From d4455081f08c4cd63ae5e0226a51690c6768e330 Mon Sep 17 00:00:00 2001 From: David Cooper Date: Thu, 9 Feb 2017 11:36:24 -0500 Subject: [PATCH] Wrap long lines This PR addresses the issue raised in #623. This PR is based on the function `out_row_aligned_max_width()` that I proposed in #623, but the `out_row_aligned_max_width()` in this PR is a little different. It takes a fourth parameter, which is the function to use to print each word in the text string to be printed. This is used in `run_pfs()` so that the "Elliptic curves offered" can be printed using this function (some servers support 25 curves), while still having the curves printed using color-coding to indicate the quality of each curve. I somewhat arbitrarily have each line wrap at 120 characters, but that could be changed (e.g., to `$TERM_WIDTH`). --- testssl.sh | 163 ++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 129 insertions(+), 34 deletions(-) diff --git a/testssl.sh b/testssl.sh index 489995c..338789b 100755 --- a/testssl.sh +++ b/testssl.sh @@ -975,6 +975,64 @@ out_row_aligned() { done } +# prints text over multiple lines, trying to make no line longer than $max_width. +# Each line is indented with $spaces and each word in $text is printed using +# $print_function. +out_row_aligned_max_width() { + local text="$1" + local spaces="$2" + local -i max_width="$3" + local print_function="$4" + local -i i len cut_point + local cr=$'\n' + local line entry first=true last=false + + max_width=$max_width-${#spaces} + len=${#text} + while true; do + i=$max_width + if [[ $i -ge $len ]]; then + i=$len + else + while true; do + [[ "${text:i:1}" == " " ]] && break + [[ $i -eq 0 ]] && break + i=$i-1 + done + if [[ $i -eq 0 ]]; then + i=$max_width+1 + while true; do + [[ "${text:i:1}" == " " ]] && break + [[ $i -eq $len ]] && break + i+=1 + done + fi + fi + if [[ $i -eq $len ]]; then + line="$text" + if ! "$first"; then + out "${cr}${spaces}" + fi + last=true + else + line="${text:0:i}" + if ! "$first"; then + out "${cr}${spaces}" + fi + len=$len-$i-1 + i=$i+1 + text="${text:i:len}" + first=false + [[ $len -eq 0 ]] && last=true + fi + while read entry; do + $print_function "$entry" ; out " " + done <<< "$(echo "$line" | tr ' ' '\n')" + "$last" && break + done + return 0 +} + is_number() { [[ "$1" =~ ^[1-9][0-9]*$ ]] && \ return 0 || \ @@ -4540,6 +4598,59 @@ run_std_cipherlists() { return 0 } +pr_ecdh_curve_quality() { + curve="$1" + local -i bits=0 + + case "$curve" in + "sect163k1") bits=163 ;; + "sect163r1") bits=162 ;; + "sect163r2") bits=163 ;; + "sect193r1") bits=193 ;; + "sect193r2") bits=193 ;; + "sect233k1") bits=232 ;; + "sect233r1") bits=233 ;; + "sect239k1") bits=238 ;; + "sect283k1") bits=281 ;; + "sect283r1") bits=282 ;; + "sect409k1") bits=407 ;; + "sect409r1") bits=409 ;; + "sect571k1") bits=570 ;; + "sect571r1") bits=570 ;; + "secp160k1") bits=161 ;; + "secp160r1") bits=161 ;; + "secp160r2") bits=161 ;; + "secp192k1") bits=192 ;; + "prime192v1") bits=192 ;; + "secp224k1") bits=225 ;; + "secp224r1") bits=224 ;; + "secp256k1") bits=256 ;; + "prime256v1") bits=256 ;; + "secp384r1") bits=384 ;; + "secp521r1") bits=521 ;; + "brainpoolP256r1") bits=256 ;; + "brainpoolP384r1") bits=384 ;; + "brainpoolP512r1") bits=512 ;; + "X25519") bits=253 ;; + "X448") bits=448 ;; + esac + + if [[ "$bits" -le 80 ]]; then # has that ever existed? + pr_svrty_critical "$curve" + elif [[ "$bits" -le 108 ]]; then # has that ever existed? + pr_svrty_high "$curve" + elif [[ "$bits" -le 163 ]]; then + pr_svrty_medium "$curve" + elif [[ "$bits" -le 193 ]]; then # hmm, according to https://wiki.openssl.org/index.php/Elliptic_Curve_Cryptography it should ok + pr_svrty_low "$curve" # but openssl removed it https://github.com/drwetter/testssl.sh/issues/299#issuecomment-220905416 + elif [[ "$bits" -le 224 ]]; then + out "$curve" + elif [[ "$bits" -gt 224 ]]; then + pr_done_good "$curve" + else + out "$curve" + fi +} # arg1: file with input for grepping the bit length for ECDH/DHE # arg2: whether to print warning "old fart" or not (empty: no) @@ -5149,7 +5260,7 @@ cipher_pref_check() { if [[ -n "$order" ]]; then outln printf " %-10s" "$proto: " - out "$order" + out_row_aligned_max_width "$order" " " 120 out fileout "order_$p" "INFO" "Default cipher order for protocol $p: $order" fi done @@ -5163,7 +5274,7 @@ cipher_pref_check() { order="" $OPENSSL s_client $BUGS -nextprotoneg "$p" -connect $NODEIP:$PORT $SNI >$ERRFILE >$TMPFILE cipher=$(awk '/Cipher.*:/ { print $3 }' $TMPFILE) - printf " %-10s %s " "$p:" "$cipher" + printf " %-10s " "$p:" tested_cipher="-"$cipher order="$cipher" if ! "$FAST"; then @@ -5171,11 +5282,11 @@ cipher_pref_check() { $OPENSSL s_client -cipher "ALL:$tested_cipher" $BUGS -nextprotoneg "$p" -connect $NODEIP:$PORT $SNI >$ERRFILE >$TMPFILE sclient_connect_successful $? $TMPFILE || break cipher=$(awk '/Cipher.*:/ { print $3 }' $TMPFILE) - out "$cipher " tested_cipher="$tested_cipher:-$cipher" order+=" $cipher" done fi + out_row_aligned_max_width "$order" " " 120 out outln [[ -n $order ]] && fileout "order_spdy_$p" "INFO" "Default cipher order for SPDY protocol $p: $order" done @@ -5732,7 +5843,7 @@ certificate_info() { local ocsp_response_status=$6 local sni_used=$7 local cert_sig_algo cert_sig_hash_algo cert_key_algo - local expire days2expire secs2warn ocsp_uri crl startdate enddate issuer_CN issuer_C issuer_O issuer sans san cn + local expire days2expire secs2warn ocsp_uri crl startdate enddate issuer_CN issuer_C issuer_O issuer sans san all_san="" cn local issuer_DC issuerfinding cn_nosni="" local cert_fingerprint_sha1 cert_fingerprint_sha2 cert_fingerprint_serial local policy_oid @@ -6012,10 +6123,10 @@ certificate_info() { out "$indent"; pr_bold " subjectAltName (SAN) " if [[ -n "$sans" ]]; then while read san; do - [[ -n "$san" ]] && pr_italic "$san" - out " " + [[ -n "$san" ]] && all_san+="$san " done <<< "$sans" - fileout "${json_prefix}san" "INFO" "subjectAltName (SAN) : $sans" + out_row_aligned_max_width "$all_san" " " 120 pr_italic + fileout "${json_prefix}san" "INFO" "subjectAltName (SAN) : $all_san" else out "-- " fileout "${json_prefix}san" "INFO" "subjectAltName (SAN) : --" @@ -6443,7 +6554,7 @@ run_server_defaults() { fileout "tls_extensions" "INFO" "TLS server extensions (std): (none)" else #FIXME: we rather want to have the chance to print each ext in italcs or another format. Atm is a string of quoted strings -- that needs to be fixed at the root - outln "$TLS_EXTENSIONS" + out_row_aligned_max_width "$TLS_EXTENSIONS" " " 120 out; outln fileout "tls_extensions" "INFO" "TLS server extensions (std): $TLS_EXTENSIONS" fi @@ -6493,7 +6604,7 @@ run_pfs() { local -a ffdhe_groups_output=("ffdhe2048" "ffdhe3072" "ffdhe4096" "ffdhe6144" "ffdhe8192") local -a supported_curve bits local -i nr_supported_ciphers=0 nr_curves=0 nr_ossl_curves=0 i j low high - local pfs_ciphers curves_offered="" curves_offered_text="" curves_to_test temp + local pfs_ciphers curves_offered="" curves_to_test temp local len1 len2 curve_found local has_dh_bits="$HAS_DH_BITS" local using_sockets=true @@ -6645,7 +6756,6 @@ run_pfs() { pfs_cipher="${rfc_ciph[i]}" fi pfs_ciphers+="$pfs_cipher " - ! "$WIDE" && out "$pfs_cipher " if [[ "${ciph[i]}" == "ECDHE-"* ]] || ( "$using_sockets" && [[ "${rfc_ciph[i]}" == "TLS_ECDHE_"* ]] ); then ecdhe_offered=true @@ -6669,10 +6779,9 @@ run_pfs() { outln "${sigalg[i]}" fi done - + ! "$WIDE" && out_row_aligned_max_width "$pfs_ciphers" " " 120 out debugme echo $pfs_offered "$WIDE" || outln - fileout "pfs_ciphers" "INFO" "(Perfect) Forward Secrecy Ciphers: $pfs_ciphers" fi @@ -6752,22 +6861,13 @@ run_pfs() { fi if "$ecdhe_offered"; then for (( i=0; i < nr_curves; i++ )); do - if "${supported_curve[i]}"; then - curves_offered+="${curves_ossl[i]} " - if [[ "${bits[i]}" -le 163 ]]; then - curves_offered_text+="$(pr_svrty_medium "${curves_ossl[i]}") " - elif [[ "${bits[i]}" -le 193 ]]; then # hmm, according to https://wiki.openssl.org/index.php/Elliptic_Curve_Cryptography it should ok - curves_offered_text+="$(pr_svrty_low "${curves_ossl[i]}") " # but openssl removed it https://github.com/drwetter/testssl.sh/issues/299#issuecomment-220905416 - elif [[ "${bits[i]}" -le 224 ]]; then - curves_offered_text+="${curves_ossl[i]} " - else - curves_offered_text+="$(pr_done_good "${curves_ossl[i]}") " - fi - fi + "${supported_curve[i]}" && curves_offered+="${curves_ossl[i]} " done if [[ -n "$curves_offered" ]]; then "$WIDE" && outln - pr_bold " Elliptic curves offered: "; outln "$curves_offered_text" + pr_bold " Elliptic curves offered: " + out_row_aligned_max_width "$curves_offered" " " 120 pr_ecdh_curve_quality + outln fileout "ecdhe_curves" "INFO" "Elliptic curves offered $curves_offered" fi fi @@ -10304,17 +10404,13 @@ run_beast(){ if ! "$WIDE"; then if [[ -n "$detected_cbc_ciphers" ]]; then - detected_cbc_ciphers=$(echo "$detected_cbc_ciphers" | \ - sed -e "s/ /\\${cr} ${spaces}/12" \ - -e "s/ /\\${cr} ${spaces}/9" \ - -e "s/ /\\${cr} ${spaces}/6" \ - -e "s/ /\\${cr} ${spaces}/3") fileout "cbc_$proto" "MEDIUM" "BEAST: CBC ciphers for $(toupper $proto): $detected_cbc_ciphers" "$cve" "$cwe" "$hint" ! "$first" && out "$spaces" out "$(toupper $proto):" [[ -n "$higher_proto_supported" ]] && \ - pr_svrty_lowln "$detected_cbc_ciphers" || \ - pr_svrty_mediumln "$detected_cbc_ciphers" + out_row_aligned_max_width "$detected_cbc_ciphers" " " 120 pr_svrty_low || \ + out_row_aligned_max_width "$detected_cbc_ciphers" " " 120 pr_svrty_medium + outln detected_cbc_ciphers="" # empty for next round first=false else @@ -10640,11 +10736,10 @@ run_rc4() { fi fi outln "${sigalg[i]}" - elif "${ciphers_found[i]}"; then - pr_svrty_high "${ciph[i]} " fi "${ciphers_found[i]}" && rc4_detected+="${ciph[i]} " done + ! "$WIDE" && out_row_aligned_max_width "$rc4_detected" " " 120 pr_svrty_high outln "$WIDE" && pr_svrty_high "VULNERABLE (NOT ok)" fileout "rc4" "HIGH" "RC4: VULNERABLE, Detected ciphers: $rc4_detected" "$cve" "$cwe" "$hint"