From 0081b126416306e721fee9f871df3d3583cd2006 Mon Sep 17 00:00:00 2001
From: Dirk <dirk@testssl.sh>
Date: Wed, 16 Sep 2026 12:24:31 +0200
Subject: [PATCH] Introduce early warning function (3.2)

... which warns also via file output when not recommended command line options are used.

This function named issue_cmdline_warnings() is being called in lets roll after all fileout() functions has been initialized. It needs to make use of fileout_insert_warning() though because otherwise the JSON output is not correct.

Besides the previoulsy introduced warning when scanning IP addresses, warnings of usage of '--fast' and '--ssl-native' will end up also in a file now which gives ther tools using the machine readable output to detect bad scan conditions.

Also warnings when scanning the most known IPv4 addresses from Cloudflare, Google and Quad9, are avoided.

See also #3043 (3.3dev) .
---
 testssl.sh | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/testssl.sh b/testssl.sh
index 043d7b0..f7c25e0 100755
--- a/testssl.sh
+++ b/testssl.sh
@@ -24840,9 +24840,6 @@ parse_cmd_line() {
           fi
      fi
 
-     "$FAST" && pr_warning "\n'--fast' can have some undesired side effects thus it is not recommended to use anymore\n"
-     "$SSL_NATIVE" && pr_warning "\nusage of '--ssl-native' is not recommended as it will return incomplete and may even return incorrect results\n"
-
      if "$do_starttls_injection" && [[ "$STARTTLS_PROTOCOL" =~ smtp ]]; then
           ((VULN_COUNT++))
      fi
@@ -24859,8 +24856,38 @@ parse_cmd_line() {
      fi
 
      CMDLINE_PARSED=true
+     # This function is amended later w issue_cmdline_warnings() when fileout() functions, specifically
+     # the pre-fileout function fileout_insert_warning(), work. Here we only can use fatal_cmd_line().
 }
 
+# This serves as a warning function when the user does something which is not recommended. Parts
+# of that have been handled in parse_cmd_line(), however that was too early for warning messages
+# which also need to go into files.
+#
+issue_cmdline_warnings() {
+     local tmp=""
+     local avoid_complaints="^(1\.1\.1\.1|1\.0\.0\.1|8\.8\.8\.8|8\.8\.4\.4|9\.9\.9\.9)$"
+     # yeah, I know there are more. But these are the most common where we avoid warnings
+
+     if "$FAST" ; then
+          outln
+          prln_warning "'--fast' can have some undesired side effects thus it is not recommended to use anymore"
+          fileout_insert_warning "cmdline_fast_depreciation" "WARN" "'--fast' can have some undesired side effects thus it is not recommended to use anymore"
+     fi
+     if "$SSL_NATIVE"; then
+          outln
+          prln_warning "usage of '--ssl-native' is not recommended as it will return incomplete and maybe even incorrect results"
+          fileout_insert_warning "cmdline_ssl-native" "WARN" "Usage of '--ssl-native' is not recommended as it will return incomplete and maybe even incorrect results"
+     fi
+     tmp=${URI#*//}      # remove https:// and (future) friends
+     if [[ ! $tmp =~ [a-zA-Z] ]] && [[ ! $tmp =~ $avoid_complaints ]]; then
+          # No letters indicate it's not a name
+          prln_warning " Warning: Target is not a server name: results may be completely wrong, at minimum trust may show false results."
+          fileout_insert_warning "cmdline_ip-target" "WARN" "Target is not a server name: results may be completely wrong, at minimum trust may show false results."
+     fi
+}
+
+
 
 # connect call from openssl needs ipv6 in square brackets
 nodeip_to_proper_ip6() {
@@ -25077,7 +25104,6 @@ lets_roll() {
 }
 
 
-
 ################# main #################
 
 
@@ -25105,6 +25131,7 @@ lets_roll() {
      maketempf
      find_openssl_binary
      find_socat
+     issue_cmdline_warnings
      choose_printf
      check_resolver_bins
      prepare_debug  ; stopwatch parse