From 8b1b9f9f27897e23e637e20721704c5b40e20ea9 Mon Sep 17 00:00:00 2001 From: Dirk Date: Tue, 14 Apr 2020 13:18:52 +0200 Subject: [PATCH] Preparing bugfix release for 3.0 * Bump version * Removed ancient CVS tag detection code * ~ backported code doc changes (http --> https and more) from @multiflexi see 7eba0fbb41393abc475a900cfb56d24a851d8a69 --- testssl.sh | 84 ++++++++++++++++++++++++++---------------------------- 1 file changed, 40 insertions(+), 44 deletions(-) diff --git a/testssl.sh b/testssl.sh index abc45a9..39c7a60 100755 --- a/testssl.sh +++ b/testssl.sh @@ -13,7 +13,7 @@ # Project lead and initiator: Dirk Wetter, copyleft: 2007-today, contributions so far see CREDITS.md # Main contributions from David Cooper # -# License: GPLv2, see http://www.fsf.org/licensing/licenses/info/GPLv2.html +# License: GPLv2, see https://www.fsf.org/licensing/licenses/info/GPLv2.html # and accompanying license "LICENSE.txt". Redistribution + modification under this # license permitted. # If you enclose this script or parts of it in your software, it has to @@ -92,7 +92,7 @@ declare -r ALLOK=0 # All is fine ########### Debugging helpers + profiling # declare -r PS4='|${LINENO}> \011${FUNCNAME[0]:+${FUNCNAME[0]}(): }' -DEBUGTIME=${DEBUGTIME:-false} # stackoverflow.com/questions/5014823/how-to-profile-a-bash-shell-script-slow-startup#20855353, profiling bash +DEBUGTIME=${DEBUGTIME:-false} # https://stackoverflow.com/questions/5014823/how-to-profile-a-bash-shell-script-slow-startup#20855353, profiling bash DEBUG_ALLINONE=${DEBUG_ALLINONE:-false} # true: do debugging in one screen (old behavior for testssl.sh and bash3's default # false: needed for performance analysis or useful for just having an extra file DEBUG_ALLINONE=${SETX:-false} # SETX as a shortcut for old style debugging, overriding DEBUG_ALLINONE @@ -117,19 +117,15 @@ trap "child_error" USR1 ########### Internal definitions # -declare -r VERSION="3.0" +declare -r VERSION="3.0-1" declare -r SWCONTACT="dirk aet testssl dot sh" grep -E -q "dev|rc|beta" <<< "$VERSION" && \ SWURL="https://testssl.sh/dev/" || SWURL="https://testssl.sh/" -declare -r CVS_REL="$(tail -5 "$0" | awk '/dirkw Exp/ { print $4" "$5" "$6}')" -declare -r CVS_REL_SHORT="$(tail -5 "$0" | awk '/dirkw Exp/ { print $4 }')" if git log &>/dev/null; then declare -r GIT_REL="$(git log --format='%h %ci' -1 2>/dev/null | awk '{ print $1" "$2" "$3 }')" declare -r GIT_REL_SHORT="$(git log --format='%h %ci' -1 2>/dev/null | awk '{ print $1 }')" declare -r REL_DATE="$(git log --format='%h %ci' -1 2>/dev/null | awk '{ print $2 }')" -else - declare -r REL_DATE="$(tail -5 "$0" | awk '/dirkw Exp/ { print $5 }')" fi declare -r PROG_NAME="$(basename "$0")" declare -r RUN_DIR="$(dirname "$0")" @@ -148,7 +144,7 @@ HNAME="${HNAME%%.*}" declare CMDLINE CMDLINE_PARSED="" # This makes sure we don't let early fatal() write into files when files aren't created yet declare -r -a CMDLINE_ARRAY=("$@") # When performing mass testing, the child processes need to be sent the -declare -a MASS_TESTING_CMDLINE # command line in the form of an array (see #702 and http://mywiki.wooledge.org/BashFAQ/050). +declare -a MASS_TESTING_CMDLINE # command line in the form of an array (see #702 and https://mywiki.wooledge.org/BashFAQ/050). ########### Some predefinitions: date, sed (we always use test and NOT try to determine @@ -512,7 +508,7 @@ outln() { printf -- "%b" "$1\n"; html_out "$(html_reserved "$1")\n"; } #TODO: Still no shell injection safe but if just run it from the cmd line: that's fine -# Color print functions, see also http://www.tldp.org/HOWTO/Bash-Prompt-HOWTO/x329.html +# Color print functions, see also https://www.tldp.org/HOWTO/Bash-Prompt-HOWTO/x329.html tm_liteblue() { [[ "$COLOR" -ge 2 ]] && ( "$COLORBLIND" && tm_out "\033[0;32m$1" || tm_out "\033[0;34m$1" ) || tm_out "$1"; tm_off; } # not yet used pr_liteblue() { tm_liteblue "$1"; [[ "$COLOR" -ge 2 ]] && ( "$COLORBLIND" && html_out "$(html_reserved "$1")" || html_out "$(html_reserved "$1")" ) || html_out "$(html_reserved "$1")"; } tmln_liteblue() { tm_liteblue "$1"; tmln_out; } @@ -627,7 +623,7 @@ pr_reverse() { tm_reverse "$1"; [[ "$COLOR" -ne 0 ]] && html_out "$(html_reserved "$1")" || html_out "$(html_reserved "$1")"; } #pr_headline() { pr_blue "$1"; } -#http://misc.flogisoft.com/bash/tip_colors_and_formatting +# https://misc.flogisoft.com/bash/tip_colors_and_formatting #pr_headline() { [[ "$COLOR" -ge 2 ]] && out "\033[1;30m\033[47m$1" || out "$1"; tm_off; } tm_headline() { [[ "$COLOR" -ne 0 ]] && tm_out "\033[1m\033[4m$1" || tm_out "$1"; tm_off; } @@ -656,7 +652,7 @@ pr_url() { tm_out "$1"; html_out "$1"; } ### color switcher (see e.g. https://linuxtidbits.wordpress.com/2008/08/11/output-color-on-bash-scripts/ -### http://www.tldp.org/HOWTO/Bash-Prompt-HOWTO/x405.html +### https://www.tldp.org/HOWTO/Bash-Prompt-HOWTO/x405.html ### no output support for HTML! set_color_functions() { local ncurses_tput=true @@ -726,7 +722,7 @@ set_color_functions() { } strip_quote() { - # remove color codes (see http://www.commandlinefu.com/commands/view/3584/remove-color-codes-special-characters-with-sed) + # remove color codes (see https://www.commandlinefu.com/commands/view/3584/remove-color-codes-special-characters-with-sed) # \', leading and all trailing spaces sed -e "s,$(echo -e "\033")\[[0-9;]*[a-zA-Z],,g" \ -e "s/\"/\\'/g" \ @@ -2560,7 +2556,7 @@ run_hpkp() { $OPENSSL s_client $(s_client_options "$STARTTLS $BUGS $PROXY -showcerts -connect $NODEIP:$PORT $SNI") $TMPFILE 2>$ERRFILE # Place the server's certificate in $HOSTCERT and any intermediate # certificates that were provided in $TEMPDIR/intermediatecerts.pem - # http://backreference.org/2010/05/09/ocsp-verification-with-openssl/ + # https://backreference.org/2010/05/09/ocsp-verification-with-openssl/ awk -v n=-1 "/Certificate chain/ {start=1} /-----BEGIN CERTIFICATE-----/{ if (start) {inc=1; n++} } inc { print > (\"$TEMPDIR/level\" n \".crt\") } @@ -2706,7 +2702,7 @@ emphasize_stuff_in_headers(){ local html_yellow="" local html_off="<\\/span>" -# see http://www.grymoire.com/Unix/Sed.html#uh-3 +# see https://www.grymoire.com/Unix/Sed.html#uh-3 # outln "$1" | sed "s/[0-9]*/$brown&${off}/g" tmln_out "$1" | sed -e "s/\([0-9]\)/${brown}\1${off}/g" \ -e "s/Unix/${yellow}Unix${off}/g" \ @@ -6091,7 +6087,7 @@ read_dhbits_from_file() { else pr_dh_quality "$bits" "$bits $add" fi - # https://wiki.openssl.org/index.php/Elliptic_Curve_Cryptography, http://www.keylength.com/en/compare/ + # https://wiki.openssl.org/index.php/Elliptic_Curve_Cryptography, https://www.keylength.com/en/compare/ elif [[ $what_dh == ECDH ]]; then add="bit ECDH" [[ -n "$curve" ]] && add+=" ($curve)" @@ -7222,7 +7218,7 @@ extract_certificates() { # Place the server's certificate in $HOSTCERT and any intermediate # certificates that were provided in $TEMPDIR/intermediatecerts.pem savedir="$PWD"; cd $TEMPDIR - # http://backreference.org/2010/05/09/ocsp-verification-with-openssl/ + # https://backreference.org/2010/05/09/ocsp-verification-with-openssl/ if [[ "$version" == ssl2 ]]; then awk -v n=-1 '/Server certificate/ {start=1} /-----BEGIN CERTIFICATE-----/{ if (start) {inc=1; n++} } @@ -8263,10 +8259,10 @@ certificate_info() { let ret++ ;; esac out "$short_keyAlgo " - # https://tools.ietf.org/html/rfc4492, http://www.keylength.com/en/compare/ - # http://infoscience.epfl.ch/record/164526/files/NPDF-22.pdf - # see http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf - # Table 2 @ chapter 5.6.1 (~ p64) + # https://tools.ietf.org/html/rfc4492, https://www.keylength.com/en/compare/ + # https://infoscience.epfl.ch/record/164526/files/NPDF-22.pdf + # see https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-4/final + # Table 2 @ chapter 5.6.1 (~ p66) if [[ $cert_key_algo =~ ecdsa ]] || [[ $cert_key_algo =~ ecPublicKey ]]; then if [[ "$cert_keysize" -le 110 ]]; then # a guess pr_svrty_critical "$cert_keysize" @@ -8634,7 +8630,7 @@ certificate_info() { determine_trust "$jsonID" "$json_postfix" || ((ret++)) fi - # http://events.ccc.de/congress/2010/Fahrplan/attachments/1777_is-the-SSLiverse-a-safe-place.pdf, see page 40pp + # https://events.ccc.de/congress/2010/Fahrplan/attachments/1777_is-the-SSLiverse-a-safe-place.pdf, see page 40pp out "$indent"; pr_bold " EV cert"; out " (experimental) " jsonID="cert_certificatePolicies_EV" # only the first one, seldom we have two @@ -8657,7 +8653,7 @@ certificate_info() { outln #TODO: check browser OIDs: # https://mxr.mozilla.org/mozilla-central/source/security/certverifier/ExtendedValidation.cpp -# http://src.chromium.org/chrome/trunk/src/net/cert/ev_root_ca_metadata.cc +# https://chromium.googlesource.com/chromium/chromium/+/master/net/base/ev_root_ca_metadata.cc # https://certs.opera.com/03/ev-oids.xml # see #967 @@ -9902,7 +9898,7 @@ run_pfs() { # good source for configuration and bugs: https://wiki.mozilla.org/Security/Server_Side_TLS -# good start to read: http://en.wikipedia.org/wiki/Transport_Layer_Security#Attacks_against_TLS.2FSSL +# good start to read: https://en.wikipedia.org/wiki/Transport_Layer_Security#Attacks_against_TLS.2FSSL npn_pre(){ @@ -9966,7 +9962,7 @@ run_npn() { ((ret++)) fi fi - # btw: nmap can do that too http://nmap.org/nsedoc/scripts/tls-nextprotoneg.html + # btw: nmap can do that too https://nmap.org/nsedoc/scripts/tls-nextprotoneg.html # nmap --script=tls-nextprotoneg #NODE -p $PORT is your friend if your openssl doesn't want to test this tmpfile_handle ${FUNCNAME[0]}.txt return $ret @@ -10357,7 +10353,7 @@ fd_socket() { starttls_xmpp_dialog # IM observatory: https://xmpp.net , XMPP server directory: https://xmpp.net/directory.php ;; - postgres) # Postgres SQL, see http://www.postgresql.org/docs/devel/static/protocol-message-formats.html + postgres) # Postgres SQL, see https://www.postgresql.org/docs/devel/static/protocol-message-formats.html starttls_postgres_dialog ;; mysql) # MySQL, see https://dev.mysql.com/doc/internals/en/x-protocol-lifecycle-lifecycle.html#x-protocol-lifecycle-tls-extension @@ -10396,7 +10392,7 @@ code2network() { NW_STR=$(sed -e 's/,/\\\x/g' <<< "$1" | sed -e 's/# .*$//g' -e 's/ //g' -e '/^$/d' | tr -d '\n' | tr -d '\t') } -# sockets inspired by http://blog.chris007.de/?p=238 +# sockets inspired by https://blog.chris007.de/using-bash-for-network-socket-operation/ # ARG1: hexbytes separated by commas, with a leading comma # ARG2: seconds to sleep socksend_clienthello() { @@ -11684,7 +11680,7 @@ parse_tls_serverhello() { # Client messages, including handshake messages, are carried by the record layer. # First, extract the handshake and alert messages. - # see http://en.wikipedia.org/wiki/Transport_Layer_Security-SSL#TLS_record + # see https://en.wikipedia.org/wiki/Transport_Layer_Security-SSL#TLS_record # byte 0: content type: 0x14=CCS, 0x15=TLS alert x16=Handshake, 0x17 Application, 0x18=HB # byte 1+2: TLS version word, major is 03, minor 00=SSL3, 01=TLS1 02=TLS1.1 03=TLS 1.2 # byte 3+4: fragment length @@ -12654,7 +12650,7 @@ parse_tls_serverhello() { if [[ $curve_type -eq 3 ]]; then # named_curve - the curve is identified by a 2-byte number named_curve=$(hex2dec "${tls_serverkeyexchange_ascii:2:4}") - # http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 + # https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 case $named_curve in 1) dh_bits=163 ; named_curve_str="K-163" ;; 2) dh_bits=162 ; named_curve_str="sect163r1" ;; @@ -13311,7 +13307,7 @@ prepare_tls_clienthello() { [[ 0x$tls_legacy_version -ge 0x04 ]] && tls_legacy_version="03" if "$offer_compression"; then - # See http://www.iana.org/assignments/comp-meth-ids/comp-meth-ids.xhtml#comp-meth-ids-2 + # See https://www.iana.org/assignments/comp-meth-ids/comp-meth-ids.xhtml#comp-meth-ids-2 compression_methods="03,01,40,00" # Offer NULL, DEFLATE, and LZS compression else compression_methods="01,00" # Only offer NULL compression (0x00) @@ -13736,7 +13732,7 @@ tls_sockets() { ####### Vulnerabilities follow ####### # General overview which browser "supports" which vulnerability: -# http://en.wikipedia.org/wiki/Transport_Layer_Security-SSL#Web_browsers +# https://en.wikipedia.org/wiki/Transport_Layer_Security-SSL#Web_browsers # mainly adapted from https://gist.github.com/takeshixx/10107280 # @@ -14044,7 +14040,7 @@ sub_session_ticket_tls() { } -# see https://blog.filippo.io/finding-ticketbleed/ | http://ticketbleed.com/ +# see https://blog.filippo.io/finding-ticketbleed/ | https://ticketbleed.com/ run_ticketbleed() { local session_tckt_tls="" local -i len_ch=300 # fixed len of prepared clienthello below @@ -14305,7 +14301,7 @@ run_ticketbleed() { return $ret } -# Overview @ http://www.exploresecurity.com/wp-content/uploads/custom/SSL_manual_cheatsheet.html +# Overview @ https://www.exploresecurity.com/wp-content/uploads/custom/SSL_manual_cheatsheet.html # run_renego() { local legacycmd="" proto="$OPTIMAL_PROTO" @@ -14366,7 +14362,7 @@ run_renego() { jsonID="secure_client_renego" cve="CVE-2011-1473" # see: https://blog.qualys.com/ssllabs/2011/10/31/tls-renegotiation-and-denial-of-service-attacks - # http://blog.ivanristic.com/2009/12/testing-for-ssl-renegotiation.html -- head/get doesn't seem to be needed though + # https://blog.ivanristic.com/2009/12/testing-for-ssl-renegotiation.html -- head/get doesn't seem to be needed though # https://archive.fo/20130415224936/http://www.thc.org/thc-ssl-dos/ # https://vincent.bernat.ch/en/blog/2011-ssl-dos-mitigation case "$OSSL_VER" in @@ -15785,7 +15781,7 @@ run_beast(){ } -# http://www.isg.rhul.ac.uk/tls/Lucky13.html +# https://web.archive.org/web/20200324101422/http://www.isg.rhul.ac.uk/tls/Lucky13.html # in a nutshell: don't offer CBC suites (again). MAC as a fix for padding oracles is not enough. Best: TLS v1.2+ AES GCM run_lucky13() { local spaces=" " @@ -15865,7 +15861,7 @@ run_lucky13() { # https://tools.ietf.org/html/rfc7465 REQUIRES that TLS clients and servers NEVER negotiate the use of RC4 cipher suites! # https://en.wikipedia.org/wiki/Transport_Layer_Security#RC4_attacks -# http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html +# https://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html # run_rc4() { local -i rc4_offered=0 @@ -16122,8 +16118,8 @@ run_rc4() { run_youknowwho() { local cve="CVE-2013-2566" local cwe="CWE-310" - # NOT FIXME as there's no code: http://www.isg.rhul.ac.uk/tls/ - # http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html + # NOT FIXME as there's no code: https://web.archive.org/web/20191008002003/http://www.isg.rhul.ac.uk/tls/index.html + # https://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html return 0 # in a nutshell: don't use RC4, really not! } @@ -16883,7 +16879,7 @@ find_openssl_binary() { fatal "cannot exec or find any openssl binary" $ERR_OSSLBIN fi - # http://www.openssl.org/news/openssl-notes.html + # https://www.openssl.org/news/openssl-notes.html OSSL_NAME=$($OPENSSL version 2>/dev/null | awk '{ print $1 }') OSSL_VER=$($OPENSSL version 2>/dev/null | awk -F' ' '{ print $2 }') OSSL_VER_MAJOR="${OSSL_VER%%\.*}" @@ -17454,7 +17450,7 @@ mybanner() { bb1=$(cat <