mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-10-31 13:55:25 +01:00
Merge pull request #2610 from testssl/links
Change orga from drwetter --> testssl
This commit is contained in:
Dirk Wetter
@@ -137,7 +137,7 @@
|
||||
* Trust chain check against certificate stores from Apple (OS), Linux (OS),
|
||||
Microsoft (OS), Mozilla (Firefox Browser), works for openssl >=1.0.1
|
||||
* IPv6 (status: 80% working, details see
|
||||
https://github.com/drwetter/testssl.sh/issues/11
|
||||
https://github.com/testssl/testssl.sh/issues/11
|
||||
* works now on servers requiring a x509 certificate for authentication
|
||||
* extensive CN <--> hostname check
|
||||
* SSL Session ID check
|
||||
@@ -183,7 +183,7 @@
|
||||
* quite some LibreSSL fixes, still not recommended to use though (see https://testssl.sh/)
|
||||
* lots of fixes, code improvements, even more robust
|
||||
|
||||
Full log @ https://github.com/drwetter/testssl.sh/commits/2.6/testssl.sh
|
||||
Full log @ https://github.com/testssl/testssl.sh/commits/2.6/testssl.sh
|
||||
|
||||
### New in 2.4
|
||||
* "only one cmd line option at a time" is completely gone
|
||||
@@ -198,7 +198,7 @@ Full log @ https://github.com/drwetter/testssl.sh/commits/2.6/testssl.sh
|
||||
* lots of cosmetic and maintainability code cleanups
|
||||
* bugfixing
|
||||
|
||||
Full changelog: https://github.com/drwetter/testssl.sh/commits/2.4/testssl.sh
|
||||
Full changelog: https://github.com/testssl/testssl.sh/commits/2.4/testssl.sh
|
||||
|
||||
### 2.2. new features:
|
||||
* Works fully under FreeBSD (openssl >=1.0)
|
||||
@@ -214,7 +214,7 @@ Full changelog: https://github.com/drwetter/testssl.sh/commits/2.4/testssl.sh
|
||||
* RFC <---> OpenSSL name space mapping of ciphers everywhere
|
||||
* includes a lot of fixes
|
||||
|
||||
Full changelog @ https://github.com/drwetter/testssl.sh/commits/2.2/testssl.sh
|
||||
Full changelog @ https://github.com/testssl/testssl.sh/commits/2.2/testssl.sh
|
||||
|
||||
### 2.0 major release, new features:
|
||||
* SNI
|
||||
|
||||
@@ -5,7 +5,7 @@ is always welcome, here @ github or via e-mail.
|
||||
|
||||
Note please the following
|
||||
|
||||
* Please read at least the [coding convention](https://github.com/drwetter/testssl.sh/Coding_Convention.md).
|
||||
* Please read at least the [coding convention](https://github.com/testssl/testssl.sh/Coding_Convention.md).
|
||||
* One PR per feature or bug fix or improvement. Please do not mix issues.
|
||||
* Document your PR, both in the PR and/or commit message and in the code.
|
||||
* Please test your changes thoroughly as reliability is important for this project. You may want to check different servers with different settings.
|
||||
|
||||
@@ -5,8 +5,8 @@ FROM alpine:3.20
|
||||
WORKDIR /home/testssl
|
||||
|
||||
ARG BUILD_VERSION
|
||||
ARG ARCHIVE_URL=https://github.com/drwetter/testssl.sh/archive/
|
||||
ARG URL=https://github.com/drwetter/testssl.sh.git
|
||||
ARG ARCHIVE_URL=https://github.com/testssl/testssl.sh/archive/
|
||||
ARG URL=https://github.com/testssl/testssl.sh.git
|
||||
|
||||
RUN test -n "${BUILD_VERSION}" \
|
||||
&& apk update \
|
||||
|
||||
34
Readme.md
34
Readme.md
@@ -1,10 +1,11 @@
|
||||
|
||||
## Intro
|
||||
|
||||
[](https://github.com/drwetter/testssl.sh/actions/workflows/unit_tests.yml)
|
||||
[](https://gitter.im/drwetter/testssl.sh?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
|
||||
[](https://github.com/drwetter/testssl.sh/LICENSE)
|
||||
[](https://github.com/drwetter/testssl.sh/blob/3.2/Dockerfile.md)
|
||||
[](https://github.com/testssl/testssl.sh/actions/workflows/unit_tests.yml)
|
||||
[](https://gitter.im/testssl/testssl.sh?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
|
||||
[](https://github.com/testssl/testssl.sh/LICENSE)
|
||||
[](https://github.com/testssl/testssl.sh/blob/3.2/Dockerfile.md)
|
||||
|
||||
|
||||
`testssl.sh` is a free command line tool which checks a server's service on
|
||||
any port for the support of TLS/SSL ciphers, protocols as well as some
|
||||
@@ -44,16 +45,16 @@ due to bash-socket-based checks. As a result you can also use e.g. LibreSSL or O
|
||||
(silent) check for binaries is done when you start testssl.sh . System V needs probably
|
||||
to have GNU grep installed. MacOS X and Windows (using MSYS2, Cygwin or WSL) work too.
|
||||
|
||||
Update notification here or @ [mastodon](https://infosec.exchange/@testssl) (old: [twitter](https://twitter.com/drwetter))
|
||||
Update notification here or @ [mastodon](https://infosec.exchange/@testssl or [bluesky](https://bsky.app/profile/testssl.bsky.social). Please note the [twitter](https://twitter.com/drwetter) account is not being used anymore.
|
||||
|
||||
### Installation
|
||||
|
||||
You can download testssl.sh branch 3.2 just by cloning this git repository:
|
||||
|
||||
git clone --depth 1 https://github.com/drwetter/testssl.sh.git
|
||||
git clone --depth 1 https://github.com/testssl/testssl.sh.git
|
||||
|
||||
3.2 is now the latest branch which evolved from 3.1dev. It's in the release candidate phase.
|
||||
For the former stable version help yourself by downloading the [ZIP](https://codeload.github.com/drwetter/testssl.sh/zip/v3.0.8) or [tar.gz](https://codeload.github.com/drwetter/testssl.sh/tar.gz/v3.0.8) archive. Just ``cd`` to the directory created (=INSTALLDIR) and run it off there.
|
||||
3.2 is now the latest branch which evolved from 3.1dev. It's in the release candidate phase and considered as stable.
|
||||
For the former stable version named oldstable please help yourself by downloading the [ZIP](https://codeload.github.com/testssl/testssl.sh/zip/v3.0.9) or [tar.gz](https://codeload.github.com/testssl/testssl.sh/tar.gz/v3.0.9) archive. Just ``cd`` to the directory created (=INSTALLDIR) and run it off there.
|
||||
|
||||
#### Docker
|
||||
|
||||
@@ -68,7 +69,7 @@ Or if you have cloned this repo you also can just ``cd`` to the INSTALLDIR and r
|
||||
docker build . -t imagefoo && docker run --rm -t imagefoo example.com
|
||||
```
|
||||
|
||||
For more please consult [Dockerfile.md](https://github.com/drwetter/testssl.sh/blob/3.2/Dockerfile.md).
|
||||
For more please consult [Dockerfile.md](https://github.com/testssl/testssl.sh/blob/3.2/Dockerfile.md).
|
||||
|
||||
### No Warranty
|
||||
|
||||
@@ -78,9 +79,9 @@ Testssl.sh is intended to be used as a standalone CLI tool. While we tried to ap
|
||||
|
||||
### Status
|
||||
|
||||
We're currently in the release candidate phase for version 3.2. Bigger features will be developed in a separate branch before merged into a 3.3dev to avoid hiccups or inconsistencies.
|
||||
We're currently in the release candidate phase for version 3.2. You should use it despite the label "RC". Bigger features will be developed in a separate branch before merged into a 3.3dev to avoid hiccups or inconsistencies.
|
||||
|
||||
Version 3.0.X receives bugfixes, labeled as 3.0.1, 3.0.2 and so on. This will happen until 3.2 is released.
|
||||
Version 3.0.X receives bugfixes, labeled as 3.0.1, 3.0.2 and so on. This will happen until 3.2 is finally released.
|
||||
|
||||
Support for 2.9.5 has been dropped. Supported is >= 3.0.x only.
|
||||
|
||||
@@ -92,16 +93,19 @@ Support for 2.9.5 has been dropped. Supported is >= 3.0.x only.
|
||||
|
||||
### Contributing
|
||||
|
||||
Contributions are welcome! See [CONTRIBUTING.md](https://github.com/drwetter/testssl.sh/blob/3.2/CONTRIBUTING.md) for details. Please also have a look at the [Coding Convention](https://github.com/drwetter/testssl.sh/blob/3.2/Coding_Convention.md).
|
||||
Contributions are welcome! See [CONTRIBUTING.md](https://github.com/testssl/testssl.sh/blob/3.2/CONTRIBUTING.md) for details. Please also have a look at the [Coding Convention](https://github.com/testssl/testssl.sh/blob/3.2/Coding_Convention.md). A lot of contributors already helped to push the project where it currently is, see [CREDITS.md](https://github.com/testssl/testssl.sh/blob/3.2/CREDITS.md). We still you use your help now. A start would be look for issues which are labeled as [good first issue](https://github.com/testssl/testssl.sh/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22), [for grabs](https://github.com/testssl/testssl.sh/issues?q=is%3Aissue+is%3Aopen+label%3A%22for+grabs%22) or [help wanted](https://github.com/testssl/testssl.sh/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22). The latter is more advanced.
|
||||
|
||||
In general there's some maintenance burden, like maintaining handshakes and CA stores, writing unit tests, improving github actions. If you believe you can contribute, speak up.
|
||||
|
||||
|
||||
### Bug reports
|
||||
|
||||
Bug reports are important. It makes this project more robust.
|
||||
|
||||
Please file bugs in the issue tracker @ GitHub. Do not forget to provide detailed information, see template for issue, and further details @
|
||||
https://github.com/drwetter/testssl.sh/wiki/Bug-reporting. Nobody can read your thoughts -- yet. And only agencies your screen ;-)
|
||||
https://github.com/testssl/testssl.sh/wiki/Bug-reporting. Nobody can read your thoughts -- yet. And only agencies your screen ;-)
|
||||
|
||||
You can also debug yourself, see [here](https://github.com/drwetter/testssl.sh/wiki/Findings-and-HowTo-Fix-them).
|
||||
You can also debug yourself, see [here](https://github.com/testssl/testssl.sh/wiki/Findings-and-HowTo-Fix-them).
|
||||
|
||||
----
|
||||
|
||||
@@ -128,7 +132,7 @@ Please address questions not specifically to the code of testssl.sh to the respe
|
||||
|
||||
#### Brew package
|
||||
|
||||
* see [#233](https://github.com/drwetter/testssl.sh/issues/233) and
|
||||
* see [#233](https://github.com/testssl/testssl.sh/issues/233) and
|
||||
[https://github.com/Homebrew/homebrew](https://github.com/Homebrew/homebrew)
|
||||
|
||||
#### Daemon for batch execution of testssl.sh command files
|
||||
|
||||
48
testssl.sh
48
testssl.sh
@@ -7,9 +7,9 @@
|
||||
# vulnerabilities or features. It may or may be not distributed by your distribution.
|
||||
# The upstream versions are available (please leave the links intact):
|
||||
#
|
||||
# Development version https://github.com/drwetter/testssl.sh
|
||||
# Development version https://github.com/testssl/testssl.sh
|
||||
# Stable version https://testssl.sh
|
||||
# File bugs at GitHub https://github.com/drwetter/testssl.sh/issues
|
||||
# File bugs at GitHub https://github.com/testssl/testssl.sh/issues
|
||||
#
|
||||
# Project lead and initiator: Dirk Wetter, copyleft: 2007-today, contributions so far see CREDITS.md
|
||||
# Main contributions from David Cooper
|
||||
@@ -399,7 +399,7 @@ RSA_CERT_FINGERPRINT_SHA2=""
|
||||
STARTTLS_PROTOCOL=""
|
||||
OPTIMAL_PROTO="" # Need this for IIS6 (sigh) + OpenSSL 1.0.2, otherwise some handshakes will fail see
|
||||
# https://github.com/PeterMosmans/openssl/issues/19#issuecomment-100897892
|
||||
STARTTLS_OPTIMAL_PROTO="" # Same for STARTTLS, see https://github.com/drwetter/testssl.sh/issues/188
|
||||
STARTTLS_OPTIMAL_PROTO="" # Same for STARTTLS, see https://github.com/testssl/testssl.sh/issues/188
|
||||
OPTIMAL_SOCKETS_PROTO="" # Same for tls_sockets(). -- not yet used
|
||||
ALL_FAILED_SOCKETS=true # Set to true if all attempts to connect to server using tls_sockets/sslv2_sockets failed
|
||||
TLS_TIME="" # To keep the value of TLS server timestamp
|
||||
@@ -617,7 +617,7 @@ tmln_cyan() { tm_cyan "$1"; tmln_out; }
|
||||
pr_cyan() { tm_cyan "$1"; [[ "$COLOR" -ge 2 ]] && html_out "<span style=\"color:#0d7ea2;font-weight:bold;\">$(html_reserved "$1")</span>" || html_out "$(html_reserved "$1")"; }
|
||||
prln_cyan() { pr_cyan "$1"; outln; }
|
||||
|
||||
tm_litegrey() { [[ "$COLOR" -ne 0 ]] && tm_out "\033[0;37m$1" || tm_out "$1"; tm_off; } # ... https://github.com/drwetter/testssl.sh/pull/600#issuecomment-276129876
|
||||
tm_litegrey() { [[ "$COLOR" -ne 0 ]] && tm_out "\033[0;37m$1" || tm_out "$1"; tm_off; } # ... https://github.com/testssl/testssl.sh/pull/600#issuecomment-276129876
|
||||
tmln_litegrey() { tm_litegrey "$1"; tmln_out; } # not really usable on a black background, see ..
|
||||
prln_litegrey() { pr_litegrey "$1"; outln; }
|
||||
pr_litegrey() { tm_litegrey "$1"; [[ "$COLOR" -ne 0 ]] && html_out "<span style=\"color:#71767a;\">$(html_reserved "$1")</span>" || html_out "$(html_reserved "$1")"; }
|
||||
@@ -1037,7 +1037,7 @@ get_cipher() {
|
||||
# However there seem to be cases where the preferred $(< "$1") logic has a problem.
|
||||
# Especially with bash 3.2 (Mac OS X) and when on the server side binary chars
|
||||
# are returned, see https://stackoverflow.com/questions/7427262/how-to-read-a-file-into-a-variable-in-shell#22607352
|
||||
# and https://github.com/drwetter/testssl.sh/issues/1292
|
||||
# and https://github.com/testssl/testssl.sh/issues/1292
|
||||
# Performance measurements showed no to barely measurable penalty (1s displayed in 9 tries).
|
||||
|
||||
if [[ "$server_hello" =~ Cipher\ *:\ ([A-Z0-9]+-[A-Za-z0-9\-]+|TLS_[A-Za-z0-9_]+|SSL_[A-Za-z0-9_]+) ]]; then
|
||||
@@ -4926,9 +4926,9 @@ client_simulation_sockets() {
|
||||
data+=", ${clienthello:i:2}"
|
||||
done
|
||||
# same as above. If a CIPHER_SUITES string was provided, then check that it is in the ServerHello
|
||||
# this appeared 1st in yassl + MySQL (https://github.com/drwetter/testssl.sh/pull/784) but adds
|
||||
# this appeared 1st in yassl + MySQL (https://github.com/testssl/testssl.sh/pull/784) but adds
|
||||
# robustness to the implementation
|
||||
# see also https://github.com/drwetter/testssl.sh/pull/797
|
||||
# see also https://github.com/testssl/testssl.sh/pull/797
|
||||
if [[ "${1:0:4}" == 1603 ]]; then
|
||||
# Extract list of cipher suites from SSLv3 or later ClientHello
|
||||
sid_len=4*$(hex2dec "${data:174:2}")
|
||||
@@ -6475,7 +6475,7 @@ pr_ecdh_quality() {
|
||||
elif [[ "$bits" -le 163 ]]; then
|
||||
pr_svrty_medium "$string"
|
||||
elif [[ "$bits" -le 193 ]]; then # hmm, according to https://wiki.openssl.org/index.php/Elliptic_Curve_Cryptography it should ok
|
||||
pr_svrty_low "$string" # but openssl removed it https://github.com/drwetter/testssl.sh/issues/299#issuecomment-220905416
|
||||
pr_svrty_low "$string" # but openssl removed it https://github.com/testssl/testssl.sh/issues/299#issuecomment-220905416
|
||||
elif [[ "$bits" -le 224 ]]; then
|
||||
out "$string"
|
||||
elif [[ "$bits" -gt 224 ]]; then
|
||||
@@ -14861,7 +14861,7 @@ parse_tls_serverhello() {
|
||||
fi
|
||||
|
||||
# If a CIPHER_SUITES string was provided, then check that $tls_cipher_suite is in the string.
|
||||
# this appeared in yassl + MySQL (https://github.com/drwetter/testssl.sh/pull/784) but adds robustness
|
||||
# this appeared in yassl + MySQL (https://github.com/testssl/testssl.sh/pull/784) but adds robustness
|
||||
# to the implementation
|
||||
if [[ -n "$cipherlist" ]]; then
|
||||
tls_cipher_suite="$(tolower "$tls_cipher_suite")"
|
||||
@@ -15726,7 +15726,7 @@ prepare_tls_clienthello() {
|
||||
# There does not seem to be any reason to include this extension. However, it appears that
|
||||
# OpenSSL, Firefox, and Chrome include it in TLS 1.3 ClientHello messages, and there is at
|
||||
# least one server that will fail the connection if it is absent
|
||||
# (see https://github.com/drwetter/testssl.sh/issues/990).
|
||||
# (see https://github.com/testssl/testssl.sh/issues/990).
|
||||
if [[ "0x$tls_low_byte" -ge 0x04 ]] && [[ ! "$extra_extensions_list" =~ \ 002d\ ]]; then
|
||||
[[ -n "$all_extensions" ]] && all_extensions+=","
|
||||
all_extensions+="$extn_psk_mode"
|
||||
@@ -17199,7 +17199,7 @@ run_renego() {
|
||||
# 1 means client tried to renegotiating but the server side errored then. You still see RENEGOTIATING in the output
|
||||
if tail -5 $TMPFILE| grep -qa '^closed'; then
|
||||
# Exemption from above: server closed the connection but return value was zero
|
||||
# See https://github.com/drwetter/testssl.sh/issues/1725 and referenced issue @haproxy
|
||||
# See https://github.com/testssl/testssl.sh/issues/1725 and referenced issue @haproxy
|
||||
sec_client_renego=1
|
||||
fi
|
||||
case "$sec_client_renego" in
|
||||
@@ -18008,7 +18008,7 @@ run_tls_fallback_scsv() {
|
||||
elif grep -qa "alert handshake failure" "$TMPFILE"; then
|
||||
pr_svrty_good "Probably OK. "
|
||||
fileout "$jsonID" "OK" "Probably oK"
|
||||
# see RFC 7507, https://github.com/drwetter/testssl.sh/issues/121
|
||||
# see RFC 7507, https://github.com/testssl/testssl.sh/issues/121
|
||||
# other case reported by Nicolas was F5 and at customer of mine: the same
|
||||
pr_svrty_medium "But received non-RFC-compliant \"handshake failure\" instead of \"inappropriate fallback\""
|
||||
fileout "$jsonID" "MEDIUM" "received non-RFC-compliant \"handshake failure\" instead of \"inappropriate fallback\""
|
||||
@@ -21285,7 +21285,7 @@ get_local_a() {
|
||||
check_resolver_bins() {
|
||||
local saved_openssl_conf="$OPENSSL_CONF"
|
||||
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
type -p dig &> /dev/null && HAS_DIG=true
|
||||
type -p host &> /dev/null && HAS_HOST=true
|
||||
type -p drill &> /dev/null && HAS_DRILL=true
|
||||
@@ -21307,7 +21307,7 @@ check_resolver_bins() {
|
||||
HAS_DIG_NOIDNOUT=true
|
||||
fi
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
return 0
|
||||
}
|
||||
|
||||
@@ -21330,7 +21330,7 @@ get_a_record() {
|
||||
echo $1
|
||||
return 0
|
||||
fi
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
if [[ "$NODE" == *.local ]]; then
|
||||
if "$HAS_AVAHIRESOLVE"; then
|
||||
ip4=$(filter_ip4_address $(avahi-resolve -4 -n "$1" 2>/dev/null | awk '{ print $2 }'))
|
||||
@@ -21355,7 +21355,7 @@ get_a_record() {
|
||||
if [[ -z "$ip4" ]] && "$HAS_NSLOOKUP"; then
|
||||
ip4=$(filter_ip4_address $(strip_lf "$(nslookup -querytype=a "$1" 2>/dev/null | awk '/^Name/ { getline; print $NF }')"))
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
echo "$ip4"
|
||||
}
|
||||
|
||||
@@ -21368,7 +21368,7 @@ get_aaaa_record() {
|
||||
|
||||
"$HAS_DIG_NOIDNOUT" && noidnout="+noidnout"
|
||||
[[ "$NODNS" == none ]] && return 0 # if no DNS lookup was instructed, leave here
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
if is_ipv6addr "$1"; then
|
||||
# This saves walking through this. Also it avoids hangs e.g. if you run docker locally without reachable DNS
|
||||
echo "$1"
|
||||
@@ -21402,7 +21402,7 @@ get_aaaa_record() {
|
||||
ip6=$(filter_ip6_address $(strip_lf "$(nslookup -type=aaaa "$1" 2>/dev/null | awk '/'"^${a}"'.*AAAA/ { print $NF }')"))
|
||||
fi
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
echo "$ip6"
|
||||
}
|
||||
|
||||
@@ -21448,7 +21448,7 @@ get_caa_rr_record() {
|
||||
return 1
|
||||
# No dig, drill, host, or nslookup --> complaint was elsewhere already
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
debugme echo $raw_caa
|
||||
|
||||
if [[ "$raw_caa" =~ \#\ [0-9][0-9] ]]; then
|
||||
@@ -21496,7 +21496,7 @@ get_mx_record() {
|
||||
local noidnout=""
|
||||
|
||||
"$HAS_DIG_NOIDNOUT" && noidnout="+noidnout"
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
# we need the last two columns here
|
||||
if "$HAS_HOST"; then
|
||||
mx="$(host -t MX "$1" 2>/dev/null | awk '/is handled by/ { print $(NF-1), $NF }')"
|
||||
@@ -21523,7 +21523,7 @@ get_txt_record() {
|
||||
local noidnout=""
|
||||
|
||||
"$HAS_DIG_NOIDNOUT" && noidnout="+noidnout"
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
# we need the last two columns here and strip any remaining double quotes later
|
||||
if "$HAS_HOST"; then
|
||||
record="$(host -t TXT "$1" 2>/dev/null | awk -F\" '/descriptive text/ { print $(NF-1) }')"
|
||||
@@ -21624,7 +21624,7 @@ determine_rdns() {
|
||||
[[ "$NODNS" == none ]] && rDNS="(instructed to skip DNS queries)" && return 0 # No DNS lookups at all
|
||||
[[ "$NODNS" == min ]] && rDNS="(instructed to minimize DNS queries)" && return 0 # PTR records were not asked for
|
||||
local nodeip="$(tr -d '[]' <<< $NODEIP)" # for DNS we do not need the square brackets of IPv6 addresses
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
if [[ "$NODE" == *.local ]]; then
|
||||
if "$HAS_AVAHIRESOLVE"; then
|
||||
rDNS=$(avahi-resolve -a $nodeip 2>/dev/null | awk '{ print $2 }')
|
||||
@@ -21641,7 +21641,7 @@ determine_rdns() {
|
||||
elif "$HAS_NSLOOKUP"; then
|
||||
rDNS=$(strip_lf "$(nslookup -type=PTR $nodeip 2>/dev/null | grep -v 'canonical name =' | grep 'name = ' | awk '{ print $NF }' | sed 's/\.$//')")
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
# First, rDNS can contain multilines due to multiple PTR DNS records, though this is not recommended.
|
||||
# So we use a loop to check for each FQDN returned. There we remove chars which under weird
|
||||
# circumstances (see #1506) can show up here. The blacklist is taken from RFC 1912 ("Allowable characters in a
|
||||
@@ -22037,7 +22037,7 @@ determine_optimal_proto() {
|
||||
|
||||
>$ERRFILE
|
||||
if [[ -n "$1" ]]; then
|
||||
# STARTTLS workaround needed see https://github.com/drwetter/testssl.sh/issues/188 -- kind of odd
|
||||
# STARTTLS workaround needed see https://github.com/testssl/testssl.sh/issues/188 -- kind of odd
|
||||
for STARTTLS_OPTIMAL_PROTO in -tls1_2 -tls1 -ssl3 -tls1_1 -tls1_3 -ssl2; do
|
||||
sclient_supported "$STARTTLS_OPTIMAL_PROTO" || continue
|
||||
$OPENSSL s_client $(s_client_options "$STARTTLS_OPTIMAL_PROTO $BUGS -connect "$NODEIP:$PORT" $PROXY -msg $STARTTLS $SNI") </dev/null >$TMPFILE 2>>$ERRFILE
|
||||
|
||||
Reference in New Issue
Block a user