Skip to content

Commit 5c889bd

Browse files
author
David Cooper
committed
Include cipher order information in file output on a per protocol basis
This commit fileout() calls to ciphers_by_strength() and cipher_pref_check() to indicate whether or not the server enforces a cipher order for a protocol version.
1 parent 045778b commit 5c889bd

2 files changed

Lines changed: 27 additions & 5 deletions

File tree

‎t/baseline_data/default_testssl.csvfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
"cipherlist_AVERAGE","testssl.sh/81.169.166.184","443","LOW","offered","","CWE-310"
1919
"cipherlist_GOOD","testssl.sh/81.169.166.184","443","OK","offered","",""
2020
"cipherlist_STRONG","testssl.sh/81.169.166.184","443","OK","offered","",""
21+
"cipher_order-tls1","testssl.sh/81.169.166.184","443","OK","server","",""
2122
"cipher-tls1_xc014","testssl.sh/81.169.166.184","443","LOW","TLSv1 xc014 ECDHE-RSA-AES256-SHA ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
2223
"cipher-tls1_xc013","testssl.sh/81.169.166.184","443","LOW","TLSv1 xc013 ECDHE-RSA-AES128-SHA ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
2324
"cipher-tls1_x88","testssl.sh/81.169.166.184","443","LOW","TLSv1 x88 DHE-RSA-CAMELLIA256-SHA DH 2048 Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA","",""
@@ -26,6 +27,7 @@
2627
"cipher-tls1_x33","testssl.sh/81.169.166.184","443","LOW","TLSv1 x33 DHE-RSA-AES128-SHA DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA","",""
2728
"cipher-tls1_x35","testssl.sh/81.169.166.184","443","LOW","TLSv1 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
2829
"cipherorder_TLSv1","testssl.sh/81.169.166.184","443","INFO","ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA AES256-SHA","",""
30+
"cipher_order-tls1_1","testssl.sh/81.169.166.184","443","OK","server","",""
2931
"cipher-tls1_1_xc014","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 xc014 ECDHE-RSA-AES256-SHA ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
3032
"cipher-tls1_1_xc013","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 xc013 ECDHE-RSA-AES128-SHA ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
3133
"cipher-tls1_1_x88","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 x88 DHE-RSA-CAMELLIA256-SHA DH 2048 Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA","",""
@@ -34,6 +36,7 @@
3436
"cipher-tls1_1_x33","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 x33 DHE-RSA-AES128-SHA DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA","",""
3537
"cipher-tls1_1_x35","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
3638
"cipherorder_TLSv1_1","testssl.sh/81.169.166.184","443","INFO","ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA AES256-SHA","",""
39+
"cipher_order-tls1_2","testssl.sh/81.169.166.184","443","OK","server","",""
3740
"cipher-tls1_2_xc030","testssl.sh/81.169.166.184","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 256 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
3841
"cipher-tls1_2_xc02f","testssl.sh/81.169.166.184","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 256 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
3942
"cipher-tls1_2_x9f","testssl.sh/81.169.166.184","443","OK","TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","",""
@@ -52,6 +55,7 @@
5255
"cipher-tls1_2_x3d","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
5356
"cipher-tls1_2_x35","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
5457
"cipherorder_TLSv1_2","testssl.sh/81.169.166.184","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA256 DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES128-SHA AES256-GCM-SHA384 AES128-GCM-SHA256 AES256-SHA256 AES256-SHA","",""
58+
"cipher_order-tls1_3","testssl.sh/81.169.166.184","443","OK","server","",""
5559
"cipher-tls1_3_x1302","testssl.sh/81.169.166.184","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
5660
"cipher-tls1_3_x1303","testssl.sh/81.169.166.184","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
5761
"cipher-tls1_3_x1301","testssl.sh/81.169.166.184","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""

‎testssl.sh‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4545,12 +4545,28 @@ ciphers_by_strength() {
45454545
fi
45464546

45474547
[[ $difference_rating -lt $NO_CIPHER_ORDER_LEVEL ]] && NO_CIPHER_ORDER_LEVEL=$difference_rating
4548+
id="cipher_order${proto}"
45484549
case $difference_rating in
4549-
5) outln " (no server order, thus listed by strength)" ;;
4550-
4) prln_svrty_low " (no server order, thus listed by strength)" ;;
4551-
3) prln_svrty_medium " (no server order, thus listed by strength)" ;;
4552-
2) prln_svrty_high " (no server order, thus listed by strength)" ;;
4553-
1) prln_svrty_critical " (no server order, thus listed by strength)" ;;
4550+
5)
4551+
outln " (no server order, thus listed by strength)"
4552+
fileout "$id" "INFO" "NOT a cipher order configured"
4553+
;;
4554+
4)
4555+
prln_svrty_low " (no server order, thus listed by strength)"
4556+
fileout "$id" "LOW" "NOT a cipher order configured"
4557+
;;
4558+
3)
4559+
prln_svrty_medium " (no server order, thus listed by strength)"
4560+
fileout "$id" "MEDIUM" "NOT a cipher order configured"
4561+
;;
4562+
2)
4563+
prln_svrty_high " (no server order, thus listed by strength)"
4564+
fileout "$id" "HIGH" "NOT a cipher order configured"
4565+
;;
4566+
1)
4567+
prln_svrty_critical " (no server order, thus listed by strength)"
4568+
fileout "$id" "CRITICAL" "NOT a cipher order configured"
4569+
;;
45544570
esac
45554571
fi
45564572
elif "$wide" && "$proto_supported" || [[ $proto != -ssl2 ]]; then
@@ -7448,8 +7464,10 @@ cipher_pref_check() {
74487464
fi
74497465
if "$prioritize_chacha"; then
74507466
outln " (server order -- server prioritizes ChaCha ciphers when preferred by clients)"
7467+
fileout "cipher_order-${proto}" "OK" "server -- server prioritizes ChaCha ciphers when preferred by clients"
74517468
elif [[ -n "$order" ]]; then
74527469
outln " (server order)"
7470+
fileout "cipher_order-${proto}" "OK" "server"
74537471
else
74547472
outln
74557473
fi

0 commit comments

Comments
 (0)