From d697faf7ded0c279954dad247a02516b40f89347 Mon Sep 17 00:00:00 2001 From: Peter Wu Date: Sat, 14 Sep 2013 23:13:48 +0200 Subject: Initial commit of notes, dumps and scripts --- gen-cipher-test | 364 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 364 insertions(+) create mode 100755 gen-cipher-test (limited to 'gen-cipher-test') diff --git a/gen-cipher-test b/gen-cipher-test new file mode 100755 index 0000000..73593b0 --- /dev/null +++ b/gen-cipher-test @@ -0,0 +1,364 @@ +#!/bin/bash +# Generate nginx config and HTML for testing ciphers +# Author: Peter Wu + +#domain=ciphertest.lekensteyn.nl +# ssl-enabled ip:port, may occur multiple times space-separated +# PORT will be replaced for a number that increments for every test +#listen=$domain:PORT +domain=${1:-local.al.lekensteyn.nl} +address=localhost +listen="$address:4433 $address:PORT " +portbase=4433 + +pkdir=certs/ +rsa_prv=server.pem +rsa_pub=server.crt +dsa_prv=dsa.pem +dsa_pub=dsa.crt +#ecc_prv=ec.pem +#ecc_pub=ec.crt +ecc_prv=secp384r1.pem +ecc_pub=secp384r1.crt +dh_params=dhparams.pem + +root=/srv/http/ciphertest +html="$root/index.html" + +get_ciphers() { + # output: index (n1 << 8 | n2) name version auth line + openssl ciphers -V | sort -n | + awk -F'[ ,]+' '{ print ++i, $2, $3, $5, $6, substr($8, 4), $0 }' +} +htmlescape() { + sed 's/&/&/g;s//\>/g' +} + +#if [ ! -s "$html" ]; then +if true; then # always generate file +cat > "$html" < + + + +Cipher suite test + + + + +
+$(openssl version -a | htmlescape) +
+ +
+ + + + + + + + + + +
+ Hide cipher suites: + + + + + + + + + + +
+
+
+ + + + + +EOF +fi + +# Begin nginx config generator + +get_common() { + local auth=$1 + local port=${2:-$portbase} + local crtfile keyfile dhpfile + + case $auth in + RSA) + crtfile=$rsa_pub + keyfile=$rsa_prv + ;; + ECDH) + # Note: NSS does not support all cipher suites from OpenSSL, but OpenSSL + # cannot work with ECDH-RSA using th below certificates. + crtfile=$ecc_pub + keyfile=$ecc_prv + #dhpfile=$dh_params + ;; + DSS) + crtfile=$dsa_pub + keyfile=$dsa_prv + ;; + ECDSA) + crtfile=$ecc_pub + keyfile=$ecc_prv + #dhpfile=$dh_params + ;; + PSK) + #echo "Unknown Au=$auth - using RSA" >&2 + crtfile=$rsa_pub + keyfile=$rsa_prv + ;; + *) + echo "Unknown Au=$auth - using RSA" >&2 + crtfile=$rsa_pub + keyfile=$rsa_prv + ;; + esac + + local listens l + listens=$(echo ${listen//PORT/$port} | tr ' ' '\n' | sort -u | tr '\n' ' ') + for l in $listens; do + echo " listen $l ssl;" + done + +cat <document.domain='$domain'"; + } +} + +EOF +done + +cat <