mirror of
https://github.com/drwetter/testssl.sh.git
synced 2024-12-28 12:29:44 +01:00
ce634f7deb
According to the POSIX Programmer's Manual, the exit status specified by the unsigned decimal integer. If n is specified, but its value is not between 0 and 255 inclusively, the exit status is undefined. By cross reference the usage between different scripts in this project, it looks like we could simply remove the `-` before the number.
95 lines
3.0 KiB
Bash
Executable File
95 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# PoC for checking the ellipticale curves negotiated
|
|
# x448 and x25519 are missing, others are not supported
|
|
# License see testssl.sh
|
|
|
|
readonly RUN_DIR=$(dirname "$0")
|
|
|
|
test_openssl_suffix() {
|
|
local naming_ext="$(uname).$(uname -m)"
|
|
local uname_arch="$(uname -m)"
|
|
local myarch_suffix=""
|
|
|
|
[[ $uname_arch =~ 64 ]] && myarch_suffix=64 || myarch_suffix=32
|
|
if [[ -f "$1/openssl" ]] && [[ -x "$1/openssl" ]]; then
|
|
OPENSSL="$1/openssl"
|
|
return 0
|
|
elif [[ -f "$1/openssl.$naming_ext" ]] && [[ -x "$1/openssl.$naming_ext" ]]; then
|
|
OPENSSL="$1/openssl.$naming_ext"
|
|
return 0
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
|
|
find_openssl_binary() {
|
|
# 0. check environment variable whether it's executable
|
|
if [[ -n "$OPENSSL" ]] && [[ ! -x "$OPENSSL" ]]; then
|
|
pr_warningln "\ncannot find specified (\$OPENSSL=$OPENSSL) binary."
|
|
outln " Looking some place else ..."
|
|
elif [[ -x "$OPENSSL" ]]; then
|
|
: # 1. all ok supplied $OPENSSL was found and has executable bit set -- testrun comes below
|
|
elif test_openssl_suffix $RUN_DIR; then
|
|
: # 2. otherwise try openssl in path of testssl.sh
|
|
elif test_openssl_suffix ../$RUN_DIR; then
|
|
: # 2. otherwise try openssl in path of testssl.sh
|
|
elif test_openssl_suffix ../$RUN_DIR/bin; then
|
|
: # 3. otherwise here, this is supposed to be the standard --platform independent path in the future!!!
|
|
elif test_openssl_suffix "$(dirname "$(which openssl)")"; then
|
|
: # 5. we tried hard and failed, so now we use the system binaries
|
|
fi
|
|
|
|
# no ERRFILE initialized yet, thus we use /dev/null for stderr directly
|
|
$OPENSSL version -a 2>/dev/null >/dev/null
|
|
if [[ $? -ne 0 ]] || [[ ! -x "$OPENSSL" ]]; then
|
|
echo "\ncannot exec or find any openssl binary"
|
|
exit 1
|
|
fi
|
|
echo
|
|
echo "using $OPENSSL"
|
|
echo
|
|
}
|
|
|
|
|
|
VERBOSE=false
|
|
if [[ $1 == "-v" ]]; then
|
|
VERBOSE=true
|
|
shift
|
|
fi
|
|
|
|
HN="$1"
|
|
[ -z "$HN" ] && HN=testssl.sh
|
|
find_openssl_binary
|
|
|
|
ERRFILE=$(mktemp /tmp/curve_tester.R.XXXXXX) || exit 6
|
|
TMPFILE=$(mktemp /tmp/curve_tester.T.XXXXXX) || exit 6
|
|
|
|
|
|
for curve in $($OPENSSL ecparam -list_curves | awk -F':' '/:/ { print $1 }'); do
|
|
#if bin/openssl.Linux.x86_64 s_client -curves $curve -connect $HN:443 -servername $HN </dev/null 2>/dev/null | grep -q "BEGIN CERTIFICATE" ; then
|
|
# echo 'YES'
|
|
#else
|
|
# echo '--'
|
|
#fi
|
|
$OPENSSL s_client -cipher ECDH -curves $curve -connect $HN:443 -servername $HN </dev/null 2>$ERRFILE | grep "Server Temp Key:" >$TMPFILE
|
|
if [[ $? -eq 0 ]]; then
|
|
printf "$curve: "
|
|
cat $TMPFILE | sed 's/^.*Server Temp Key: //'
|
|
else
|
|
if grep -q 'Error with' $ERRFILE; then
|
|
if "$VERBOSE"; then
|
|
echo "$curve: no client support"
|
|
fi
|
|
else
|
|
echo "$curve: --"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
rm -f $ERRFILE $TMPFILE
|
|
|
|
# vim:ts=5:sw=5:expandtab
|
|
# $Id: curves.bash,v 1.3 2016/07/09 12:22:13 dirkw Exp $
|
|
|