Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-20 16:48:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Avoid use of color functions and fix SC2021 and SC2171

Browse Source 
This commit backports #3138 and #3144 to the 3.2 branch. It also fixes Shellcheck issue SC2171.
This commit is contained in:
David Cooper
2026-09-15 21:31:37 -07:00
committed by David
parent 6555311656
commit df0fc9aec1
1 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testssl.sh
+17 -9
View File
@@ -11566,7 +11566,7 @@ run_npn() {
if "$HAS_NPN"; then if "$HAS_NPN"; then
# TLS 1.3 s_client doesn't support -nextprotoneg when connecting with TLS 1.3. So we need to make sure it won't be used # TLS 1.3 s_client doesn't support -nextprotoneg when connecting with TLS 1.3. So we need to make sure it won't be used
# TLS13_ONLY is tested here again, just to be sure, see npn_pre # TLS13_ONLY is tested here again, just to be sure, see npn_pre
if "$HAS_TLS13" && ! $TLS13_ONLY ]] ; then if "$HAS_TLS13" && ! "$TLS13_ONLY"; then
proto="-no_tls1_3" proto="-no_tls1_3"
fi fi
$OPENSSL s_client $(s_client_options "$proto -connect $NODEIP:$PORT $BUGS $SNI -nextprotoneg "$NPN_PROTOs"") </dev/null 2>$ERRFILE >$TMPFILE $OPENSSL s_client $(s_client_options "$proto -connect $NODEIP:$PORT $BUGS $SNI -nextprotoneg "$NPN_PROTOs"") </dev/null 2>$ERRFILE >$TMPFILE
@@ -18666,7 +18666,7 @@ run_freak() {
return 0 return 0
;; ;;
1|2|3) 1|2|3)
addtl_warning=" ($magenta""tested only with $nr_supported_ciphers out of 9 ciphers only!$off)" ;; addtl_warning=" (tested only with $nr_supported_ciphers out of 9 ciphers only!)" ;;
4|5|6|7) 4|5|6|7)
addtl_warning=" (tested with $nr_supported_ciphers/9 ciphers)" ;; addtl_warning=" (tested with $nr_supported_ciphers/9 ciphers)" ;;
8|9|10|11) 8|9|10|11)
@@ -18704,7 +18704,12 @@ run_freak() {
pr_svrty_critical "VULNERABLE (NOT ok)"; out ", uses EXPORT RSA ciphers" pr_svrty_critical "VULNERABLE (NOT ok)"; out ", uses EXPORT RSA ciphers"
fileout "$jsonID" "CRITICAL" "VULNERABLE, uses EXPORT RSA ciphers" "$cve" "$cwe" "$hint" fileout "$jsonID" "CRITICAL" "VULNERABLE, uses EXPORT RSA ciphers" "$cve" "$cwe" "$hint"
else else
pr_svrty_best "not vulnerable (OK)"; out "$addtl_warning" pr_svrty_best "not vulnerable (OK)"
if [[ -n "$addtl_warning" ]] && [[ $nr_supported_ciphers -le 3 ]]; then
out " ("; pr_warning "${addtl_warning:2:-1}"; out ")"
else
out "$addtl_warning"
fi
fileout "$jsonID" "OK" "not vulnerable $addtl_warning" "$cve" "$cwe" fileout "$jsonID" "OK" "not vulnerable $addtl_warning" "$cve" "$cwe"
fi fi
outln outln
@@ -18867,7 +18872,7 @@ run_logjam() {
out "$spaces" out "$spaces"
openssl_no_expdhciphers=true openssl_no_expdhciphers=true
;; ;;
1|2|3) addtl_warning=" ($magenta""tested w/ $nr_supported_ciphers/4 ciphers only!$off)" ;; 1|2|3) addtl_warning=" (tested w/ $nr_supported_ciphers/4 ciphers only!)" ;;
4) ;; 4) ;;
esac esac
fi fi
@@ -18973,16 +18978,16 @@ run_logjam() {
out_common_prime "$jsonID2" "$cve" "$cwe" out_common_prime "$jsonID2" "$cve" "$cwe"
if ! "$openssl_no_expdhciphers"; then if ! "$openssl_no_expdhciphers"; then
outln "," outln ","
out "${spaces}but no DH EXPORT ciphers${addtl_warning}" out "${spaces}but no DH EXPORT ciphers"
fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe"
fi fi
elif [[ $subret -eq 3 ]]; then elif [[ $subret -eq 3 ]]; then
pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers${addtl_warning}" pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers"
fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe"
out ", no DH key detected with <= TLS 1.2" out ", no DH key detected with <= TLS 1.2"
fileout "$jsonID2" "OK" "no DH key with <= TLS 1.2" "$cve" "$cwe" fileout "$jsonID2" "OK" "no DH key with <= TLS 1.2" "$cve" "$cwe"
elif [[ $subret -eq 0 ]]; then elif [[ $subret -eq 0 ]]; then
pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers${addtl_warning}" pr_svrty_good "not vulnerable (OK):"; out " no DH EXPORT ciphers"
fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe"
# we issue a special warning if there's no common prime but the bit length is too low # we issue a special warning if there's no common prime but the bit length is too low
if [[ $DH_GROUP_LEN_P -le 1024 ]]; then if [[ $DH_GROUP_LEN_P -le 1024 ]]; then
@@ -18998,9 +19003,12 @@ run_logjam() {
fileout "$jsonID2" "OK" "--" "$cve" "$cwe" fileout "$jsonID2" "OK" "--" "$cve" "$cwe"
fi fi
elif [[ $ret -eq 1 ]]; then elif [[ $ret -eq 1 ]]; then
pr_svrty_good "partly not vulnerable:"; out " no DH EXPORT ciphers${addtl_warning}" pr_svrty_good "partly not vulnerable:"; out " no DH EXPORT ciphers"
fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe" fileout "$jsonID" "OK" "not vulnerable, no DH EXPORT ciphers,$addtl_warning" "$cve" "$cwe"
fi fi
if [[ -n "$addtl_warning" ]]; then
out " ("; pr_warning "${addtl_warning:2:-1}"; out ")"
fi
fi fi
[[ $DH_GROUP_LEN_P -gt 0 ]] && set_key_str_score "DHE" $DH_GROUP_LEN_P [[ $DH_GROUP_LEN_P -gt 0 ]] && set_key_str_score "DHE" $DH_GROUP_LEN_P
@@ -22339,7 +22347,7 @@ determine_rdns() {
# circumstances (see #1506) can show up here. The blacklist is taken from RFC 1912 ("Allowable characters in a # circumstances (see #1506) can show up here. The blacklist is taken from RFC 1912 ("Allowable characters in a
# label for a host name are only ASCII, letters, digits, and the `-' character") # label for a host name are only ASCII, letters, digits, and the `-' character")
while read -r line; do while read -r line; do
line="$(tr -dc '[a-zA-Z0-9-_.]' <<< "$line")" line="$(tr -dc 'a-zA-Z0-9-_.' <<< "$line")"
[[ -z "$rdns" ]] && rdns="$line" || rdns="$rdns $line" [[ -z "$rdns" ]] && rdns="$line" || rdns="$rdns $line"
done <<< "$rDNS" done <<< "$rDNS"
rDNS="$rdns" rDNS="$rdns"