Skip to content

Commit 43a71b0

Browse files
committed
Consistency for function ciphers_by_strength()
This PR ist similar to #2905 for 3.3dev . However for the stable brnach it's important to note that this is a breaking change as it modifies the output. That happens only tough when `ciphers_by_strength()` is being used --equivalent to the command line `./testssl.sh -E` = `./testssl.sh --cipher-per-proto`. As this is seldom used and was basically succeeded by `-P, --server-preference` this looks acceptable as it provides consistency which was overdue. Details: * keys now always with `v`, like `supportedciphers_TLSv1_2` and also ciphers (e.g. `TLSv1.2 x35 AES256-SHA`) * add word "server" to file output so that it reads "NOT a server cipher order configured" Fixes #2884 for 3.2 .
1 parent 5d275e5 commit 43a71b0

File tree

1 file changed

+7
-3
lines changed

1 file changed

+7
-3
lines changed

testssl.sh

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4399,6 +4399,7 @@ run_allciphers() {
43994399
# test for all ciphers per protocol locally configured (w/o distinguishing whether they are good or bad)
44004400
# for the specified protocol, test for all ciphers locally configured (w/o distinguishing whether they
44014401
# are good or bad) and list them in order to encryption strength.
4402+
#
44024403
ciphers_by_strength() {
44034404
local proto="$1" proto_hex="$2" proto_text="$3"
44044405
local using_sockets="$4" wide="$5" serverpref_known="$6"
@@ -4824,7 +4825,7 @@ run_cipher_per_proto() {
48244825
while read proto proto_hex proto_text; do
48254826
pr_underline "$(printf -- "%b" "$proto_text")"
48264827
ciphers_by_strength "$proto" "$proto_hex" "$proto_text" "$using_sockets" "true" "false"
4827-
done <<< "$(tm_out " -ssl2 22 SSLv2\n -ssl3 00 SSLv3\n -tls1 01 TLS 1\n -tls1_1 02 TLS 1.1\n -tls1_2 03 TLS 1.2\n -tls1_3 04 TLS 1.3")"
4828+
done <<< "$(tm_out " -ssl2 22 SSLv2\n -ssl3 00 SSLv3\n -tls1 01 TLSv1\n -tls1_1 02 TLSv1.1\n -tls1_2 03 TLSv1.2\n -tls1_3 04 TLSv1.3")"
48284829
return 0
48294830
#FIXME: no error condition
48304831
}
@@ -4843,6 +4844,7 @@ run_cipher_per_proto() {
48434844
# then either:
48444845
# 1) replace it with one corresponding to $SNI; or
48454846
# 2) remove it, if $SNI is empty
4847+
#
48464848
modify_clienthello() {
48474849
local tls_handshake_ascii="$1"
48484850
local new_key_share="$2" cookie="$3"
@@ -7171,15 +7173,15 @@ run_server_preference() {
71717173
if "$TLS13_ONLY" && ! "$has_tls13_cipher_order"; then
71727174
terminal_msg="no (TLS 1.3 only)"
71737175
limitedsense=" (limited sense as client will pick)"
7174-
fileout_msg="not a cipher order for TLS 1.3 configured"
7176+
fileout_msg="not a server cipher order for TLS 1.3 configured"
71757177
elif ! "$TLS13_ONLY" && [[ -z "$cipher2" ]]; then
71767178
pr_warning "unable to determine"
71777179
elif ! "$has_cipher_order" && ! "$has_tls13_cipher_order"; then
71787180
# server used the different ends (ciphers) from the client hello
71797181
terminal_msg="no (NOT ok)"
71807182
[[ "$fileout_rating" == INFO ]] && terminal_msg="no"
71817183
limitedsense=" (limited sense as client will pick)"
7182-
fileout_msg="NOT a cipher order configured"
7184+
fileout_msg="NOT a server cipher order configured"
71837185
elif "$has_cipher_order" && ! "$has_tls13_cipher_order" && [[ "$default_proto" == TLSv1.3 ]]; then
71847186
if [[ $NO_CIPHER_ORDER_LEVEL -eq 5 ]]; then
71857187
pr_svrty_good "yes (OK)"; out " -- only for < TLS 1.3"
@@ -7254,6 +7256,7 @@ run_server_preference() {
72547256
}
72557257

72567258
# arg1: true if the list that is returned does not need to be ordered by preference.
7259+
#
72577260
check_tls12_pref() {
72587261
local unordered_list_ok="$1"
72597262
local chacha20_ciphers="" non_chacha20_ciphers=""
@@ -7349,6 +7352,7 @@ check_tls12_pref() {
73497352
}
73507353

73517354
# At the moment only called from run_server_preference()
7355+
#
73527356
cipher_pref_check() {
73537357
local proto="$1" proto_hex="$2" proto_text="$3"
73547358
local using_sockets="$4"

0 commit comments

Comments
 (0)