mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-01-01 06:19:44 +01:00
Merge pull request #2067 from drwetter/polish_fixhttpclockskew
Consider HTTP 'Age' header field when calculating HTTP clock skew
This commit is contained in:
Dirk Wetter
GitHub
commit
6da72bcfd7
@ -50,6 +50,10 @@ $master_socket_csv=~ s/HTTP_clock_skew.*\n//g;
|
||||
$socket_csv=~ s/censys.io.*\n//g;
|
||||
$master_socket_csv=~ s/censys.io.*\n//g;
|
||||
|
||||
# HTTP time
|
||||
$socket_csv=~ s/HTTP_headerTime.*\n//g;
|
||||
$master_socket_csv=~ s/HTTP_headerTime.*\n//g;
|
||||
|
||||
|
||||
# Compare the differences to the master file -- and print differences if there were detected.
|
||||
#
|
||||
|
||||
@ -66,6 +66,7 @@
|
||||
"DH_groups","testssl.sh/81.169.166.184","443","OK","Unknown DH group (2048 bits)","",""
|
||||
"HTTP_status_code","testssl.sh/81.169.166.184","443","INFO","200 OK ('/')","",""
|
||||
"HTTP_clock_skew","testssl.sh/81.169.166.184","443","INFO","0 seconds from localtime","",""
|
||||
"HTTP_headerTime","testssl.sh/81.169.166.184","443","INFO","1639146981","",""
|
||||
"HSTS_time","testssl.sh/81.169.166.184","443","OK","362 days (=31337000 seconds) > 15552000 seconds","",""
|
||||
"HSTS_subdomains","testssl.sh/81.169.166.184","443","INFO","only for this domain","",""
|
||||
"HSTS_preload","testssl.sh/81.169.166.184","443","INFO","domain is NOT marked for preloading","",""
|
||||
@ -90,7 +91,7 @@
|
||||
"SWEET32","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","testssl.sh/81.169.166.184","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","testssl.sh/81.169.166.184","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://censys.io/ipv4?q=91A9378E08487C723EF5E880C5088AA32D17F339C1C953675F4419CAF0436E37","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","testssl.sh/81.169.166.184","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://censys.io/ipv4?q=317383D12511E625564E8C850DD7494CAC6903ECAD7394055A5D3FB5E6EFB402","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","testssl.sh/81.169.166.184","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","testssl.sh/81.169.166.184","443","OK","--","CVE-2015-4000","CWE-310"
|
||||
"BEAST_CBC_TLS1","testssl.sh/81.169.166.184","443","MEDIUM","ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA AES256-SHA","CVE-2011-3389","CWE-20"
|
||||
|
||||
25
testssl.sh
25
testssl.sh
@ -394,6 +394,7 @@ TLS_NOW="" # Similar
|
||||
TLS_DIFFTIME_SET=false # Tells TLS functions to measure the TLS difftime or not
|
||||
NOW_TIME=""
|
||||
HTTP_TIME=""
|
||||
HTTP_AGE="" # Age Header, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Age + RFC 7234
|
||||
REQHEADERS=()
|
||||
GET_REQ11=""
|
||||
START_TIME=0 # time in epoch when the action started
|
||||
@ -403,7 +404,7 @@ LAST_TIME=0 # only used for performance measurements
|
||||
SERVER_COUNTER=0 # Counter for multiple servers
|
||||
|
||||
TLS_LOW_BYTE="" # For "secret" development stuff, see -q below
|
||||
HEX_CIPHER="" # "
|
||||
HEX_CIPHER="" # -- " --
|
||||
|
||||
GRADE_CAP="" # Keeps track of the current grading cap
|
||||
GRADE_CAP_REASONS=() # Keeps track of all the reasons why grades are capped
|
||||
@ -2369,6 +2370,7 @@ run_http_header() {
|
||||
tm_out "$GET_REQ11" | $OPENSSL s_client $(s_client_options "$OPTIMAL_PROTO $BUGS -quiet -ign_eof -connect $NODEIP:$PORT $PROXY $SNI") >$HEADERFILE 2>$ERRFILE
|
||||
NOW_TIME=$(date "+%s")
|
||||
HTTP_TIME=$(awk -F': ' '/^date:/ { print $2 } /^Date:/ { print $2 }' $HEADERFILE)
|
||||
HTTP_AGE=$(awk -F': ' '/^[aA][gG][eE]: / { print $2 }' $HEADERFILE)
|
||||
HAD_SLEPT=0
|
||||
else
|
||||
# 1st GET request hung and needed to be killed. Check whether it succeeded anyway:
|
||||
@ -2376,6 +2378,7 @@ run_http_header() {
|
||||
# correct by seconds we slept, HAD_SLEPT comes from wait_kill()
|
||||
NOW_TIME=$(($(date "+%s") - HAD_SLEPT))
|
||||
HTTP_TIME=$(awk -F': ' '/^date:/ { print $2 } /^Date:/ { print $2 }' $HEADERFILE)
|
||||
HTTP_AGE=$(awk -F': ' '/^[aA][gG][eE]: / { print $2 }' $HEADERFILE)
|
||||
else
|
||||
prln_warning " likely HTTP header requests failed (#lines: $(wc -l $HEADERFILE | awk '{ print $1 }'))"
|
||||
[[ "$DEBUG" -lt 1 ]] && outln "Rerun with DEBUG>=1 and inspect $HEADERFILE\n"
|
||||
@ -2407,7 +2410,9 @@ run_http_header() {
|
||||
fi
|
||||
|
||||
# Populate vars for HTTP time
|
||||
debugme echo "NOW_TIME: $NOW_TIME | HTTP_TIME: $HTTP_TIME"
|
||||
[[ -n "$HTTP_AGE" ]] && HTTP_AGE="$(strip_lf "$HTTP_AGE")"
|
||||
[[ -n "$HTTP_TIME" ]] && HTTP_TIME="$(strip_lf "$HTTP_TIME")"
|
||||
debugme echo "NOW_TIME: $NOW_TIME | HTTP_AGE: $HTTP_AGE | HTTP_TIME: $HTTP_TIME"
|
||||
|
||||
# Quit on first empty line to catch 98% of the cases. Next pattern is there because the SEDs tested
|
||||
# so far seem not to be fine with header containing x0d x0a (CRLF) which is the usual case.
|
||||
@ -2522,26 +2527,36 @@ run_http_date() {
|
||||
fi
|
||||
pr_bold " HTTP clock skew "
|
||||
if [[ -n "$HTTP_TIME" ]]; then
|
||||
HTTP_TIME="$(strip_lf "$HTTP_TIME")"
|
||||
if "$HAS_OPENBSDDATE"; then
|
||||
# We won't normalize the date under an OpenBSD thus no subtraction is feasible
|
||||
outln "remote: $HTTP_TIME"
|
||||
out "${spaces}local: $(LC_ALL=C TZ=GMT date "+%a, %d %b %Y %T %Z")"
|
||||
fileout "$jsonID" "INFO" "$HTTP_TIME - $(TZ=GMT date "+%a, %d %b %Y %T %Z")"
|
||||
else
|
||||
# modifying the global from string to a number
|
||||
HTTP_TIME="$(parse_date "$HTTP_TIME" "+%s" "%a, %d %b %Y %T %Z" 2>>$ERRFILE)"
|
||||
difftime=$((HTTP_TIME - NOW_TIME))
|
||||
difftime=$((HTTP_TIME + HTTP_AGE - NOW_TIME))
|
||||
[[ $difftime != "-"* ]] && [[ $difftime != "0" ]] && difftime="+$difftime"
|
||||
# process was killed, so we need to add an error
|
||||
[[ $HAD_SLEPT -ne 0 ]] && difftime="$difftime (± 1.5)"
|
||||
out "$difftime sec from localtime";
|
||||
fileout "$jsonID" "INFO" "$difftime seconds from localtime"
|
||||
fi
|
||||
if [[ -n "$HTTP_TIME" ]]; then
|
||||
# out " (HTTP header time: $HTTP_TIME)"
|
||||
fileout "HTTP_headerTime" "INFO" "$HTTP_TIME"
|
||||
fi
|
||||
if [[ -n "$HTTP_AGE" ]]; then
|
||||
outln
|
||||
pr_bold " HTTP Age"
|
||||
out " (RFC 7234) $HTTP_AGE"
|
||||
fileout "HTTP_headerAge" "INFO" "$HTTP_AGE seconds"
|
||||
fi
|
||||
else
|
||||
out "Got no HTTP time, maybe try different URL?";
|
||||
fileout "$jsonID" "INFO" "Got no HTTP time, maybe try different URL?"
|
||||
fi
|
||||
debugme tm_out ", HTTP_TIME in epoch: $HTTP_TIME"
|
||||
debugme tm_out ", HTTP_TIME + HTTP_AGE in epoch: $HTTP_TIME / $HTTP_AGE"
|
||||
outln
|
||||
match_ipv4_httpheader "$1"
|
||||
return 0
|
||||
|
||||
Loading…
Reference in New Issue
Block a user