forked from mozilla/cipherscan
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathcipherscan
executable file
·2205 lines (2019 loc) · 75.3 KB
/
cipherscan
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/env bash
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# Authors: Julien Vehent [:ulfr] - 201{3,4}
# Hubert Kario - 2014, 2015
# vim: autoindent tabstop=4 shiftwidth=4 expandtab softtabstop=4 filetype=sh
DOBENCHMARK=0
BENCHMARKITER=30
# cipherscan requires bash4, which doesn't come by default in OSX
if [[ ${BASH_VERSINFO[0]} -lt 4 ]]; then
echo "Bash version 4 is required to run cipherscan." 1>&2
echo "Please upgrade your version of bash (ex: brew install bash)." 1>&2
exit 1
fi
if [[ -n $NOAUTODETECT ]]; then
if ! [[ -f $TIMEOUTBIN && -x $TIMEOUTBIN ]]; then
echo "NOAUTODETECT set, but TIMEOUTBIN is not an executable file" 1>&2
exit 1
fi
if ! [[ -f $OPENSSLBIN && -x $OPENSSLBIN ]]; then
echo "NOAUTODETECT set, but OPENSSLBIN is not an executable file" 1>&2
exit 1
fi
else
case "$(uname -s)" in
Darwin)
opensslbin_name="openssl-darwin64"
READLINKBIN=$(which greadlink 2>/dev/null)
if [[ -z $READLINKBIN ]]; then
echo "greadlink not found. (try: brew install coreutils)" 1>&2
exit 1
fi
TIMEOUTBIN=$(which gtimeout 2>/dev/null)
if [[ -z $TIMEOUTBIN ]]; then
echo "gtimeout not found. (try: brew install coreutils)" 1>&2
exit 1
fi
;;
*)
opensslbin_name="openssl"
# test that readlink or greadlink (darwin) are present
READLINKBIN="$(which readlink)"
if [[ -z $READLINKBIN ]]; then
READLINKBIN="$(which greadlink)"
if [[ -z $READLINKBIN ]]; then
echo "neither readlink nor greadlink are present. install coreutils with {apt-get,yum,brew} install coreutils" 1>&2
exit 1
fi
fi
# test that timeout or gtimeout (darwin) are present
TIMEOUTBIN="$(which timeout)"
if [[ -z $TIMEOUTBIN ]]; then
TIMEOUTBIN="$(which gtimeout)"
if [[ -z $TIMEOUTBIN ]]; then
echo "neither timeout nor gtimeout are present. install coreutils with {apt-get,yum,brew} install coreutils" 1>&2
exit 1
fi
fi
# Check for busybox, which has different arguments
TIMEOUTOUTPUT="$($TIMEOUTBIN --help 2>&1)"
if [[ "$TIMEOUTOUTPUT" =~ BusyBox ]]; then
TIMEOUTBIN="$TIMEOUTBIN -t"
fi
;;
esac
fi
DIRNAMEPATH=$(dirname "$0")
join_array_by_char() {
# Two or less parameters (join + 0 or 1 value), then no need to set IFS because no join occurs.
if (( $# >= 3 )); then
# Three or more parameters (join + 2 values), then we need to set IFS for the join.
local IFS=$1
fi
# Discard the join string (usually ':', could be others).
shift
# Store the joined string in the result.
joined_array="$*"
}
# RSA ciphers are put at the end to force Google servers to accept ECDSA ciphers
# (probably a result of a workaround for the bug in Apple implementation of ECDSA)
CIPHERSUITE="ALL:COMPLEMENTOFALL:+aRSA"
# some servers are intolerant to large client hello, try a shorter list of
# ciphers with them
SHORTCIPHERSUITE=(
'ECDHE-ECDSA-AES128-GCM-SHA256'
'ECDHE-RSA-AES128-GCM-SHA256'
'ECDHE-RSA-AES256-GCM-SHA384'
'ECDHE-ECDSA-AES256-SHA'
'ECDHE-ECDSA-AES128-SHA'
'ECDHE-RSA-AES128-SHA'
'ECDHE-RSA-AES256-SHA'
'ECDHE-RSA-DES-CBC3-SHA'
'ECDHE-ECDSA-RC4-SHA'
'ECDHE-RSA-RC4-SHA'
'DHE-RSA-AES128-SHA'
'DHE-DSS-AES128-SHA'
'DHE-RSA-CAMELLIA128-SHA'
'DHE-RSA-AES256-SHA'
'DHE-DSS-AES256-SHA'
'DHE-RSA-CAMELLIA256-SHA'
'EDH-RSA-DES-CBC3-SHA'
'AES128-SHA'
'CAMELLIA128-SHA'
'AES256-SHA'
'CAMELLIA256-SHA'
'DES-CBC3-SHA'
'RC4-SHA'
'RC4-MD5'
)
join_array_by_char ':' "${SHORTCIPHERSUITE[@]}"
SHORTCIPHERSUITESTRING="$joined_array"
# as some servers are intolerant to large client hello's (or ones that have
# RC4 ciphers below position 64), use the following for cipher testing in case
# of problems
FALLBACKCIPHERSUITE=(
'ECDHE-RSA-AES128-GCM-SHA256'
'ECDHE-RSA-AES128-SHA256'
'ECDHE-RSA-AES128-SHA'
'ECDHE-RSA-DES-CBC3-SHA'
'ECDHE-RSA-RC4-SHA'
'DHE-RSA-AES128-SHA'
'DHE-DSS-AES128-SHA'
'DHE-RSA-CAMELLIA128-SHA'
'DHE-RSA-AES256-SHA'
'DHE-DSS-AES256-SHA'
'DHE-RSA-CAMELLIA256-SHA'
'EDH-RSA-DES-CBC3-SHA'
'AES128-SHA'
'CAMELLIA128-SHA'
'AES256-SHA'
'CAMELLIA256-SHA'
'DES-CBC3-SHA'
'RC4-SHA'
'RC4-MD5'
'SEED-SHA'
'IDEA-CBC-SHA'
'IDEA-CBC-MD5'
'RC2-CBC-MD5'
'DES-CBC3-MD5'
'EXP1024-DHE-DSS-DES-CBC-SHA'
'EDH-RSA-DES-CBC-SHA'
'EXP1024-DES-CBC-SHA'
'DES-CBC-MD5'
'EXP1024-RC4-SHA'
'EXP-EDH-RSA-DES-CBC-SHA'
'EXP-DES-CBC-SHA'
'EXP-RC2-CBC-MD5'
'EXP-RC4-MD5'
)
join_array_by_char ':' "${FALLBACKCIPHERSUITE[@]}"
FALLBACKCIPHERSUITESTRING="$joined_array"
DEBUG=0
VERBOSE=0
DELAY=0
ALLCIPHERS=""
OUTPUTFORMAT="terminal"
TIMEOUT=30
USECOLORS="auto"
# place where to put the found intermediate CA certificates and where
# trust anchors are stored
SAVECRT=""
TEST_CURVES="True"
has_curves="False"
TEST_TOLERANCE="True"
SNI="True"
# openssl formated list of curves that will cause server to select ECC suite
ecc_ciphers=""
TEST_KEX_SIGALG="False"
unset known_certs
declare -A known_certs
unset cert_checksums
declare -A cert_checksums
# array with results of tolerance scans (TLS version, extensions, etc.)
declare -A tls_tolerance
# array with info on type of fallback on unknown sigalgs (or required ones)
declare -A sigalgs_fallback
# array with preferred sigalgs for aRSA and aECDSA ciphers
declare -a sigalgs_preferred_rsa
declare -a sigalgs_preferred_ecdsa
renegotiation=""
compression=""
# because running external commands like sleep incurs a fork penalty, we
# first check if it is necessary
ratelimit() {
if [[ $DELAY != "0" ]]; then
sleep $DELAY
fi
}
usage() {
echo -e "usage: $0 [-a|--allciphers] [-b|--benchmark] [--capath directory]
[--saveca] [--savecrt directory] [-d|--delay seconds] [-D|--debug] [-j|--json]
[-v|--verbose] [-o|--openssl file] [openssl s_client args] <target:port>
usage: $0 -h|--help
$0 attempts to connect to a target site using all the ciphersuites known
to OpenSSL it is using.
Julien Vehent [:ulfr] and others (see README.md)
https://github.com/jvehent/cipherscan
Port defaults to 443
example: $ $0 www.google.com
Use one of the options below:
-a | --allciphers Test all known ciphers individually at the end.
-b | --benchmark Activate benchmark mode.
--capath use CAs from directory (must be in OpenSSL CAdir format)
--saveca save intermediate certificates in CA directory
-d | --delay Pause for n seconds between connections
-D | --debug Output ALL the information.
-h | --help Shows this help text.
-j | --json Output results in JSON format.
-o | --openssl path/to/your/openssl binary you want to use.
--savecrt path where to save untrusted and leaf certificates
--[no-]curves test ECC curves supported by server (req. OpenSSL 1.0.2)
--sigalg test signature algorithms used in TLSv1.2 ephemeral ciphers
(req. OpenSSL 1.0.2)
--[no-]tolerance test TLS tolerance
--no-sni don't use Server Name Indication
--colors force use of colors (autodetect by default)
--no-colors don't use terminal colors
-v | --verbose Increase verbosity.
The rest of the arguments will be interpreted as openssl s_client argument.
Some useful OpenSSL options:
-starttls [smtp|imap|pop3|ftp|xmpp] Enable support and testing of the protocols
that require turning TLS after initial protocol specific
hello
-servername name Request SNI support for connections
-proxy proxyhost:port Connect to the scan target via specified proxy
(req. OpenSSL 1.1.0 or bundled OpenSSL)
-verify_hostname name Request host name verification in connection
(req. OpenSSL 1.0.2)
-verify_ip ip Request host name verification for an IP address, usually
not specified in certificates (req. OpenSSL 1.0.2)
EXAMPLES:
$0 -starttls xmpp jabber.ccc.de:5222
$0 -servername youtube.com youtube.com:443
$0 -proxy myproxy.example.com:8080 youtube.com:443
"
}
verbose() {
if [[ $VERBOSE != 0 ]]; then
echo "$@" >&2
fi
}
debug(){
if [[ $DEBUG == 1 ]]; then
echo Debug: "$@" >&2
set -evx
fi
}
# obtain an array of curves supported by openssl
CURVES=(
'sect163k1' # K-163
'sect163r1'
'sect163r2' # B-163
'sect193r1'
'sect193r2'
'sect233k1' # K-233
'sect233r1' # B-233
'sect239k1'
'sect283k1' # K-283
'sect283r1' # B-283
'sect409k1' # K-409
'sect409r1' # B-409
'sect571k1' # K-571
'sect571r1' # B-571
'secp160k1'
'secp160r1'
'secp160r2'
'secp192k1'
'prime192v1' # P-192 secp192r1
'secp224k1'
'secp224r1' # P-224
'secp256k1'
'prime256v1' # P-256 secp256r1
'secp384r1' # P-384
'secp521r1' # P-521
'brainpoolP256r1'
'brainpoolP384r1'
'brainpoolP512r1'
)
# many curves have alternative names, this array provides a mapping to find the IANA
# name of a curve using its alias
CURVES_MAP=(
'sect163k1 K-163'
'sect163r2 B-163'
'sect233k1 K-233'
'sect233r1 B-233'
'sect283k1 K-283'
'sect283r1 B-283'
'sect409k1 K-409'
'sect409r1 B-409'
'sect571k1 K-571'
'sect571r1 B-571'
'prime192v1 P-192 secp192r1'
'secp224r1 P-224'
'prime256v1 P-256 secp256r1'
'secp384r1 P-384'
'secp521r1 P-521'
)
get_curve_name() {
local identifier=$1
for c in "${CURVES_MAP[@]}"; do
if [[ "$c" =~ $identifier ]]; then
verbose "$c matches identifier $identifier"
echo "${c%% *}"
return
fi
done
echo "$identifier"
return
}
c_hash() {
local h=$(${OPENSSLBIN} x509 -hash -noout -in "$1/$2" 2>/dev/null)
for ((num=0; num<=100; num++)) ; do
if [[ $1/${h}.${num} -ef $2 ]]; then
# file already linked, ignore
break
fi
if [[ ! -e $1/${h}.${num} ]]; then
# file doesn't exist, create a link
if pushd "$1" > /dev/null; then
ln -s "$2" "${h}.${num}"
else
echo "'pushd $1' failed unexpectedly, refusing to proceed" 1>&2
exit 1
fi
popd > /dev/null
break
fi
done
}
check_option_support() {
[[ $OPENSSLBINHELP =~ "$1" ]]
}
parse_openssl_output() {
# clear variables in case matching doesn't hit them
current_ocspstaple="False"
current_cipher=""
current_kex_sigalg=""
current_pfs=""
current_protocol=""
current_tickethint="None"
current_pubkey=0
current_trusted="False"
current_sigalg="None"
current_renegotiation="False"
current_compression=""
current_npn="None"
certs_found=0
current_raw_certificates=()
while read line; do
# check if there isn't OCSP response data (response and responder cert)
if [[ $line =~ ^====================================== ]]; then
while read data; do
# check if there is a OCSP response in output
if [[ $data =~ OCSP\ Response\ Data ]]; then
current_ocspstaple="True"
continue
fi
# skip all data from a OCSP response
if [[ $data =~ ^====================================== ]]; then
break
fi
done
continue
fi
# get NPN protocols
if [[ $line =~ Protocols\ advertised\ by\ server:\ (.*) ]]; then
current_npn="${BASH_REMATCH[1]// /}"
continue
fi
# extract selected cipher
if [[ $line =~ New,\ ]]; then
local match=($line)
current_cipher="${match[4]}"
continue
fi
# renegotiation support
if [[ $line =~ Secure\ Renegotiation\ IS\ supported ]]; then
current_renegotiation="secure"
continue
fi
if [[ $line =~ Secure\ Renegotiation\ IS\ NOT\ supported ]]; then
current_renegotiation="insecure"
continue
fi
# compression settings
if [[ $line =~ Compression:\ (.*) ]]; then
current_compression="${BASH_REMATCH[1]}"
continue
fi
# extract the signing algorithm used in TLSv1.2 ephemeral kex
if [[ $line =~ Peer\ signing\ digest ]]; then
local match=($line)
current_kex_sigalg="${match[3]}"
continue
fi
# extract data about selected temporary key
if [[ $line =~ Server\ Temp\ Key ]]; then
local match=($line)
current_pfs="${match[3]}${match[4]}${match[5]}${match[6]}"
continue
fi
# extract used protocol
if [[ $line =~ ^Protocol\ + ]]; then
local match=($line)
current_protocol="${match[2]}"
continue
fi
# extract session ticket hint
if [[ $line =~ ticket\ lifetime\ hint ]]; then
local match=($line)
current_tickethint="${match[5]}"
continue
fi
# extract size of server public key
if [[ $line =~ Server\ public\ key\ is\ ]]; then
local match=($line)
current_pubkey="${match[4]}"
continue
fi
# check if connection used trused certificate
if [[ $line =~ Verify\ return\ code:\ 0 ]]; then
current_trusted="True"
continue
fi
# extract certificates
if [[ $line =~ -----BEGIN\ CERTIFICATE----- ]]; then
current_raw_certificates[$certs_found]="$line"$'\n'
while read data; do
current_raw_certificates[$certs_found]+="$data"$'\n'
if [[ $data =~ -----END\ CERTIFICATE----- ]]; then
break
fi
done
certs_found=$((certs_found+1))
continue
fi
done
# if we found any certs in output, process the first one and extract
# the signature algorithm on it (it's the server's certificate)
if (( certs_found > 0 )); then
local ossl_out=$(${OPENSSLBIN} x509 -noout -text 2>/dev/null <<<"${current_raw_certificates[0]}")
local regex='Signature Algorithm[^ ]+ +(.+$)'
while read data; do
if [[ $data =~ $regex ]]; then
current_sigalg="${BASH_REMATCH[1]// /_}"
fi
done <<<"$ossl_out"
fi
}
# Connect to a target host with the selected ciphersuite
test_cipher_on_target() {
local sslcommand="$*"
cipher=""
local cmnd=""
protocols=""
pfs=""
previous_cipher=""
certificates=""
for tls_version in "-ssl2" "-ssl3" "-tls1" "-tls1_1" "-tls1_2"
do
# sslv2 client hello doesn't support SNI extension
# in SSLv3 mode OpenSSL just ignores the setting so it's ok
# -status exception is ignored in SSLv2, go figure
if [[ "$tls_version" == "-ssl2" ]]; then
if [[ "$sslcommand" =~ (.*)(-servername\ [^ ]*)(.*) ]]; then
cmnd="${BASH_REMATCH[1]} ${BASH_REMATCH[3]}"
else
cmnd="$sslcommand"
fi
else
cmnd=$sslcommand
fi
ratelimit
debug echo \"Q\" \| $cmnd $tls_version
local tmp=$(echo "Q" | $cmnd $tls_version 1>/dev/stdout 2>/dev/null)
parse_openssl_output <<<"$tmp"
verbose "selected cipher is '$current_cipher'"
verbose "using protocol '$current_protocol'"
# collect certificate data
current_certificates=""
local certificate_count=$certs_found
debug "server presented $certificate_count certificates"
local i
for ((i=0; i<certificate_count; i=i+1 )); do
# extract i'th certificate
local cert="${current_raw_certificates[$i]}"
# put the output to an array instead running awk '{print $1}'
local cksum=($(cksum <<<"$cert"))
# compare the values not just checksums so that eventual collision
# doesn't mess up results
if [[ ${known_certs[$cksum]} == "$cert" ]]; then
if [[ -n "${current_certificates}" ]]; then
current_certificates+=","
fi
current_certificates+="\"${cert_checksums[$cksum]}\""
continue
fi
# compute sha256 fingerprint of the certificate
local sha256sum=($(${OPENSSLBIN} x509 -outform DER\
<<<"$cert" 2>/dev/null |\
${OPENSSLBIN} dgst -sha256 -r 2>/dev/null))
# check if it is a CA certificate
local isCA="False"
if ${OPENSSLBIN} x509 -noout -text <<<"$cert" 2>/dev/null |\
grep 'CA:TRUE' >/dev/null; then
isCA="True"
fi
# build trust source for certificate verification
local trust_source=()
if [[ -n $CAPATH ]]; then
trust_source=("-CApath" "$CAPATH")
elif [[ -e $CACERTS ]]; then
trust_source=("-CAfile" "$CACERTS")
fi
# check if the certificate is actually trusted (server may present
# unrelated certificates that are not trusted (including self
# signed ones)
local saved="False"
if ${OPENSSLBIN} verify "${trust_source[@]}" \
-untrusted <(printf "%s" "${current_raw_certificates[@]}") \
<(echo "$cert") 2>/dev/null | \
grep ': OK$' >/dev/null; then
# if the certificate is an intermediate CA it may be useful
# for connecting to servers that are misconfigured so save it
if [[ -n $CAPATH ]] && [[ $SAVECA == "True" ]] && [[ $isCA == "True" ]]; then
if [[ ! -e "$CAPATH/${sha256sum}.pem" ]]; then
echo "$cert" > "$CAPATH/${sha256sum}.pem"
c_hash "$CAPATH" "${sha256sum}.pem"
fi
saved="True"
fi
fi
if [[ -n $SAVECRT ]] && [[ $saved == "False" ]]; then
if [[ ! -e $SAVECRT/${sha256sum}.pem ]]; then
echo "$cert" > "$SAVECRT/${sha256sum}.pem"
fi
fi
# save the sha sum for reporting
if [[ -n "${current_certificates}" ]]; then
current_certificates+=","
fi
current_certificates+="\"${sha256sum}\""
known_certs[$cksum]="$cert"
cert_checksums[$cksum]="$sha256sum"
done
debug "current_certificates: $current_certificates"
# parsing finished, report result
if [[ -z "$current_protocol" || "$current_cipher" == '(NONE)' ]]; then
# connection failed, try again with next TLS version
continue
else
verbose "connection successful; protocol: $current_protocol, cipher: $current_cipher, previous cipher: $previous_cipher"
fi
# handling of TLSv1.2 only cipher suites
if [[ ! -z "$previous_cipher" ]] && [[ "$previous_cipher" != "$current_cipher" ]] && [[ "$current_cipher" != "0000" ]]; then
unset protocols
fi
previous_cipher=$current_cipher
# connection succeeded, add TLS version to positive results
if [[ -z "$protocols" ]]; then
protocols=$current_protocol
else
protocols="$protocols,$current_protocol"
fi
cipher=$current_cipher
pfs=$current_pfs
[[ -z $pfs ]] && pfs="None"
pubkey=$current_pubkey
sigalg=$current_sigalg
trusted=$current_trusted
tickethint=$current_tickethint
ocspstaple=$current_ocspstaple
npn="$current_npn"
certificates="$current_certificates"
# grab the cipher and PFS key size
done
# if cipher is empty, that means none of the TLS version worked with
# the current cipher
if [[ -z "$cipher" ]]; then
verbose "handshake failed, no ciphersuite was returned"
result='ConnectionFailure'
return 2
# if cipher contains NONE, the cipher wasn't accepted
elif [[ "$cipher" == '(NONE) ' ]]; then
result="$cipher $protocols $pubkey $sigalg $trusted $tickethint $ocspstaple $npn $pfs $current_curves $curves_ordering"
verbose "handshake failed, server returned ciphersuite '$result'"
return 1
# the connection succeeded
else
current_curves="None"
# if pfs uses ECDH, test supported curves
if [[ $pfs =~ ECDH ]]; then
has_curves="True"
if [[ $TEST_CURVES == "True" ]]; then
test_curves
if [[ -n $ecc_ciphers ]]; then
ecc_ciphers+=":"
fi
ecc_ciphers+="$cipher"
else
# resolve the openssl curve to the proper IANA name
current_curves="$(get_curve_name "$(echo $pfs|cut -d ',' -f2)")"
curves_ordering="unknown"
fi
fi
result="$cipher $protocols $pubkey $sigalg $trusted $tickethint $ocspstaple $npn $pfs $current_curves $curves_ordering"
verbose "handshake succeeded, server returned ciphersuite '$result'"
return 0
fi
}
# Calculate the average handshake time for a specific ciphersuite
bench_cipher() {
local ciphersuite="$1"
local sslcommand="$TIMEOUTBIN $TIMEOUT $OPENSSLBIN s_client $SCLIENTARGS"
sslcommand+=" -connect $TARGET -cipher $ciphersuite"
local t="$(date +%s%N)"
verbose "Benchmarking handshake on '$TARGET' with ciphersuite '$ciphersuite'"
for i in $(seq 1 $BENCHMARKITER); do
debug "Connection $i"
(echo "Q" | $sslcommand 2>/dev/null 1>/dev/null)
if (( $? != 0 )); then
break
fi
done
# Time interval in nanoseconds
local t="$(($(date +%s%N) - t))"
verbose "Benchmarking done in $t nanoseconds"
# Microseconds
cipherbenchms="$((t/1000/BENCHMARKITER))"
}
# Connect to the target and retrieve the chosen cipher
# recursively until the connection fails
get_cipher_pref() {
[[ "$OUTPUTFORMAT" == "terminal" ]] && [[ $DEBUG -lt 1 ]] && echo -n '.'
local ciphersuite="$1"
local sslcommand="$TIMEOUTBIN $TIMEOUT $OPENSSLBIN s_client"
if [[ -n "$CAPATH" ]]; then
sslcommand+=" -CApath $CAPATH -showcerts"
elif [[ -e $CACERTS ]]; then
sslcommand+=" -CAfile $CACERTS"
fi
sslcommand+=" -trusted_first -status $SCLIENTARGS -connect $TARGET"
sslcommand+=" -cipher $ciphersuite -nextprotoneg http/1.1"
verbose "Connecting to '$TARGET' with ciphersuite '$ciphersuite'"
# If the connection succeeded with the current cipher, benchmark and store
if test_cipher_on_target "$sslcommand"; then
cipherspref=("${cipherspref[@]}" "$result")
ciphercertificates=("${ciphercertificates[@]}" "$certificates")
pciph=($result)
get_cipher_pref "!$pciph:$ciphersuite"
return 0
fi
}
display_sigalgs_in_terminal() {
(echo "prio sigalg"
for sigalg in "$@"; do
if [[ $sigalg == "MD5" ]]; then
color="${c_red}"
elif [[ $sigalg == "SHA1" ]]; then
color="${c_yellow}"
else
color="${c_green}"
fi
echo -e "$cnt ${color}$sigalg${c_reset}"
cnt=$((cnt+1))
done )| column -t
}
display_results_in_terminal() {
# Display the results
ctr=1
local pubkey
local sigalg
local trusted
local tickethint
local npn
local ocspstaple
local curvesordering
local different=False
# Configure colors, if terminal supports them
if [[ $USECOLORS == "auto" ]]; then
if [[ -t 1 ]]; then
USECOLORS="True"
else
USECOLORS="False"
fi
fi
if [[ $USECOLORS == "True" ]]; then
c_blue="\033[0;34m"
c_green="\033[0;32m"
c_yellow="\033[0;33m"
c_red="\033[0;31m"
c_reset="\033[0m"
else
c_blue=
c_green=
c_yellow=
c_red=
c_reset=
fi
echo "Target: $TARGET"; echo
for cipher in "${cipherspref[@]}"; do
# get first in array
pciph=($cipher)
if [[ $DOBENCHMARK -eq 1 ]]; then
bench_cipher "$pciph"
r="$ctr $cipher $cipherbenchms"
else
r="$ctr $cipher"
fi
local cipher_data=($cipher)
if [[ $ctr -eq 1 ]]; then
cipher="${cipher_data[1]}"
pubkey="${cipher_data[2]}"
sigalg="${cipher_data[3]}"
trusted="${cipher_data[4]}"
tickethint="${cipher_data[5]}"
ocspstaple="${cipher_data[6]}"
npn="${cipher_data[7]}"
if [[ $TEST_CURVES == "True" && -n ${cipher_data[10]} ]]; then
curvesordering="${cipher_data[10]}"
else
curvesordering="unknown"
fi
else
if [[ "$pubkey" != "${cipher_data[2]}" ]]; then
different=True
fi
if [[ "$sigalg" != "${cipher_data[3]}" ]]; then
different=True
fi
if [[ "$trusted" != "${cipher_data[4]}" ]]; then
different=True
fi
if [[ "$tickethint" != "${cipher_data[5]}" ]]; then
different=True
fi
if [[ "$ocspstaple" != "${cipher_data[6]}" ]]; then
different=True
fi
if [[ "$npn" != "${cipher_data[7]}" ]]; then
different=True
fi
if [[ "$TEST_CURVES" == "True" && "$curvesordering" != "${cipher_data[10]}" ]]; then
different=True
fi
fi
results=("${results[@]}" "$r")
ctr=$((ctr+1))
done
header="prio ciphersuite protocols"
if [[ $different == "True" ]]; then
header+=" pubkey_size signature_algoritm trusted ticket_hint ocsp_staple npn"
fi
header+=" pfs"
if [[ $has_curves == "True" ]]; then
header+=" curves"
if [[ $TEST_CURVES == "True" && $different == "True" ]]; then
header+=" curves_ordering"
fi
fi
if [[ $DOBENCHMARK -eq 1 ]]; then
header+=" avg_handshake_microsec"
fi
ctr=0
for result in "${results[@]}"; do
if [[ $ctr -eq 0 ]]; then
echo "$header"
ctr=$((ctr+1))
fi
if [[ $different == "True" ]]; then
echo "$result"|grep -v '(NONE)'
else
# prints priority, ciphersuite, protocols, pfs and benchmark time (if any)
awk '!/(NONE)/{print $1 " " $2 " " $3 " " $10 " " $11 " " $13 }' <<<"$result"
fi
done|column -t
echo
if [[ ($sigalg =~ RSA && $pubkey -ge 2047) || ($cipher =~ ECDSA && $pubkey -gt 255) ]]; then
pubkey="${c_green}${pubkey}${c_reset}"
else
pubkey="${c_red}${pubkey}${c_reset}"
fi
if [[ $sigalg =~ md5|sha1 ]]; then
sigalg="${c_red}${sigalg}${c_reset}"
else
sigalg="${c_green}${sigalg}${c_reset}"
fi
if [[ $trusted == "True" ]]; then
trusted="${c_green}trusted${c_reset}"
else
trusted="${c_red}untrusted${c_reset}"
fi
if [[ $different != "True" ]]; then
echo -e "Certificate: $trusted, $pubkey bits, $sigalg signature"
echo "TLS ticket lifetime hint: $tickethint"
echo "NPN protocols: $npn"
fi
if [[ $ocspstaple == "True" ]]; then
echo -e "OCSP stapling: ${c_green}supported${c_reset}"
else
echo -e "OCSP stapling: ${c_red}not supported${c_reset}"
fi
if [[ $serverside == "True" ]]; then
echo -e "Cipher ordering: ${c_green}server${c_reset}"
else
echo -e "Cipher ordering: ${c_red}client${c_reset}"
fi
if [[ $TEST_CURVES == "True" ]]; then
if [[ $curvesordering == "server" ]]; then
curvesordering="${c_green}${curvesordering}${c_reset}"
else
if [[ $curvesordering == "" ]]; then
curvesordering="none"
fi
curvesordering="${c_red}${curvesordering}${c_reset}"
fi
if [[ $fallback_supported == "True" ]]; then
fallback_supported="${c_green}yes${c_reset}"
else
fallback_supported="${c_red}no${c_reset}"
fi
echo -e "Curves ordering: $curvesordering - fallback: $fallback_supported"
fi
if [[ $renegotiation ]]; then
if [[ $renegotiation == "secure" ]]; then
echo -e "Server ${c_green}supports${c_reset} secure renegotiation"
else
echo -e "Server ${c_red}DOESN'T${c_reset} support secure renegotiation"
fi
else
echo "Renegotiation test error"
fi
if [[ $compression ]]; then
if [[ $compression != "NONE" ]]; then
color="${c_red}"
else
color="${c_green}"
fi
echo -e "Server supported compression methods:" \
"${color}$compression${c_reset}"
else
echo -e "Supported compression methods ${c_red}test error${c_reset}"
fi
if [[ $TEST_KEX_SIGALG == "True" ]]; then
echo
echo "TLSv1.2 ephemeral sigalgs:"
for auth in "ECDSA" "RSA"; do
# not colored as neither of that results alone is good or bad
if [[ -z ${sigalgs_fallback[$auth]} ]]; then
echo "no PFS $auth ciphers detected"
elif [[ ${sigalgs_fallback[$auth]} == "False" ]]; then
echo "no PFS $auth fallback"
elif [[ ${sigalgs_fallback[$auth]} == "intolerant" ]]; then
echo "$auth test: intolerant of sigalg removal"
elif [[ ${sigalgs_fallback[$auth]} =~ "pfs-" ]]; then
echo "PFS $auth fallbacks to ${sigalgs_fallback[$auth]}"
else
echo "server forces ${sigalgs_fallback[$auth]} with $auth"
fi
done
if [[ ${sigalgs_ordering} == "server" ]]; then
echo -e "${c_green}Server side sigalg ordering${c_reset}"
elif [[ ${sigalgs_ordering} == "client" ]]; then
echo -e "${c_red}Client side sigalg ordering${c_reset}"
elif [[ ${sigalgs_ordering} == "unsupported" ]]; then
# do nothing - messages above will report that it's unsupported
echo -n
else
echo "Ordering test failure: ${sigalgs_ordering}"
fi
if [[ ${#sigalgs_preferred_ecdsa[@]} -gt 0 ]]; then
echo
if [[ ${sigalgs_preferred_ecdsa[0]} == "Fail" ]]; then
echo -e "${c_red}ECDSA test failed${c_reset}"
else
local cnt=1
echo "Supported PFS ECDSA signature algorithms"
display_sigalgs_in_terminal "${sigalgs_preferred_ecdsa[@]}"
fi
fi
if [[ ${#sigalgs_preferred_rsa[@]} -gt 0 ]]; then
echo
if [[ ${sigalgs_preferred_rsa[0]} == "Fail" ]]; then
echo -e "${c_red}RSA test failed${c_reset}"
else
local cnt=1
echo "Supported PFS RSA signature algorithms"
display_sigalgs_in_terminal "${sigalgs_preferred_rsa[@]}"
fi
fi
echo
fi
if [[ $TEST_TOLERANCE == "True" ]]; then
if [[ ${tls_tolerance['big-TLSv1.2']} =~ TLSv1\.2 ]]; then
echo -e "TLS Tolerance: ${c_green}yes${c_reset}"
else
echo
echo -e "TLS Tolerance: ${c_red}no${c_reset}"
echo "Fallbacks required:"
for test_name in "${!tls_tolerance[@]}"; do
if [[ ${tls_tolerance[$test_name]} == "False" ]]; then
echo "$test_name config not supported, connection failed"
else
local res=(${tls_tolerance[$test_name]})
echo "$test_name no fallback req, connected: ${res[1]} ${res[2]}"
fi
done | sort
fi
fi
echo "$cscan_tests"
}
display_results_in_json() {
# Display the results in json
ctr=0
echo -n "{\"target\":\"$TARGET\",\"utctimestamp\":\"$(date -u '+%FT%T.0Z')\",\"serverside\":\"${serverside}\",\"ciphersuite\": ["
for cipher in "${cipherspref[@]}"; do
local cipher_arr=($cipher)
(( ctr > 0 )) && echo -n ','
echo -n "{\"cipher\":\"${cipher_arr[0]}\","
echo -n "\"protocols\":[\"${cipher_arr[1]//,/\",\"}\"],"