mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-01-30 20:31:15 +01:00
Merge branch 'fix_ci_runs' into https_rr
This commit is contained in:
Dirk Wetter
commit
096a912567
4
.github/workflows/docker-3.2.yml
vendored
4
.github/workflows/docker-3.2.yml
vendored
@ -23,7 +23,7 @@ jobs:
|
||||
|
||||
- name: Setup QEMU
|
||||
id: qemu
|
||||
uses: docker/setup-qemu-action@v3.2.0
|
||||
uses: docker/setup-qemu-action@v3.3.0
|
||||
|
||||
- name: Setup Buildx
|
||||
id: buildx
|
||||
@ -48,7 +48,7 @@ jobs:
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v6.7.0
|
||||
uses: docker/build-push-action@v6.12.0
|
||||
with:
|
||||
push: ${{ github.event_name != 'pull_request' }}
|
||||
context: .
|
||||
|
||||
16
CHANGELOG.md
16
CHANGELOG.md
@ -12,6 +12,7 @@
|
||||
* Improved compatibility with Open/LibreSSL versions not supporting TLS 1.0-1.1 anymore
|
||||
* Renamed PFS/perfect forward secrecy --> FS/forward secrecy
|
||||
* Cipher list straightening
|
||||
* Support RFC 9150 cipher suites
|
||||
* Improved mass testing
|
||||
* Better align colors of ciphers with standard cipherlists
|
||||
* Save a few cycles for ROBOT
|
||||
@ -23,13 +24,16 @@
|
||||
* Test for STARTTLS injection vulnerabilities (SMTP, POP3, IMAP)
|
||||
* STARTTLS: XMPP server support, plus new set of OpenSSL-bad binaries
|
||||
* Several code improvements to STARTTLS, also better detection when no STARTTLS is offered
|
||||
* Renegotiation checks more reliable against different servers
|
||||
* STARTTLS on active directory service support
|
||||
* Security fixes: DNS and other input from servers
|
||||
* Don't penalize missing trust in rating when CA not in Java store
|
||||
* Added support for certificates with EdDSA signatures and public keys
|
||||
* Extract CA list shows supported certification authorities sent by the server
|
||||
* Wildcard certificates: detection and warning
|
||||
* TLS 1.2 and TLS 1.3 sig algs added
|
||||
* Check for ffdhe groups
|
||||
* Check for three KEMs in draft-kwiatkowski-tls-ecdhe-mlkem/draft-tls-westerbaan-xyber768d00
|
||||
* Show server supported signature algorithms
|
||||
* --add-ca can also now be a directory with \*.pem files
|
||||
* Warning of 398 day limit for certificates issued after 2020/9/1
|
||||
@ -41,12 +45,14 @@
|
||||
* DNS via proxy improvements
|
||||
* Client simulation runs in wide mode which is even better readable
|
||||
* Added --reqheader to support custom headers in HTTP requests
|
||||
* Search for more HTTP security headers on the server
|
||||
* Test for support for RFC 8879 certificate compression
|
||||
* Deprecating --fast and --ssl-native (warning but still av)
|
||||
* Compatible to GNU grep 3.8
|
||||
* Don't use external pwd command anymore
|
||||
* Doesn't hang anymore when there's no local resolver
|
||||
* Added --mtls feature to support client authentication
|
||||
* Added --mtls feature to support client authentication
|
||||
* If a TLS 1.3 host is tested and e.g. /usr/bin/openssl supports it, it'll automagically will switch to it
|
||||
|
||||
|
||||
### Features implemented / improvements in 3.0
|
||||
@ -136,7 +142,7 @@
|
||||
* Trust chain check against certificate stores from Apple (OS), Linux (OS),
|
||||
Microsoft (OS), Mozilla (Firefox Browser), works for openssl >=1.0.1
|
||||
* IPv6 (status: 80% working, details see
|
||||
https://github.com/drwetter/testssl.sh/issues/11
|
||||
https://github.com/testssl/testssl.sh/issues/11
|
||||
* works now on servers requiring a x509 certificate for authentication
|
||||
* extensive CN <--> hostname check
|
||||
* SSL Session ID check
|
||||
@ -182,7 +188,7 @@
|
||||
* quite some LibreSSL fixes, still not recommended to use though (see https://testssl.sh/)
|
||||
* lots of fixes, code improvements, even more robust
|
||||
|
||||
Full log @ https://github.com/drwetter/testssl.sh/commits/2.6/testssl.sh
|
||||
Full log @ https://github.com/testssl/testssl.sh/commits/2.6/testssl.sh
|
||||
|
||||
### New in 2.4
|
||||
* "only one cmd line option at a time" is completely gone
|
||||
@ -197,7 +203,7 @@ Full log @ https://github.com/drwetter/testssl.sh/commits/2.6/testssl.sh
|
||||
* lots of cosmetic and maintainability code cleanups
|
||||
* bugfixing
|
||||
|
||||
Full changelog: https://github.com/drwetter/testssl.sh/commits/2.4/testssl.sh
|
||||
Full changelog: https://github.com/testssl/testssl.sh/commits/2.4/testssl.sh
|
||||
|
||||
### 2.2. new features:
|
||||
* Works fully under FreeBSD (openssl >=1.0)
|
||||
@ -213,7 +219,7 @@ Full changelog: https://github.com/drwetter/testssl.sh/commits/2.4/testssl.sh
|
||||
* RFC <---> OpenSSL name space mapping of ciphers everywhere
|
||||
* includes a lot of fixes
|
||||
|
||||
Full changelog @ https://github.com/drwetter/testssl.sh/commits/2.2/testssl.sh
|
||||
Full changelog @ https://github.com/testssl/testssl.sh/commits/2.2/testssl.sh
|
||||
|
||||
### 2.0 major release, new features:
|
||||
* SNI
|
||||
|
||||
@ -1,21 +1,25 @@
|
||||
|
||||
### Contributions / participation
|
||||
### Contributing / participating
|
||||
|
||||
is always welcome, here @ github or via e-mail.
|
||||
Contributing / participating is always welcome!
|
||||
|
||||
Note please the following
|
||||
Please note the following:
|
||||
|
||||
* Please read at least the [coding convention](https://github.com/drwetter/testssl.sh/Coding_Convention.md).
|
||||
* One PR per feature or bug fix or improvement. Please do not mix issues.
|
||||
* Document your PR, both in the PR and/or commit message and in the code.
|
||||
* Please read the [coding convention](https://github.com/testssl/testssl.sh/blob/3.2/Coding_Convention.md).
|
||||
* If you have something new and/or bigger which you like to contribute, better open an issue first before you get frustrated.
|
||||
* Please one pull request per feature or bug fix or improvement. Please do not mix issues.
|
||||
* Documentation pays off in the long run. So please your document your code and the pull request and/or commit message.
|
||||
* Please test your changes thoroughly as reliability is important for this project. You may want to check different servers with different settings.
|
||||
* Travis runs automatically when anything is committed/PR'd. You should check any complains from Travis. Beforehand you can check with `prove -v`.
|
||||
* If it's a new feature please consider writing a unit test for it. You can use e.g. `t/20_baseline_ipv4_http.t` as a template. The general documentation for [Test::More](https://perldoc.perl.org/Test/More.html) is a good start.
|
||||
* If it's a new feature it would need to be documented in the appropriate section in `help()` and in `~/doc/testssl.1.md`
|
||||
* GitHub actions are running automatically when anything is committed. You should see any complains. Beforehand you can check with `prove -v` from the "root dir" of this project.
|
||||
* If it's a new feature, please consider writing a unit test for it. You can use e.g. `t/10_baseline_ipv4_http.t` or `t/61_diff_testsslsh.t` as a template. The general documentation for [Test::More](https://perldoc.perl.org/Test/More.html) is a good start.
|
||||
* If it's a new feature, it would need to be documented in the appropriate section in `help()` and in `~/doc/testssl.1.md`
|
||||
|
||||
For questions just open an issue or feel free to send me an e-mail.
|
||||
If you're interested in contributing and wonder how you can help, you can search for different tags in the issues (somewhat increasing degree of difficulty):
|
||||
* [documentation](https://github.com/testssl/testssl.sh/issues?q=is:issue%20state:open%20label:documentation)
|
||||
* [good first issue](https://github.com/testssl/testssl.sh/issues?q=is:issue%20state:open%20label:%22good%20first%20issue%22)
|
||||
* [help wanted](https://github.com/testssl/testssl.sh/issues?q=is:issue%20state:open%20label:%22help%20wanted%22)
|
||||
* [for grabs](https://github.com/testssl/testssl.sh/issues?q=is:issue%20state:open%20label:%22good%20first%20issue%22)
|
||||
|
||||
For questions just open an issue. Thanks for reading this!
|
||||
|
||||
#### Patches via e-mail
|
||||
|
||||
Of course it is fine when you want to send in patches to use e-mail. For the address please grep for SWCONTACT in testssl.sh .
|
||||
Let me know how you like them to be attributed.
|
||||
|
||||
@ -18,7 +18,7 @@ RUN source /etc/os-release \
|
||||
&& zypper "${ZYPPER_OPTIONS[@]}" --gpg-auto-import-keys refresh \
|
||||
&& rpm -e util-linux --nodeps \
|
||||
&& zypper "${ZYPPER_OPTIONS[@]}" --non-interactive install --download-in-advance --no-recommends \
|
||||
bash procps grep gawk sed coreutils busybox-util-linux busybox-vi ldns libidn2-0 socat openssl curl \
|
||||
bash procps grep gawk sed coreutils busybox ldns libidn2-0 socat openssl curl \
|
||||
&& zypper up -y \
|
||||
&& zypper "${ZYPPER_OPTIONS[@]}" clean --all
|
||||
## Cleanup (reclaim approx 13 MiB):
|
||||
@ -35,6 +35,7 @@ ARG INSTALL_ROOT
|
||||
COPY --link --from=builder ${INSTALL_ROOT} /
|
||||
# Link busybox to tar, see #2403. Create user + (home with SGID set):
|
||||
RUN ln -s /usr/bin/busybox /usr/bin/tar \
|
||||
&& ln -s /usr/bin/busybox /usr/bin/hexdump \
|
||||
&& echo 'testssl:x:1000:1000::/home/testssl:/bin/bash' >> /etc/passwd \
|
||||
&& echo 'testssl:x:1000:' >> /etc/group \
|
||||
&& echo 'testssl:!::0:::::' >> /etc/shadow \
|
||||
|
||||
@ -5,8 +5,8 @@ FROM alpine:3.20
|
||||
WORKDIR /home/testssl
|
||||
|
||||
ARG BUILD_VERSION
|
||||
ARG ARCHIVE_URL=https://github.com/drwetter/testssl.sh/archive/
|
||||
ARG URL=https://github.com/drwetter/testssl.sh.git
|
||||
ARG ARCHIVE_URL=https://github.com/testssl/testssl.sh/archive/
|
||||
ARG URL=https://github.com/testssl/testssl.sh.git
|
||||
|
||||
RUN test -n "${BUILD_VERSION}" \
|
||||
&& apk update \
|
||||
|
||||
37
Readme.md
37
Readme.md
@ -1,11 +1,11 @@
|
||||
|
||||
## Intro
|
||||
|
||||
<!-- [](https://travis-ci.org/drwetter/testssl.sh) -->
|
||||
[](https://github.com/drwetter/testssl.sh/actions/workflows/test.yml)
|
||||
[](https://gitter.im/drwetter/testssl.sh?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
|
||||
[](https://github.com/drwetter/testssl.sh/LICENSE)
|
||||
[](https://github.com/drwetter/testssl.sh/blob/3.2/Dockerfile.md)
|
||||
[](https://github.com/testssl/testssl.sh/actions/workflows/unit_tests.yml)
|
||||
[](https://gitter.im/testssl/testssl.sh?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
|
||||
[](https://github.com/testssl/testssl.sh/LICENSE)
|
||||
[](https://github.com/testssl/testssl.sh/blob/3.2/Dockerfile.md)
|
||||
|
||||
|
||||
`testssl.sh` is a free command line tool which checks a server's service on
|
||||
any port for the support of TLS/SSL ciphers, protocols as well as some
|
||||
@ -45,16 +45,16 @@ due to bash-socket-based checks. As a result you can also use e.g. LibreSSL or O
|
||||
(silent) check for binaries is done when you start testssl.sh . System V needs probably
|
||||
to have GNU grep installed. MacOS X and Windows (using MSYS2, Cygwin or WSL) work too.
|
||||
|
||||
Update notification here or @ [mastodon](https://infosec.exchange/@testssl) (old: [twitter](https://twitter.com/drwetter))
|
||||
Update notification here or @ [mastodon](https://infosec.exchange/@testssl or [bluesky](https://bsky.app/profile/testssl.bsky.social). Please note the [twitter](https://twitter.com/drwetter) account is not being used anymore.
|
||||
|
||||
### Installation
|
||||
|
||||
You can download testssl.sh branch 3.2 just by cloning this git repository:
|
||||
|
||||
git clone --depth 1 https://github.com/drwetter/testssl.sh.git
|
||||
git clone --depth 1 https://github.com/testssl/testssl.sh.git
|
||||
|
||||
3.2 is now the latest branch which evolved from 3.1dev. It's in the release candidate phase.
|
||||
For the former stable version help yourself by downloading the [ZIP](https://codeload.github.com/drwetter/testssl.sh/zip/v3.0.8) or [tar.gz](https://codeload.github.com/drwetter/testssl.sh/tar.gz/v3.0.8) archive. Just ``cd`` to the directory created (=INSTALLDIR) and run it off there.
|
||||
3.2 is now the latest branch which evolved from 3.1dev. It's in the release candidate phase and considered as stable.
|
||||
For the former stable version named oldstable please help yourself by downloading the [ZIP](https://codeload.github.com/testssl/testssl.sh/zip/v3.0.9) or [tar.gz](https://codeload.github.com/testssl/testssl.sh/tar.gz/v3.0.9) archive. Just ``cd`` to the directory created (=INSTALLDIR) and run it off there.
|
||||
|
||||
#### Docker
|
||||
|
||||
@ -69,19 +69,19 @@ Or if you have cloned this repo you also can just ``cd`` to the INSTALLDIR and r
|
||||
docker build . -t imagefoo && docker run --rm -t imagefoo example.com
|
||||
```
|
||||
|
||||
For more please consult [Dockerfile.md](https://github.com/drwetter/testssl.sh/blob/3.2/Dockerfile.md).
|
||||
For more please consult [Dockerfile.md](https://github.com/testssl/testssl.sh/blob/3.2/Dockerfile.md).
|
||||
|
||||
### No Warranty
|
||||
|
||||
Usage of the program is without any warranty. Use it at yor own risk.
|
||||
Usage of the program is without any warranty. Use it at your own risk.
|
||||
|
||||
Testssl.sh is intended to be used as a standalone CLI tool. While we tried to apply best practise security measures, we can't guarantee that the program is without any vulnerabilities. Running as a service may pose security risks and you're recommended to apply additional security measures.
|
||||
|
||||
### Status
|
||||
|
||||
We're currently in the release candidate phase for version 3.2. Bigger features will be developed in a separate branch before merged into a 3.3dev to avoid hiccups or inconsistencies.
|
||||
We're currently in the release candidate phase for version 3.2. You should use it despite the label "RC". Bigger features will be developed in a separate branch before merged into a 3.3dev to avoid hiccups or inconsistencies.
|
||||
|
||||
Version 3.0.X receives bugfixes, labeled as 3.0.1, 3.0.2 and so on. This will happen until 3.2 is released.
|
||||
Version 3.0.X receives bugfixes, labeled as 3.0.1, 3.0.2 and so on. This will happen until 3.2 is finally released.
|
||||
|
||||
Support for 2.9.5 has been dropped. Supported is >= 3.0.x only.
|
||||
|
||||
@ -93,16 +93,19 @@ Support for 2.9.5 has been dropped. Supported is >= 3.0.x only.
|
||||
|
||||
### Contributing
|
||||
|
||||
Contributions are welcome! See [CONTRIBUTING.md](https://github.com/drwetter/testssl.sh/blob/3.2/CONTRIBUTING.md) for details. Please also have a look at the [Coding Convention](https://github.com/drwetter/testssl.sh/blob/3.2/Coding_Convention.md).
|
||||
Contributions are welcome! See [CONTRIBUTING.md](https://github.com/testssl/testssl.sh/blob/3.2/CONTRIBUTING.md) for details. Please also have a look at the [Coding Convention](https://github.com/testssl/testssl.sh/blob/3.2/Coding_Convention.md). A lot of contributors already helped to push the project where it currently is, see [CREDITS.md](https://github.com/testssl/testssl.sh/blob/3.2/CREDITS.md). We still you use your help now. A start would be look for issues which are labeled as [good first issue](https://github.com/testssl/testssl.sh/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22), [for grabs](https://github.com/testssl/testssl.sh/issues?q=is%3Aissue+is%3Aopen+label%3A%22for+grabs%22) or [help wanted](https://github.com/testssl/testssl.sh/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22). The latter is more advanced.
|
||||
|
||||
In general there's some maintenance burden, like maintaining handshakes and CA stores, writing unit tests, improving github actions. If you believe you can contribute, speak up.
|
||||
|
||||
|
||||
### Bug reports
|
||||
|
||||
Bug reports are important. It makes this project more robust.
|
||||
|
||||
Please file bugs in the issue tracker @ GitHub. Do not forget to provide detailed information, see template for issue, and further details @
|
||||
https://github.com/drwetter/testssl.sh/wiki/Bug-reporting. Nobody can read your thoughts -- yet. And only agencies your screen ;-)
|
||||
https://github.com/testssl/testssl.sh/wiki/Bug-reporting. Nobody can read your thoughts -- yet. And only agencies your screen ;-)
|
||||
|
||||
You can also debug yourself, see [here](https://github.com/drwetter/testssl.sh/wiki/Findings-and-HowTo-Fix-them).
|
||||
You can also debug yourself, see [here](https://github.com/testssl/testssl.sh/wiki/Findings-and-HowTo-Fix-them).
|
||||
|
||||
----
|
||||
|
||||
@ -129,7 +132,7 @@ Please address questions not specifically to the code of testssl.sh to the respe
|
||||
|
||||
#### Brew package
|
||||
|
||||
* see [#233](https://github.com/drwetter/testssl.sh/issues/233) and
|
||||
* see [#233](https://github.com/testssl/testssl.sh/issues/233) and
|
||||
[https://github.com/Homebrew/homebrew](https://github.com/Homebrew/homebrew)
|
||||
|
||||
#### Daemon for batch execution of testssl.sh command files
|
||||
|
||||
@ -10,7 +10,7 @@ for some new / advanced cipher suites and/or features which are not in the
|
||||
official branch like (old version of the) CHACHA20+POLY1305 and CAMELLIA 256 bit ciphers.
|
||||
|
||||
The (stripped) binaries this directory are all compiled from my openssl snapshot
|
||||
(https://github.com/drwetter/openssl-1.0.2.bad) which adds a few bits to Peter
|
||||
(https://github.com/testssl/openssl-1.0.2.bad) which adds a few bits to Peter
|
||||
Mosman's openssl fork (https://github.com/PeterMosmans/openssl). Thx a bunch, Peter!
|
||||
The few bits are IPv6 support (except IPV6 proxy) and some STARTTLS backports.
|
||||
|
||||
@ -71,11 +71,11 @@ Compilation instructions
|
||||
If you want to compile OpenSSL yourself, here are the instructions:
|
||||
|
||||
1.)
|
||||
git git clone https://github.com/drwetter/openssl-1.0.2-bad
|
||||
git git clone https://github.com/testssl/openssl-1.0.2-bad
|
||||
cd openssl
|
||||
|
||||
|
||||
2.) configure the damned thing. Options I used (see https://github.com/drwetter/testssl.sh/blob/master/utils/make-openssl.sh)
|
||||
2.) configure the damned thing. Options I used (see https://github.com/testssl/testssl.sh/blob/master/utils/make-openssl.sh)
|
||||
|
||||
**for 64Bit including Kerberos ciphers:**
|
||||
|
||||
|
||||
@ -141,7 +141,7 @@ Any single check switch supplied as an argument prevents testssl\.sh from doing
|
||||
.P
|
||||
\fB\-f, \-\-fs, \-\-nsa, \-\-forward\-secrecy\fR Checks robust forward secrecy key exchange\. "Robust" means that ciphers having intrinsic severe weaknesses like Null Authentication or Encryption, 3DES and RC4 won't be considered here\. There shouldn't be the wrong impression that a secure key exchange has been taking place and everything is fine when in reality the encryption sucks\. Also this section lists the available elliptical curves and Diffie Hellman groups, as well as FFDHE groups (TLS 1\.2 and TLS 1\.3)\.
|
||||
.P
|
||||
\fB\-p, \-\-protocols\fR checks TLS/SSL protocols SSLv2, SSLv3, TLS 1\.0 through TLS 1\.3 and for HTTP: SPDY (NPN) and ALPN, a\.k\.a\. HTTP/2\. For TLS 1\.3 several drafts (from 18 on) and final are supported and being tested for\.
|
||||
\fB\-p, \-\-protocols\fR checks TLS/SSL protocols SSLv2, SSLv3, TLS 1\.0 through TLS 1\.3 and for HTTP: SPDY (NPN) and ALPN, a\.k\.a\. HTTP/2\. For TLS 1\.3 several drafts (from 18 on) and final are supported and being tested for\. Note the supplied openssl\-bad version doesn't support TLS 1\.3 \. As the check for TLS 1\.3 will be done in sockets this normally does not pose a problem\. However if a TLS\-1\.3\-only host is encountered and to have a complete test coverage (e.g. header checks) \fB/usr/bin/openssl\fR (or the content of \fBOPENSSL2\fR) is checked for existence and support of TLS 1\.3 and if those tests succeeded it will be switched to this binary\. A message will notify you\.
|
||||
.P
|
||||
\fB\-P, \-\-server\-preference, \-\-preference\fR displays the servers preferences: cipher order, with used openssl client: negotiated protocol and cipher\. If there's a cipher order enforced by the server it displays it for each protocol (openssl+sockets)\. If there's not, it displays instead which ciphers from the server were picked with each protocol\.
|
||||
.P
|
||||
@ -418,13 +418,17 @@ MAX_SOCKET_FAIL: A number which tells testssl\.sh how often a TCP socket connect
|
||||
MAX_OSSL_FAIL: A number which tells testssl\.sh how often an OpenSSL s_client connect may fail before the program gives up and terminates\. The default is 2\. You can increase it to a higher value if you frequently see a message like \fIFatal error: repeated TCP connect problems, giving up\fR\.
|
||||
.IP "\[ci]" 4
|
||||
MAX_HEADER_FAIL: A number which tells testssl\.sh how often a HTTP GET request over OpenSSL may return an empty file before the program gives up and terminates\. The default is 3\. Also here you can increase the threshold when you spot messages like \fIFatal error: repeated HTTP header connect problems, doesn't make sense to continue\fR\.
|
||||
.IP "\[ci]" 4
|
||||
OPENSSL2 can be used to supply an alternative openssl version\. This only makes sense if you want to amend the supplied version in \fBbin/\fR which lacks TLS 1\.3 support with a version which does not and is not in \fB/usr/bin/openssl\fR.
|
||||
.IP "\[ci]" 4
|
||||
OSSL_SHORTCUT can be set to true when you run interactively and don't want to switch automatically to \fB/usr/bin/openssl\fR (\fBOPENSSL2\fR) if you encounter a TLS 1\.3-only host\.
|
||||
.IP "" 0
|
||||
.SS "RATING"
|
||||
This program has a near\-complete implementation of SSL Labs's 'SSL Server Rating Guide \fIhttps://github\.com/ssllabs/research/wiki/SSL\-Server\-Rating\-Guide\fR'\.
|
||||
.P
|
||||
This is \fInot\fR a 100% reimplementation of the SSL Lab's SSL Server Test \fIhttps://www\.ssllabs\.com/ssltest/analyze\.html\fR, but an implementation of the above rating specification, slight discrepancies may occur\. Please note that for now we stick to the SSL Labs rating as good as possible\. We are not responsible for their rating\. Before filing issues please inspect their Rating Guide\.
|
||||
.P
|
||||
Disclaimer: Having a good grade is \fBNOT\fR necessarily equal to having good security! Don't start a competition for the best grade, at least not without monitoring the client handshakes and not without adding a portion of good sense to it\. Please note STARTTLS always results in a grade cap to T\. Anything else would lead to a false sense of security \- at least until we test for DANE or MTA\-STS\.
|
||||
Disclaimer: Having a good grade is \fBNOT\fR necessarily equal to having good security! Don't start a competition for the best grade, at least not without monitoring the client handshakes and not without adding a portion of good sense to it\. Please note STARTTLS always results in a grade cap to T\. Anything else would lead to a false sense of security\. Use TLS, see also RFC 8314\. The security of STARTTLS is always client determined, i'\.e\. checking the certificate which for SMTP port 25 is often enough not the case\. Also with DANE or MTA\-STS no one can test on the server side whether a client makes use if it\.
|
||||
.P
|
||||
As of writing, these checks are missing: * GOLDENDOODLE \- should be graded \fBF\fR if vulnerable * Insecure renegotiation \- should be graded \fBF\fR if vulnerable * Padding oracle in AES\-NI CBC MAC check (CVE\-2016\-2107) \- should be graded \fBF\fR if vulnerable * Sleeping POODLE \- should be graded \fBF\fR if vulnerable * Zero Length Padding Oracle (CVE\-2019\-1559) \- should be graded \fBF\fR if vulnerable * Zombie POODLE \- should be graded \fBF\fR if vulnerable * All remaining old Symantec PKI certificates are distrusted \- should be graded \fBT\fR * Symantec certificates issued before June 2016 are distrusted \- should be graded \fBT\fR * Anonymous key exchange \- should give \fB0\fR points in \fBset_key_str_score()\fR * Exportable key exchange \- should give \fB40\fR points in \fBset_key_str_score()\fR * Weak key (Debian OpenSSL Flaw) \- should give \fB0\fR points in \fBset_key_str_score()\fR
|
||||
.P
|
||||
@ -603,4 +607,4 @@ All native Windows platforms emulating Linux are known to be slow\.
|
||||
.SH "BUGS"
|
||||
Probably\. Current known ones and interface for filing new ones: https://testssl\.sh/bugs/ \.
|
||||
.SH "SEE ALSO"
|
||||
\fBciphers\fR(1), \fBopenssl\fR(1), \fBs_client\fR(1), \fBx509\fR(1), \fBverify\fR(1), \fBocsp\fR(1), \fBcrl\fR(1), \fBbash\fR(1) and the websites https://testssl\.sh/ and https://github\.com/drwetter/testssl\.sh/ \.
|
||||
\fBciphers\fR(1), \fBopenssl\fR(1), \fBs_client\fR(1), \fBx509\fR(1), \fBverify\fR(1), \fBocsp\fR(1), \fBcrl\fR(1), \fBbash\fR(1) and the websites https://testssl\.sh/ and https://github\.com/testssl/testssl\.sh/ \.
|
||||
|
||||
@ -262,7 +262,7 @@ in <code>/etc/hosts</code>. The use of the switch is only useful if you either
|
||||
|
||||
<p><code>-f, --fs, --nsa, --forward-secrecy</code> Checks robust forward secrecy key exchange. "Robust" means that ciphers having intrinsic severe weaknesses like Null Authentication or Encryption, 3DES and RC4 won't be considered here. There shouldn't be the wrong impression that a secure key exchange has been taking place and everything is fine when in reality the encryption sucks. Also this section lists the available elliptical curves and Diffie Hellman groups, as well as FFDHE groups (TLS 1.2 and TLS 1.3).</p>
|
||||
|
||||
<p><code>-p, --protocols</code> checks TLS/SSL protocols SSLv2, SSLv3, TLS 1.0 through TLS 1.3 and for HTTP: SPDY (NPN) and ALPN, a.k.a. HTTP/2. For TLS 1.3 several drafts (from 18 on) and final are supported and being tested for.</p>
|
||||
<p><code>-p, --protocols</code> checks TLS/SSL protocols SSLv2, SSLv3, TLS 1.0 through TLS 1.3 and for HTTP: SPDY (NPN) and ALPN, a.k.a. HTTP/2. For TLS 1.3 several drafts (from 18 on) and final are supported and being tested for. Note the supplied openssl-bad version doesn't support TLS 1.3 . As the check for TLS 1.3 will be done in sockets this normally does not pose a problem. However if a TLS-1.3-only host is encountered and to have a complete test coverage (e.g. header checks) `/usr/bin/openssl` (or the content of `OPENSSL2`) is checked for existence and support of TLS 1.3 and if those tests succeeded it will be switched to this binary. A message will notify you.</p>
|
||||
|
||||
<p><code>-P, --server-preference, --preference</code> displays the servers preferences: cipher order, with used openssl client: negotiated protocol and cipher. If there's a cipher order enforced by the server it displays it for each protocol (openssl+sockets). If there's not, it displays instead which ciphers from the server were picked with each protocol.</p>
|
||||
|
||||
@ -501,6 +501,8 @@ Rating automatically gets disabled, to not give a wrong or misleading grade, whe
|
||||
<li>MAX_SOCKET_FAIL: A number which tells testssl.sh how often a TCP socket connection may fail before the program gives up and terminates. The default is 2. You can increase it to a higher value if you frequently see a message like <em>Fatal error: repeated openssl s_client connect problem, doesn't make sense to continue</em>.</li>
|
||||
<li>MAX_OSSL_FAIL: A number which tells testssl.sh how often an OpenSSL s_client connect may fail before the program gives up and terminates. The default is 2. You can increase it to a higher value if you frequently see a message like <em>Fatal error: repeated TCP connect problems, giving up</em>.</li>
|
||||
<li>MAX_HEADER_FAIL: A number which tells testssl.sh how often a HTTP GET request over OpenSSL may return an empty file before the program gives up and terminates. The default is 3. Also here you can increase the threshold when you spot messages like <em>Fatal error: repeated HTTP header connect problems, doesn't make sense to continue</em>.</li>
|
||||
<li>OPENSSL2 can be used to supply an alternative openssl version. This only makes sense if you want to amend the supplied version in <code>bin/</code> which lacks TLS 1.3 support with a version which does not and is not in <code>/usr/bin/openssl</code>.</li>
|
||||
<li>OSSL_SHORTCUT should be set to false when you run interactively and don't want to switch automatically to <code>/usr/bin/openssl</code> (<code>OPENSSL2</code>) if you encounter a TLS 1.3-only host.</li>
|
||||
</ul>
|
||||
|
||||
<h3 id="RATING">RATING</h3>
|
||||
@ -509,7 +511,7 @@ Rating automatically gets disabled, to not give a wrong or misleading grade, whe
|
||||
<p>This is <em>not</em> a 100% reimplementation of the <a href="https://www.ssllabs.com/ssltest/analyze.html">SSL Lab's SSL Server Test</a>, but an implementation of the above rating specification, slight discrepancies may occur. Please note that for now we stick to the SSL Labs rating as good as possible. We are not responsible for their rating. Before filing issues please inspect their Rating Guide.</p>
|
||||
|
||||
<p>Disclaimer: Having a good grade is <strong>NOT</strong> necessarily equal to having good security! Don't start a competition for the best grade, at least not without monitoring the client handshakes and not without adding a portion of good sense to it. Please note STARTTLS always results in a grade cap to T. Anything else
|
||||
would lead to a false sense of security - at least until we test for DANE or MTA-STS.</p>
|
||||
would lead to a false sense of security. Use TLS, see also RFC 8314. The security of STARTTLS is always client determined, i.e. checking the certificate which for SMTP port 25 is often enough not the case. Also with DANE or MTA-STS no one can test on the server side whether a client makes use if it.</p>
|
||||
|
||||
<p>As of writing, these checks are missing:
|
||||
* GOLDENDOODLE - should be graded <strong>F</strong> if vulnerable
|
||||
@ -679,7 +681,7 @@ from. That helps us to get bugfixes, other feedback and more contributions.</p>
|
||||
|
||||
<h2 id="SEE-ALSO">SEE ALSO</h2>
|
||||
|
||||
<p><span class="man-ref"><code>ciphers</code><span class="s">(1)</span></span>, <span class="man-ref"><code>openssl</code><span class="s">(1)</span></span>, <span class="man-ref"><code>s_client</code><span class="s">(1)</span></span>, <span class="man-ref"><code>x509</code><span class="s">(1)</span></span>, <span class="man-ref"><code>verify</code><span class="s">(1)</span></span>, <span class="man-ref"><code>ocsp</code><span class="s">(1)</span></span>, <span class="man-ref"><code>crl</code><span class="s">(1)</span></span>, <span class="man-ref"><code>bash</code><span class="s">(1)</span></span> and the websites https://testssl.sh/ and https://github.com/drwetter/testssl.sh/ .</p>
|
||||
<p><span class="man-ref"><code>ciphers</code><span class="s">(1)</span></span>, <span class="man-ref"><code>openssl</code><span class="s">(1)</span></span>, <span class="man-ref"><code>s_client</code><span class="s">(1)</span></span>, <span class="man-ref"><code>x509</code><span class="s">(1)</span></span>, <span class="man-ref"><code>verify</code><span class="s">(1)</span></span>, <span class="man-ref"><code>ocsp</code><span class="s">(1)</span></span>, <span class="man-ref"><code>crl</code><span class="s">(1)</span></span>, <span class="man-ref"><code>bash</code><span class="s">(1)</span></span> and the websites https://testssl.sh/ and https://github.com/testssl/testssl.sh/ .</p>
|
||||
|
||||
<ol class='man-decor man-foot man foot'>
|
||||
<li class='tl'></li>
|
||||
|
||||
@ -175,7 +175,7 @@ Any single check switch supplied as an argument prevents testssl.sh from doing a
|
||||
|
||||
`-f, --fs, --nsa, --forward-secrecy` Checks robust forward secrecy key exchange. "Robust" means that ciphers having intrinsic severe weaknesses like Null Authentication or Encryption, 3DES and RC4 won't be considered here. There shouldn't be the wrong impression that a secure key exchange has been taking place and everything is fine when in reality the encryption sucks. Also this section lists the available elliptical curves and Diffie Hellman groups, as well as FFDHE groups (TLS 1.2 and TLS 1.3).
|
||||
|
||||
`-p, --protocols` checks TLS/SSL protocols SSLv2, SSLv3, TLS 1.0 through TLS 1.3 and for HTTP: SPDY (NPN) and ALPN, a.k.a. HTTP/2. For TLS 1.3 several drafts (from 18 on) and final are supported and being tested for.
|
||||
`-p, --protocols` checks TLS/SSL protocols SSLv2, SSLv3, TLS 1.0 through TLS 1.3 and for HTTP: SPDY (NPN) and ALPN, a.k.a. HTTP/2. For TLS 1.3 several drafts (from 18 on) and final are supported and being tested for. Note the supplied openssl-bad version doesn't support TLS 1.3 . As the check for TLS 1.3 will be done in sockets this normally does not pose a problem. However if a TLS-1.3-only host is encountered and to have a complete test coverage (e.g. header checks) `/usr/bin/openssl` (or the content of `OPENSSL2`) is checked for existence and support of TLS 1.3 and if those tests succeeded it will be switched to this binary. A message will notify you.
|
||||
|
||||
`-P, --server-preference, --preference` displays the servers preferences: cipher order, with used openssl client: negotiated protocol and cipher. If there's a cipher order enforced by the server it displays it for each protocol (openssl+sockets). If there's not, it displays instead which ciphers from the server were picked with each protocol.
|
||||
|
||||
@ -403,6 +403,9 @@ Except the environment variables mentioned above which can replace command line
|
||||
* MAX_SOCKET_FAIL: A number which tells testssl.sh how often a TCP socket connection may fail before the program gives up and terminates. The default is 2. You can increase it to a higher value if you frequently see a message like *Fatal error: repeated openssl s_client connect problem, doesn't make sense to continue*.
|
||||
* MAX_OSSL_FAIL: A number which tells testssl.sh how often an OpenSSL s_client connect may fail before the program gives up and terminates. The default is 2. You can increase it to a higher value if you frequently see a message like *Fatal error: repeated TCP connect problems, giving up*.
|
||||
* MAX_HEADER_FAIL: A number which tells testssl.sh how often a HTTP GET request over OpenSSL may return an empty file before the program gives up and terminates. The default is 3. Also here you can increase the threshold when you spot messages like *Fatal error: repeated HTTP header connect problems, doesn't make sense to continue*.
|
||||
* OPENSSL2 can be used to supply an alternative openssl version. This only makes sense if you want to amend the supplied version in `bin/` which lacks TLS 1.3 support with a version which doesn not and is not in `/usr/bin/openssl`.
|
||||
* OSSL_SHORTCUT should be set to false when you run interactively and don't want to switch automatically to `/usr/bin/openssl` (`OPENSSL2`) if you encounter a TLS 1.3-only host.
|
||||
|
||||
|
||||
### RATING
|
||||
|
||||
@ -410,8 +413,7 @@ This program has a near-complete implementation of SSL Labs's '[SSL Server Ratin
|
||||
|
||||
This is *not* a 100% reimplementation of the [SSL Lab's SSL Server Test](https://www.ssllabs.com/ssltest/analyze.html), but an implementation of the above rating specification, slight discrepancies may occur. Please note that for now we stick to the SSL Labs rating as good as possible. We are not responsible for their rating. Before filing issues please inspect their Rating Guide.
|
||||
|
||||
Disclaimer: Having a good grade is **NOT** necessarily equal to having good security! Don't start a competition for the best grade, at least not without monitoring the client handshakes and not without adding a portion of good sense to it. Please note STARTTLS always results in a grade cap to T. Anything else
|
||||
would lead to a false sense of security - at least until we test for DANE or MTA-STS.
|
||||
Disclaimer: Having a good grade is **NOT** necessarily equal to having good security! Don't start a competition for the best grade, at least not without monitoring the client handshakes and not without adding a portion of good sense to it. Please note STARTTLS always results in a grade cap to T. Anything else would lead to a false sense of security. Use TLS, see also RFC 8314. The security of STARTTLS is always client determined, i.e. checking the certificate which for SMTP port 25 is often enough not the case. Also with DANE or MTA-STS no one can test on the server side whether a client makes use if it.
|
||||
|
||||
As of writing, these checks are missing:
|
||||
|
||||
@ -585,4 +587,4 @@ Probably. Current known ones and interface for filing new ones: https://testssl.
|
||||
|
||||
## SEE ALSO
|
||||
|
||||
`ciphers`(1), `openssl`(1), `s_client`(1), `x509`(1), `verify`(1), `ocsp`(1), `crl`(1), `bash`(1) and the websites https://testssl.sh/ and https://github.com/drwetter/testssl.sh/ .
|
||||
`ciphers`(1), `openssl`(1), `s_client`(1), `x509`(1), `verify`(1), `ocsp`(1), `crl`(1), `bash`(1) and the websites https://testssl.sh/ and https://github.com/testssl/testssl.sh/ .
|
||||
|
||||
@ -342,6 +342,8 @@
|
||||
0x02,0x00,0x80 - EXP-RC4-MD5 SSL_CK_RC4_128_EXPORT40_WITH_MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
|
||||
0x00,0x28 - EXP-KRB5-RC4-SHA TLS_KRB5_EXPORT_WITH_RC4_40_SHA SSLv3 Kx=KRB5 Au=KRB5 Enc=RC4(40) Mac=SHA1 export
|
||||
0x00,0x2B - EXP-KRB5-RC4-MD5 TLS_KRB5_EXPORT_WITH_RC4_40_MD5 SSLv3 Kx=KRB5 Au=KRB5 Enc=RC4(40) Mac=MD5 export
|
||||
0xC0,0xB4 - TLS_SHA256_SHA256 TLS_SHA256_SHA256 TLSv1.3 Kx=any Au=any Enc=None Mac=SHA256
|
||||
0xC0,0xB5 - TLS_SHA384_SHA384 TLS_SHA384_SHA384 TLSv1.3 Kx=any Au=any Enc=None Mac=SHA384
|
||||
0xC0,0x10 - ECDHE-RSA-NULL-SHA TLS_ECDHE_RSA_WITH_NULL_SHA SSLv3 Kx=ECDH Au=RSA Enc=None Mac=SHA1
|
||||
0xC0,0x06 - ECDHE-ECDSA-NULL-SHA TLS_ECDHE_ECDSA_WITH_NULL_SHA SSLv3 Kx=ECDH Au=ECDSA Enc=None Mac=SHA1
|
||||
0xC0,0x15 - AECDH-NULL-SHA TLS_ECDH_anon_WITH_NULL_SHA SSLv3 Kx=ECDH Au=None Enc=None Mac=SHA1
|
||||
|
||||
@ -45,3 +45,7 @@
|
||||
0x01,0x02 - ffdhe4096 ffdhe4096
|
||||
0x01,0x03 - ffdhe6144 ffdhe6144
|
||||
0x01,0x04 - ffdhe8192 ffdhe8192
|
||||
0x11,0xeb - SecP256r1MLKEM768 SecP256r1MLKEM768
|
||||
0x11,0xec - X25519MLKEM768 X25519MLKEM768
|
||||
0x11,0xed - SecP384r1MLKEM1024 SecP384r1MLKEM1024
|
||||
0x63,0x99 - X25519Kyber768Draft00 X25519Kyber768Draft00
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -425,6 +425,10 @@ xB9 TLS_RSA_PSK_WITH_NULL_SHA384
|
||||
<tr><td> [0xc0ae]</td><td> ECDHE-ECDSA-AES128-CCM8 </td><td> ECDH </td><td> AESCCM </td><td> 128 </td><td> TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 </td></tr>
|
||||
<tr><td> [0xc0af]</td><td> ECDHE-ECDSA-AES256-CCM8 </td><td> ECDH </td><td> AESCCM </td><td> 256 </td><td> TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 </td></tr>
|
||||
|
||||
<!-- RFC 9150 -->
|
||||
<tr><td> [0xc0b4]</td><td> TLS_SHA256_SHA256 </td><td> ECDH </td><td> Null </td><td> 0 </td><td> TLS_SHA256_SHA256</td></tr>
|
||||
<tr><td> [0xc0b5]</td><td> TLS_SHA384_SHA384 </td><td> ECDH </td><td> Null </td><td> 0 </td><td> TLS_SHA384_SHA384</td></tr>
|
||||
|
||||
<!-- OLD CHACHA POLY CIPHERS, per agreement with Peter Mosmans we use the names like SSLlabs -->
|
||||
<tr><td> [0xcc13]</td><td> ECDHE-RSA-CHACHA20-POLY1305-OLD </td><td> ECDH </td><td> ChaCha20-Poly1305</td><td> </td><td> TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256_OLD</td></tr>
|
||||
<tr><td> [0xcc14]</td><td> ECDHE-ECDSA-CHACHA20-POLY1305-OLD</td><td> ECDH </td><td> ChaCha20-Poly1305</td><td> </td><td> TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256_OLD</td></tr>
|
||||
|
||||
@ -24,10 +24,10 @@ printf "\n%s\n", "Testing whether just calling \"./testssl.sh\" produces no erro
|
||||
my $info = stat($prg);
|
||||
my $retMode = $info->mode;
|
||||
|
||||
is($retMode & 0400, 0400, "Checking \"./testssl.sh\" for read permission");
|
||||
is($retMode & 0400, 0400, "Checking \"./testssl.sh\" for read permission");
|
||||
$tests++;
|
||||
|
||||
is($retMode & 0100, 0100, "Checking \"./testssl.sh\" for execute permission");
|
||||
is($retMode & 0100, 0100, "Checking \"./testssl.sh\" for execute permission");
|
||||
$tests++;
|
||||
|
||||
$fileout = `timeout 10 bash $prg 2>&1`;
|
||||
@ -55,7 +55,7 @@ $out=`grep -E "$debug_regexp" $prg`;
|
||||
unlike($out, qr/$debug_regexp/, "Debug RegEx");
|
||||
$tests++;
|
||||
|
||||
printf "\n";
|
||||
printf "\n\n";
|
||||
done_testing($tests);
|
||||
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ use Test::More;
|
||||
printf "\n%s\n", "Testing whether CA certificates are newer their SPKI hashes \"~/etc/ca_hashes.txt\" ...";
|
||||
|
||||
my $newer_bundles=`find etc/*.pem -newer etc/ca_hashes.txt`;
|
||||
is($newer_bundles,"","If there's an output with a *.pem file run \"~/utils/create_ca_hashes.sh\"");
|
||||
is($newer_bundles,"","Checking if there's an output with a *.pem file run \"~/utils/create_ca_hashes.sh\"");
|
||||
|
||||
printf "\n";
|
||||
done_testing;
|
||||
|
||||
@ -15,48 +15,51 @@ use JSON;
|
||||
|
||||
my $tests = 0;
|
||||
my $prg="./testssl.sh";
|
||||
my $check2run="-p -s -P --fs -S -h -U -q --ip=one --color 0";
|
||||
my $tmp_json="tmp.json";
|
||||
my $check2run="-p -s -P --fs -S -h -U -q --ip=one --color 0 --jsonfile $tmp_json";
|
||||
my $uri="google.com";
|
||||
my $socket_out="";
|
||||
my $openssl_out="";
|
||||
# Blacklists we use to trigger an error:
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal|(c|C)ommand not found';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem|(c|C)ommand not found';
|
||||
my $json_regex_bl='(id".*:\s"scanProblem"|severity".*:\s"FATAL"|"Scan interrupted")';
|
||||
|
||||
my $socket_json="";
|
||||
my $openssl_json="";
|
||||
$check2run="--jsonfile tmp.json $check2run";
|
||||
#FIXME: Blacklists we use to trigger an error, but likely we can skip that and instead we should?/could use
|
||||
# @args="$prg $check2run $uri >/dev/null";
|
||||
# system("@args") == 0
|
||||
# or die ("FAILED: \"@args\" ");
|
||||
my $socket_errors='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal|(c|C)ommand not found';
|
||||
my $openssl_errors='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem|(c|C)ommand not found';
|
||||
my $json_errors='(id".*:\s"scanProblem"|severity".*:\s"FATAL"|"Scan interrupted")';
|
||||
|
||||
|
||||
die "Unable to open $prg" unless -f $prg;
|
||||
|
||||
# Provide proper start conditions
|
||||
unlink "tmp.json";
|
||||
unlink $tmp_json;
|
||||
|
||||
# Title
|
||||
printf "\n%s\n", "Baseline unit test IPv4 against \"$uri\"";
|
||||
|
||||
#1
|
||||
$socket_out = `$prg $check2run $uri 2>&1`;
|
||||
$socket_json = json('tmp.json');
|
||||
unlink "tmp.json";
|
||||
unlike($socket_out, qr/$socket_regex_bl/, "via sockets, terminal output");
|
||||
$socket_json = json($tmp_json);
|
||||
unlike($socket_out, qr/$socket_errors≈/, "via sockets, checking terminal output");
|
||||
$tests++;
|
||||
unlike($socket_json, qr/$json_regex_bl/, "via sockets JSON output");
|
||||
unlike($socket_json, qr/$json_errors/, "via sockets checking JSON output");
|
||||
$tests++;
|
||||
|
||||
unlink $tmp_json;
|
||||
|
||||
|
||||
#2
|
||||
$openssl_out = `$prg --ssl-native $check2run $uri 2>&1`;
|
||||
$openssl_json = json('tmp.json');
|
||||
unlink "tmp.json";
|
||||
# With Google only we sometimes encounter an error as they return a 0 char with openssl, so we white list this pattern here:
|
||||
# It should be fixed in the code though so we comment this out
|
||||
# $openssl_out =~ s/testssl.*warning: command substitution: ignored null byte in input\n//g;
|
||||
unlike($openssl_out, qr/$openssl_regex_bl/, "via OpenSSL");
|
||||
$openssl_json = json($tmp_json);
|
||||
unlike($openssl_out, qr/$openssl_errors/, "via (builtin) OpenSSL, checking terminal output");
|
||||
$tests++;
|
||||
unlike($openssl_json, qr/$json_regex_bl/, "via OpenSSL JSON output");
|
||||
unlike($openssl_json, qr/$json_errors/, "via OpenSSL (builtin) checking JSON output");
|
||||
$tests++;
|
||||
|
||||
unlink $tmp_json;
|
||||
|
||||
done_testing($tests);
|
||||
printf "\n";
|
||||
|
||||
@ -69,5 +72,5 @@ sub json($) {
|
||||
}
|
||||
|
||||
|
||||
# vim:ts=5:sw=5:expandtab
|
||||
# vim:ts=5:sw=5:expandtab
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env perl
|
||||
|
||||
# disabled as IPv6 is not supported by Travis, see https://github.com/drwetter/testssl.sh/issues/1177
|
||||
# disabled as IPv6 wasn't supported by Travis CI and isn't by GH action, see https://github.com/testssl/testssl.sh/issues/1177
|
||||
|
||||
# Just a functional test, whether there are any problems on the client side
|
||||
# Probably we could also inspect the JSON for any problems for
|
||||
|
||||
85
t/12_diff_opensslversions.t
Executable file
85
t/12_diff_opensslversions.t
Executable file
@ -0,0 +1,85 @@
|
||||
#!/usr/bin/env perl
|
||||
|
||||
# Baseline diff test against testssl.sh (csv output)
|
||||
#
|
||||
# This runs a basic test with the supplied openssl vs /usr/bin/openssl
|
||||
|
||||
use strict;
|
||||
use Test::More;
|
||||
use Data::Dumper;
|
||||
use Text::Diff;
|
||||
|
||||
my $tests = 0;
|
||||
my $prg="./testssl.sh";
|
||||
my $check2run="--protocols --std --server-preference --fs --header --renegotiation --crime --breach --poodle --tls-fallback --sweet32 --beast --lucky13 --freak --logjam --drown --rc4 --phone-out --client-simulation -q --ip=one --color 0 --csvfile";
|
||||
my $csvfile="tmp.csv";
|
||||
my $csvfile2="tmp2.csv";
|
||||
my $cat_csvfile="";
|
||||
my $cat_csvfile2="";
|
||||
my $uri="google.com";
|
||||
my $diff="";
|
||||
my $distro_openssl="/usr/bin/openssl";
|
||||
my @args="";
|
||||
|
||||
die "Unable to open $prg" unless -f $prg;
|
||||
die "Unable to open $distro_openssl" unless -f $distro_openssl;
|
||||
|
||||
# Provide proper start conditions
|
||||
unlink $csvfile;
|
||||
unlink $csvfile2;
|
||||
|
||||
#1 run
|
||||
printf "\n%s\n", "Diff test IPv4 with supplied openssl against \"$uri\"";
|
||||
@args="$prg $check2run $csvfile $uri >/dev/null";
|
||||
system("@args") == 0
|
||||
or die ("FAILED: \"@args\"");
|
||||
|
||||
# 2
|
||||
printf "\n%s\n", "Diff test IPv4 with $distro_openssl against \"$uri\"";
|
||||
@args="$prg $check2run $csvfile2 --openssl=$distro_openssl $uri >/dev/null";
|
||||
system("@args") == 0
|
||||
or die ("FAILED: \"@args\" ");
|
||||
|
||||
$cat_csvfile = `cat $csvfile`;
|
||||
$cat_csvfile2 = `cat $csvfile2`;
|
||||
|
||||
# Filter for changes that are allowed to occur
|
||||
$cat_csvfile =~ s/HTTP_clock_skew.*\n//g;
|
||||
$cat_csvfile2 =~ s/HTTP_clock_skew.*\n//g;
|
||||
|
||||
# HTTP time
|
||||
$cat_csvfile =~ s/HTTP_headerTime.*\n//g;
|
||||
$cat_csvfile2 =~ s/HTTP_headerTime.*\n//g;
|
||||
|
||||
#engine_problem
|
||||
$cat_csvfile =~ s/"engine_problem.*\n//g;
|
||||
$cat_csvfile2 =~ s/"engine_problem.*\n//g;
|
||||
|
||||
# PR #2628. TL:DR; make the kx between tls_sockets() and openssl the same for this CI run
|
||||
$cat_csvfile =~ s/ECDH 256/ECDH 253/g;
|
||||
$cat_csvfile =~ s/ECDH\/MLKEM/ECDH 253 /g;
|
||||
|
||||
# Nonce in CSP
|
||||
$cat_csvfile =~ s/.nonce-.* //g;
|
||||
$cat_csvfile2 =~ s/.nonce-.* //g;
|
||||
|
||||
+# Fix IP addresses. needed when we don't hit the same IP address. We just remove them
|
||||
$cat_csvfile =~ s/","google.com\/.*","443/","google.com","443/;
|
||||
$cat_csvfile2 =~ s/","google.com\/.*","443/","google.com","443/;
|
||||
|
||||
$diff = diff \$cat_csvfile, \$cat_csvfile2;
|
||||
|
||||
# Compare the differences -- and print them if there were any
|
||||
ok( $cat_csvfile eq $cat_csvfile2, "Check whether CSV outputs match" ) or
|
||||
diag ("\n%s\n", "$diff");
|
||||
|
||||
unlink "tmp.csv";
|
||||
unlink "tmp2.csv";
|
||||
|
||||
$tests++;
|
||||
done_testing($tests);
|
||||
printf "\n";
|
||||
|
||||
|
||||
# vim:ts=5:sw=5:expandtab
|
||||
|
||||
@ -46,15 +46,16 @@ $edited_html =~ s/>/>/g;
|
||||
$edited_html =~ s/"/"/g;
|
||||
$edited_html =~ s/'/'/g;
|
||||
|
||||
cmp_ok($edited_html, "eq", $out, "HTML file matches terminal output");
|
||||
$tests++;
|
||||
|
||||
$diff = diff \$edited_html, \$out;
|
||||
printf "\n%s\n", "$diff";
|
||||
|
||||
cmp_ok($edited_html, "eq", $out, "Checking if HTML file matches terminal output") or
|
||||
diag ("\n%s\n", "$diff");
|
||||
|
||||
$tests++;
|
||||
|
||||
|
||||
#2
|
||||
printf "\n%s\n", " .. running again $prg against \"$uri\", now with --debug 4 to create HTML output (may take another ~2 minutes)";
|
||||
printf "%s\n", " .. running again $prg against \"$uri\", now with --debug 4 to create HTML output (may take another ~2 minutes)";
|
||||
# Redirect stderr to /dev/null in order to avoid some unexplained "date: invalid date" error messages
|
||||
$out = `TERM_WIDTH=120 $prg $check2run --debug 4 $uri 2> /dev/null`;
|
||||
$debughtml = `cat $htmlfile`;
|
||||
@ -79,15 +80,14 @@ $debughtml =~ s/.*built: .*\n//g;
|
||||
$debughtml =~ s/.*Using bash .*\n//g;
|
||||
# is whole line: s/.*<pattern> .*\n//g;
|
||||
|
||||
cmp_ok($debughtml, "eq", $html, "HTML file created with --debug 4 matches HTML file created without --debug");
|
||||
$diff = diff \$debughtml, \$html;
|
||||
|
||||
cmp_ok($debughtml, "eq", $html, "Checking if HTML file created with --debug 4 matches HTML file created without --debug") or
|
||||
diag ("\n%s\n", "$diff");
|
||||
$tests++;
|
||||
|
||||
$diff = diff \$debughtml, \$html;
|
||||
printf "\n%s\n", "$diff";
|
||||
|
||||
|
||||
|
||||
printf "\n";
|
||||
printf "\n\n";
|
||||
done_testing($tests);
|
||||
|
||||
|
||||
|
||||
@ -17,7 +17,7 @@ pass("Running testssl.sh against badssl.com to create a baseline (may take 2~3 m
|
||||
my $okout = `./testssl.sh -S -e --freak --logjam --drown --rc4 --sweet32 --breach --winshock --crime --jsonfile tmp.json --color 0 badssl.com`;
|
||||
my $okjson = json('tmp.json');
|
||||
unlink 'tmp.json';
|
||||
cmp_ok(@$okjson,'>',10,"We have more then 10 findings"); $tests++;
|
||||
cmp_ok(@$okjson,'>',10,"We should have more then 10 findings"); $tests++;
|
||||
|
||||
# Expiration
|
||||
pass("Running testssl against expired.badssl.com"); $tests++;
|
||||
@ -35,7 +35,7 @@ foreach my $f ( @$json ) {
|
||||
last;
|
||||
}
|
||||
}
|
||||
is($found,1,"We had a finding for this in the JSON output"); $tests++;
|
||||
is($found,1,"We should have a finding for this in the JSON output"); $tests++;
|
||||
|
||||
# Self signed and not-expired
|
||||
pass("Running testssl against self-signed.badssl.com"); $tests++;
|
||||
@ -52,7 +52,7 @@ foreach my $f ( @$json ) {
|
||||
last;
|
||||
}
|
||||
}
|
||||
is($found,1,"We had a finding for this in the JSON output"); $tests++;
|
||||
is($found,1,"We should a finding for this in the JSON output"); $tests++;
|
||||
|
||||
like($out, qr/Chain of trust.*?NOT ok.*\(self signed\)/,"Chain of trust should fail because of self signed"); $tests++;
|
||||
$found = 0;
|
||||
@ -64,7 +64,7 @@ foreach my $f ( @$json ) {
|
||||
last;
|
||||
}
|
||||
}
|
||||
is($found,1,"We had a finding for this in the JSON output"); $tests++;
|
||||
is($found,1,"We should have a finding for this in the JSON output"); $tests++;
|
||||
|
||||
like($okout, qr/Chain of trust[^\n]*?Ok/,"Chain of trust should be ok"); $tests++;
|
||||
$found = 0;
|
||||
@ -77,7 +77,7 @@ foreach my $f ( @$okjson ) {
|
||||
last;
|
||||
}
|
||||
}
|
||||
is($found,1,"We had a finding for this in the JSON output"); $tests++;
|
||||
is($found,1,"We should have a finding for this in the JSON output"); $tests++;
|
||||
|
||||
# Wrong host
|
||||
#pass("Running testssl against wrong.host.badssl.com"); $tests++;
|
||||
@ -111,7 +111,7 @@ foreach my $f ( @$json ) {
|
||||
last;
|
||||
}
|
||||
}
|
||||
is($found,1,"We had a finding for this in the JSON output"); $tests++;
|
||||
is($found,1,"We should have a finding for this in the JSON output"); $tests++;
|
||||
|
||||
# TODO: RSA 8192
|
||||
|
||||
|
||||
@ -3,11 +3,10 @@
|
||||
# Baseline diff test against testssl.sh (csv output)
|
||||
#
|
||||
# We don't use a full run yet and only the certificate section.
|
||||
# There we would need to blacklist at least:
|
||||
# There we would need to blacklist more, like:
|
||||
# cert_serialNumber, cert_fingerprintSHA1, cert_fingerprintSHA256, cert
|
||||
# cert_expirationStatus, cert_notBefore, cert_notAfter, cert_caIssuers, intermediate_cert
|
||||
#
|
||||
# help is appreciated here
|
||||
|
||||
use strict;
|
||||
use Test::More;
|
||||
@ -16,55 +15,54 @@ use Text::Diff;
|
||||
|
||||
my $tests = 0;
|
||||
my $prg="./testssl.sh";
|
||||
my $master_socket_csv="./t/baseline_data/default_testssl.csvfile";
|
||||
my $socket_csv="tmp.csv";
|
||||
my $check2run="-p -s -P --fs -h -U -c -q --ip=one --color 0 --csvfile $socket_csv";
|
||||
#my $check2run="-p --color 0 --csvfile $socket_csv";
|
||||
my $baseline_csv="./t/baseline_data/default_testssl.csvfile";
|
||||
my $cat_csv="tmp.csv";
|
||||
my $check2run="-p -s -P --fs -h -U -c -q --ip=one --color 0 --csvfile $cat_csv";
|
||||
my $uri="testssl.sh";
|
||||
my $diff="";
|
||||
my @args="";
|
||||
|
||||
die "Unable to open $prg" unless -f $prg;
|
||||
die "Unable to open $master_socket_csv" unless -f $master_socket_csv;
|
||||
|
||||
die "Unable to open $baseline_csv" unless -f $baseline_csv;
|
||||
|
||||
# Provide proper start conditions
|
||||
unlink "tmp.csv";
|
||||
unlink $cat_csv;
|
||||
|
||||
# Title
|
||||
printf "\n%s\n", "Diff unit test IPv4 against \"$uri\"";
|
||||
|
||||
#1 run
|
||||
`$prg $check2run $uri 2>&1`;
|
||||
printf "\n%s\n", "Diff unit test (IPv4) against \"$uri\"";
|
||||
@args="$prg $check2run $uri >/dev/null";
|
||||
system("@args") == 0
|
||||
or die ("FAILED: \"@args\" ");
|
||||
|
||||
$diff = diff $socket_csv, $master_socket_csv;
|
||||
|
||||
$socket_csv=`cat tmp.csv`;
|
||||
$master_socket_csv=`cat $master_socket_csv`;
|
||||
$cat_csv=`cat $cat_csv`;
|
||||
$baseline_csv=`cat $baseline_csv`;
|
||||
|
||||
# Filter for changes that are allowed to occur
|
||||
$socket_csv=~ s/HTTP_clock_skew.*\n//g;
|
||||
$master_socket_csv=~ s/HTTP_clock_skew.*\n//g;
|
||||
|
||||
# DROWN
|
||||
$socket_csv=~ s/censys.io.*\n//g;
|
||||
$master_socket_csv=~ s/censys.io.*\n//g;
|
||||
$cat_csv =~ s/HTTP_clock_skew.*\n//g;
|
||||
$baseline_csv =~ s/HTTP_clock_skew.*\n//g;
|
||||
|
||||
# HTTP time
|
||||
$socket_csv=~ s/HTTP_headerTime.*\n//g;
|
||||
$master_socket_csv=~ s/HTTP_headerTime.*\n//g;
|
||||
$cat_csv =~ s/HTTP_headerTime.*\n//g;
|
||||
$baseline_csv =~ s/HTTP_headerTime.*\n//g;
|
||||
|
||||
# Compare the differences to the master file -- and print differences if there were detected.
|
||||
# DROWN
|
||||
$cat_csv =~ s/censys.io.*\n//g;
|
||||
$baseline_csv =~ s/censys.io.*\n//g;
|
||||
|
||||
$diff = diff \$cat_csv, \$baseline_csv;
|
||||
|
||||
# Compare the differences to the baseline file -- and print differences if there were detected.
|
||||
#
|
||||
cmp_ok($socket_csv, "eq", $master_socket_csv, "Check whether CSV output matches master file from $uri") or
|
||||
ok($cat_csv eq $baseline_csv, "Check whether CSV output matches baseline file from $uri") or
|
||||
diag ("\n%s\n", "$diff");
|
||||
|
||||
$tests++;
|
||||
|
||||
unlink "tmp.csv";
|
||||
|
||||
$tests++;
|
||||
done_testing($tests);
|
||||
printf "\n";
|
||||
|
||||
|
||||
# vim:ts=5:sw=5:expandtab
|
||||
# vim:ts=5:sw=5:expandtab
|
||||
|
||||
|
||||
@ -5,6 +5,6 @@
|
||||
* 30-39: Does reporting work?
|
||||
* 50-69: Are the results what I expect (server side)?
|
||||
|
||||
Please help to write Travis/CI tests! Documentation can be found [here](https://perldoc.perl.org/Test/More.html).
|
||||
You can consult the existing code here. Feel free to use `10_baseline_ipv4_http.t` or `23_client_simulation.t` as a
|
||||
template.
|
||||
Please help to write CI tests! Documentation can be found [here](https://perldoc.perl.org/Test/More.html).
|
||||
You can consult the existing code here. Feel free to use `10_baseline_ipv4_http.t` or `12_diff_opensslversions.t` as a
|
||||
template. The latter is newer and code is cleaner.
|
||||
|
||||
@ -70,7 +70,7 @@
|
||||
"FS_TLS13_sig_algs","testssl.sh/81.169.166.184","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
|
||||
"HTTP_status_code","testssl.sh/81.169.166.184","443","INFO","200 OK ('/')","",""
|
||||
"HTTP_clock_skew","testssl.sh/81.169.166.184","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","testssl.sh/81.169.166.184","443","INFO","1654006271","",""
|
||||
"HTTP_headerTime","testssl.sh/81.169.166.184","443","INFO","1737570310","",""
|
||||
"HSTS_time","testssl.sh/81.169.166.184","443","OK","362 days (=31337000 seconds) > 15552000 seconds","",""
|
||||
"HSTS_subdomains","testssl.sh/81.169.166.184","443","INFO","only for this domain","",""
|
||||
"HSTS_preload","testssl.sh/81.169.166.184","443","INFO","domain is NOT marked for preloading","",""
|
||||
@ -81,6 +81,8 @@
|
||||
"X-Frame-Options","testssl.sh/81.169.166.184","443","OK","DENY","",""
|
||||
"X-Content-Type-Options","testssl.sh/81.169.166.184","443","OK","nosniff","",""
|
||||
"Content-Security-Policy","testssl.sh/81.169.166.184","443","OK","script-src 'unsafe-inline'; style-src 'unsafe-inline' 'self'; object-src 'self'; base-uri 'none'; form-action 'none'; img-src 'self' ; default-src 'self'; frame-ancestors 'self'; upgrade-insecure-requests;","",""
|
||||
"Cross-Origin-Opener-Policy","testssl.sh/81.169.166.184","443","INFO","same-origin-allow-popups","",""
|
||||
"Cross-Origin-Resource-Policy","testssl.sh/81.169.166.184","443","INFO","same-site","",""
|
||||
"banner_reverseproxy","testssl.sh/81.169.166.184","443","INFO","--","","CWE-200"
|
||||
"heartbleed","testssl.sh/81.169.166.184","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
@ -95,7 +97,7 @@
|
||||
"SWEET32","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","testssl.sh/81.169.166.184","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","testssl.sh/81.169.166.184","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=31B44391529821C6A77F3C78B02D716A07F99B8FDB342BF5A78F263C25375968","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","testssl.sh/81.169.166.184","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=5B4BC205947AED96ECB1879F2668F7F69D696C143BA8D1C69DBB4DC873C92AE9","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","testssl.sh/81.169.166.184","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","testssl.sh/81.169.166.184","443","OK","--","CVE-2015-4000","CWE-310"
|
||||
"BEAST_CBC_TLS1","testssl.sh/81.169.166.184","443","MEDIUM","ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA AES256-SHA","CVE-2011-3389","CWE-20"
|
||||
|
||||
784
testssl.sh
784
testssl.sh
File diff suppressed because it is too large
Load Diff
@ -69,7 +69,7 @@ testv6_patch() {
|
||||
else
|
||||
echo
|
||||
echo "no IPv6 patch (Fedora) detected!! -- Press ^C and dl & apply from"
|
||||
echo "https://github.com/drwetter/testssl.sh/blob/master/bin/fedora-dirk-ipv6.diff"
|
||||
echo "https://github.com/testssl/testssl.sh/blob/master/bin/fedora-dirk-ipv6.diff"
|
||||
echo "or press any key to ignore"
|
||||
echo
|
||||
read a
|
||||
|
||||
@ -72,6 +72,10 @@ foreach my $client ( @$ssllabs ) {
|
||||
push @ciphersuites, "TLS_AES_128_CCM_SHA256"; }
|
||||
elsif ( $suite == "4869" ) {
|
||||
push @ciphersuites, "TLS_AES_128_CCM_8_SHA256"; }
|
||||
elsif ( $suite == "49332" ) {
|
||||
push @ciphersuites, "TLS_SHA256_SHA256"; }
|
||||
elsif ( $suite == "49333" ) {
|
||||
push @ciphersuites, "TLS_SHA384_SHA384"; }
|
||||
elsif ( exists $ciphers{$suite} ) {
|
||||
push @ciphers, $ciphers{$suite}; }
|
||||
elsif ( $suite == "255" ) {
|
||||
|
||||
Loading…
Reference in New Issue
Block a user