From ac3e5f4d6200c3c8fe2e8396f6f86fdeadf32ab1 Mon Sep 17 00:00:00 2001 From: Hubert Kario Date: Thu, 3 Apr 2014 23:37:46 +0200 Subject: [PATCH 1/2] Correctly report TLSv1.2 only ciphers as negotiable with TLSv1.2 Previously scan would report: prio ciphersuite protocols pfs_keysize 1 ECDHE-RSA-AES128-GCM-SHA256 SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits 2 ECDHE-RSA-RC4-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits Now it correctly reports: prio ciphersuite protocols pfs_keysize 1 ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 ECDH,P-256,256bits 2 ECDHE-RSA-RC4-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits --- cipherscan | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/cipherscan b/cipherscan index 4d861aa..4bb7b75 100755 --- a/cipherscan +++ b/cipherscan @@ -64,6 +64,7 @@ test_cipher_on_target() { cipher="" protocols="" pfs="" + previous_cipher="" for tls_version in "-ssl2" "-ssl3" "-tls1" "-tls1_1" "-tls1_2" do debug echo \"quit\\n\" \| $sslcommand $tls_version @@ -74,7 +75,15 @@ test_cipher_on_target() { if [[ -z "$current_protocol" || "$current_cipher" == '(NONE)' ]]; then # connection failed, try again with next TLS version continue + else + verbose "connection successful; protocol: $current_protocol, cipher: $current_cipher, previous cipher: $previous_cipher" fi + # handling of TLSv1.2 only cipher suites + if [ ! -z "$previous_cipher" ] && [ "$previous_cipher" != "$current_cipher" ] && [ "$current_cipher" != "0000" ]; then + unset protocols + fi + previous_cipher=$current_cipher + # connection succeeded, add TLS version to positive results if [ -z "$protocols" ]; then protocols=$current_protocol From 32eba4e64435d8091caa1418db63011463d17273 Mon Sep 17 00:00:00 2001 From: Hubert Kario Date: Sat, 5 Apr 2014 18:46:41 +0200 Subject: [PATCH 2/2] update examples from README since now the scan reports protocols correctly, update the example to illustrate that --- README.md | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/README.md b/README.md index 651e846..bdc43d3 100644 --- a/README.md +++ b/README.md @@ -45,24 +45,24 @@ Testing plain SSL/TLS: linux $ ./cipherscan www.google.com:443 ................... prio ciphersuite protocols pfs_keysize -1 ECDHE-RSA-CHACHA20-POLY1305 SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits -2 ECDHE-RSA-AES128-GCM-SHA256 SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits -3 ECDHE-RSA-RC4-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits -4 ECDHE-RSA-AES128-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits -5 AES128-GCM-SHA256 SSLv3,TLSv1,TLSv1.1,TLSv1.2 -6 RC4-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 -7 RC4-MD5 SSLv3,TLSv1,TLSv1.1,TLSv1.2 -8 ECDHE-RSA-AES256-GCM-SHA384 SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits -9 ECDHE-RSA-AES256-SHA384 SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits -10 ECDHE-RSA-AES256-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits -11 AES256-GCM-SHA384 SSLv3,TLSv1,TLSv1.1,TLSv1.2 -12 AES256-SHA256 SSLv3,TLSv1,TLSv1.1,TLSv1.2 -13 AES256-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 -14 ECDHE-RSA-DES-CBC3-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits -15 DES-CBC3-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 -16 ECDHE-RSA-AES128-SHA256 SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits -17 AES128-SHA256 SSLv3,TLSv1,TLSv1.1,TLSv1.2 -18 AES128-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 +1 ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 ECDH,P-256,256bits +2 ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 ECDH,P-256,256bits +3 ECDHE-RSA-AES128-SHA TLSv1.2 ECDH,P-256,256bits +4 ECDHE-RSA-RC4-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits +5 AES128-GCM-SHA256 TLSv1.2 +6 AES128-SHA256 TLSv1.2 +7 AES128-SHA TLSv1.2 +8 RC4-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 +9 RC4-MD5 SSLv3,TLSv1,TLSv1.1,TLSv1.2 +10 ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 ECDH,P-256,256bits +11 ECDHE-RSA-AES256-SHA384 TLSv1.2 ECDH,P-256,256bits +12 ECDHE-RSA-AES256-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits +13 AES256-GCM-SHA384 TLSv1.2 +14 AES256-SHA256 TLSv1.2 +15 AES256-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 +16 ECDHE-RSA-DES-CBC3-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 ECDH,P-256,256bits +17 DES-CBC3-SHA SSLv3,TLSv1,TLSv1.1,TLSv1.2 +18 ECDHE-RSA-AES128-SHA256 TLSv1.2 ECDH,P-256,256bits ``` Testing STARTTLS: