Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-01-30 20:31:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug when legacy NPN is tested against a TLS 1.3 host

Browse Source 
When testing a TLS 1.3 host s_client_options used TLS 1.3 ciphers to test
for NPN. As that is not implemented we nee dto make sure any other version
is used.

This PR ensures that --after testing whether it's a TLS 1.3-only host
where this test doesn't make any sense in the first place.

Fix for #2633
This commit is contained in:
Dirk 2025-01-24 18:46:07 +01:00
parent 5c1232b9dc
commit 43a0099fbc
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
testssl.sh
View File

@ -11258,6 +11258,12 @@ npn_pre(){
fileout "NPN" "WARN" "not tested $OPENSSL doesn't support NPN/SPDY"
return 7
fi
if "$TLS13_ONLY"; then
# https://github.com/openssl/openssl/issues/3665
pr_warning "There's no such thing as NPN on TLS 1.3-only hosts"
fileout "NPN" "WARN" "not possible for TLS 1.3-only hosts"
return 6
fi
return 0
}
@ -11281,16 +11287,24 @@ alpn_pre(){
run_npn() {
local tmpstr
local -i ret=0
local proto=""
local jsonID="NPN"
[[ -n "$STARTTLS" ]] && return 0
"$FAST" && return 0
pr_bold " NPN/SPDY "
if ! npn_pre; then
outln
return 0
fi
$OPENSSL s_client $(s_client_options "-connect $NODEIP:$PORT $BUGS $SNI -nextprotoneg "$NPN_PROTOs"") </dev/null 2>$ERRFILE >$TMPFILE
# TLS 1.3 s_client doesn't support -nextprotoneg when connecting with TLS 1.3. So we need to make sure it wont be used
# TLS13_ONLY is tested here again, just to be sure, see npn_pre
if "$HAS_TLS13" && ! $TLS13_ONLY ]] ; then
proto="-no_tls1_3"
fi
$OPENSSL s_client $(s_client_options "$proto -connect $NODEIP:$PORT $BUGS $SNI -nextprotoneg "$NPN_PROTOs"") </dev/null 2>$ERRFILE >$TMPFILE
[[ $? -ne 0 ]] && ret=1
tmpstr="$(grep -a '^Protocols' $TMPFILE | sed 's/Protocols.*: //')"
if [[ -z "$tmpstr" ]] || [[ "$tmpstr" == " " ]]; then