Git
/
testssl.sh
mirror of https://github.com/drwetter/testssl.sh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Speedup normalize_ciphercode() 

This PR is the same as #661, except that it applies to the 2.9dev_html branch. It also fixes a bug in `prettyprint_local()` when a pattern to match is provided as input.
This commit is contained in:
David Cooper 2017-03-15 10:32:29 -04:00 committed by GitHub
parent 939b6f0cb9
commit c791e5cc0e
1 changed files with 15 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
testssl.sh
View File

@ -211,7 +211,6 @@ GOST_STATUS_PROBLEM=false
DETECTED_TLS_VERSION="" DETECTED_TLS_VERSION=""
PATTERN2SHOW="" PATTERN2SHOW=""
SOCK_REPLY_FILE="" SOCK_REPLY_FILE=""
HEXC=""
NW_STR="" NW_STR=""
LEN_STR="" LEN_STR=""
SNI="" SNI=""
@ -2205,30 +2204,19 @@ run_more_flags() {
} }
# #1: string with 2 opensssl codes, HEXC= same in NSS/ssllabs terminology # #1: string with 2 opensssl codes, output is same in NSS/ssllabs terminology
normalize_ciphercode() { normalize_ciphercode() {
part1=$(echo "$1" | awk -F',' '{ print $1 }') if [[ "${1:2:2}" == "00" ]]; then
part2=$(echo "$1" | awk -F',' '{ print $2 }') tm_out "$(tolower "x${1:7:2}")"
part3=$(echo "$1" | awk -F',' '{ print $3 }')
if [[ "$part1" == "0x00" ]]; then # leading 0x00
HEXC=$part2
else else
#part2=$(echo $part2 | sed 's/0x//g') tm_out "$(tolower "x${1:2:2}${1:7:2}${1:12:2}")"
part2=${part2//0x/}
if [[ -n "$part3" ]]; then # a SSLv2 cipher has three parts
#part3=$(echo $part3 | sed 's/0x//g')
part3=${part3//0x/}
fi fi
HEXC="$part1$part2$part3"
fi
#TODO: we should just echo this and avoid the global var HEXC
HEXC=$(tolower "$HEXC"| sed 's/0x/x/') # strip leading 0
return 0 return 0
} }
prettyprint_local() { prettyprint_local() {
local arg line local arg line
local hexcode dash ciph sslvers kx auth enc mac export local hexc hexcode dash ciph sslvers kx auth enc mac export
local re='^[0-9A-Fa-f]+$' local re='^[0-9A-Fa-f]+$'
if [[ "$1" == 0x* ]] || [[ "$1" == 0X* ]]; then if [[ "$1" == 0x* ]] || [[ "$1" == 0X* ]]; then
@ -2249,18 +2237,18 @@ prettyprint_local() {
if [[ -z "$1" ]]; then if [[ -z "$1" ]]; then
$OPENSSL ciphers -V 'ALL:COMPLEMENTOFALL:@STRENGTH' 2>$ERRFILE | while read hexcode dash ciph sslvers kx auth enc mac export ; do # -V doesn't work with openssl < 1.0 $OPENSSL ciphers -V 'ALL:COMPLEMENTOFALL:@STRENGTH' 2>$ERRFILE | while read hexcode dash ciph sslvers kx auth enc mac export ; do # -V doesn't work with openssl < 1.0
normalize_ciphercode $hexcode hexc="$(normalize_ciphercode $hexcode)"
outln "$(neat_list "$HEXC" "$ciph" "$kx" "$enc")" outln "$(neat_list "$hexc" "$ciph" "$kx" "$enc")"
done done
else else
#for arg in $(echo $@ | sed 's/,/ /g'); do #for arg in $(echo $@ | sed 's/,/ /g'); do
for arg in ${*//,/ /}; do for arg in ${*//,/ /}; do
$OPENSSL ciphers -V 'ALL:COMPLEMENTOFALL:@STRENGTH' 2>$ERRFILE | while read hexcode dash ciph sslvers kx auth enc mac export ; do # -V doesn't work with openssl < 1.0 $OPENSSL ciphers -V 'ALL:COMPLEMENTOFALL:@STRENGTH' 2>$ERRFILE | while read hexcode dash ciph sslvers kx auth enc mac export ; do # -V doesn't work with openssl < 1.0
normalize_ciphercode $hexcode hexc="$(normalize_ciphercode $hexcode)"
# for numbers we don't do word matching: # for numbers we don't do word matching:
[[ $arg =~ $re ]] && \ [[ $arg =~ $re ]] && \
line="$(neat_list "$HEXC" "$ciph" "$kx" "$enc" | grep -ai "$arg" || \ line="$(neat_list "$hexc" "$ciph" "$kx" "$enc" | grep -ai "$arg")" || \
neat_list "$HEXC" "$ciph" "$kx" "$enc" | grep -wai "$arg")" line="$(neat_list "$hexc" "$ciph" "$kx" "$enc" | grep -wai "$arg")"
[[ -n "$line" ]] && outln "$line" [[ -n "$line" ]] && outln "$line"
done done
done done
@ -2610,16 +2598,16 @@ test_just_one(){
done done
else else
while read hexc n ciph[nr_ciphers] sslvers[nr_ciphers] kx[nr_ciphers] auth enc[nr_ciphers] mac export2[nr_ciphers]; do while read hexc n ciph[nr_ciphers] sslvers[nr_ciphers] kx[nr_ciphers] auth enc[nr_ciphers] mac export2[nr_ciphers]; do
normalize_ciphercode $hexc hexc="$(normalize_ciphercode $hexc)"
# is argument a number? # is argument a number?
if [[ $arg =~ $re ]]; then if [[ $arg =~ $re ]]; then
neat_list "$HEXC" "${ciph[nr_ciphers]}" "${kx[nr_ciphers]}" "${enc[nr_ciphers]}" | grep -qai "$arg" neat_list "$hexc" "${ciph[nr_ciphers]}" "${kx[nr_ciphers]}" "${enc[nr_ciphers]}" | grep -qai "$arg"
else else
neat_list "$HEXC" "${ciph[nr_ciphers]}" "${kx[nr_ciphers]}" "${enc[nr_ciphers]}" | grep -qwai "$arg" neat_list "$hexc" "${ciph[nr_ciphers]}" "${kx[nr_ciphers]}" "${enc[nr_ciphers]}" | grep -qwai "$arg"
fi fi
if [[ $? -eq 0 ]]; then # string matches, so we can ssl to it: if [[ $? -eq 0 ]]; then # string matches, so we can ssl to it:
ciphers_found[nr_ciphers]=false ciphers_found[nr_ciphers]=false
normalized_hexcode[nr_ciphers]="$HEXC" normalized_hexcode[nr_ciphers]="$hexc"
sigalg[nr_ciphers]="" sigalg[nr_ciphers]=""
ossl_supported[nr_ciphers]=true ossl_supported[nr_ciphers]=true
nr_ciphers+=1 nr_ciphers+=1