diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md deleted file mode 100644 index aec5b59..0000000 --- a/.github/ISSUE_TEMPLATE.md +++ /dev/null @@ -1,18 +0,0 @@ -Please make sure that you provide enough information so that we understand what your issue is about. - -0. Did you check the documentation in ~/doc/ or, if it is a different problem: Did you google for it? - -1. uname -a - -2. testssl version from the banner: testssl.sh -b 2>/dev/null | head -4 | tail -2 - -3. git log | head -1 (if running from git repo) - -4. openssl version used by testssl.sh: testssl.sh -b 2>/dev/null | awk -F':' '/openssl/ { print $2}' - -5. steps to reproduce: testssl.sh or docker command line, if possible incl. host - -6. what exactly was happening, output is needed - -7. what did you expect instead? - diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..3ea885a --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,30 @@ +--- +name: Bug report +about: Create a report to help us improve +title: "[BUG / possible BUG]" +labels: '' +assignees: '' + +--- + +_**Please don't remove this template. We would like to reproduce the bug and need concise information. **_ + + +**Command line / docker command to reproduce** +In addition the target of your scan would be helpful. If you don't want to disclose it publicly: ``grep SWCONTACT testssl.sh``. + + +**Expected behavior** +A clear and concise description of what you expected to happen. + + +**Your system (please complete the following information):** + - OS: ``awk -F\" '/PRETTY_NAME/ { print $2 }' /etc/os-release`` + - Platform: ``uname -srm`` + - Version: ``testssl.sh -b 2>/dev/null | head -4 | tail -2`` + - Version if running from git repo: ``git log | head -1`` + - OpenSSL: ``testssl.sh -b 2>/dev/null | awk -F':' '/openssl/ { print $2}'`` + + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..750bbb4 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,27 @@ +--- +name: Feature request +about: Suggest an idea for this project +title: "[Feature request]" +labels: '' +assignees: '' + +--- + +--- +name: Feature request +about: Suggest an idea for this project +title: "[Feature Request]" +labels: '' +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. +`` diff --git a/.github/ISSUE_TEMPLATE/other-issues---question.md b/.github/ISSUE_TEMPLATE/other-issues---question.md new file mode 100644 index 0000000..898c032 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/other-issues---question.md @@ -0,0 +1,10 @@ +--- +name: Other issues / Question +about: Anything else which is not covered by a bug report or feature request +title: '' +labels: '' +assignees: '' + +--- + + diff --git a/.gitignore b/.gitignore index cc2ec36..8067262 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ .DS_Store tmp.json tmp.html +*_p*-????????-????.html *.bak *.json *.csv diff --git a/.travis.yml b/.travis.yml index 950e14b..d1d660b 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,4 +1,5 @@ language: perl +dist: bionic perl: - "5.26" addons: diff --git a/CHANGELOG.md b/CHANGELOG.md index 289f81a..0b21696 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,33 @@ ## Change Log +### Features implemented / improvements in 3.1dev + +* Extend Server (cipher) preference: always now in wide mode instead of running all ciphers in the end (per default) +* Improved compatibility with OpenSSL 3.0 +* Renamed PFS/perfect forward secrecy --> FS/forward secrecy +* Improved mass testing +* Align better colors of ciphers with standard cipherlists +* Added several ciphers to colored ciphers +* Percent output char problem fixed +* Several display/output fixes +* BREACH check: list all compression methods and add brotli +* test for winshock vulnerability +* Security fix: DNS input +* Don't use external pwd anymore +* STARTTLS: XMPP server support +* Code improvements to STARTTLS +* Detect better when no STARTTLS is offered +* Rating (SSL Labs, not complete) +* Don't penalize missing trust in rating when CA not in Java store +* Added support for certificates with EdDSA signatures and pubilc keys +* --add-ca can also now be a directory with \*.pem files +* Warning of 398 day limit for certificates issued after 2020/9/1 +* Added environment variable for amount of attempts for ssl renegotiation check +* Added --user-agent argument to support using a custom User Agent +* Added --overwrite argument to support overwriting output files without warning +* Headerflag X-XSS-Protection is labeled as INFO + ### Features implemented / improvements in 3.0 * Full support of TLS 1.3, shows also drafts supported diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 48acd15..540ad04 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,15 +1,17 @@ ### Contributions / participation -is always welcome. +is always welcome! -Note please that following is strongly requested: +Note please the following: -* One PR per feature or bug fix or improvement. -* Document your PR properly, both in the PR and/or commit message and in the code. -* Please test your changes thoroughly as reliability is important for this project. -* Follow the length [coding guideline](https://github.com/drwetter/testssl.sh/wiki/Coding-Style). +* Please read at least the [coding convention](https://github.com/drwetter/testssl.sh/Coding_Convention.md). +* One PR per feature or bug fix or improvement. Please do not mix issues. +* Document your PR, both in the PR and/or commit message and in the code. +* Please test your changes thoroughly as reliability is important for this project. You may want to check different servers with different settings. +* Travis runs automatically when anything is committed/PR'd. You should check any complains from Travis. Beforehand you can check with `prove -v`. +* If it's a new feature please consider writing a unit test for it. You can use e.g. `t/20_baseline_ipv4_http.t` as a template. The general documentation for [Test::More](https://perldoc.perl.org/Test/More.html) is a good start. +* If it's a new feature it would need to be documented in the appropriate section in `help()` and in `~/doc/testssl.1.md` - -If it's a new feature please consider writing a unit test for it. There's a directory ~/t/ which Travis runs automatically when anything is committed. You can use e.g. `20_baseline_ipv4_http.t` as a template. There's also [general documentation for Test::More](https://perldoc.perl.org/Test/More.html). +For questions just open an issue. diff --git a/CREDITS.md b/CREDITS.md index 38ccced..beee57a 100644 --- a/CREDITS.md +++ b/CREDITS.md @@ -39,6 +39,10 @@ Full contribution, see git log. * Christoph Badura - NetBSD fixes +* Jim Blankendaal + - maximum certificate lifespan of 398 days + - ssl renegotiation amount variable + * Frank Breedijk - Detection of insecure redirects - JSON and CSV output @@ -46,9 +50,9 @@ Full contribution, see git log. - Client simulations - CI integration, some test cases for it - * Steven Danneman - - Postgres and MySQL STARTTLS support - - MongoDB support +* Steven Danneman + - Postgres and MySQL STARTTLS support + - MongoDB support * Christian Dresen - Dockerfile @@ -78,6 +82,9 @@ Full contribution, see git log. * Hubert Kario - helped with avoiding accidental TCP fragmentation +* Magnus Larsen + - SSL Labs Rating + * Jacco de Leeuw - skip checks which might trigger an IDS ($OFFENSIVE / --ids-friendly) @@ -140,6 +147,9 @@ Full contribution, see git log. * Dmitri S - inspiration & help for Darwin port +* Jonas Schäfer + - XMPP server patch + * Marcin Szychowski - Quick'n'dirty client certificate support diff --git a/Coding_Convention.md b/Coding_Convention.md new file mode 100644 index 0000000..03122d1 --- /dev/null +++ b/Coding_Convention.md @@ -0,0 +1,73 @@ +## Coding Style + +### PR + +You'd make the life of the maintainers easier if you submit only _one_ patch with _one_ functional change per PR. + +### General + * Portability is important: Don't use highly system depended binaries (`rpm`, `ip/ifconfig`, ..) as it is not portable. Or it would require lots of efforts (like C's #ifdefs) to be portable plus the code gets ugly. + * Don't use additional binaries. + * If you really, really need to use an additional binary make sure it's available on the system before calling it. (Example: see `timeout`.) + * Keep in mind that binaries might come in different flavors. Especially with ``sed`` you need to be careful as GNU sed is only 80% compatible with BSD sed (`sed -i`,` \n`, `\t`, etc.). + * Avoid checking for the operating system when using a feature of a binary or an OS. E.g. FreeBSD or MacOSX may or may not have GNU binaries installed, so it's better to check a capability of the binary instead. See how `HAS_*` variables are set. + + +### Documentation + +Some people really read that ! New features would need to be documented in the appropriate section in `help()` and in `~/doc/testssl.1.md`. + +### Coding + +#### Shell / bash + +Bash is actually quite powerful -- not only with respect to sockets. It's not as mighty as perl or python, but there are a lot of neat features. Here's how you make use of them. Besides those short hints here there's a wealth of information of there. One good resource is the [bash hackers wiki](https://wiki.bash-hackers.org/start). + +* Don't use backticks anymore, use `$(..)` instead +* Use double square `[[]]` brackets (_conditional expressions)_ instead of single square `[]` brackets +* In double square brackets avoid quoting at the right hand side if not necessary, see [bash hackers wiki](https://wiki.bash-hackers.org/syntax/ccmd/conditional_expression). For regex matching (`=~`) you shouldn't quote at all. +* The [BashPitfalls](http://mywiki.wooledge.org/BashPitfalls) is a good read! +* Whenever possible try to avoid `tr` `sed` `awk` and use bash internal functions instead, see e.g. [bash shell parameter substitution](http://www.cyberciti.biz/tips/bash-shell-parameter-substitution-2.html). It slower as it forks, fopens and pipes back the result. +* `read` often can replace `awk`: `IFS=, read -ra a b c <<< "$line_with_comma"` +* Bash can also deal perfectly with regular expressions, see e.g. [here](https://www.networkworld.com/article/2693361/unix-tip-using-bash-s-regular-expressions.html) and [here](https://unix.stackexchange.com/questions/421460/bash-regex-and-https-regex101-com). You can as well have a look @ `is_ipv4addr()` or `is_ipv6addr()`. +* If you still need to use any of `tr`, `sed` and `awk`: try to avoid a mix of several external binaries e.g. if you can achieve the same with e.g. `awk`. +* Be careful with very advanced bash features. Mac OS X is still using bash version 3 ([differences](http://tldp.org/LDP/abs/html/bashver4.html), see also [bash hackers wiki](https://wiki.bash-hackers.org/scripting/bashchanges)). +* Always use a return value for a function/method. 0 means all is fine. +* Make use of [shellcheck](https://github.com/koalaman/shellcheck) if possible + + +#### Shell / testssl.sh specific +* Make use the short functions / methods (code starts from `###### START helper function definitions`) like + * `count_words()` / `count_lines()` / `count_ciphers()` + * `strip_lf()` / `strip_spaces()` + * `toupper()` / `tolower()` + * `newline_to_spaces()` + * `is_number()` / `is_ipv4addr()` + * .. and much more +* Security: + * Watch out for any input especially (but not only) supplied from the server. Input should never be trusted. + * Unless you're really sure where the values come from, variables need to be put in quotes. + * You can use `safe_echo()` when processing input which does some input validation. + * Use ``out()`` or similar output functions when writing something back to the user. +* Use `$OPENSSL` instead of `openssl`. The latter is highly system depended and also $OPENSSL is a binary which capabilities are checked internally before using it, independent whether the supplied one is being used or another one. + +#### Variables +* Use "speaking variables" but don't overdo it with the length +* No camelCase please. We distinguish between lowercase and uppercase only + * Global variables + * use them only when really necessary + * in CAPS + * initialize them + * use ``readonly`` and use typing (variable types) if possible +* Local variables + * are lower case + * declare them before usage (`local`) + * initialize them + +### Misc + +* If you're implementing a new feature a cmd line switch, there has to be also a global ENV variable which can be used without the switch (see e.g. `SNEAKY`, `ASSUME_HTTP` or `ADDTL_CA_FILES`) +* Test before doing a PR! Best if you check with two bad and two good examples which should then work as expected. Maybe compare results e.g. with SSLlabs. +* Unit tests are done automatically done with Perl using Travis. The trigger is `~/.travis.yml`. The general documentation for [Test::More](https://perldoc.perl.org/Test/More.html) is a good start. You are encouraged to write own checks. You can use e.g. `t/20_baseline_ipv4_http.t` as an example. +* If it's an OpenSSL feature you want to use and it could be not available for older OpenSSL versions testssl.sh needs to find out whether OpenSSL has that feature. Best do this with OpenSSL itself and not by checking the version as some vendors do backports. See the examples for `HAS_SSL2` or proxy option check of OpenSSL in `check_proxy()`. +* If a feature of OpenSSL is not available you need to tell this the user by using `pr_warning*()`. Or accordingly with `fatal()` if a continuation of the program doesn't make sense anymore. + diff --git a/Dockerfile b/Dockerfile index 11e2759..42a6941 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,16 +1,19 @@ FROM alpine:3.11 -RUN apk update && apk upgrade && apk add --no-cache bash procps drill git coreutils libidn curl - -RUN addgroup testssl -RUN adduser -G testssl -g "testssl user" -s /bin/bash -D testssl - -RUN ln -s /home/testssl/testssl.sh /usr/local/bin/ +RUN apk update && \ + apk upgrade && \ + apk add --no-cache bash procps drill git coreutils libidn curl && \ + addgroup testssl && \ + adduser -G testssl -g "testssl user" -s /bin/bash -D testssl && \ + ln -s /home/testssl/testssl.sh /usr/local/bin/ && \ + mkdir -m 755 -p /home/testssl/etc /home/testssl/bin USER testssl WORKDIR /home/testssl/ -RUN git clone --depth=1 https://github.com/drwetter/testssl.sh.git . +COPY --chown=testssl:testssl etc/. /home/testssl/etc/ +COPY --chown=testssl:testssl bin/. /home/testssl/bin/ +COPY --chown=testssl:testssl testssl.sh /home/testssl/ ENTRYPOINT ["testssl.sh"] diff --git a/Readme.md b/Readme.md index eb7d9b4..b9833c7 100644 --- a/Readme.md +++ b/Readme.md @@ -1,8 +1,11 @@ ## Intro -[![Build Status](https://travis-ci.org/drwetter/testssl.sh.svg?branch=master)](https://travis-ci.org/drwetter/testssl.sh) + +[![Travis CI Status](https://travis-ci.org/drwetter/testssl.sh.svg?branch=3.1dev)](https://travis-ci.org/drwetter/testssl.sh) [![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/drwetter/testssl.sh?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) +[![License](https://img.shields.io/github/license/drwetter/testssl.sh)](https://github.com/drwetter/testssl.sh/LICENSE) +[![Docker](https://img.shields.io/docker/pulls/drwetter/testssl.sh)](https://github.com/drwetter/testssl.sh/blob/3.1dev/Dockerfile.md) `testssl.sh` is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as some @@ -14,11 +17,9 @@ cryptographic flaws. * Machine readable output (CSV, two JSON formats) * No need to install or to configure something. No gems, CPAN, pip or the like. * Works out of the box: Linux, OSX/Darwin, FreeBSD, NetBSD, MSYS2/Cygwin, WSL (bash on Windows). Only OpenBSD needs bash. -* A Dockerfile is provided, there's also an offical container @ dockerhub. -* Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not - only web servers at port 443. -* Toolbox: Several command line options help you to run *your* test and - configure *your* output. +* A Dockerfile is provided, there's also an offical container build @ dockerhub. +* Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not only web servers at port 443. +* Toolbox: Several command line options help you to run *your* test and configure *your* output. * Reliability: features are tested thoroughly. * Privacy: It's only you who sees the result, not a third party. * Freedom: It's 100% open source. You can look at the code, see what's going on. @@ -27,15 +28,18 @@ cryptographic flaws. ### License This software is free. You can use it under the terms of GPLv2, see LICENSE. -In addition starting from version 3.0rc1 if you're offering a scanner based on testssl.sh -as a public and / or paid service in the internet you need to mention to your audience that you're using -this program and where to get this program from. + +Attribution is important for the future of this project -- also in the +internet. Thus if you're offering a scanner based on testssl.sh as a public and/or +paid service in the internet you are strongly encouraged to mention to your audience +that you're using this program and where to get this program from. That helps us +to get bugfixes, other feedback and more contributions. ### Compatibility -testssl.sh is working on every Linux/BSD distribution out of the box. Latest by 2.9dev +Testssl.sh is working on every Linux/BSD distribution out of the box. Latest by 2.9dev most of the limitations of disabled features from the openssl client are gone -due to bash-socket-based checks. As a result you can also use e.g. LibreSSL or OpenSSL +due to bash-socket-based checks. As a result you can also use e.g. LibreSSL or OpenSSL >= 1.1.1 . testssl.sh also works on other unixoid system out of the box, supposed they have `/bin/bash` >= version 3.2 and standard tools like sed and awk installed. An implicit (silent) check for binaries is done when you start testssl.sh . System V needs probably @@ -45,24 +49,26 @@ Update notification here or @ [twitter](https://twitter.com/drwetter). ### Installation -You can download testssl.sh by cloning this git repository: +You can download testssl.sh branch 3.1dev just by cloning this git repository: git clone --depth 1 https://github.com/drwetter/testssl.sh.git -Or help yourself downloading the ZIP archive [https://github.com/drwetter/testssl.sh/archive/3.0.zip](https://github.com/drwetter/testssl.sh/archive/3.0.zip). Just ``cd`` to the directory created (=INSTALLDIR) and run it off there. +Think of 3.1dev like a rolling release, see below. For the stable version help yourself by downloading the [ZIP](https://github.com/drwetter/testssl.sh/archive/3.0.2.zip) or [tar.gz](https://github.com/drwetter/testssl.sh/archive/3.0.2.zip) archive. Just ``cd`` to the directory created (=INSTALLDIR) and run it off there. #### Docker Testssl.sh has minimal requirements. As stated you don't have to install or build anything. You can just run it from the pulled/cloned directory. Still if you don't want to pull the github repo to your directory of choice you can pull a container from dockerhub and run it: + ``` -docker run --rm -ti drwetter/testssl.sh +docker run --rm -ti drwetter/testssl.sh:3.1dev ``` + Or if you have cloned this repo you also can just ``cd`` to the INSTALLDIR and run ``` docker build . ``` -followed by ``docker exec -ti `` where ``ID`` is the identifier in the last line from the build command like +followed by ``docker run -ti `` where ``ID`` is the identifier in the last line from the build command like ``` ---> 889fa2f99933 @@ -71,16 +77,15 @@ Successfully built 889fa2f99933 ### Status -We're currently in the developement pase of 3.1dev. That means **occasionally** things can break. But we plan to keep it usable, think more of a rolling development. For missing critical purposes or when you don't like changes you should wait a bit until we're in the release phase. As soon as we reach that or the "dev" disappears in the branch you should rather use this version. - -Support for 2.9.5 has been dropped. Supported is 3.0 only. +We're currently in the development phase, version 3.1dev. 3.1dev will eventually become 3.2. Bigger features are developed in a separate branch before merged into 3.1dev to avoid hiccups or inconsistencies. Albeit we try to keep 3.1dev as solid as possible things will certainly change in 3.1dev. So if you need stability the 3.0 branch is better for you. Think of the 3.1dev branch like a rolling release. +Support for 2.9.5 has been dropped. Supported is 3.0.x only. ### Documentation * .. it is there for reading. Please do so :-) -- at least before asking questions. See man page in groff, html and markdown format in `~/doc/`. * [https://testssl.sh/](https://testssl.sh/) will help to get you started. -* Will Hunt provides a longer, good [description](https://www.4armed.com/blog/doing-your-own-ssl-tls-testing/) for the (older) version 2.8, including useful background info. +* For the (older) version 2.8 will Hunt provides a longer, good [description](https://www.4armed.com/blog/doing-your-own-ssl-tls-testing/), including useful background info. ### Contributing @@ -102,9 +107,12 @@ You can also debug yourself, see [here](https://github.com/drwetter/testssl.sh/w Please address questions not specifically to the code of testssl.sh to the respective projects below. -#### Cool web frontend +#### Web frontend * https://github.com/TKCERT/testssl.sh-webfrontend +#### Free to use Web frontend + commercial API +* https://inspect.rapydblok.com (see also https://inspect.rapydblok.com/about) + #### Mass scanner w parallel scans and elastic searching the results * https://github.com/TKCERT/testssl.sh-masscan @@ -114,6 +122,10 @@ Please address questions not specifically to the code of testssl.sh to the respe #### Privacy checker using testssl.sh * https://privacyscore.org +#### Nagios / Icinga Plugins +* https://github.com/dnmvisser/nagios-testssl (Python 3) +* https://gitgud.malvager.net/Wazakindjes/icinga2_plugins/src/master/check_testssl.sh (Shell) + #### Brew package * see [#233](https://github.com/drwetter/testssl.sh/issues/233) and diff --git a/doc/testssl.1 b/doc/testssl.1 index 822fbbd..57c7a4f 100644 --- a/doc/testssl.1 +++ b/doc/testssl.1 @@ -1,7 +1,7 @@ .\" generated with Ronn/v0.7.3 .\" http://github.com/rtomayko/ronn/tree/0.7.3 . -.TH "TESTSSL" "1" "January 2020" "" "" +.TH "TESTSSL" "1" "May 2020" "" "" . .SH "NAME" \fBtestssl\fR @@ -43,13 +43,13 @@ Any OpenSSL or LibreSSL version is needed as a helper\. Unlike previous versions 1) SSL/TLS protocol check . .P -2) standard cipher categories to give you upfront an idea for the ciphers supported +2) standard cipher categories . .P -3) checks (perfect) forward secrecy: ciphers and elliptical curves +3) server\'s cipher preferences (server order?) . .P -4) server preferences (server order) +4) forward secrecy: ciphers and elliptical curves . .P 5) server defaults (certificate info, TLS extensions, session information) @@ -64,7 +64,10 @@ Any OpenSSL or LibreSSL version is needed as a helper\. Unlike previous versions 8) testing each of 370 preconfigured ciphers . .P -9) client simulation +8) client simulation +. +.P +9) rating . .SH "OPTIONS AND PARAMETERS" Options are either short or long options\. Any long or short option requiring a value can be called with or without an equal sign\. E\.g\. \fBtestssl\.sh \-t=smtp \-\-wide \-\-openssl=/usr/bin/openssl \fR (short options with equal sign) is equivalent to \fBtestssl\.sh \-\-starttls smtp \-\-wide \-\-openssl /usr/bin/openssl \fR (long option without equal sign)\. Some command line options can also be preset via ENV variables\. \fBWIDE=true OPENSSL=/usr/bin/openssl testssl\.sh \-\-starttls=smtp \fR would be the equivalent to the aforementioned examples\. Preference has the command line over any environment variables\. @@ -72,17 +75,17 @@ Options are either short or long options\. Any long or short option requiring a .P \fB\fR or \fB\-\-file \fR always needs to be the last parameter\. . -.SS "BANNER OPTIONS" -\fB\-\-help\fR (or no arg) display command line help +.SS "BANNER OPTIONS (standalone)" +\fB\-\-help\fR (or no arg) displays command line help . .P -\fB\-b, \-\-banner\fR displays testssl\.sh banner, including license, usage conditions, version of testssl\.sh, detected openssl version, its path to it, # of ciphers of openssl, its build date and the architecture +\fB\-b, \-\-banner\fR displays testssl\.sh banner, including license, usage conditions, version of testssl\.sh, detected openssl version, its path to it, # of ciphers of openssl, its build date and the architecture\. . .P \fB\-v, \-\-version\fR same as before . .P -\fB\-V [pattern] , \-\-local [pattern]\fR pretty print all local ciphers supported by openssl version\. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below\. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits\. It does a word pattern match for non\-numbers, for number just a normal match applies\. Numbers here are defined as [0\-9,A\-F]\. This means (attention: catch) that the pattern CBC is matched as non\-word, but AES as word\. +\fB\-V [pattern], \-\-local [pattern]\fR pretty print all local ciphers supported by openssl version\. If a pattern is supplied it performs a match (ignore case) on any of the strings supplied in the wide output, see below\. The pattern will be searched in the any of the columns: hexcode, cipher suite name (OpenSSL or IANA), key exchange, encryption, bits\. It does a word pattern match for non\-numbers, for number just a normal match applies\. Numbers here are defined as [0\-9,A\-F]\. This means (attention: catch) that the pattern CBC is matched as non\-word, but AES as word\. This option also accepts -\fB-openssl=\fR\. . .SS "INPUT PARAMETERS" \fBURI\fR can be a hostname, an IPv4 or IPv6 address (restriction see below) or an URL\. IPv6 addresses need to be in square brackets\. For any given parameter port 443 is assumed unless specified by appending a colon and a port number\. The only preceding protocol specifier allowed is \fBhttps\fR\. You need to be aware that checks for an IP address might not hit the vhost you want\. DNS resolution (A/AAAA record) is being performed unless you have an \fB/etc/hosts\fR entry for the hostname\. @@ -125,7 +128,7 @@ Please note that \fBfname\fR has to be in Unix format\. DOS carriage returns won \fB\-\-warnings \fR\. The warnings parameter determines how testssl\.sh will deal with situations where user input normally will be necessary\. There are two options\. \fBbatch\fR doesn\'t wait for a confirming keypress when a client\- or server\-side probem is encountered\. As of 3\.0 it just then terminates the particular scan\. This is automatically chosen for mass testing (\fB\-\-file\fR)\. \fBoff\fR just skips the warning, the confirmation but continues the scan, independent whether it makes sense or not\. Please note that there are conflicts where testssl\.sh will still ask for confirmation which are the ones which otherwise would have a drastic impact on the results\. Almost any other decision will be made in the future as a best guess by testssl\.sh\. The same can be achieved by setting the environment variable \fBWARNINGS\fR\. . .P -\fB\-\-connect\-timeout \fR This is useful for socket TCP connections to a node\. If the node does not complete a TCP handshake (e\.g\. because it is down or behind a firewall or there\'s an IDS or a tarpit) testssl\.sh may ususally hang for around 2 minutes or even much more\. This parameter instructs testssl\.sh to wait at most \fBseconds\fR for the handshake to complete before giving up\. This option only works if your OS has a timeout binary installed\. CONNECT_TIMEOUT is the corresponding enviroment variable\. +\fB\-\-connect\-timeout \fR This is useful for socket TCP connections to a node\. If the node does not complete a TCP handshake (e\.g\. because it is down or behind a firewall or there\'s an IDS or a tarpit) testssl\.sh may usually hang for around 2 minutes or even much more\. This parameter instructs testssl\.sh to wait at most \fBseconds\fR for the handshake to complete before giving up\. This option only works if your OS has a timeout binary installed\. CONNECT_TIMEOUT is the corresponding environment variable\. . .P \fB\-\-openssl\-timeout \fR This is especially useful for all connects using openssl and practically useful for mass testing\. It avoids the openssl connect to hang for ~2 minutes\. The expected parameter \fBseconds\fR instructs testssl\.sh to wait before the openssl connect will be terminated\. The option is only available if your OS has a timeout binary installed\. As there are different implementations of \fBtimeout\fR: It automatically calls the binary with the right parameters\. OPENSSL_TIMEOUT is the equivalent environment variable\. @@ -134,7 +137,7 @@ Please note that \fBfname\fR has to be in Unix format\. DOS carriage returns won \fB\-\-basicauth \fR This can be set to provide HTTP basic auth credentials which are used during checks for security headers\. BASICAUTH is the ENV variable you can use instead\. . .SS "SPECIAL INVOCATIONS" -\fB\-t , \-\-starttls \fR does a default run against a STARTTLS enabled \fBprotocol\fR\. \fBprotocol\fR must be one of \fBftp\fR, \fBsmtp\fR, \fBpop3\fR, \fBimap\fR, \fBxmpp\fR, \fBtelnet\fR, \fBldap\fR, \fBirc\fR, \fBlmtp\fR, \fBnntp\fR, \fBpostgres\fR, \fBmysql\fR\. For the latter four you need e\.g\. the supplied OpenSSL or OpenSSL version 1\.1\.1\. Please note: MongoDB doesn\'t offer a STARTTLS connection, LDAP currently only works with \fB\-\-ssl\-native\fR\. \fBtelnet\fR and \fBirc\fR is WIP\. +\fB\-t , \-\-starttls \fR does a default run against a STARTTLS enabled \fBprotocol\fR\. \fBprotocol\fR must be one of \fBftp\fR, \fBsmtp\fR, \fBpop3\fR, \fBimap\fR, \fBxmpp\fR, \fBxmpp-server\fR, \fBtelnet\fR, \fBldap\fR, \fBirc\fR, \fBlmtp\fR, \fBnntp\fR, \fBpostgres\fR, \fBmysql\fR\. For the latter four you need e\.g\. the supplied OpenSSL or OpenSSL version 1\.1\.1\. Please note: MongoDB doesn\'t offer a STARTTLS connection, LDAP currently only works with \fB\-\-ssl\-native\fR\. \fBtelnet\fR and \fBirc\fR is WIP\. . .P \fB\-\-xmpphost \fR is an additional option for STARTTLS enabled XMPP: It expects the jabber domain as a parameter\. This is only needed if the domain is different from the URI supplied\. @@ -164,10 +167,12 @@ Please note that \fBfname\fR has to be in Unix format\. DOS carriage returns won \fB\-\-assuming\-http\fR testssl\.sh normally does upfront an application protocol detection\. In cases where HTTP cannot be automatically detected you may want to use this option\. It enforces testssl\.sh not to skip HTTP specific tests (HTTP header) and to run a browser based client simulation\. Please note that sometimes also the severity depends on the application protocol, e\.g\. SHA1 signed certificates, the lack of any SAN matches and some vulnerabilities will be punished harder when checking a web server as opposed to a mail server\. . .P -\fB\-n, \-\-nodns \fR tells testssl\.sh which DNS lookups should be performed\. \fBmin\fR uses only forward DNS resolution (A and AAAA record or MX record) and skips CAA lookups and PTR records from the IP address back to a DNS name\. \fBnone\fR performs no DNS lookups at all\. For the latter you either have to supply the IP address as a target, to use \fB\-\-ip\fR or have the IP address in \fB/etc/hosts\fR\. The use of the switch is only useful if you either can\'t or are not willing to perform DNS lookups\. The latter can apply e\.g\. to some pentests\. In general this option could e\.g\. help you to avoid timeouts by DNS lookups\. \fBNODNS\fR is the enviroment variable for this\. +\fB\-n, \-\-nodns \fR tells testssl\.sh which DNS lookups should be performed\. \fBmin\fR uses only forward DNS resolution (A and AAAA record or MX record) and skips CAA lookups and PTR records from the IP address back to a DNS name\. \fBnone\fR performs no DNS lookups at all\. For the latter you either have to supply the IP address as a target, to use \fB\-\-ip\fR or have the IP address in \fB/etc/hosts\fR\. The use of the switch is only useful if you either can\'t or are not willing to perform DNS lookups\. The latter can apply e\.g\. to some pentests\. In general this option could e\.g\. help you to avoid timeouts by DNS lookups\. \fBNODNS\fR is the environment variable for this\. . .P \fB\-\-sneaky\fR For HTTP header checks testssl\.sh uses normally the server friendly HTTP user agent \fBTLS tester from ${URL}\fR\. With this option your traces are less verbose and a Firefox user agent is being used\. Be aware that it doesn\'t hide your activities\. That is just not possible (environment preset via \fBSNEAKY=true\fR)\. +.P +\fB\-\-user\-agent\fR tells testssl.sh to use the supplied HTTP user agent instead of the standard user agent \fBTLS tester from ${URL}\fR\. . .P \fB\-\-ids\-friendly\fR is a switch which may help to get a scan finished which otherwise would be blocked by a server side IDS\. This switch skips tests for the following vulnerabilities: Heartbleed, CCS Injection, Ticketbleed and ROBOT\. The environment variable OFFENSIVE set to false will achieve the same result\. Please be advised that as an alternative or as a general approach you can try to apply evasion techniques by changing the variables USLEEP_SND and / or USLEEP_REC and maybe MAX_WAITSOCK\. @@ -176,7 +181,7 @@ Please note that \fBfname\fR has to be in Unix format\. DOS carriage returns won \fB\-\-phone\-out\fR Checking for revoked certificates via CRL and OCSP is not done per default\. This switch instructs testssl\.sh to query external \-\- in a sense of the current run \-\- URIs\. By using this switch you acknowledge that the check might have privacy issues, a download of several megabytes (CRL file) may happen and there may be network connectivity problems while contacting the endpoint which testssl\.sh doesn\'t handle\. PHONE_OUT is the environment variable for this which needs to be set to true if you want this\. . .P -\fB\-\-add\-ca \fR enables you to add your own CA(s) for trust chain checks\. \fBcafile\fR can be a single path or multiple paths as a comma separated list of root CA files\. Internally they will be added during runtime to all CA stores\. This is (only) useful for internal hosts whose certificates is issued by internal CAs\. Alternatively ADDITIONAL_CA_FILES is the environment variable for this\. +\fB\-\-add\-ca \fR enables you to add your own CA(s) in PEM format for trust chain checks\. \fBCAfile\fR can be a directory containing files with a \.pem extension, a single file or multiple files as a comma separated list of root CAs\. Internally they will be added during runtime to all CA stores\. This is (only) useful for internal hosts whose certificates are issued by internal CAs\. Alternatively ADDTL_CA_FILES is the environment variable for this\. . .SS "SINGLE CHECK OPTIONS" Any single check switch supplied as an argument prevents testssl\.sh from doing a default run\. It just takes this and if supplied other options and runs them \- in the order they would also appear in the default run\. @@ -209,12 +214,12 @@ Any single check switch supplied as an argument prevents testssl\.sh from doing \fBAverage grade Ciphers\fR: \'HIGH:MEDIUM:AES:CAMELLIA:ARIA:!IDEA:!CHACHA20:!3DES:!RC2:!RC4:!AESCCM8:!AESCCM:!AESGCM:!ARIAGCM:!aNULL\' . .IP "\(bu" 4 -\fBStrong grade Ciphers\fR (AEAD): \'AESGCM:CHACHA20:AESGCM:CamelliaGCM:AESCCM8:AESCCM\' +\fBStrong grade Ciphers\fR (AEAD): \'AESGCM:CHACHA20:CamelliaGCM:AESCCM\' . .IP "" 0 . .P -\fB\-f, \-\-pfs, \-\-fs,\-\-nsa\fR Checks robust (perfect) forward secrecy key exchange\. "Robust" means that ciphers having intrinsic severe weaknesses like Null Authentication or Encryption, 3DES and RC4 won\'t be considered here\. There shouldn\'t be the wrong impression that a secure key exchange has been taking place and everything is fine when in reality the encryption sucks\. Also this section lists the available elliptical curves and Diffie Hellman groups, as well as FFDHE groups (TLS 1\.2 and TLS 1\.3)\. +\fB\-f, \-\-fs, \-\-nsa, \-\-forward\-secrecy\fR Checks robust forward secrecy key exchange\. "Robust" means that ciphers having intrinsic severe weaknesses like Null Authentication or Encryption, 3DES and RC4 won\'t be considered here\. There shouldn\'t be the wrong impression that a secure key exchange has been taking place and everything is fine when in reality the encryption sucks\. Also this section lists the available elliptical curves and Diffie Hellman groups, as well as FFDHE groups (TLS 1\.2 and TLS 1\.3)\. . .P \fB\-p, \-\-protocols\fR checks TLS/SSL protocols SSLv2, SSLv3, TLS 1\.0 through TLS 1\.3 and for HTTP: SPDY (NPN) and ALPN, a\.k\.a\. HTTP/2\. For TLS 1\.3 several drafts (from 18 on) and final are supported and being tested for\. @@ -238,8 +243,7 @@ session resumption capabilities, Time skew relative to localhost (most server implementations return random values)\. . .IP "\(bu" 4 -Several certificate information -.RS +. .IP "\(bu" 4 signature algorithm, . @@ -275,14 +279,14 @@ displaying DNS Certification Authority Authorization resource record . .IP "\(bu" 4 Certificate Transparency info (if provided by server)\. -.RE +. .IP "" 0 . .IP "" 0 . .P -For the trust chain check 5 certificate stores are provided\. If the test against one of the trust stores failed, the one is being identified and the reason for the failure is displayed \- in addition the ones which succeeded are displayed too\. You can configure your own CA via ADDITIONAL_CA_FILES, see section \fBFILES\fR below\. If the server provides no matching record in Subject Alternative Name (SAN) but in Common Name (CN), it will be indicated as this is deprecated\. Also for multiple server certificates are being checked for as well as for the certificate reply to a non\-SNI (Server Name Indication) client hello to the IP address\. Regarding the TLS clock skew: it displays the time difference to the client\. Only a few TLS stacks nowadays still support this and return the local clock \fBgmt_unix_time\fR, e\.g\. IIS, openssl < 1\.0\.1f\. In addition to the HTTP date you could e\.g\. derive that there are different hosts where your TLS and your HTTP request ended \-\- if the time deltas differ significantly\. +For the trust chain check 5 certificate stores are provided\. If the test against one of the trust stores failed, the one is being identified and the reason for the failure is displayed \- in addition the ones which succeeded are displayed too\. You can configure your own CA via ADDTL_CA_FILES, see section \fBFILES\fR below\. If the server provides no matching record in Subject Alternative Name (SAN) but in Common Name (CN), it will be indicated as this is deprecated\. Also for multiple server certificates are being checked for as well as for the certificate reply to a non\-SNI (Server Name Indication) client hello to the IP address\. Regarding the TLS clock skew: it displays the time difference to the client\. Only a few TLS stacks nowadays still support this and return the local clock \fBgmt_unix_time\fR, e\.g\. IIS, openssl < 1\.0\.1f\. In addition to the HTTP date you could e\.g\. derive that there are different hosts where your TLS and your HTTP request ended \-\- if the time deltas differ significantly\. . .P \fB\-x , \-\-single\-cipher \fR tests matched \fBpattern\fR of ciphers against a server\. Patterns are similar to \fB\-V pattern , \-\-local pattern\fR, see above about matching\. @@ -329,10 +333,10 @@ Security headers (X\-Frame\-Options, X\-XSS\-Protection, Expect\-CT,\.\.\. , CSP .IP "" 0 . .P -\fB\-\-c, \-\-client\-simulation\fR This simulates a handshake with a number of standard clients so that you can figure out which client cannot or can connect to your site\. For the latter case the protocol, cipher and curve is displayed, also if there\'s Forward Secrecy\. testssl\.sh uses a handselected set of clients which are retrieved by the SSLlabs API\. The output is aligned in columns when combined with the \fB\-\-wide\fR option\. If you want the full nine yards of clients displayed use the environment variable ALL_CLIENTS\. +\fB\-c, \-\-client\-simulation\fR This simulates a handshake with a number of standard clients so that you can figure out which client cannot or can connect to your site\. For the latter case the protocol, cipher and curve is displayed, also if there\'s Forward Secrecy\. testssl\.sh uses a handselected set of clients which are retrieved by the SSLlabs API\. The output is aligned in columns when combined with the \fB\-\-wide\fR option\. If you want the full nine yards of clients displayed use the environment variable ALL_CLIENTS\. . .P -\fB\-g, \-\-grease\fR checks several server implementation bugs like tolerance to size limitations and GREASE, see https://www\.ietf\.org/archive/id/draft\-ietf\-tls\-grease\-01\.txt \. This checks doesn\'t run per default\. +\fB\-g, \-\-grease\fR checks several server implementation bugs like tolerance to size limitations and GREASE, see RFC 8701\. This check doesn\'t run per default\. . .SS "VULNERABILITIES" \fB\-U, \-\-vulnerable, \-\-vulnerabilities\fR Just tests all (of the following) vulnerabilities\. The environment variable \fBVULN_THRESHLD\fR determines after which value a separate headline for each vulnerability is being displayed\. Default is \fB1\fR which means if you check for two vulnerabilities, only the general headline for vulnerabilities section is displayed \-\- in addition to the vulnerability and the result\. Otherwise each vulnerability or vulnerability section gets its own headline in addition to the output of the name of the vulnerabilty and test result\. A vulnerability section is comprised of more than one check, e\.g\. the renegotiation vulnerability check has two checks, so has Logjam\. @@ -383,13 +387,16 @@ Security headers (X\-Frame\-Options, X\-XSS\-Protection, Expect\-CT,\.\.\. , CSP \fB\-L, \-\-lucky13\fR Checks for LUCKY13 vulnerability\. It checks for the presence of CBC ciphers in TLS versions 1\.0 \- 1\.2\. . .P +\fB\-WS, \-\-winshock\fR Checks for Winshock vulnerability\. It tests for the absence of a lot of ciphers, some TLS extensions and ec curves which were introduced later in Windows\. In the end the server banner is being looked at\. +. +.P \fB\-4, \-\-rc4, \-\-appelbaum\fR Checks which RC4 stream ciphers are being offered\. . .SS "OUTPUT OPTIONS" \fB\-q, \-\-quiet\fR Normally testssl\.sh displays a banner on stdout with several version information, usage rights and a warning\. This option suppresses it\. Please note that by choosing this option you acknowledge usage terms and the warning normally appearing in the banner\. . .P -\fB\-\-wide\fR Except the "each cipher output" all tests displays the single cipher name (scheme see below)\. This option enables testssl\.sh to display also for the following sections the same output as for testing each ciphers: BEAST, PFS, RC4\. The client simulation has also a wide mode\. The difference here is restricted to a column aligned output and a proper headline\. The environment variable \fBWIDE\fR can be used instead\. +\fB\-\-wide\fR Except the "each cipher output" all tests displays the single cipher name (scheme see below)\. This option enables testssl\.sh to display also for the following sections the same output as for testing each ciphers: BEAST, FS, RC4\. The client simulation has also a wide mode\. The difference here is restricted to a column aligned output and a proper headline\. The environment variable \fBWIDE\fR can be used instead\. . .P \fB\-\-mapping \fR @@ -409,7 +416,7 @@ Security headers (X\-Frame\-Options, X\-XSS\-Protection, Expect\-CT,\.\.\. , CSP .IP "" 0 . .P -Please note that in testssl\.sh 3,0 you can still use \fBrfc\fR instead of \fBiana\fR and \fBno\-rfc\fR instead of \fBno\-iana\fR but it\'ll disappear after 3\.0\. +Please note that in testssl\.sh 3\.0 you can still use \fBrfc\fR instead of \fBiana\fR and \fBno\-rfc\fR instead of \fBno\-iana\fR but it\'ll disappear after 3\.0\. . .P \fB\-\-show\-each\fR This is an option for all wide modes only: it displays all ciphers tested \-\- not only succeeded ones\. \fBSHOW_EACH_C\fR is your friend if you prefer to set this via the shell environment\. @@ -443,6 +450,9 @@ whole 9 yards . .IP "" 0 . +.P +\fB\-\-disable\-rating\fR disables rating\. Rating automatically gets disabled, to not give a wrong or misleading grade, when not all required functions are executed (e\.g when checking for a single vulnerabilities)\. +. .SS "FILE OUTPUT OPTIONS" \fB\-\-log, \-\-logging\fR Logs stdout also to \fB${NODE}\-p${port}${YYYYMMDD\-HHMM}\.log\fR in current working directory of the shell\. Depending on the color output option (see above) the output file will contain color and other markup escape codes, unless you specify \fB\-\-color 0\fR too\. \fBcat\fR and \-\- if properly configured \fBless\fR \-\- will show the output properly formatted on your terminal\. The output shows a banner with the almost the same information as on the screen\. In addition it shows the command line of the testssl\.sh instance\. Please note that the resulting log file is formatted according to the width of your screen while running testssl\.sh\. You can override the width with the environment variable TERM_WIDTH\. . @@ -486,7 +496,10 @@ whole 9 yards \fB\-\-severity \fR For CSV and both JSON outputs this will only add findings to the output file if a severity is equal or higher than the \fBseverity\fR value specified\. Allowed are \fB\fR\. WARN is another level which translates to a client\-side scanning error or problem\. Thus you will always see them in a file if they occur\. . .P -\fB\-\-append\fR Normally, if an output file already exists and it has a file size greater zero, testssl\.sh will prompt you to manually remove the file exit with an error\. \fB\-\-append\fR however will append to this file, without a header\. The environment variable APPEND does the same\. Be careful using this switch/variable\. A complementary option which overwrites an existing file doesn\'t exist per design\. +\fB\-\-append\fR Normally, if an output file already exists and it has a file size greater zero, testssl\.sh will prompt you to manually remove the file and then exit with an error\. \fB\-\-append\fR however will append to this file, without a header\. The environment variable APPEND does the same\. Be careful using this switch/variable\. +. +.P +\fB\-\-overwrite\fR Normally, if an output file already exists and it has a file size greater zero, testssl\.sh will not allow you to overwrite this file\. This option will do that \fBwithout any warning\fR\. The environment variable OVERWRITE does the same\. Be careful, you have been warned! . .P \fB\-\-outprefix \fR Prepend output filename prefix \fIfname_prefix\fR before \'${NODE}\-\'\. You can use as well the environment variable FNAME_PREFIX\. Using this any output files will be named \fB\-${NODE}\-p${port}${YYYYMMDD\-HHMM}\.\fR when no file name of the respective output option was specified\. If you do not like the separator \'\-\' you can as well supply a \fB\fR ending in \'\.\', \'_\' or \',\'\. In this case or if you already supplied \'\-\' no additional \'\-\' will be appended to \fB\fR\. @@ -626,6 +639,30 @@ MAX_HEADER_FAIL: A number which tells testssl\.sh how often a HTTP GET request o . .IP "" 0 . +.SS "RATING" +This program has a near\-complete implementation of SSL Labs\'s \'SSL Server Rating Guide \fIhttps://github\.com/ssllabs/research/wiki/SSL\-Server\-Rating\-Guide\fR\'\. +. +.P +This is \fInot\fR a 100% reimplementation of the SSL Lab\'s SSL Server Test \fIhttps://www\.ssllabs\.com/ssltest/analyze\.html\fR, but an implementation of the above rating specification, slight discrepancies may occur\. Please note that for now we stick to the SSL Labs rating as good as possible\. We are not responsible for their rating\. Before filing issues please inspect their Rating Guide\. +. +.P +Disclaimer: Having a good grade is \fBNOT\fR necessarily equal to having good security! Don\'t start a competition for the best grade, at least not without monitoring the client handshakes and not without adding a portion of good sense to it\. Please note STARTTLS always results in a grade cap to T\. Anything else would lead to a false sense of security \- at least until we test for DANE or MTA-STS\. +. +.P +As of writing, these checks are missing: * GOLDENDOODLE \- should be graded \fBF\fR if vulnerable * Insecure renegotiation \- should be graded \fBF\fR if vulnerable * Padding oracle in AES\-NI CBC MAC check (CVE\-2016\-2107) \- should be graded \fBF\fR if vulnerable * Sleeping POODLE \- should be graded \fBF\fR if vulnerable * Zero Length Padding Oracle (CVE\-2019\-1559) \- should be graded \fBF\fR if vulnerable * Zombie POODLE \- should be graded \fBF\fR if vulnerable * All remaining old Symantec PKI certificates are distrusted \- should be graded \fBT\fR * Symantec certificates issued before June 2016 are distrusted \- should be graded \fBT\fR * ! A reading of DH params \- should give correct points in \fBset_key_str_score()\fR * Anonymous key exchange \- should give \fB0\fR points in \fBset_key_str_score()\fR * Exportable key exchange \- should give \fB40\fR points in \fBset_key_str_score()\fR * Weak key (Debian OpenSSL Flaw) \- should give \fB0\fR points in \fBset_key_str_score()\fR +. +.P +To implement a new grading cap, simply call the \fBset_grade_cap()\fR function, with the grade and a reason: \fBbash set_grade_cap "D" "Vulnerable to documentation"\fR To implement a new grade warning, simply call the \fBset_grade_warning()\fR function, with a message: \fBbash set_grade_warning "Documentation is always right"\fR +. +.P +When implementing a new check (be it vulnerability or not) that sets grade caps, the \fBset_rating_state()\fR has to be updated (i\.e\. the \fB$do_mycheck\fR variable\-name has to be added to the loop, and \fB$nr_enabled\fR if\-statement has to be incremented) +. +.P +The \fBset_rating_state()\fR automatically disables rating, if all the required checks are \fInot\fR enabled\. This is to prevent giving out a misleading or wrong grade\. +. +.P +When a new revision of the rating specification comes around, the following has to be done: * New grade caps has to be either: 1\. Added to the script wherever relevant, or 2\. Added to the above list of missing checks (if above is not possible) * New grade warnings has to be added wherever relevant * The revision output in \fBrun_rating()\fR function has to updated +. .SH "EXAMPLES" . .nf @@ -635,7 +672,7 @@ MAX_HEADER_FAIL: A number which tells testssl\.sh how often a HTTP GET request o .fi . .P -does a default run on https://testssl\.sh (protocols, standard cipher lists, PFS, server preferences, server defaults, vulnerabilities, testing all known 370 ciphers, client simulation\. +does a default run on https://testssl\.sh (protocols, standard cipher lists, server\'s cipher preferences, forward secrecy, server defaults, vulnerabilities, client simulation, and rating\. . .IP "" 4 . @@ -795,6 +832,9 @@ RFC 8143: Using Transport Layer Security (TLS) with Network News Transfer Protoc RFC 8446: The Transport Layer Security (TLS) Protocol Version 1\.3 . .IP "\(bu" 4 +RFC 8701: Applying Generate Random Extensions And Sustain Extensibility (GREASE) to TLS Extensibility +. +.IP "\(bu" 4 W3C CSP: Content Security Policy Level 1\-3 . .IP "\(bu" 4 @@ -873,10 +913,15 @@ TLSWG Draft: The Transport Layer Security (TLS) Protocol Version 1\.3 Developed by Dirk Wetter, David Cooper and many others, see CREDITS\.md \. . .SH "COPYRIGHT" -Copyright © 2012 Dirk Wetter\. License GPLv2: Free Software Foundation, Inc\. This is free software: you are free to change and redistribute it under the terms of the license\. Usage WITHOUT ANY WARRANTY\. USE at your OWN RISK! +Copyright © 2012 Dirk Wetter\. License GPLv2: Free Software Foundation, Inc\. This is free software: you are free to change and redistribute it under the terms of the license, see LICENSE\. +.P +Attribution is important for the future of this project - also in the internet\. Thus if you\'re offering a scanner based on testssl\.sh as a public +and/or paid service in the internet you are strongly encouraged to mention to your audience that you\'re using this program and where to get this program +from\. That helps us to get bugfixes, other feedback and more contributions\. . .P -If you\'re offering testssl\.sh as a public and / or paid service in the internet you need to mention to your audience that you\'re using this program and where to get this program from\. +Usage WITHOUT ANY WARRANTY\. USE at your OWN RISK! +. . .SH "LIMITATION" All native Windows platforms emulating Linux are known to be slow\. diff --git a/doc/testssl.1.html b/doc/testssl.1.html index 56c24d8..dff5c7c 100644 --- a/doc/testssl.1.html +++ b/doc/testssl.1.html @@ -1,7 +1,7 @@ - + testssl(1)