From 953e1bd0ff89dda8b3d2a296a06673a8eb91cd2a Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Thu, 13 Aug 2020 18:11:24 +0200 Subject: [PATCH] Phrase --version & friends as standalone This PR fixes #1671. Primarily there's now an additional case statement in the main while loop which just calls fatal() when it detects --help -b --banner -v or --version. The documentation was also updated to reflect that. (Some grammar and other errors which I stumbled over were corrected too) --- doc/testssl.1 | 6 +++--- doc/testssl.1.html | 14 ++++++-------- doc/testssl.1.md | 6 +++--- testssl.sh | 24 ++++++++++++------------ 4 files changed, 24 insertions(+), 26 deletions(-) diff --git a/doc/testssl.1 b/doc/testssl.1 index 3d1bd53..2f4fea5 100644 --- a/doc/testssl.1 +++ b/doc/testssl.1 @@ -75,8 +75,8 @@ Options are either short or long options\. Any long or short option requiring a .P \fB\fR or \fB\-\-file \fR always needs to be the last parameter\. . -.SS "BANNER OPTIONS" -\fB\-\-help\fR (or no arg) display command line help +.SS "BANNER OPTIONS (standalone)" +\fB\-\-help\fR (or no arg) displays command line help . .P \fB\-b, \-\-banner\fR displays testssl\.sh banner, including license, usage conditions, version of testssl\.sh, detected openssl version, its path to it, # of ciphers of openssl, its build date and the architecture\. @@ -85,7 +85,7 @@ Options are either short or long options\. Any long or short option requiring a \fB\-v, \-\-version\fR same as before . .P -\fB\-V [pattern] , \-\-local [pattern]\fR pretty print all local ciphers supported by openssl version\. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below\. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits\. It does a word pattern match for non\-numbers, for number just a normal match applies\. Numbers here are defined as [0\-9,A\-F]\. This means (attention: catch) that the pattern CBC is matched as non\-word, but AES as word\. +\fB\-V [pattern], \-\-local [pattern]\fR pretty print all local ciphers supported by openssl version\. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below\. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits\. It does a word pattern match for non\-numbers, for number just a normal match applies\. Numbers here are defined as [0\-9,A\-F]\. This means (attention: catch) that the pattern CBC is matched as non\-word, but AES as word\. This option also accepts -\fB-openssl=\fR\. . .SS "INPUT PARAMETERS" \fBURI\fR can be a hostname, an IPv4 or IPv6 address (restriction see below) or an URL\. IPv6 addresses need to be in square brackets\. For any given parameter port 443 is assumed unless specified by appending a colon and a port number\. The only preceding protocol specifier allowed is \fBhttps\fR\. You need to be aware that checks for an IP address might not hit the vhost you want\. DNS resolution (A/AAAA record) is being performed unless you have an \fB/etc/hosts\fR entry for the hostname\. diff --git a/doc/testssl.1.html b/doc/testssl.1.html index c5e9de3..e3d78d7 100644 --- a/doc/testssl.1.html +++ b/doc/testssl.1.html @@ -143,15 +143,15 @@ linked OpenSSL binaries for major operating systems are supplied in ./bin/

<URI> or --file <FILE> always needs to be the last parameter.

- + -

--help (or no arg) display command line help

+

--help (or no arg) displays command line help

-b, --banner displays testssl.sh banner, including license, usage conditions, version of testssl.sh, detected openssl version, its path to it, # of ciphers of openssl, its build date and the architecture.

-v, --version same as before

-

-V [pattern] , --local [pattern] pretty print all local ciphers supported by openssl version. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits. It does a word pattern match for non-numbers, for number just a normal match applies. Numbers here are defined as [0-9,A-F]. This means (attention: catch) that the pattern CBC is matched as non-word, but AES as word.

+

-V [pattern], --local [pattern] pretty print all local ciphers supported by openssl version. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits. It does a word pattern match for non-numbers, for number just a normal match applies. Numbers here are defined as [0-9,A-F]. This means (attention: catch) that the pattern CBC is matched as non-word, but AES as word. This option also accepts --openssl=<path_to_openssl>.

INPUT PARAMETERS

@@ -189,7 +189,7 @@ The same can be achieved by setting the environment variable WARNINGSSPECIAL INVOCATIONS -

-t <protocol>, --starttls <protocol> does a default run against a STARTTLS enabled protocol. protocol must be one of ftp, smtp, pop3, imap, xmpp,xmpp-server, telnet, ldap, irc, lmtp, nntp, postgres, mysql. For the latter four you need e.g. the supplied OpenSSL or OpenSSL version 1.1.1. Please note: MongoDB doesn't offer a STARTTLS connection, LDAP currently only works with --ssl-native. telnet and irc is WIP.

+

-t <protocol>, --starttls <protocol> does a default run against a STARTTLS enabled protocol. protocol must be one of ftp, smtp, pop3, imap, xmpp, xmpp-server, telnet, ldap, irc, lmtp, nntp, postgres, mysql. For the latter four you need e.g. the supplied OpenSSL or OpenSSL version 1.1.1. Please note: MongoDB doesn't offer a STARTTLS connection, LDAP currently only works with --ssl-native. telnet and irc is WIP.

--xmpphost <jabber_domain> is an additional option for STARTTLS enabled XMPP: It expects the jabber domain as a parameter. This is only needed if the domain is different from the URI supplied.

@@ -199,7 +199,7 @@ The same can be achieved by setting the environment variable WARNINGS--proxy <host>:<port> does ANY check via the specified proxy. --proxy=auto inherits the proxy setting from the environment. The hostname supplied will be resolved to the first A record. In addition if you want lookups via proxy you can specify DNS_VIA_PROXY=true. OCSP revocation checking (-S --phone-out) is not supported by OpenSSL via proxy. As supplying a proxy is an indicator for port 80 and 443 outgoing being blocked in your network an OCSP revocation check won't be performed. However if IGN_OCSP_PROXY=true has been supplied it will be tried directly. Authentication to the proxy is not supported. Proxying via IPv6 addresses is not possible, no HTTPS or SOCKS proxy is supported.

-

-6 does (also) IPv6 checks. Please note that testssl.sh doesn't perform checks on an IPv6 address automatically, because of two reasons: testssl.sh does no connectivity checks for IPv6 and it cannot determine reliably whether the OpenSSL binary you're using has IPv6 s_client support. -6 assumes both is the case. If both conditions are met and you in general prefer to test for IPv6 branches as well you can add HAS_IPv6 to your shell environment. Besides the OpenSSL binary supplied IPv6 is known to work with vanilla OpenSSL >= 1.1.0 and older versions >=1.0.2 in RHEL/CentOS/FC and Gentoo.

+

-6 does (also) IPv6 checks. Please note that testssl.sh doesn't perform checks on an IPv6 address automatically, because of two reasons: testssl.sh does no connectivity checks for IPv6 and it cannot determine reliably whether the OpenSSL binary you're using has IPv6 s_client support. -6 assumes both is the case. If both conditions are met and you in general prefer to test for IPv6 branches as well you can add HAS_IPv6 to your shell environment. Besides the OpenSSL binary supplied IPv6 is known to work with vanilla OpenSSL ≥ 1.1.0 and older versions ≥1.0.2 in RHEL/CentOS/FC and Gentoo.

--ssl-native Instead of using a mixture of bash sockets and a few openssl s_client connects, testssl.sh uses the latter (almost) only. This is faster at the moment but provides less accurate results, especially for the client simulation and for cipher support. For all checks you will see a warning if testssl.sh cannot tell if a particular check cannot be performed. For some checks however you might end up getting false negatives without a warning. This option is only recommended if you prefer speed over accuracy or you know that your target has sufficient overlap with the protocols and cipher provided by your openssl binary.

@@ -667,9 +667,7 @@ from. That helps us to get bugfixes, other feedback and more contributions.
  1. -
  2. May 2020
    3. -
  3. testssl(1)
    4. -
+
  • August 2020
  • testssl(1)
    • diff --git a/doc/testssl.1.md b/doc/testssl.1.md index 30e07aa..42f8c7e 100644 --- a/doc/testssl.1.md +++ b/doc/testssl.1.md @@ -66,15 +66,15 @@ Options are either short or long options. Any long or short option requiring a v `` or `--file ` always needs to be the last parameter. -### BANNER OPTIONS +### BANNER OPTIONS (standalone) -`--help` (or no arg) display command line help +`--help` (or no arg) displays command line help `-b, --banner` displays testssl.sh banner, including license, usage conditions, version of testssl.sh, detected openssl version, its path to it, # of ciphers of openssl, its build date and the architecture. `-v, --version` same as before -`-V [pattern] , --local [pattern]` pretty print all local ciphers supported by openssl version. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits. It does a word pattern match for non-numbers, for number just a normal match applies. Numbers here are defined as [0-9,A-F]. This means (attention: catch) that the pattern CBC is matched as non-word, but AES as word. +`-V [pattern], --local [pattern]` pretty print all local ciphers supported by openssl version. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits. It does a word pattern match for non-numbers, for number just a normal match applies. Numbers here are defined as [0-9,A-F]. This means (attention: catch) that the pattern CBC is matched as non-word, but AES as word. This option also accepts `--openssl=`. ### INPUT PARAMETERS diff --git a/testssl.sh b/testssl.sh index c365cd9..ed93ca8 100755 --- a/testssl.sh +++ b/testssl.sh @@ -18808,26 +18808,23 @@ help() { "$PROG_NAME [options] " or "$PROG_NAME " - -"$PROG_NAME ", where is: +"$PROG_NAME