mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-01-30 12:21:17 +01:00
Change orga from drwetter --> testssl
... to avoid redirects on the client side and to make repo migration better visible. Also amend 'Status' and 'Contributing' in Readme.md. bluesky added, albeit mastodon seems more interactive. Clarify twitter account is not in use anymore.
This commit is contained in:
Dirk
parent
245ad2ae4a
commit
b708026151
@ -137,7 +137,7 @@
|
||||
* Trust chain check against certificate stores from Apple (OS), Linux (OS),
|
||||
Microsoft (OS), Mozilla (Firefox Browser), works for openssl >=1.0.1
|
||||
* IPv6 (status: 80% working, details see
|
||||
https://github.com/drwetter/testssl.sh/issues/11
|
||||
https://github.com/testssl/testssl.sh/issues/11
|
||||
* works now on servers requiring a x509 certificate for authentication
|
||||
* extensive CN <--> hostname check
|
||||
* SSL Session ID check
|
||||
@ -183,7 +183,7 @@
|
||||
* quite some LibreSSL fixes, still not recommended to use though (see https://testssl.sh/)
|
||||
* lots of fixes, code improvements, even more robust
|
||||
|
||||
Full log @ https://github.com/drwetter/testssl.sh/commits/2.6/testssl.sh
|
||||
Full log @ https://github.com/testssl/testssl.sh/commits/2.6/testssl.sh
|
||||
|
||||
### New in 2.4
|
||||
* "only one cmd line option at a time" is completely gone
|
||||
@ -198,7 +198,7 @@ Full log @ https://github.com/drwetter/testssl.sh/commits/2.6/testssl.sh
|
||||
* lots of cosmetic and maintainability code cleanups
|
||||
* bugfixing
|
||||
|
||||
Full changelog: https://github.com/drwetter/testssl.sh/commits/2.4/testssl.sh
|
||||
Full changelog: https://github.com/testssl/testssl.sh/commits/2.4/testssl.sh
|
||||
|
||||
### 2.2. new features:
|
||||
* Works fully under FreeBSD (openssl >=1.0)
|
||||
@ -214,7 +214,7 @@ Full changelog: https://github.com/drwetter/testssl.sh/commits/2.4/testssl.sh
|
||||
* RFC <---> OpenSSL name space mapping of ciphers everywhere
|
||||
* includes a lot of fixes
|
||||
|
||||
Full changelog @ https://github.com/drwetter/testssl.sh/commits/2.2/testssl.sh
|
||||
Full changelog @ https://github.com/testssl/testssl.sh/commits/2.2/testssl.sh
|
||||
|
||||
### 2.0 major release, new features:
|
||||
* SNI
|
||||
|
||||
@ -5,7 +5,7 @@ is always welcome, here @ github or via e-mail.
|
||||
|
||||
Note please the following
|
||||
|
||||
* Please read at least the [coding convention](https://github.com/drwetter/testssl.sh/Coding_Convention.md).
|
||||
* Please read at least the [coding convention](https://github.com/testssl/testssl.sh/Coding_Convention.md).
|
||||
* One PR per feature or bug fix or improvement. Please do not mix issues.
|
||||
* Document your PR, both in the PR and/or commit message and in the code.
|
||||
* Please test your changes thoroughly as reliability is important for this project. You may want to check different servers with different settings.
|
||||
|
||||
@ -5,8 +5,8 @@ FROM alpine:3.20
|
||||
WORKDIR /home/testssl
|
||||
|
||||
ARG BUILD_VERSION
|
||||
ARG ARCHIVE_URL=https://github.com/drwetter/testssl.sh/archive/
|
||||
ARG URL=https://github.com/drwetter/testssl.sh.git
|
||||
ARG ARCHIVE_URL=https://github.com/testssl/testssl.sh/archive/
|
||||
ARG URL=https://github.com/testssl/testssl.sh.git
|
||||
|
||||
RUN test -n "${BUILD_VERSION}" \
|
||||
&& apk update \
|
||||
|
||||
35
Readme.md
35
Readme.md
@ -1,11 +1,11 @@
|
||||
|
||||
## Intro
|
||||
|
||||
<!-- [](https://travis-ci.org/drwetter/testssl.sh) -->
|
||||
[](https://github.com/drwetter/testssl.sh/actions/workflows/test.yml)
|
||||
[](https://gitter.im/drwetter/testssl.sh?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
|
||||
[](https://github.com/drwetter/testssl.sh/LICENSE)
|
||||
[](https://github.com/drwetter/testssl.sh/blob/3.2/Dockerfile.md)
|
||||
<!-- [](https://travis-ci.org/drwetter/testssl.sh) -->
|
||||
[](https://github.com/testssl/testssl.sh/actions/workflows/test.yml)
|
||||
[](https://gitter.im/testssl/testssl.sh?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
|
||||
[](https://github.com/testssl/testssl.sh/LICENSE)
|
||||
[](https://github.com/testssl/testssl.sh/blob/3.2/Dockerfile.md)
|
||||
|
||||
`testssl.sh` is a free command line tool which checks a server's service on
|
||||
any port for the support of TLS/SSL ciphers, protocols as well as some
|
||||
@ -45,16 +45,16 @@ due to bash-socket-based checks. As a result you can also use e.g. LibreSSL or O
|
||||
(silent) check for binaries is done when you start testssl.sh . System V needs probably
|
||||
to have GNU grep installed. MacOS X and Windows (using MSYS2, Cygwin or WSL) work too.
|
||||
|
||||
Update notification here or @ [mastodon](https://infosec.exchange/@testssl) (old: [twitter](https://twitter.com/drwetter))
|
||||
Update notification here or @ [mastodon](https://infosec.exchange/@testssl or [bluesky](https://bsky.app/profile/testssl.bsky.social). Please note the [twitter](https://twitter.com/drwetter) account is not being used anymore.
|
||||
|
||||
### Installation
|
||||
|
||||
You can download testssl.sh branch 3.2 just by cloning this git repository:
|
||||
|
||||
git clone --depth 1 https://github.com/drwetter/testssl.sh.git
|
||||
git clone --depth 1 https://github.com/testssl/testssl.sh.git
|
||||
|
||||
3.2 is now the latest branch which evolved from 3.1dev. It's in the release candidate phase.
|
||||
For the former stable version help yourself by downloading the [ZIP](https://codeload.github.com/drwetter/testssl.sh/zip/v3.0.8) or [tar.gz](https://codeload.github.com/drwetter/testssl.sh/tar.gz/v3.0.8) archive. Just ``cd`` to the directory created (=INSTALLDIR) and run it off there.
|
||||
3.2 is now the latest branch which evolved from 3.1dev. It's in the release candidate phase and considered as stable.
|
||||
For the former stable version named oldstable please help yourself by downloading the [ZIP](https://codeload.github.com/testssl/testssl.sh/zip/v3.0.9) or [tar.gz](https://codeload.github.com/testssl/testssl.sh/tar.gz/v3.0.9) archive. Just ``cd`` to the directory created (=INSTALLDIR) and run it off there.
|
||||
|
||||
#### Docker
|
||||
|
||||
@ -69,7 +69,7 @@ Or if you have cloned this repo you also can just ``cd`` to the INSTALLDIR and r
|
||||
docker build . -t imagefoo && docker run --rm -t imagefoo example.com
|
||||
```
|
||||
|
||||
For more please consult [Dockerfile.md](https://github.com/drwetter/testssl.sh/blob/3.2/Dockerfile.md).
|
||||
For more please consult [Dockerfile.md](https://github.com/testssl/testssl.sh/blob/3.2/Dockerfile.md).
|
||||
|
||||
### No Warranty
|
||||
|
||||
@ -79,9 +79,9 @@ Testssl.sh is intended to be used as a standalone CLI tool. While we tried to ap
|
||||
|
||||
### Status
|
||||
|
||||
We're currently in the release candidate phase for version 3.2. Bigger features will be developed in a separate branch before merged into a 3.3dev to avoid hiccups or inconsistencies.
|
||||
We're currently in the release candidate phase for version 3.2. You should use it despite the label "RC". Bigger features will be developed in a separate branch before merged into a 3.3dev to avoid hiccups or inconsistencies.
|
||||
|
||||
Version 3.0.X receives bugfixes, labeled as 3.0.1, 3.0.2 and so on. This will happen until 3.2 is released.
|
||||
Version 3.0.X receives bugfixes, labeled as 3.0.1, 3.0.2 and so on. This will happen until 3.2 is finally released.
|
||||
|
||||
Support for 2.9.5 has been dropped. Supported is >= 3.0.x only.
|
||||
|
||||
@ -93,16 +93,19 @@ Support for 2.9.5 has been dropped. Supported is >= 3.0.x only.
|
||||
|
||||
### Contributing
|
||||
|
||||
Contributions are welcome! See [CONTRIBUTING.md](https://github.com/drwetter/testssl.sh/blob/3.2/CONTRIBUTING.md) for details. Please also have a look at the [Coding Convention](https://github.com/drwetter/testssl.sh/blob/3.2/Coding_Convention.md).
|
||||
Contributions are welcome! See [CONTRIBUTING.md](https://github.com/testssl/testssl.sh/blob/3.2/CONTRIBUTING.md) for details. Please also have a look at the [Coding Convention](https://github.com/testssl/testssl.sh/blob/3.2/Coding_Convention.md). A lot of contributors already helped to push the project where it currently is, see [CREDITS.md](https://github.com/testssl/testssl.sh/blob/3.2/CREDITS.md). We still you use your help now. A start would be look for issues which are labeled as [good first issue](https://github.com/testssl/testssl.sh/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22), [for grabs](https://github.com/testssl/testssl.sh/issues?q=is%3Aissue+is%3Aopen+label%3A%22for+grabs%22) or [help wanted](https://github.com/testssl/testssl.sh/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22). The latter is more advanced.
|
||||
|
||||
In general there's some maintenance burden, like maintaining handshakes and CA stores, writing unit tests, improving github actions. If you believe you can contribute, speak up.
|
||||
|
||||
|
||||
### Bug reports
|
||||
|
||||
Bug reports are important. It makes this project more robust.
|
||||
|
||||
Please file bugs in the issue tracker @ GitHub. Do not forget to provide detailed information, see template for issue, and further details @
|
||||
https://github.com/drwetter/testssl.sh/wiki/Bug-reporting. Nobody can read your thoughts -- yet. And only agencies your screen ;-)
|
||||
https://github.com/testssl/testssl.sh/wiki/Bug-reporting. Nobody can read your thoughts -- yet. And only agencies your screen ;-)
|
||||
|
||||
You can also debug yourself, see [here](https://github.com/drwetter/testssl.sh/wiki/Findings-and-HowTo-Fix-them).
|
||||
You can also debug yourself, see [here](https://github.com/testssl/testssl.sh/wiki/Findings-and-HowTo-Fix-them).
|
||||
|
||||
----
|
||||
|
||||
@ -129,7 +132,7 @@ Please address questions not specifically to the code of testssl.sh to the respe
|
||||
|
||||
#### Brew package
|
||||
|
||||
* see [#233](https://github.com/drwetter/testssl.sh/issues/233) and
|
||||
* see [#233](https://github.com/testssl/testssl.sh/issues/233) and
|
||||
[https://github.com/Homebrew/homebrew](https://github.com/Homebrew/homebrew)
|
||||
|
||||
#### Daemon for batch execution of testssl.sh command files
|
||||
|
||||
48
testssl.sh
48
testssl.sh
@ -7,9 +7,9 @@
|
||||
# vulnerabilities or features. It may or may be not distributed by your distribution.
|
||||
# The upstream versions are available (please leave the links intact):
|
||||
#
|
||||
# Development version https://github.com/drwetter/testssl.sh
|
||||
# Development version https://github.com/testssl/testssl.sh
|
||||
# Stable version https://testssl.sh
|
||||
# File bugs at GitHub https://github.com/drwetter/testssl.sh/issues
|
||||
# File bugs at GitHub https://github.com/testssl/testssl.sh/issues
|
||||
#
|
||||
# Project lead and initiator: Dirk Wetter, copyleft: 2007-today, contributions so far see CREDITS.md
|
||||
# Main contributions from David Cooper
|
||||
@ -399,7 +399,7 @@ RSA_CERT_FINGERPRINT_SHA2=""
|
||||
STARTTLS_PROTOCOL=""
|
||||
OPTIMAL_PROTO="" # Need this for IIS6 (sigh) + OpenSSL 1.0.2, otherwise some handshakes will fail see
|
||||
# https://github.com/PeterMosmans/openssl/issues/19#issuecomment-100897892
|
||||
STARTTLS_OPTIMAL_PROTO="" # Same for STARTTLS, see https://github.com/drwetter/testssl.sh/issues/188
|
||||
STARTTLS_OPTIMAL_PROTO="" # Same for STARTTLS, see https://github.com/testssl/testssl.sh/issues/188
|
||||
OPTIMAL_SOCKETS_PROTO="" # Same for tls_sockets(). -- not yet used
|
||||
ALL_FAILED_SOCKETS=true # Set to true if all attempts to connect to server using tls_sockets/sslv2_sockets failed
|
||||
TLS_TIME="" # To keep the value of TLS server timestamp
|
||||
@ -617,7 +617,7 @@ tmln_cyan() { tm_cyan "$1"; tmln_out; }
|
||||
pr_cyan() { tm_cyan "$1"; [[ "$COLOR" -ge 2 ]] && html_out "<span style=\"color:#0d7ea2;font-weight:bold;\">$(html_reserved "$1")</span>" || html_out "$(html_reserved "$1")"; }
|
||||
prln_cyan() { pr_cyan "$1"; outln; }
|
||||
|
||||
tm_litegrey() { [[ "$COLOR" -ne 0 ]] && tm_out "\033[0;37m$1" || tm_out "$1"; tm_off; } # ... https://github.com/drwetter/testssl.sh/pull/600#issuecomment-276129876
|
||||
tm_litegrey() { [[ "$COLOR" -ne 0 ]] && tm_out "\033[0;37m$1" || tm_out "$1"; tm_off; } # ... https://github.com/testssl/testssl.sh/pull/600#issuecomment-276129876
|
||||
tmln_litegrey() { tm_litegrey "$1"; tmln_out; } # not really usable on a black background, see ..
|
||||
prln_litegrey() { pr_litegrey "$1"; outln; }
|
||||
pr_litegrey() { tm_litegrey "$1"; [[ "$COLOR" -ne 0 ]] && html_out "<span style=\"color:#71767a;\">$(html_reserved "$1")</span>" || html_out "$(html_reserved "$1")"; }
|
||||
@ -1037,7 +1037,7 @@ get_cipher() {
|
||||
# However there seem to be cases where the preferred $(< "$1") logic has a problem.
|
||||
# Especially with bash 3.2 (Mac OS X) and when on the server side binary chars
|
||||
# are returned, see https://stackoverflow.com/questions/7427262/how-to-read-a-file-into-a-variable-in-shell#22607352
|
||||
# and https://github.com/drwetter/testssl.sh/issues/1292
|
||||
# and https://github.com/testssl/testssl.sh/issues/1292
|
||||
# Performance measurements showed no to barely measurable penalty (1s displayed in 9 tries).
|
||||
|
||||
if [[ "$server_hello" =~ Cipher\ *:\ ([A-Z0-9]+-[A-Za-z0-9\-]+|TLS_[A-Za-z0-9_]+|SSL_[A-Za-z0-9_]+) ]]; then
|
||||
@ -4922,9 +4922,9 @@ client_simulation_sockets() {
|
||||
data+=", ${clienthello:i:2}"
|
||||
done
|
||||
# same as above. If a CIPHER_SUITES string was provided, then check that it is in the ServerHello
|
||||
# this appeared 1st in yassl + MySQL (https://github.com/drwetter/testssl.sh/pull/784) but adds
|
||||
# this appeared 1st in yassl + MySQL (https://github.com/testssl/testssl.sh/pull/784) but adds
|
||||
# robustness to the implementation
|
||||
# see also https://github.com/drwetter/testssl.sh/pull/797
|
||||
# see also https://github.com/testssl/testssl.sh/pull/797
|
||||
if [[ "${1:0:4}" == 1603 ]]; then
|
||||
# Extract list of cipher suites from SSLv3 or later ClientHello
|
||||
sid_len=4*$(hex2dec "${data:174:2}")
|
||||
@ -6471,7 +6471,7 @@ pr_ecdh_quality() {
|
||||
elif [[ "$bits" -le 163 ]]; then
|
||||
pr_svrty_medium "$string"
|
||||
elif [[ "$bits" -le 193 ]]; then # hmm, according to https://wiki.openssl.org/index.php/Elliptic_Curve_Cryptography it should ok
|
||||
pr_svrty_low "$string" # but openssl removed it https://github.com/drwetter/testssl.sh/issues/299#issuecomment-220905416
|
||||
pr_svrty_low "$string" # but openssl removed it https://github.com/testssl/testssl.sh/issues/299#issuecomment-220905416
|
||||
elif [[ "$bits" -le 224 ]]; then
|
||||
out "$string"
|
||||
elif [[ "$bits" -gt 224 ]]; then
|
||||
@ -14857,7 +14857,7 @@ parse_tls_serverhello() {
|
||||
fi
|
||||
|
||||
# If a CIPHER_SUITES string was provided, then check that $tls_cipher_suite is in the string.
|
||||
# this appeared in yassl + MySQL (https://github.com/drwetter/testssl.sh/pull/784) but adds robustness
|
||||
# this appeared in yassl + MySQL (https://github.com/testssl/testssl.sh/pull/784) but adds robustness
|
||||
# to the implementation
|
||||
if [[ -n "$cipherlist" ]]; then
|
||||
tls_cipher_suite="$(tolower "$tls_cipher_suite")"
|
||||
@ -15722,7 +15722,7 @@ prepare_tls_clienthello() {
|
||||
# There does not seem to be any reason to include this extension. However, it appears that
|
||||
# OpenSSL, Firefox, and Chrome include it in TLS 1.3 ClientHello messages, and there is at
|
||||
# least one server that will fail the connection if it is absent
|
||||
# (see https://github.com/drwetter/testssl.sh/issues/990).
|
||||
# (see https://github.com/testssl/testssl.sh/issues/990).
|
||||
if [[ "0x$tls_low_byte" -ge 0x04 ]] && [[ ! "$extra_extensions_list" =~ \ 002d\ ]]; then
|
||||
[[ -n "$all_extensions" ]] && all_extensions+=","
|
||||
all_extensions+="$extn_psk_mode"
|
||||
@ -17195,7 +17195,7 @@ run_renego() {
|
||||
# 1 means client tried to renegotiating but the server side errored then. You still see RENEGOTIATING in the output
|
||||
if tail -5 $TMPFILE| grep -qa '^closed'; then
|
||||
# Exemption from above: server closed the connection but return value was zero
|
||||
# See https://github.com/drwetter/testssl.sh/issues/1725 and referenced issue @haproxy
|
||||
# See https://github.com/testssl/testssl.sh/issues/1725 and referenced issue @haproxy
|
||||
sec_client_renego=1
|
||||
fi
|
||||
case "$sec_client_renego" in
|
||||
@ -18004,7 +18004,7 @@ run_tls_fallback_scsv() {
|
||||
elif grep -qa "alert handshake failure" "$TMPFILE"; then
|
||||
pr_svrty_good "Probably OK. "
|
||||
fileout "$jsonID" "OK" "Probably oK"
|
||||
# see RFC 7507, https://github.com/drwetter/testssl.sh/issues/121
|
||||
# see RFC 7507, https://github.com/testssl/testssl.sh/issues/121
|
||||
# other case reported by Nicolas was F5 and at customer of mine: the same
|
||||
pr_svrty_medium "But received non-RFC-compliant \"handshake failure\" instead of \"inappropriate fallback\""
|
||||
fileout "$jsonID" "MEDIUM" "received non-RFC-compliant \"handshake failure\" instead of \"inappropriate fallback\""
|
||||
@ -21281,7 +21281,7 @@ get_local_a() {
|
||||
check_resolver_bins() {
|
||||
local saved_openssl_conf="$OPENSSL_CONF"
|
||||
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
type -p dig &> /dev/null && HAS_DIG=true
|
||||
type -p host &> /dev/null && HAS_HOST=true
|
||||
type -p drill &> /dev/null && HAS_DRILL=true
|
||||
@ -21303,7 +21303,7 @@ check_resolver_bins() {
|
||||
HAS_DIG_NOIDNOUT=true
|
||||
fi
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
return 0
|
||||
}
|
||||
|
||||
@ -21326,7 +21326,7 @@ get_a_record() {
|
||||
echo $1
|
||||
return 0
|
||||
fi
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
if [[ "$NODE" == *.local ]]; then
|
||||
if "$HAS_AVAHIRESOLVE"; then
|
||||
ip4=$(filter_ip4_address $(avahi-resolve -4 -n "$1" 2>/dev/null | awk '{ print $2 }'))
|
||||
@ -21351,7 +21351,7 @@ get_a_record() {
|
||||
if [[ -z "$ip4" ]] && "$HAS_NSLOOKUP"; then
|
||||
ip4=$(filter_ip4_address $(strip_lf "$(nslookup -querytype=a "$1" 2>/dev/null | awk '/^Name/ { getline; print $NF }')"))
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
echo "$ip4"
|
||||
}
|
||||
|
||||
@ -21364,7 +21364,7 @@ get_aaaa_record() {
|
||||
|
||||
"$HAS_DIG_NOIDNOUT" && noidnout="+noidnout"
|
||||
[[ "$NODNS" == none ]] && return 0 # if no DNS lookup was instructed, leave here
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
if is_ipv6addr "$1"; then
|
||||
# This saves walking through this. Also it avoids hangs e.g. if you run docker locally without reachable DNS
|
||||
echo "$1"
|
||||
@ -21398,7 +21398,7 @@ get_aaaa_record() {
|
||||
ip6=$(filter_ip6_address $(strip_lf "$(nslookup -type=aaaa "$1" 2>/dev/null | awk '/'"^${a}"'.*AAAA/ { print $NF }')"))
|
||||
fi
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
echo "$ip6"
|
||||
}
|
||||
|
||||
@ -21444,7 +21444,7 @@ get_caa_rr_record() {
|
||||
return 1
|
||||
# No dig, drill, host, or nslookup --> complaint was elsewhere already
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
debugme echo $raw_caa
|
||||
|
||||
if [[ "$raw_caa" =~ \#\ [0-9][0-9] ]]; then
|
||||
@ -21492,7 +21492,7 @@ get_mx_record() {
|
||||
local noidnout=""
|
||||
|
||||
"$HAS_DIG_NOIDNOUT" && noidnout="+noidnout"
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
# we need the last two columns here
|
||||
if "$HAS_HOST"; then
|
||||
mx="$(host -t MX "$1" 2>/dev/null | awk '/is handled by/ { print $(NF-1), $NF }')"
|
||||
@ -21519,7 +21519,7 @@ get_txt_record() {
|
||||
local noidnout=""
|
||||
|
||||
"$HAS_DIG_NOIDNOUT" && noidnout="+noidnout"
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
# we need the last two columns here and strip any remaining double quotes later
|
||||
if "$HAS_HOST"; then
|
||||
record="$(host -t TXT "$1" 2>/dev/null | awk -F\" '/descriptive text/ { print $(NF-1) }')"
|
||||
@ -21620,7 +21620,7 @@ determine_rdns() {
|
||||
[[ "$NODNS" == none ]] && rDNS="(instructed to skip DNS queries)" && return 0 # No DNS lookups at all
|
||||
[[ "$NODNS" == min ]] && rDNS="(instructed to minimize DNS queries)" && return 0 # PTR records were not asked for
|
||||
local nodeip="$(tr -d '[]' <<< $NODEIP)" # for DNS we do not need the square brackets of IPv6 addresses
|
||||
OPENSSL_CONF="" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
if [[ "$NODE" == *.local ]]; then
|
||||
if "$HAS_AVAHIRESOLVE"; then
|
||||
rDNS=$(avahi-resolve -a $nodeip 2>/dev/null | awk '{ print $2 }')
|
||||
@ -21637,7 +21637,7 @@ determine_rdns() {
|
||||
elif "$HAS_NSLOOKUP"; then
|
||||
rDNS=$(strip_lf "$(nslookup -type=PTR $nodeip 2>/dev/null | grep -v 'canonical name =' | grep 'name = ' | awk '{ print $NF }' | sed 's/\.$//')")
|
||||
fi
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/drwetter/testssl.sh/issues/134
|
||||
OPENSSL_CONF="$saved_openssl_conf" # see https://github.com/testssl/testssl.sh/issues/134
|
||||
# First, rDNS can contain multilines due to multiple PTR DNS records, though this is not recommended.
|
||||
# So we use a loop to check for each FQDN returned. There we remove chars which under weird
|
||||
# circumstances (see #1506) can show up here. The blacklist is taken from RFC 1912 ("Allowable characters in a
|
||||
@ -22033,7 +22033,7 @@ determine_optimal_proto() {
|
||||
|
||||
>$ERRFILE
|
||||
if [[ -n "$1" ]]; then
|
||||
# STARTTLS workaround needed see https://github.com/drwetter/testssl.sh/issues/188 -- kind of odd
|
||||
# STARTTLS workaround needed see https://github.com/testssl/testssl.sh/issues/188 -- kind of odd
|
||||
for STARTTLS_OPTIMAL_PROTO in -tls1_2 -tls1 -ssl3 -tls1_1 -tls1_3 -ssl2; do
|
||||
sclient_supported "$STARTTLS_OPTIMAL_PROTO" || continue
|
||||
$OPENSSL s_client $(s_client_options "$STARTTLS_OPTIMAL_PROTO $BUGS -connect "$NODEIP:$PORT" $PROXY -msg $STARTTLS $SNI") </dev/null >$TMPFILE 2>>$ERRFILE
|
||||
|
||||
Loading…
Reference in New Issue
Block a user