Skip to content

Add TLS 1.3 cipher-suite scanning using a capable OpenSSL #196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SahandMas wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add TLS 1.3 cipher-suite scanning using a capable OpenSSL #196

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 56 additions & 3 deletions cipherscan
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,7 @@ join_array_by_char() {
# RSA ciphers are put at the end to force Google servers to accept ECDSA ciphers
# (probably a result of a workaround for the bug in Apple implementation of ECDSA)
CIPHERSUITE="ALL:COMPLEMENTOFALL:+aRSA"
TLS13CIPHERSUITES="TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_128_CCM_8_SHA256"
# some servers are intolerant to large client hello, try a shorter list of
# ciphers with them
SHORTCIPHERSUITE=(
Expand Down Expand Up @@ -412,6 +413,7 @@ parse_openssl_output() {
# extract selected cipher
if [[ $line =~ New,\ ]]; then
local match=($line)
current_protocol="${match[1]%,}"
current_cipher="${match[4]}"
continue
fi
Expand Down Expand Up @@ -509,7 +511,9 @@ test_cipher_on_target() {
pfs=""
previous_cipher=""
certificates=""
for tls_version in "-ssl2" "-ssl3" "-tls1" "-tls1_1" "-tls1_2"
local tls_versions=("-ssl2" "-ssl3" "-tls1" "-tls1_1" "-tls1_2")
[[ -n $CIPHERSCAN_TLS_VERSION ]] && tls_versions=("$CIPHERSCAN_TLS_VERSION")
for tls_version in "${tls_versions[@]}"
do
cmnd=("${sslcommand[@]}")
# sslv2 client hello doesn't support SNI extension
Expand Down Expand Up @@ -680,8 +684,13 @@ bench_cipher() {
local ciphersuite="$1"
local sslcommand
sslcommand+=("${TIMEOUTBIN[@]}" "$TIMEOUT")
sslcommand+=("$OPENSSLBIN" "s_client" "${SCLIENTARGS[@]}")
sslcommand+=("-connect" "$TARGET" "-cipher" "$ciphersuite")
if [[ $ciphersuite == TLS_* ]]; then
sslcommand+=("$TLS13OPENSSLBIN" "s_client" "${SCLIENTARGS[@]}")
sslcommand+=("-connect" "$TARGET" "-tls1_3" "-ciphersuites" "$ciphersuite")
else
sslcommand+=("$OPENSSLBIN" "s_client" "${SCLIENTARGS[@]}")
sslcommand+=("-connect" "$TARGET" "-cipher" "$ciphersuite")
fi
local t="$(date +%s%N)"
verbose "Benchmarking handshake on '$TARGET' with ciphersuite '$ciphersuite'"
for i in $(seq 1 $BENCHMARKITER); do
Expand Down Expand Up @@ -725,6 +734,31 @@ get_cipher_pref() {
fi
}

get_tls13_cipher_pref() {
[[ "$OUTPUTFORMAT" == "terminal" ]] && [[ $DEBUG -lt 1 ]] && echo -n '.'
local ciphersuites="$1"
local sslcommand=("${TIMEOUTBIN[@]}" "$TIMEOUT" "$TLS13OPENSSLBIN" "s_client")
if [[ -n "$CAPATH" ]]; then
sslcommand+=("-CApath" "$CAPATH" "-showcerts")
elif [[ -e $CACERTS ]]; then
sslcommand+=("-CAfile" "$CACERTS")
fi
sslcommand+=("-trusted_first" "-status" "${SCLIENTARGS[@]}" "-connect" "$TARGET")
sslcommand+=("-ciphersuites" "$ciphersuites")

verbose "Connecting to '$TARGET' with TLS 1.3 ciphersuites '$ciphersuites'"
if OPENSSLBIN="$TLS13OPENSSLBIN" CIPHERSCAN_TLS_VERSION="-tls1_3" test_cipher_on_target "${sslcommand[@]}"; then
cipherspref+=("$result")
ciphercertificates+=("$certificates")
local selected="${result%% *}"
local remaining=":$ciphersuites:"
remaining="${remaining//:$selected:/:}"
remaining="${remaining#:}"
remaining="${remaining%:}"
[[ -n $remaining ]] && get_tls13_cipher_pref "$remaining"
fi
}

display_sigalgs_in_terminal() {
(echo "prio sigalg"
for sigalg in "$@"; do
Expand Down Expand Up @@ -2045,6 +2079,19 @@ if ! [[ $OPENSSLBINHELP =~ -connect ]]; then
exit 1
fi

TLS13OPENSSLBIN=""
if [[ $OPENSSLBINHELP =~ -tls1_3 && $OPENSSLBINHELP =~ -ciphersuites ]]; then
TLS13OPENSSLBIN="$OPENSSLBIN"
else
SYSTEMOPENSSLBIN="$(command -v openssl)"
if [[ -n $SYSTEMOPENSSLBIN ]]; then
SYSTEMOPENSSLBINHELP="$("$SYSTEMOPENSSLBIN" s_client -help 2>&1)"
if [[ $SYSTEMOPENSSLBINHELP =~ -tls1_3 && $SYSTEMOPENSSLBINHELP =~ -ciphersuites ]]; then
TLS13OPENSSLBIN="$SYSTEMOPENSSLBIN"
fi
fi
fi

if [[ -n $CAPATH && -n $CACERTS ]]; then
echo "Both directory and file with CA certificates specified" 1>&2
exit 1
Expand Down Expand Up @@ -2192,6 +2239,12 @@ if [[ $TEST_CURVES == "True" ]]; then
test_curves_fallback
fi

if [[ -n $TLS13OPENSSLBIN ]]; then
get_tls13_cipher_pref "$TLS13CIPHERSUITES"
else
echo "TLS 1.3 scanning is unavailable: no TLS 1.3-capable OpenSSL was found." 1>&2
fi

if [[ "$OUTPUTFORMAT" == "json" ]]; then
display_results_in_json
else
Expand Down