Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-10-30 21:35:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Trying to address #733, not complete yet (see also #735).

Browse Source 
Open issues: 1) The SNI logic 2) The fileout logic. 3) another section with ``trust_nosni -eq 4/8``

For 2): fileout is a general finding MEDIUM [1] which isn't in line now with the pr_*finding
in the section above anymore. It would make sense to punish HTTP services more than others.
Unfortunately he fileout statement cannot be moved below pr_svrty_medium/pr_svrty_high as
trustfinding_nosni hasn't been determined yet.

Fast solution would be probably to move the trustfinding_nosni section above the trustfinding
section.

Still 3) and a different trust over non-SNI makes it difficult -- e.g. Server has CN match only over
SNI but without SNI SAN matches. That's an edge case though which probably doesn't exist (like Bielefeld)

[1] That was WARN before. WARN should indicate a status of testssl that it cannot perform a check
This commit is contained in:
Dirk
2017-06-01 15:19:21 +02:00
parent 5890677d85
commit e035dabb13
1 changed files with 30 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
testssl.sh
View File

@@ -5774,12 +5774,11 @@ certificate_info() {
fileout "${json_prefix}san" "INFO" "subjectAltName (SAN) : $all_san" fileout "${json_prefix}san" "INFO" "subjectAltName (SAN) : $all_san"
else else
if [[ $SERVICE == "HTTP" ]]; then if [[ $SERVICE == "HTTP" ]]; then
# https://bugzilla.mozilla.org/show_bug.cgi?id=1245280, https://bugzilla.mozilla.org/show_bug.cgi?id=1245280 pr_svrty_high "missing (NOT ok)"; outln " -- Browsers are complaining"
pr_svrty_medium "missing (NOT ok)"; outln " -- Browser will complain soon" fileout "${json_prefix}san" "HIGH" "subjectAltName (SAN) : -- Browsers are complaining"
fileout "${json_prefix}san" "MEDIUM" "subjectAltName (SAN) : -- Browser will complain soon"
else else
pr_svrty_low "missing"; outln " -- no SAN is deprecated" pr_svrty_medium "missing"; outln " -- no SAN is deprecated"
fileout "${json_prefix}san" "LOW" "subjectAltName (SAN) : -- no SAN is deprecated" fileout "${json_prefix}san" "MEDIUM" "subjectAltName (SAN) : -- no SAN is deprecated"
fi fi
fi fi
out "$indent"; pr_bold " Issuer " out "$indent"; pr_bold " Issuer "
@@ -5841,19 +5840,19 @@ certificate_info() {
0) trustfinding="certificate does not match supplied URI" ;; 0) trustfinding="certificate does not match supplied URI" ;;
1) trustfinding="Ok via SAN" ;; 1) trustfinding="Ok via SAN" ;;
2) trustfinding="Ok via SAN wildcard" ;; 2) trustfinding="Ok via SAN wildcard" ;;
4) if $has_dns_sans; then 4) if "$has_dns_sans"; then
trustfinding="Ok via CN, but not SAN" trustfinding="via CN, but not SAN"
else else
trustfinding="Ok via CN" trustfinding="via CN only"
fi fi
;; ;;
5) trustfinding="Ok via SAN and CN" ;; 5) trustfinding="Ok via SAN and CN" ;;
6) trustfinding="Ok via SAN wildcard and CN" 6) trustfinding="Ok via SAN wildcard and CN"
;; ;;
8) if $has_dns_sans; then 8) if "$has_dns_sans"; then
trustfinding="Ok via CN wildcard, but not SAN" trustfinding="via CN wildcard, but not SAN"
else else
trustfinding="Ok via CN wildcard" trustfinding="via CN (wildcard) only"
fi fi
;; ;;
9) trustfinding="Ok via CN wildcard and SAN" 9) trustfinding="Ok via CN wildcard and SAN"
@@ -5865,9 +5864,25 @@ certificate_info() {
if [[ $trust_sni -eq 0 ]]; then if [[ $trust_sni -eq 0 ]]; then
pr_svrty_medium "$trustfinding" pr_svrty_medium "$trustfinding"
trust_sni="fail" trust_sni="fail"
elif "$has_dns_sans" && ( [[ $trust_sni -eq 4 ]] || [[ $trust_sni -eq 8 ]] ); then elif ( [[ $trust_sni -eq 4 ]] || [[ $trust_sni -eq 8 ]] ); then
if "$has_dns_sans"; then
if [[ $SERVICE == "HTTP" ]]; then
https://bugs.chromium.org/p/chromium/issues/detail?id=308330
https://bugzilla.mozilla.org/show_bug.cgi?id=1245280
https://www.chromestatus.com/feature/4981025180483584
pr_svrty_high "$trustfinding"; out " -- Browsers are complaining"
else
pr_svrty_medium "$trustfinding" pr_svrty_medium "$trustfinding"
trust_sni="warn" trust_sni="warn"
fi
else
if [[ $SERVICE == "HTTP" ]]; then
pr_svrty_high "$trustfinding"; out " -- Browsers are complaining"
else
# we punish this for non-HTTP as it is deprecated https://tools.ietf.org/html/rfc2818#section-3.1
pr_svrty_medium "$trustfinding"; out " -- CN only match is deprecated"
fi
fi
else else
pr_done_good "$trustfinding" pr_done_good "$trustfinding"
trust_sni="ok" trust_sni="ok"
@@ -5905,7 +5920,7 @@ certificate_info() {
if [[ "$trust_sni" == "ok" ]]; then if [[ "$trust_sni" == "ok" ]]; then
fileout "${json_prefix}trust" "INFO" "${trustfinding}${trustfinding_nosni}" fileout "${json_prefix}trust" "INFO" "${trustfinding}${trustfinding_nosni}"
else else
fileout "${json_prefix}trust" "WARN" "${trustfinding}${trustfinding_nosni}" fileout "${json_prefix}trust" "MEDIUM" ${trustfinding}${trustfinding_nosni}"
fi fi
out "$indent"; pr_bold " Chain of trust"; out " " out "$indent"; pr_bold " Chain of trust"; out " "