diff --git a/openssl-rfc.mappping.html b/openssl-rfc.mappping.html index 6dd7538..c916534 100644 --- a/openssl-rfc.mappping.html +++ b/openssl-rfc.mappping.html @@ -204,9 +204,32 @@ td { border:1px solid #999; } [0xc030] ECDHE-RSA-AES256-GCM-SHA384 ECDH AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 [0xc031] ECDH-RSA-AES128-GCM-SHA256 ECDH/RSA AESGCM 128 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 [0xc032] ECDH-RSA-AES256-GCM-SHA384 ECDH/RSA AESGCM 256 TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + + [0xc09c] AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM + [0xc09d] AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM + [0xc09e] DHE-RSA-AES128-CCM DH AESCCM 128 TLS_DHE_RSA_WITH_AES_128_CCM + [0xc09f] DHE-RSA-AES256-CCM DH AESCCM 256 TLS_DHE_RSA_WITH_AES_256_CCM + [0xc0a0] AES128-CCM8 RSA AESCCM8 128 TLS_RSA_WITH_AES_128_CCM_8 + [0xc0a1] AES256-CCM8 RSA AESCCM8 256 TLS_RSA_WITH_AES_256_CCM_8 + [0xc0a2] DHE-RSA-AES128-CCM8 DH AESCCM8 128 TLS_DHE_RSA_WITH_AES_128_CCM_8 + [0xc0a3] DHE-RSA-AES256-CCM8 DH AESCCM8 256 TLS_DHE_RSA_WITH_AES_256_CCM_8 + [0xc0a4] PSK-AES128-CCM PSK AESCCM 128 TLS_PSK_WITH_AES_128_CCM + [0xc0a5] PSK-AES256-CCM PSK AESCCM 256 TLS_PSK_WITH_AES_256_CCM + [0xc0a6] DHE-PSK-AES128-CCM PSK/DHE AESCCM 128 TLS_DHE_PSK_WITH_AES_128_CCM + [0xc0a7] DHE-PSK-AES256-CCM PSK/DHE AESCCM 256 TLS_DHE_PSK_WITH_AES_256_CCM + [0xc0a8] PSK-AES128-CCM8 PSK AESCCM 128 TLS_PSK_WITH_AES_128_CCM_8 + [0xc0a9] PSK-AES256-CCM8 PSK AESCCM 256 TLS_PSK_WITH_AES_256_CCM_8 + [0xc0aa] DHE-PSK-AES128-CCM8 PSK/DHE AESCCM 128 TLS_PSK_DHE_WITH_AES_128_CCM_8 + [0xc0ab] DHE-PSK-AES256-CCM8 PSK/DHE AESCCM 256 TLS_PSK_DHE_WITH_AES_256_CCM_8 + [0xc0ac] ECDHE-ECDSA-AES128-CCM ECDH AESCCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_CCM + [0xc0ad] ECDHE-ECDSA-AES256-CCM ECDH AESCCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_CCM + [0xc0ae] ECDHE-ECDSA-AES128-CCM8 ECDH AESCCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 + [0xc0af] ECDHE-ECDSA-AES256-CCM8 ECDH AESCCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 + [0xcc13] ECDHE-RSA-CHACHA20-POLY1305 ECDH ChaCha20-Poly1305 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 [0xcc14] ECDHE-ECDSA-CHACHA20-POLY1305 ECDH ChaCha20-Poly1305 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 [0xcc15] DHE-RSA-CHACHA20-POLY1305 DH ChaCha20-Poly1305 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + [0xff00] GOST-MD5 RSA GOST89 256 TLS_GOSTR341094_RSA_WITH_28147_CNT_MD5 [0xff01] GOST-GOST94 RSA GOST89 256 TLS_RSA_WITH_28147_CNT_GOST94 [0xff02] GOST-GOST89MAC RSA GOST89 256 diff --git a/testssl.sh b/testssl.sh index e99f5ce..47b719e 100755 --- a/testssl.sh +++ b/testssl.sh @@ -198,6 +198,7 @@ HAS_DH_BITS=${HAS_DH_BITS:-false} HAS_SSL2=true #TODO: in the future we'll do the fastest possible test (openssl s_client -ssl2 is currently faster than sockets) HAS_SSL3=true HAS_ALPN=false +ADD_RFC_STR="rfc" # display RFC ciphernames PORT=443 # unless otherwise auto-determined, see below NODE="" NODEIP="" @@ -1251,17 +1252,17 @@ rfc2openssl() { show_rfc_style(){ - local rfcname + [[ -z "$ADD_RFC_STR" ]] && return 1 - [[ -z "$MAPPING_FILE_RFC" ]] && return 1 + local rfcname rfcname=$(grep -iw "$1" "$MAPPING_FILE_RFC" | sed -e 's/^.*TLS/TLS/' -e 's/^.*SSL/SSL/') [[ -n "$rfcname" ]] && out "$rfcname" return 0 } neat_header(){ - printf -- "Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits${MAPPING_FILE_RFC:+ Cipher Suite Name (RFC)}\n" - printf -- "%s-------------------------------------------------------------------------${MAPPING_FILE_RFC:+----------------------------------------------}\n" + printf -- "Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits${ADD_RFC_STR:+ Cipher Suite Name (RFC)}\n" + printf -- "%s-------------------------------------------------------------------------${ADD_RFC_STR:+-------------------------------------------------}\n" } @@ -1288,11 +1289,8 @@ neat_list(){ [[ "${#kx}" -eq 19 ]] && kx="$kx " # 19 means DH, colored >=1000. Add another space #echo ${#kx} # should be always 20 fi - #if [[ -r "$MAPPING_FILE_RFC" ]]; then - printf -- " %-7s %-30s %-10s %-11s%-11s${MAPPING_FILE_RFC:+ %-48s}${SHOW_EACH_C:+ }" "$hexcode" "$ossl_cipher" "$kx" "$enc" "$strength" "$(show_rfc_style $HEXC)" - #else - # printf -- " %-7s %-30s %-10s %-11s%-11s${SHOW_EACH_C:+ }" "$1" "$2" "$kx" "$enc" "$strength" - #fi + + printf -- " %-7s %-30s %-10s %-11s%-11s${ADD_RFC_STR:+ %-48s}${SHOW_EACH_C:+ %-0s}" "$hexcode" "$ossl_cipher" "$kx" "$enc" "$strength" "$(show_rfc_style $HEXC)" } test_just_one(){ @@ -4550,7 +4548,7 @@ get_install_dir() { [[ -r "$INSTALL_DIR/mapping-rfc.txt" ]] && MAPPING_FILE_RFC="$INSTALL_DIR/mapping-rfc.txt" fi - [[ ! -r "$MAPPING_FILE_RFC" ]] && unset MAPPING_FILE_RFC && pr_litemagentaln "\nNo mapping file found" + [[ ! -r "$MAPPING_FILE_RFC" ]] && unset MAPPING_FILE_RFC && unset ADD_RFC_STR && pr_litemagentaln "\nNo mapping file found" debugme echo "$MAPPING_FILE_RFC" } @@ -4734,6 +4732,7 @@ tuning options (can also be preset via environment variables): --logfile logs stdout to if file is a dir or to specified file --wide wide output for tests like RC4, BEAST. PFS also with hexcode, kx, strength, RFC name --show-each for wide outputs: display all ciphers tested -- not only succeeded ones + --mapping don't display the RFC Cipher Suite Name --warnings "batch" doesn't wait for keypress, "off" or "false" skips connection warning --color <0|1|2> 0: no escape or other codes, 1: b/w escape codes, 2: color (default) --debug <0-6> 1: screen output normal but debug output in temp files. 2-6: see line ~120 @@ -5863,6 +5862,16 @@ parse_cmd_line() { OPENSSL=$(parse_opt_equal_sign "$1" "$2") [[ $? -eq 0 ]] && shift ;; + --mapping|--mapping=*) + local cipher_mapping + cipher_mapping=$(parse_opt_equal_sign "$1" "$2") + [[ $? -eq 0 ]] && shift + case "$cipher_mapping" in + no-rfc) unset ADD_RFC_STR;; + *) pr_magentaln "\nmapping can only be \"no-rfc\"" + help 1 ;; + esac + ;; --proxy|--proxy=*) PROXY=$(parse_opt_equal_sign "$1" "$2") [[ $? -eq 0 ]] && shift