Merge branch 'crl_ocsp' into 2.9dev
OCSP revocation checks ran with a 100% success rate for the Alexa ~Top 1000 (basis: all hosts supporting TLS and having an OCSP URI)
This commit is contained in:
commit
f426a3bb21
77
testssl.sh
77
testssl.sh
|
@ -1404,10 +1404,10 @@ http_get() {
|
||||||
"$SNEAKY" && useragent="$UA_SNEAKY"
|
"$SNEAKY" && useragent="$UA_SNEAKY"
|
||||||
|
|
||||||
# automatically handles proxy vars via ENV
|
# automatically handles proxy vars via ENV
|
||||||
if which curl &>/dev/null; then
|
if type -p curl &>/dev/null; then
|
||||||
curl -s -A $''"$useragent"'' -o $dl "$1"
|
curl -s -A $''"$useragent"'' -o $dl "$1"
|
||||||
return $?
|
return $?
|
||||||
elif which wget &>/dev/null; then
|
elif type -p wget &>/dev/null; then
|
||||||
wget -q -U $''"$useragent"'' -O $dl "$1"
|
wget -q -U $''"$useragent"'' -O $dl "$1"
|
||||||
return $?
|
return $?
|
||||||
else
|
else
|
||||||
|
@ -1434,7 +1434,7 @@ ldap_get() {
|
||||||
local tmpfile="$2"
|
local tmpfile="$2"
|
||||||
local jsonID="$3"
|
local jsonID="$3"
|
||||||
|
|
||||||
if which curl &>/dev/null; then
|
if type -p curl &>/dev/null; then
|
||||||
ldif="$(curl -s "$crl")"
|
ldif="$(curl -s "$crl")"
|
||||||
[[ $? -eq 0 ]] || return 1
|
[[ $? -eq 0 ]] || return 1
|
||||||
awk '/certificateRevocationList/ { print $2 }' <<< "$ldif" | $OPENSSL base64 -d -A -out "$tmpfile" 2>/dev/null
|
awk '/certificateRevocationList/ { print $2 }' <<< "$ldif" | $OPENSSL base64 -d -A -out "$tmpfile" 2>/dev/null
|
||||||
|
@ -1494,6 +1494,49 @@ check_revocation_crl() {
|
||||||
return 0
|
return 0
|
||||||
}
|
}
|
||||||
|
|
||||||
|
check_revocation_ocsp() {
|
||||||
|
local uri="$1"
|
||||||
|
local jsonID="$2"
|
||||||
|
local tmpfile=""
|
||||||
|
local -i success
|
||||||
|
local code=""
|
||||||
|
local host_header=""
|
||||||
|
|
||||||
|
"$PHONE_OUT" || return 0
|
||||||
|
tmpfile=$TEMPDIR/${NODE}-${NODEIP}.${uri##*\/} || exit $ERR_FCREATE
|
||||||
|
host_header=${uri##http://}
|
||||||
|
host_header=${host_header%%/*}
|
||||||
|
$OPENSSL ocsp -no_nonce -header Host ${host_header} -url "$uri" \
|
||||||
|
-issuer $TEMPDIR/hostcert_issuer.pem -verify_other $TEMPDIR/intermediatecerts.pem \
|
||||||
|
-CAfile $TEMPDIR/intermediatecerts.pem -cert $HOSTCERT -text &> "$tmpfile"
|
||||||
|
if [[ $? -eq 0 ]] && fgrep -q "Response verify OK" "$tmpfile"; then
|
||||||
|
if grep -q "$HOSTCERT: good" "$tmpfile"; then
|
||||||
|
out ", "
|
||||||
|
pr_svrty_good "not revoked"
|
||||||
|
fileout "$jsonID" "OK" "not revoked"
|
||||||
|
elif fgrep -q "$HOSTCERT: revoked" "$tmpfile"; then
|
||||||
|
out ", "
|
||||||
|
pr_svrty_critical "revoked"
|
||||||
|
fileout "$jsonID" "CRITICAL" "revoked"
|
||||||
|
elif [[ $DEBUG -ge 2 ]]; then
|
||||||
|
outln
|
||||||
|
cat "$tmpfile"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
code="$(awk -F':' '/Code/ { print $NF }' $tmpfile)"
|
||||||
|
out ", "
|
||||||
|
pr_warning "error querying OCSP responder"
|
||||||
|
[[ -s "$tmpfile" ]] && code="empty ocsp response"
|
||||||
|
fileout "$jsonID" "WARN" "$code"
|
||||||
|
if [[ $DEBUG -ge 2 ]]; then
|
||||||
|
outln
|
||||||
|
[[ -s "$tmpfile" ]] && cat "$tmpfile" || echo "empty ocsp response"
|
||||||
|
else
|
||||||
|
out " ($code)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
wait_kill(){
|
wait_kill(){
|
||||||
local pid=$1 # pid we wait for or kill
|
local pid=$1 # pid we wait for or kill
|
||||||
local maxsleep=$2 # how long we wait before killing
|
local maxsleep=$2 # how long we wait before killing
|
||||||
|
@ -6488,6 +6531,7 @@ extract_certificates() {
|
||||||
echo "" > $TEMPDIR/intermediatecerts.pem
|
echo "" > $TEMPDIR/intermediatecerts.pem
|
||||||
else
|
else
|
||||||
cat level?.crt > $TEMPDIR/intermediatecerts.pem
|
cat level?.crt > $TEMPDIR/intermediatecerts.pem
|
||||||
|
cp level1.crt $TEMPDIR/hostcert_issuer.pem
|
||||||
rm level?.crt
|
rm level?.crt
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
@ -7548,9 +7592,27 @@ certificate_info() {
|
||||||
fileout "${jsonID}${json_postfix}" "INFO" "--"
|
fileout "${jsonID}${json_postfix}" "INFO" "--"
|
||||||
else
|
else
|
||||||
if [[ $(count_lines "$ocsp_uri") -eq 1 ]]; then
|
if [[ $(count_lines "$ocsp_uri") -eq 1 ]]; then
|
||||||
outln "$ocsp_uri"
|
out "$ocsp_uri"
|
||||||
|
if [[ "$expfinding" != "expired" ]]; then
|
||||||
|
check_revocation_ocsp "$ocsp_uri" "cert_ocspRevoked${json_postfix}"
|
||||||
|
fi
|
||||||
|
ret=$((ret +$?))
|
||||||
|
outln
|
||||||
else
|
else
|
||||||
out_row_aligned "$ocsp_uri" "$spaces"
|
first_ocsp=true
|
||||||
|
while read -r line; do
|
||||||
|
if "$first_ocsp"; then
|
||||||
|
first_ocsp=false
|
||||||
|
else
|
||||||
|
out "$spaces"
|
||||||
|
fi
|
||||||
|
out "$line"
|
||||||
|
if [[ "$expfinding" != "expired" ]]; then
|
||||||
|
check_revocation_ocsp "$line" "cert_ocspRevoked${json_postfix}"
|
||||||
|
ret=$((ret +$?))
|
||||||
|
fi
|
||||||
|
outln
|
||||||
|
done <<< "$ocsp_uri"
|
||||||
fi
|
fi
|
||||||
fileout "${jsonID}${json_postfix}" "INFO" "$ocsp_uri"
|
fileout "${jsonID}${json_postfix}" "INFO" "$ocsp_uri"
|
||||||
fi
|
fi
|
||||||
|
@ -7647,7 +7709,7 @@ run_server_defaults() {
|
||||||
local -i i n
|
local -i i n
|
||||||
local -i certs_found=0
|
local -i certs_found=0
|
||||||
local -i ret=0
|
local -i ret=0
|
||||||
local -a previous_hostcert previous_hostcert_txt previous_hostcert_type previous_intermediates keysize cipher
|
local -a previous_hostcert previous_hostcert_txt previous_hostcert_type previous_hostcert_issuer previous_intermediates keysize cipher
|
||||||
local -a ocsp_response ocsp_response_status sni_used tls_version ct
|
local -a ocsp_response ocsp_response_status sni_used tls_version ct
|
||||||
local -a ciphers_to_test certificate_type
|
local -a ciphers_to_test certificate_type
|
||||||
local -a -i success
|
local -a -i success
|
||||||
|
@ -7778,6 +7840,8 @@ run_server_defaults() {
|
||||||
previous_hostcert[certs_found]=$newhostcert
|
previous_hostcert[certs_found]=$newhostcert
|
||||||
previous_hostcert_txt[certs_found]="$($OPENSSL x509 -noout -text 2>>$ERRFILE <<< "$newhostcert")"
|
previous_hostcert_txt[certs_found]="$($OPENSSL x509 -noout -text 2>>$ERRFILE <<< "$newhostcert")"
|
||||||
previous_intermediates[certs_found]=$(cat $TEMPDIR/intermediatecerts.pem)
|
previous_intermediates[certs_found]=$(cat $TEMPDIR/intermediatecerts.pem)
|
||||||
|
previous_hostcert_issuer[certs_found]=""
|
||||||
|
[[ -n "${previous_intermediates[certs_found]}" ]] && previous_hostcert_issuer[certs_found]=$(cat $TEMPDIR/hostcert_issuer.pem)
|
||||||
[[ $n -ge 10 ]] && sni_used[certs_found]="" || sni_used[certs_found]="$SNI"
|
[[ $n -ge 10 ]] && sni_used[certs_found]="" || sni_used[certs_found]="$SNI"
|
||||||
tls_version[certs_found]="$DETECTED_TLS_VERSION"
|
tls_version[certs_found]="$DETECTED_TLS_VERSION"
|
||||||
previous_hostcert_type[certs_found]=" ${certificate_type[n]}"
|
previous_hostcert_type[certs_found]=" ${certificate_type[n]}"
|
||||||
|
@ -7947,6 +8011,7 @@ run_server_defaults() {
|
||||||
for (( i=1; i <= certs_found; i++ )); do
|
for (( i=1; i <= certs_found; i++ )); do
|
||||||
echo "${previous_hostcert[i]}" > $HOSTCERT
|
echo "${previous_hostcert[i]}" > $HOSTCERT
|
||||||
echo "${previous_intermediates[i]}" > $TEMPDIR/intermediatecerts.pem
|
echo "${previous_intermediates[i]}" > $TEMPDIR/intermediatecerts.pem
|
||||||
|
echo "${previous_hostcert_issuer[i]}" > $TEMPDIR/hostcert_issuer.pem
|
||||||
certificate_info "$i" "$certs_found" "${previous_hostcert_txt[i]}" \
|
certificate_info "$i" "$certs_found" "${previous_hostcert_txt[i]}" \
|
||||||
"${cipher[i]}" "${keysize[i]}" "${previous_hostcert_type[i]}" \
|
"${cipher[i]}" "${keysize[i]}" "${previous_hostcert_type[i]}" \
|
||||||
"${ocsp_response[i]}" "${ocsp_response_status[i]}" "${sni_used[i]}" "${ct[i]}"
|
"${ocsp_response[i]}" "${ocsp_response_status[i]}" "${sni_used[i]}" "${ct[i]}"
|
||||||
|
|
Loading…
Reference in New Issue