Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-01-03 23:39:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1510 from drwetter/rDNS_fixes

Browse Source 
Fix for non compliant DNS PTR records
This commit is contained in:
Dirk Wetter 2020-02-15 15:22:22 +01:00 committed by GitHub
commit 64fea03f66
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
testssl.sh
View File

@ -19209,7 +19209,7 @@ determine_ip_addresses() {
determine_rdns() { determine_rdns() {
local saved_openssl_conf="$OPENSSL_CONF" local saved_openssl_conf="$OPENSSL_CONF"
local nodeip="" local nodeip="" rdns="" line=""
[[ -n "$NODNS" ]] && rDNS="(instructed to minimize DNS queries)" && return 0 # PTR records were not asked for [[ -n "$NODNS" ]] && rDNS="(instructed to minimize DNS queries)" && return 0 # PTR records were not asked for
local nodeip="$(tr -d '[]' <<< $NODEIP)" # for DNS we do not need the square brackets of IPv6 addresses local nodeip="$(tr -d '[]' <<< $NODEIP)" # for DNS we do not need the square brackets of IPv6 addresses
@ -19231,10 +19231,15 @@ determine_rdns() {
rDNS=$(strip_lf "$(nslookup -type=PTR $nodeip 2>/dev/null | grep -v 'canonical name =' | grep 'name = ' | awk '{ print $NF }' | sed 's/\.$//')") rDNS=$(strip_lf "$(nslookup -type=PTR $nodeip 2>/dev/null | grep -v 'canonical name =' | grep 'name = ' | awk '{ print $NF }' | sed 's/\.$//')")
fi fi
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134 OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
rDNS="$(echo $rDNS)" # First, rDNS can contain multilines due to multiple PTR DNS records, though this is not recommended.
# remove chars which under weird circumstances can show up here # So we use a loop to check for each FQDN returned. There we remove chars which under weird
rDNS=${rDNS// /} # circumstances (see #1506) can show up here. The blacklist is taken from RFC 1912 ("Allowable characters in a
rDNS=${rDNS//;/} # label for a host name are only ASCII, letters, digits, and the `-' character")
while read -r line; do
line="$(tr -dc '[a-zA-Z0-9-_.]' <<< "$line")"
[[ -z "$rdns" ]] && rdns="$line" || rdns="$rdns $line"
done <<< "$rDNS"
rDNS="$rdns"
[[ -z "$rDNS" ]] && rDNS="--" [[ -z "$rDNS" ]] && rDNS="--"
return 0 return 0
} }