From 54fad800c01f5ed296839d0ffa1283b20c63ca53 Mon Sep 17 00:00:00 2001 From: David Cooper Date: Wed, 6 Nov 2019 15:58:38 -0500 Subject: [PATCH 1/5] Fix issue with run_protocols() in --ssl-native mode This PR fixes a minor problem with run_protocols() in "--ssl-native" mode if $OPENSSL does not support TLS 1.3. Currently, the warning message that $OPENSSL does not support a protocol is printed when run_prototest_openssl() is called. This causes a problem for the output if $OPENSSL does not support TLS 1.3, since the run_prototest_openssl() is called before the results for TLS 1.2 are printed. The result is something like this: SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 offered (deprecated) TLS 1.1 offered (deprecated) Local problem: /home/cooper/Desktop/testssl.sh/bin/openssl.Linux.x86_64 doesn't support "s_client -tls1_3" TLS 1.2 offered (OK) TLS 1.3 NPN/SPDY not offered ALPN/HTTP2 http/1.1 (offered) --- testssl.sh | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/testssl.sh b/testssl.sh index f295cd3..a4af525 100755 --- a/testssl.sh +++ b/testssl.sh @@ -4796,7 +4796,8 @@ locally_supported() { run_prototest_openssl() { local -i ret=0 - ! locally_supported "$1" && return 7 + # check whether the protocol being tested is supported by $OPENSSL + $OPENSSL s_client "$1" -connect x 2>&1 | grep -aq "unknown option" && return 7 $OPENSSL s_client $(s_client_options "-state $1 $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI") >$TMPFILE 2>$ERRFILE Date: Thu, 7 Nov 2019 12:57:58 -0500 Subject: [PATCH 2/5] Fix typos in comment --- testssl.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/testssl.sh b/testssl.sh index a4af525..a5c2441 100755 --- a/testssl.sh +++ b/testssl.sh @@ -4784,8 +4784,8 @@ locally_supported() { } -# The protocol check in run_protocols needs to be redone. The using_socket part there kind of sucks. -# 1) we need to have a variable where the results are being stored so that every other test doesn't have to do this agai +# The protocol check in run_protocols needs to be redone. The using_sockets part there kind of sucks. +# 1) we need to have a variable where the results are being stored so that every other test doesn't have to do this again # --> we have that but certain information like "downgraded" are not being passed. That's not ok for run_protocols()/ # for all other functions we can use it # 2) the code is old and one can do that way better From c607bf4d9246db011eb880a60ccd5c0ae61a0b55 Mon Sep 17 00:00:00 2001 From: David Cooper Date: Thu, 7 Nov 2019 13:01:21 -0500 Subject: [PATCH 3/5] Check stderr for "no cipher list" run_prototest_openssl() currently checks only stdout for the string "no cipher list", which is an indication that the server supports SSLv2, but no ciphers for that protocol. However, the output that includes "no cipher list" is sent to stderr. --- testssl.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/testssl.sh b/testssl.sh index a5c2441..9245d80 100755 --- a/testssl.sh +++ b/testssl.sh @@ -4798,12 +4798,12 @@ run_prototest_openssl() { # check whether the protocol being tested is supported by $OPENSSL $OPENSSL s_client "$1" -connect x 2>&1 | grep -aq "unknown option" && return 7 - $OPENSSL s_client $(s_client_options "-state $1 $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI") >$TMPFILE 2>$ERRFILE $TMPFILE 2>&1 $TMPFILE 2>$ERRFILE $TMPFILE 2>&1 Date: Thu, 7 Nov 2019 13:03:42 -0500 Subject: [PATCH 4/5] Missing line break If --ssl-native is being used and the server supports SSLv2, but does not support any SSLv2 ciphers, there is a missing line break after the warning message is printed. --- testssl.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testssl.sh b/testssl.sh index 9245d80..3c20f50 100755 --- a/testssl.sh +++ b/testssl.sh @@ -4964,7 +4964,7 @@ run_protocols() { fileout "$jsonID" "OK" "not offered" add_tls_offered ssl2 no ;; - 5) pr_svrty_high "CVE-2015-3197: $supported_no_ciph2"; + 5) prln_svrty_high "CVE-2015-3197: $supported_no_ciph2"; fileout "$jsonID" "HIGH" "offered, no cipher" "CVE-2015-3197" "CWE-310" add_tls_offered ssl2 yes ;; From a7fe48190461bbeae96e7d947eb8264983199832 Mon Sep 17 00:00:00 2001 From: David Cooper Date: Thu, 7 Nov 2019 13:12:41 -0500 Subject: [PATCH 5/5] Don't ignore first call to $OPENSSL s_client run_prototest_openssl() currently calls "$OPENSSL s_client" twice, once with $PROXY and once without. The problem is that the results of the first call are just ignored. This commit changes run_prototest_openssl() so that the attempt without $PROXY is only tried if the first attempt was unsuccessful. --- testssl.sh | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/testssl.sh b/testssl.sh index 3c20f50..ee1ce38 100755 --- a/testssl.sh +++ b/testssl.sh @@ -4802,12 +4802,18 @@ run_prototest_openssl() { sclient_connect_successful $? $TMPFILE ret=$? debugme grep -E "error|failure" $ERRFILE | grep -Eav "unable to get local|verify error" - # try again without $PROXY - $OPENSSL s_client $(s_client_options "-state $1 $STARTTLS $BUGS -connect $NODEIP:$PORT $SNI") >$TMPFILE 2>&1 $TMPFILE 2>&1