mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-01-07 17:20:57 +01:00
Multiple IP scan fix (no --file) + single cipher scan works with multiple IPs
This PR addresses the problem (#1037) that if a hostname resolves to multiple IP addresses only the first one is being scanned as this IP isn't reachable and the scan terminated here and didn't continue with the 2nd, 3rd etc. Same applied to scans with --mx. This based on the global MULTIPLE_CHECKS which is set to true whenever such a scan is started. One minor point: Also if the last IP isn't reachable the output will say "proceeding with next:". I guess that should be clear looking at the (different outputs). This PR also fixes a scan problem with a single cipher/pattern (-x/--single-cipher): previously where only one IP was scanned. Furthermore some redundant quotes were removed.
This commit is contained in:
Dirk Wetter
parent
ef6deb037e
commit
966f414a2b
88
testssl.sh
88
testssl.sh
@ -277,6 +277,7 @@ HTMLHEADER=true # same for HTML
|
||||
SECTION_FOOTER_NEEDED=false # kludge for tracking whether we need to close the JSON section object
|
||||
GIVE_HINTS=false # give an additional info to findings
|
||||
SERVER_SIZE_LIMIT_BUG=false # Some servers have either a ClientHello total size limit or a 128 cipher limit (e.g. old ASAs)
|
||||
MULTIPLE_CHECKS=false # need to know whether an MX record or a hostname resolves to multiple IPs to check
|
||||
CHILD_MASS_TESTING=${CHILD_MASS_TESTING:-false}
|
||||
HAD_SLEPT=0
|
||||
NR_SOCKET_FAIL=0 # Counter for socket failures
|
||||
@ -3241,7 +3242,7 @@ neat_list(){
|
||||
|
||||
[[ "$DISPLAY_CIPHERNAMES" != openssl-only ]] && tls_cipher="$(show_rfc_style "$hexcode")"
|
||||
|
||||
if [[ "$5" != "true" ]]; then
|
||||
if [[ "$5" != true ]]; then
|
||||
if [[ "$DISPLAY_CIPHERNAMES" =~ rfc ]]; then
|
||||
line="$(printf -- " %-7s %-49s %-10s %-12s%-8s" "$hexcode" "$tls_cipher" "$kx" "$enc" "$strength")"
|
||||
[[ "$DISPLAY_CIPHERNAMES" != rfc-only ]] && line+="$(printf -- " %-33s${SHOW_EACH_C:+ %-0s}" "$ossl_cipher")"
|
||||
@ -3601,15 +3602,6 @@ run_cipher_match(){
|
||||
done
|
||||
"$using_sockets" && HAS_DH_BITS="$has_dh_bits"
|
||||
tmpfile_handle ${FUNCNAME[0]}.txt
|
||||
stopwatch run_cipher_match
|
||||
fileout_section_footer true
|
||||
outln
|
||||
calc_scantime
|
||||
datebanner " Done"
|
||||
|
||||
"$MEASURE_TIME" && printf "%${COLUMNS}s\n" "$SCAN_TIME"
|
||||
[[ -e "$MEASURE_TIME_FILE" ]] && echo "Total : $SCAN_TIME " >> "$MEASURE_TIME_FILE"
|
||||
exit
|
||||
done
|
||||
outln
|
||||
|
||||
@ -9438,6 +9430,9 @@ fd_socket() {
|
||||
imap|imaps) # IMAP, https://tools.ietf.org/html/rfc2595, https://tools.ietf.org/html/rfc3501
|
||||
starttls_imap_dialog
|
||||
;;
|
||||
irc|ircs) # IRC, https://ircv3.net/specs/extensions/tls-3.1.html, https://ircv3.net/specs/core/capability-negotiation.html
|
||||
fatal "FIXME: IRC+STARTTLS not yet supported" $ERR_NOSUPPORT
|
||||
;;
|
||||
ldap|ldaps) # LDAP, https://tools.ietf.org/html/rfc2830, https://tools.ietf.org/html/rfc4511
|
||||
fatal "FIXME: LDAP+STARTTLS over sockets not yet supported (try \"--ssl-native\")" $ERR_NOSUPPORT
|
||||
;;
|
||||
@ -16246,9 +16241,11 @@ child_error() {
|
||||
exit $ERR_CHILD
|
||||
}
|
||||
|
||||
|
||||
# Program terminates prematurely, with error code
|
||||
# arg1: string to print / to write to file
|
||||
# arg2: error code, is a global, see ERR_* above
|
||||
# arg3: an optional string
|
||||
# arg2: global error code, see ERR_* above
|
||||
# arg3: an optional hint (string)
|
||||
#
|
||||
fatal() {
|
||||
outln
|
||||
@ -16262,6 +16259,18 @@ fatal() {
|
||||
exit $2
|
||||
}
|
||||
|
||||
# This OTOH doesn't exit but puts a fatal error to the screen but continues with the next
|
||||
# IP/hostname. It should only be used if a single IP/Hostname in a scan is not reachable.
|
||||
# arg1: string to print / to write to file
|
||||
#
|
||||
ip_fatal() {
|
||||
outln
|
||||
prln_magenta "Fatal error: $1, proceeding with next IP (if any)" >&2
|
||||
[[ -n "$LOGFILE" ]] && prln_magenta "Fatal error: $1, proceeding with next IP (if any)" >>$LOGFILE
|
||||
outln
|
||||
fileout "scanProblem" "FATAL" "$1, proceeding with next IP (if any)"
|
||||
return 0
|
||||
}
|
||||
|
||||
initialize_engine(){
|
||||
# for now only GOST engine
|
||||
@ -16895,21 +16904,26 @@ determine_optimal_proto() {
|
||||
}
|
||||
|
||||
|
||||
# arg1: ftp smtp, lmtp, pop3, imap, xmpp, telnet, ldap, postgres, mysql (maybe with trailing s)
|
||||
# arg1: ftp smtp, lmtp, pop3, imap, xmpp, telnet, ldap, postgres, mysql, irc, nntp (maybe with trailing s)
|
||||
determine_service() {
|
||||
local ua
|
||||
local protocol
|
||||
local protocol error_msg
|
||||
|
||||
if ! fd_socket 5; then # check if we can connect to $NODEIP:$PORT
|
||||
# check if we can connect to $NODEIP:$PORT
|
||||
if ! fd_socket 5; then
|
||||
if [[ -n "$PROXY" ]]; then
|
||||
fatal "You're sure $PROXYNODE:$PROXYPORT allows tunneling here? Can't connect to \"$NODEIP:$PORT\"" $ERR_CONNECT
|
||||
else
|
||||
if "$MULTIPLE_CHECKS"; then
|
||||
ip_fatal "Couldn't connect to $NODEIP:$PORT"
|
||||
return 1
|
||||
else
|
||||
fatal "Can't connect to \"$NODEIP:$PORT\"\nMake sure a firewall is not between you and your scanning target!" $ERR_CONNECT
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
close_socket
|
||||
|
||||
datebanner " Start"
|
||||
outln
|
||||
if [[ -z "$1" ]]; then
|
||||
# no STARTTLS.
|
||||
@ -16926,6 +16940,7 @@ determine_service() {
|
||||
else
|
||||
protocol=${1%s} # strip trailing 's' in ftp(s), smtp(s), pop3(s), etc
|
||||
fi
|
||||
|
||||
case "$protocol" in
|
||||
ftp|smtp|lmtp|pop3|imap|xmpp|telnet|ldap|postgres|mysql|nntp)
|
||||
STARTTLS="-starttls $protocol"
|
||||
@ -16973,12 +16988,20 @@ determine_service() {
|
||||
fatal "Your $OPENSSL does not support the \"-starttls nntp\" option" $ERR_OSSLBIN
|
||||
fi
|
||||
fi
|
||||
|
||||
$OPENSSL s_client $(s_client_options "-connect $NODEIP:$PORT $PROXY $BUGS $STARTTLS") 2>$ERRFILE >$TMPFILE </dev/null
|
||||
if [[ $? -ne 0 ]]; then
|
||||
error_msg="$OPENSSL couldn't connect to $NODEIP:$PORT via STARTTLS using $protocol"
|
||||
debugme cat $TMPFILE | head -25
|
||||
outln
|
||||
fatal " $OPENSSL couldn't establish STARTTLS via $protocol to $NODEIP:$PORT" $ERR_CONNECT
|
||||
if "$MULTIPLE_CHECKS"; then
|
||||
ip_fatal "$error_msg"
|
||||
return 1
|
||||
else
|
||||
fatal " $error_msg" $ERR_CONNECT
|
||||
fi
|
||||
fi
|
||||
|
||||
grep -q '^Server Temp Key' $TMPFILE && HAS_DH_BITS=true # FIX #190
|
||||
out " Service set:$CORRECT_SPACES STARTTLS via "
|
||||
out "$(toupper "$protocol")"
|
||||
@ -16988,7 +17011,7 @@ determine_service() {
|
||||
outln
|
||||
;;
|
||||
*) outln
|
||||
fatal "momentarily only ftp, smtp, lmtp, pop3, imap, xmpp, telnet, ldap, postgres, and mysql allowed" $ERR_CMDLINE
|
||||
fatal "momentarily only ftp, smtp, lmtp, pop3, imap, xmpp, telnet, ldap, nntp, postgres and mysql allowed" $ERR_CMDLINE
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
@ -17071,15 +17094,16 @@ run_mx_all_ips() {
|
||||
prepare_logging "${FNAME_PREFIX}mx-$1"
|
||||
fi
|
||||
if [[ -n "$mxs" ]] && [[ "$mxs" != ' ' ]]; then
|
||||
[[ $mxport == "465" ]] && \
|
||||
STARTTLS_PROTOCOL="" # no starttls for tcp 465, all other ports are starttls
|
||||
[[ $(count_words "$mxs") -gt 1 ]] && MULTIPLE_CHECKS=true
|
||||
pr_bold "Testing all MX records (on port $mxport): "; outln "$mxs"
|
||||
[[ $mxport == 465 ]] && STARTTLS_PROTOCOL="" # no starttls for tcp 465, all other ports are starttls
|
||||
for mx in $mxs; do
|
||||
draw_line "-" $((TERM_WIDTH * 2 / 3))
|
||||
outln
|
||||
parse_hn_port "$mx:$mxport"
|
||||
determine_ip_addresses || continue
|
||||
if [[ $(count_words "$IPADDRs") -gt 1 ]]; then # we have more than one ipv4 address to check
|
||||
MULTIPLE_CHECKS=true
|
||||
pr_bold "Testing all IPv4 addresses (port $PORT): "; outln "$IPADDRs"
|
||||
for ip in $IPADDRs; do
|
||||
NODEIP="$ip"
|
||||
@ -17358,7 +17382,7 @@ run_mass_testing() {
|
||||
get_next_message_testing_parallel_result() {
|
||||
draw_line "=" $((TERM_WIDTH / 2)); outln;
|
||||
outln "${PARALLEL_TESTING_CMDLINE[NEXT_PARALLEL_TEST_TO_FINISH]}"
|
||||
if [[ "$1" == "completed" ]]; then
|
||||
if [[ "$1" == completed ]]; then
|
||||
cat "$TEMPDIR/term_output_$(printf "%08d" $NEXT_PARALLEL_TEST_TO_FINISH).log"
|
||||
if "$JSONHEADER" && [[ -s "$TEMPDIR/jsonfile_$(printf "%08d" $NEXT_PARALLEL_TEST_TO_FINISH).json" ]]; then
|
||||
# Need to ensure that a separator is only added if the test
|
||||
@ -17717,7 +17741,7 @@ parse_cmd_line() {
|
||||
unset CMDLINE_IP
|
||||
fi
|
||||
# normalize any IPv6 address
|
||||
CMDLINE_IP="${CMDLINE_IP//[/}"
|
||||
CMDLINE_IP="${CMDLINE_IP//[/}" # fix vim syntax highlighting "]
|
||||
CMDLINE_IP="${CMDLINE_IP//]/}"
|
||||
;;
|
||||
-n|--nodns|-n=*|--nodns=*)
|
||||
@ -18209,8 +18233,10 @@ lets_roll() {
|
||||
stopwatch determine_rdns
|
||||
|
||||
((SERVER_COUNTER++))
|
||||
determine_service "$1" # STARTTLS service? Other will be determined here too. Returns always 0 or has already exited if fatal error occurred
|
||||
|
||||
datebanner " Start"
|
||||
determine_service "$1" # STARTTLS service? Other will be determined here too. Returns 0 if test connect was ok or has already exited if fatal error occurred
|
||||
# determine_service() can return 1, it indicates that this IP cannot be reached but there are more IPs to check
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
# "secret" devel options --devel:
|
||||
if "$do_tls_sockets"; then
|
||||
if [[ "$TLS_LOW_BYTE" == 22 ]]; then
|
||||
@ -18225,9 +18251,13 @@ lets_roll() {
|
||||
echo $?
|
||||
exit $ALLOK;
|
||||
fi
|
||||
"$do_cipher_match" && { fileout_section_header $section_number false; run_cipher_match ${single_cipher}; }
|
||||
if "$do_cipher_match"; then
|
||||
# we will have an invalid JSON with no if statement
|
||||
fileout_section_header $section_number false
|
||||
run_cipher_match ${single_cipher}
|
||||
stopwatch run_cipher_match
|
||||
else
|
||||
((section_number++))
|
||||
|
||||
# all top level functions now following have the prefix "run_"
|
||||
fileout_section_header $section_number false && ((section_number++))
|
||||
"$do_protocols" && {
|
||||
@ -18253,7 +18283,7 @@ lets_roll() {
|
||||
if "$do_header"; then
|
||||
#TODO: refactor this into functions
|
||||
fileout_section_header $section_number true && ((section_number++))
|
||||
if [[ $SERVICE == "HTTP" ]]; then
|
||||
if [[ $SERVICE == HTTP ]]; then
|
||||
run_http_header "$URL_PATH"; ret=$(($? + ret))
|
||||
run_http_date "$URL_PATH"; ret=$(($? + ret))
|
||||
run_hsts "$URL_PATH"; ret=$(($? + ret))
|
||||
@ -18299,8 +18329,9 @@ lets_roll() {
|
||||
|
||||
fileout_section_header $section_number true && ((section_number++))
|
||||
"$do_client_simulation" && { run_client_simulation; ret=$(($? + ret)); stopwatch run_client_simulation; }
|
||||
|
||||
fi
|
||||
fileout_section_footer true
|
||||
fi
|
||||
|
||||
outln
|
||||
calc_scantime
|
||||
@ -18381,6 +18412,7 @@ lets_roll() {
|
||||
fatal "No IP address could be determined" $ERR_DNSLOOKUP
|
||||
fi
|
||||
if [[ $(count_words "$IPADDRs") -gt 1 ]]; then # we have more than one ipv4 address to check
|
||||
MULTIPLE_CHECKS=true
|
||||
pr_bold "Testing all IPv4 addresses (port $PORT): "; outln "$IPADDRs"
|
||||
for ip in $IPADDRs; do
|
||||
draw_line "-" $((TERM_WIDTH * 2 / 3))
|
||||
|
||||
Loading…
Reference in New Issue
Block a user