
||||
do_vulnerabilities=true
|
||||
do_heartbleed=true
|
||||
@ -5490,6 +5914,7 @@ lets_roll() {
|
||||
|
||||
$do_allciphers && { run_allciphers; ret=$(($? + ret)); }
|
||||
$do_cipher_per_proto && { run_cipher_per_proto; ret=$(($? + ret)); }
|
||||
$do_client_simulation && { run_client_simulation; ret=$(($? + ret)); }
|
||||
|
||||
outln
|
||||
datebanner " Done"
|
||||
@ -5559,4 +5984,4 @@ fi
|
||||
exit $?
|
||||
|
||||
|
||||
# $Id: testssl.sh,v 1.434 2015/12/29 16:07:02 dirkw Exp $
|
||||
# $Id: testssl.sh,v 1.438 2016/01/15 16:30:46 dirkw Exp $
|
||||
|
||||
44
utils/parse_client_ciphers.pl
Executable file
44
utils/parse_client_ciphers.pl
Executable file
@ -0,0 +1,44 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
use strict;
|
||||
use Data::Dumper;
|
||||
|
||||
my @spec;
|
||||
my %ciphers;
|
||||
|
||||
# Turn cipher section of page like this https://www.ssllabs.com/ssltest/viewClient.html?name=Android&version=4.0.4
|
||||
# into an openssl cipher spec
|
||||
|
||||
# Get all ciphers first (sorry only works on 64 bit mac atm)
|
||||
foreach my $line ( split /\n/, `bin/openssl.Darwin.x86_64 ciphers -V 'ALL:COMPLEMENTOFALL:\@STRENGTH'`) {
|
||||
my @fields = split /\s+/, $line;
|
||||
my $hex = "";
|
||||
foreach my $byte ( split /,/, $fields[1] ) {
|
||||
$byte = lc $byte;
|
||||
$byte =~ s/^0x//;
|
||||
$hex .= $byte;
|
||||
}
|
||||
$hex =~ s/^0+//;
|
||||
$ciphers{"0x$hex"} = $fields[3];
|
||||
}
|
||||
|
||||
while (<>) {
|
||||
chomp;
|
||||
if ( $_ =~ /^(TLS|SSL)/ ) {
|
||||
if ( $_ !~ /^TLS_EMPTY_RENEGOTIATION_INFO_SCSV/ ) {
|
||||
$_ =~ /(0x[0-9a-f]+)/;
|
||||
if ( $1 ) {
|
||||
push @spec, $ciphers{$1};
|
||||
unless ( $ciphers{$1} ) {
|
||||
die "Unable to find cipher for $1";
|
||||
}
|
||||
} else {
|
||||
print "** $_\n";
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
print join ":", @spec;
|
||||
print "\n";
|
||||
my $count = @spec;
|
||||
print "$count ciphers\n";
|
||||
Loading…
Reference in New Issue
Block a user