From 004cbad07b03480079c2bebc8d2a32d55a1a0d7b Mon Sep 17 00:00:00 2001 From: David Cooper Date: Tue, 14 Feb 2017 16:43:46 -0500 Subject: [PATCH 1/2] run_protocols() bug fix Since the test for TLS 1.2 in `run_protocols()` now uses `tls_sockets()` whenever `$ssl_native` is `true` (i.e., there is no longer a requirement for `$EXPERIMENTAL` to be true as well), the `$EXPERIMENTAL` flag should no longer be checked if the return value is 1. --- testssl.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testssl.sh b/testssl.sh index 4d98c64..5e437ea 100755 --- a/testssl.sh +++ b/testssl.sh @@ -4506,7 +4506,7 @@ run_protocols() { ;; # GCM cipher in TLS 1.2: very good! 1) pr_svrty_mediumln "not offered" - if ! "$using_sockets" || ! "$EXPERIMENTAL" || [[ -z $latest_supported ]]; then + if ! "$using_sockets" || [[ -z $latest_supported ]]; then fileout "tls1_2" "MEDIUM" "TLSv1.2 is not offered" # no GCM, penalty else pr_svrty_criticalln " -- connection failed rather than downgrading to $latest_supported_string" From 2456c808217c847699712fd10860d7659495cd31 Mon Sep 17 00:00:00 2001 From: David Cooper Date: Wed, 15 Feb 2017 11:47:11 -0500 Subject: [PATCH 2/2] Fix early newline In the case that `tls_sockets()` is being used and the server incorrectly fails the connection rather than downgrading, testssl.sh is printing "not offered" on one line and then the error message on the next line, but all the text should appear on one line (as it does when testing TLS 1 and TLS 1.1). --- testssl.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/testssl.sh b/testssl.sh index 8f8de5f..874c139 100755 --- a/testssl.sh +++ b/testssl.sh @@ -4505,8 +4505,9 @@ run_protocols() { add_tls_offered "tls1_2" ;; # GCM cipher in TLS 1.2: very good! 1) - pr_svrty_mediumln "not offered" + pr_svrty_medium "not offered" if ! "$using_sockets" || [[ -z $latest_supported ]]; then + outln fileout "tls1_2" "MEDIUM" "TLSv1.2 is not offered" # no GCM, penalty else pr_svrty_criticalln " -- connection failed rather than downgrading to $latest_supported_string"