Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-09-17 09:22:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Formatting, early exit when HTTPS RR retruned in clear text

Browse Source
This commit is contained in:
Dirk
2025-07-29 16:07:31 +02:00
parent d0d49e2869
commit 250f30819c
1 changed files with 56 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
testssl.sh
View File

@ -22367,6 +22367,7 @@ get_caa_rrecord() {
# Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records).
# https://www.rfc-editor.org/rfc/rfc9460.html
# arg1: domain to check for
# returns: string for record
#
get_https_rrecord() {
local raw_https=""
@ -22408,7 +22409,13 @@ get_https_rrecord() {
text_httpsrr=$(nslookup -type=HTTPS $1 | awk '/'"^${1}"'.*rdata_65// { print substr($0,index($0,$4)) }')
fi
if [[ -n "$text_httpsrr" ]]; then
safe_echo "$text_httpsrr"
return 0
fi
# Now we need to try parsing the raw output
# Format probably: https://www.rfc-editor.org/rfc/rfc3597 (plus updates)
# If there's a type65 record there are 2x3 output formats, mostly depending on age of distribution
# -- roughly that's the difference between text and binary format -- and the type of DNS client
@ -22425,14 +22432,6 @@ get_https_rrecord() {
# 1) dev.testssl.sh rdata_65 = 1 . alpn="h2"
# 2) dev.testssl.sh rdata_65 = \# 10 00010000010003026832
# we normalize the output during the following so that's e.g. 1 . alpn="h2"
# https://datatracker.ietf.org/doc/rfc9460/?include_text=1
#set -x
if [[ -n "$text_httpsrr" ]]; then
safe_echo "$text_httpsrr"
else
if "$HAS_DIG"; then
raw_https="$(dig $DIG_R +short +search +timeout=3 +tries=3 $noidnout type65 "$1" 2>/dev/null)"
# empty if there's no such record
@ -22456,8 +22455,6 @@ get_https_rrecord() {
fi
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
# Format probably: https://www.rfc-editor.org/rfc/rfc3597 (plus updates)
# dig +short +search +timeout=3 +tries=3 +noidnout type65 dev.testssl.sh
# 1 . alpn="h2" port=443 ipv6hint=2a01:238:4308:a920:1000:0:b:1337
#
@ -22499,14 +22496,14 @@ get_https_rrecord() {
# https_property_name="$(hex2ascii ${line:4:$len_https_property})"
# https_property_value="$(hex2ascii "${line:$((4+len_https_property)):100}")"
else
outln "please report unknown HTTPS RR $line with flag @ $NODE"
out "please report unknown HTTPS RR $line with flag @ $NODE"
return 7
fi
done <<< "$raw_https"
else
safe_echo "$raw_https"
fi
fi
#set +x
return 0
@ -23343,7 +23340,7 @@ dns_https_rr () {
else
https_rr="$(get_https_rrecord $NODE)"
if [[ -n "$https_rr" ]]; then
pr_svrty_good "yes" ; out " "
pr_svrty_good "yes" ; out ": "
prln_italic "$(out_row_aligned_max_width "$https_rr" "$indent " $TERM_WIDTH)"
fileout "${jsonID}" "OK" "$https_rr"
else