mirror of
https://github.com/drwetter/testssl.sh.git
synced 2024-12-29 04:49:44 +01:00
Phrase --version & friends as standalone
This PR fixes #1671. Primarily there's now an additional case statement in the main while loop which just calls fatal() when it detects --help -b --banner -v or --version. The documentation was also updated to reflect that. (Some grammar and other errors which I stumbled over were corrected too)
This commit is contained in:
Dirk Wetter
parent
a2929211b2
commit
953e1bd0ff
@ -75,8 +75,8 @@ Options are either short or long options\. Any long or short option requiring a
|
||||
.P
|
||||
\fB<URI>\fR or \fB\-\-file <FILE>\fR always needs to be the last parameter\.
|
||||
.
|
||||
.SS "BANNER OPTIONS"
|
||||
\fB\-\-help\fR (or no arg) display command line help
|
||||
.SS "BANNER OPTIONS (standalone)"
|
||||
\fB\-\-help\fR (or no arg) displays command line help
|
||||
.
|
||||
.P
|
||||
\fB\-b, \-\-banner\fR displays testssl\.sh banner, including license, usage conditions, version of testssl\.sh, detected openssl version, its path to it, # of ciphers of openssl, its build date and the architecture\.
|
||||
@ -85,7 +85,7 @@ Options are either short or long options\. Any long or short option requiring a
|
||||
\fB\-v, \-\-version\fR same as before
|
||||
.
|
||||
.P
|
||||
\fB\-V [pattern] , \-\-local [pattern]\fR pretty print all local ciphers supported by openssl version\. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below\. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits\. It does a word pattern match for non\-numbers, for number just a normal match applies\. Numbers here are defined as [0\-9,A\-F]\. This means (attention: catch) that the pattern CBC is matched as non\-word, but AES as word\.
|
||||
\fB\-V [pattern], \-\-local [pattern]\fR pretty print all local ciphers supported by openssl version\. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below\. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits\. It does a word pattern match for non\-numbers, for number just a normal match applies\. Numbers here are defined as [0\-9,A\-F]\. This means (attention: catch) that the pattern CBC is matched as non\-word, but AES as word\. This option also accepts -\fB-openssl=<path_to_openssl>\fR\.
|
||||
.
|
||||
.SS "INPUT PARAMETERS"
|
||||
\fBURI\fR can be a hostname, an IPv4 or IPv6 address (restriction see below) or an URL\. IPv6 addresses need to be in square brackets\. For any given parameter port 443 is assumed unless specified by appending a colon and a port number\. The only preceding protocol specifier allowed is \fBhttps\fR\. You need to be aware that checks for an IP address might not hit the vhost you want\. DNS resolution (A/AAAA record) is being performed unless you have an \fB/etc/hosts\fR entry for the hostname\.
|
||||
|
||||
@ -143,15 +143,15 @@ linked OpenSSL binaries for major operating systems are supplied in <code>./bin/
|
||||
|
||||
<p><code><URI></code> or <code>--file <FILE></code> always needs to be the last parameter.</p>
|
||||
|
||||
<h3 id="BANNER-OPTIONS">BANNER OPTIONS</h3>
|
||||
<h3 id="BANNER-OPTIONS">BANNER OPTIONS (standalone)</h3>
|
||||
|
||||
<p><code>--help</code> (or no arg) display command line help</p>
|
||||
<p><code>--help</code> (or no arg) displays command line help</p>
|
||||
|
||||
<p><code>-b, --banner</code> displays testssl.sh banner, including license, usage conditions, version of testssl.sh, detected openssl version, its path to it, # of ciphers of openssl, its build date and the architecture.</p>
|
||||
|
||||
<p><code>-v, --version</code> same as before</p>
|
||||
|
||||
<p><code>-V [pattern] , --local [pattern]</code> pretty print all local ciphers supported by openssl version. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits. It does a word pattern match for non-numbers, for number just a normal match applies. Numbers here are defined as [0-9,A-F]. This means (attention: catch) that the pattern CBC is matched as non-word, but AES as word.</p>
|
||||
<p><code>-V [pattern], --local [pattern]</code> pretty print all local ciphers supported by openssl version. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits. It does a word pattern match for non-numbers, for number just a normal match applies. Numbers here are defined as [0-9,A-F]. This means (attention: catch) that the pattern CBC is matched as non-word, but AES as word. This option also accepts <code>--openssl=<path_to_openssl></code>.</p>
|
||||
|
||||
<h3 id="INPUT-PARAMETERS">INPUT PARAMETERS</h3>
|
||||
|
||||
@ -189,7 +189,7 @@ The same can be achieved by setting the environment variable <code>WARNINGS</cod
|
||||
|
||||
<h3 id="SPECIAL-INVOCATIONS">SPECIAL INVOCATIONS</h3>
|
||||
|
||||
<p><code>-t <protocol>, --starttls <protocol></code> does a default run against a STARTTLS enabled <code>protocol</code>. <code>protocol</code> must be one of <code>ftp</code>, <code>smtp</code>, <code>pop3</code>, <code>imap</code>, <code>xmpp</code>,<code>xmpp-server<code>, <code>telnet</code>, <code>ldap</code>, <code>irc</code>, <code>lmtp</code>, <code>nntp</code>, <code>postgres</code>, <code>mysql</code>. For the latter four you need e.g. the supplied OpenSSL or OpenSSL version 1.1.1. Please note: MongoDB doesn't offer a STARTTLS connection, LDAP currently only works with <code>--ssl-native</code>. <code>telnet</code> and <code>irc</code> is WIP.</p>
|
||||
<p><code>-t <protocol>, --starttls <protocol></code> does a default run against a STARTTLS enabled <code>protocol</code>. <code>protocol</code> must be one of <code>ftp</code>, <code>smtp</code>, <code>pop3</code>, <code>imap</code>, <code>xmpp</code>, <code>xmpp-server</code>, <code>telnet</code>, <code>ldap</code>, <code>irc</code>, <code>lmtp</code>, <code>nntp</code>, <code>postgres</code>, <code>mysql</code>. For the latter four you need e.g. the supplied OpenSSL or OpenSSL version 1.1.1. Please note: MongoDB doesn't offer a STARTTLS connection, LDAP currently only works with <code>--ssl-native</code>. <code>telnet</code> and <code>irc</code> is WIP.</p>
|
||||
|
||||
<p><code>--xmpphost <jabber_domain></code> is an additional option for STARTTLS enabled XMPP: It expects the jabber domain as a parameter. This is only needed if the domain is different from the URI supplied.</p>
|
||||
|
||||
@ -199,7 +199,7 @@ The same can be achieved by setting the environment variable <code>WARNINGS</cod
|
||||
|
||||
<p><code>--proxy <host>:<port></code> does ANY check via the specified proxy. <code>--proxy=auto</code> inherits the proxy setting from the environment. The hostname supplied will be resolved to the first A record. In addition if you want lookups via proxy you can specify <code>DNS_VIA_PROXY=true</code>. OCSP revocation checking (<code>-S --phone-out</code>) is not supported by OpenSSL via proxy. As supplying a proxy is an indicator for port 80 and 443 outgoing being blocked in your network an OCSP revocation check won't be performed. However if <code>IGN_OCSP_PROXY=true</code> has been supplied it will be tried directly. Authentication to the proxy is not supported. Proxying via IPv6 addresses is not possible, no HTTPS or SOCKS proxy is supported.</p>
|
||||
|
||||
<p><code>-6</code> does (also) IPv6 checks. Please note that testssl.sh doesn't perform checks on an IPv6 address automatically, because of two reasons: testssl.sh does no connectivity checks for IPv6 and it cannot determine reliably whether the OpenSSL binary you're using has IPv6 s_client support. <code>-6</code> assumes both is the case. If both conditions are met and you in general prefer to test for IPv6 branches as well you can add <code>HAS_IPv6</code> to your shell environment. Besides the OpenSSL binary supplied IPv6 is known to work with vanilla OpenSSL >= 1.1.0 and older versions >=1.0.2 in RHEL/CentOS/FC and Gentoo.</p>
|
||||
<p><code>-6</code> does (also) IPv6 checks. Please note that testssl.sh doesn't perform checks on an IPv6 address automatically, because of two reasons: testssl.sh does no connectivity checks for IPv6 and it cannot determine reliably whether the OpenSSL binary you're using has IPv6 s_client support. <code>-6</code> assumes both is the case. If both conditions are met and you in general prefer to test for IPv6 branches as well you can add <code>HAS_IPv6</code> to your shell environment. Besides the OpenSSL binary supplied IPv6 is known to work with vanilla OpenSSL ≥ 1.1.0 and older versions ≥1.0.2 in RHEL/CentOS/FC and Gentoo.</p>
|
||||
|
||||
<p><code>--ssl-native</code> Instead of using a mixture of bash sockets and a few openssl s_client connects, testssl.sh uses the latter (almost) only. This is faster at the moment but provides less accurate results, especially for the client simulation and for cipher support. For all checks you will see a warning if testssl.sh cannot tell if a particular check cannot be performed. For some checks however you might end up getting false negatives without a warning. This option is only recommended if you prefer speed over accuracy or you know that your target has sufficient overlap with the protocols and cipher provided by your openssl binary.</p>
|
||||
|
||||
@ -667,9 +667,7 @@ from. That helps us to get bugfixes, other feedback and more contributions.
|
||||
|
||||
<ol class='man-decor man-foot man foot'>
|
||||
<li class='tl'></li>
|
||||
<li class='tc'>May 2020</li>
|
||||
<li class='tr'>testssl(1)</li>
|
||||
</ol>
|
||||
<li class='tc'>August 2020</li> <li class='tr'>testssl(1)</li> </ol>
|
||||
|
||||
</div>
|
||||
</body>
|
||||
|
||||
@ -66,15 +66,15 @@ Options are either short or long options. Any long or short option requiring a v
|
||||
|
||||
`<URI>` or `--file <FILE>` always needs to be the last parameter.
|
||||
|
||||
### BANNER OPTIONS
|
||||
### BANNER OPTIONS (standalone)
|
||||
|
||||
`--help` (or no arg) display command line help
|
||||
`--help` (or no arg) displays command line help
|
||||
|
||||
`-b, --banner` displays testssl.sh banner, including license, usage conditions, version of testssl.sh, detected openssl version, its path to it, # of ciphers of openssl, its build date and the architecture.
|
||||
|
||||
`-v, --version` same as before
|
||||
|
||||
`-V [pattern] , --local [pattern]` pretty print all local ciphers supported by openssl version. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits. It does a word pattern match for non-numbers, for number just a normal match applies. Numbers here are defined as [0-9,A-F]. This means (attention: catch) that the pattern CBC is matched as non-word, but AES as word.
|
||||
`-V [pattern], --local [pattern]` pretty print all local ciphers supported by openssl version. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits. It does a word pattern match for non-numbers, for number just a normal match applies. Numbers here are defined as [0-9,A-F]. This means (attention: catch) that the pattern CBC is matched as non-word, but AES as word. This option also accepts `--openssl=<path_to_openssl>`.
|
||||
|
||||
### INPUT PARAMETERS
|
||||
|
||||
|
||||
24
testssl.sh
24
testssl.sh
@ -18808,26 +18808,23 @@ help() {
|
||||
|
||||
"$PROG_NAME [options] <URI>" or "$PROG_NAME <options>"
|
||||
|
||||
|
||||
"$PROG_NAME <options>", where <options> is:
|
||||
"$PROG_NAME <option>", where <option> is mostly standalone and one of:
|
||||
|
||||
--help what you're looking at
|
||||
-b, --banner displays banner + version of $PROG_NAME
|
||||
-v, --version same as previous
|
||||
-V, --local pretty print all local ciphers
|
||||
-V, --local <pattern> which local ciphers with <pattern> are available? If pattern is not a number: word match
|
||||
-V, --local [pattern] pretty print all local ciphers (of openssl only). If search pattern supplied: it is an
|
||||
an ignore case word pattern of cipher hexcode or any other string in its name, kx or bits
|
||||
|
||||
<pattern> is always an ignore case word pattern of cipher hexcode or any other string in the name, kx or bits
|
||||
"$PROG_NAME [options] <URI>", where <URI> is:
|
||||
|
||||
"$PROG_NAME <URI>", where <URI> is:
|
||||
<URI> host|host:port|URL|URL:port port 443 is default, URL can only contain HTTPS as a protocol
|
||||
|
||||
<URI> host|host:port|URL|URL:port port 443 is default, URL can only contain HTTPS protocol)
|
||||
and [options] is/are:
|
||||
|
||||
"$PROG_NAME [options] <URI>", where [options] is:
|
||||
|
||||
-t, --starttls <protocol> Does a default run against a STARTTLS enabled <protocol,
|
||||
protocol is <ftp|smtp|lmtp|pop3|imap|xmpp|xmpp-server|telnet|ldap|nntp|postgres|mysql>
|
||||
--xmpphost <to_domain> For STARTTLS enabled XMPP it supplies the XML stream to-'' domain -- sometimes needed
|
||||
-t, --starttls <protocol> Does a run against a STARTTLS enabled service which is one of ftp, smtp, lmtp, pop3, imap,
|
||||
xmpp, xmpp-server, telnet, ldap, nntp, postgres, mysql
|
||||
--xmpphost <to_domain> For STARTTLS xmpp or xmpp-server checks it supplies the domainname (like SNI)
|
||||
--mx <domain/host> Tests MX records from high to low priority (STARTTLS, port 25)
|
||||
--file/-iL <fname> Mass testing option: Reads one testssl.sh command line per line from <fname>.
|
||||
Can be combined with --serial or --parallel. Implicitly turns on "--warnings batch".
|
||||
@ -21345,6 +21342,9 @@ parse_cmd_line() {
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case $1 in
|
||||
--help|-b|--banner|-v|--version)
|
||||
fatal "$1 is a standalone command line option"
|
||||
;;
|
||||
--mx)
|
||||
do_mx_all_ips=true
|
||||
PORT=25
|
||||
|
||||
Loading…
Reference in New Issue
Block a user