Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,349 Commits 16 Branches 39 Tags
061732a5fb095b65987594714cd6c69774413782
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub 061732a5fb Merge pull request #1552 from drwetter/drwetter-patch-1 
Badges from shields.io / Monitoring Links
 2020-04-01 12:41:16 +02:00
Dirk WetterandGitHub 333ccdfb41 Badges from shields.io / Monitoring Links 2020-04-01 12:40:56 +02:00
Dirk WetterandGitHub d32743b2eb Merge pull request #1548 from dcooper16/adjust_pr_cipher_quality 
Adjust pr_cipher_quality ratings
 2020-03-31 14:09:47 +02:00
Dirk WetterandGitHub 8ff45208c3 Merge pull request #1546 from dcooper16/display_ciphernames_bug 
Fix bug in setting DISPLAY_CIPHERNAMES
 2020-03-25 18:28:03 +01:00
Dirk WetterandGitHub 1e94d5a2f6 Merge pull request #1544 from mkauschi/replace-printf-with-tm_out 
Replace printf with tm_out
 2020-03-24 10:56:10 +01:00
Dirk WetterandGitHub 3a003d9ab9 Merge pull request #1538 from mkauschi/fix_bug_with_basicauth_generation 
Fix basicauth bug where a newline is added to the user:password string before encoding
 2020-03-18 14:51:18 +01:00
Dirk WetterandGitHub 32df6b8bef Merge pull request #1533 from drwetter/breach_output31 
Fix output for BEAST when no SSL3 or TLS
 2020-03-07 12:16:11 +01:00
Dirk 8242607d94 Fix output for BEAST when no SSL3 or TLS 
LF added
 2020-03-06 22:06:13 +01:00
Dirk WetterandGitHub 9cd4cf3eb9 Merge pull request #1531 from dcooper16/fix_typo_emphasize_stuff_in_headers 
Fix typo in emphasize_stuff_in_headers()
 2020-03-06 21:28:28 +01:00
Dirk WetterandGitHub 5aadc1951d Merge pull request #1523 from drwetter/pwdfix3.1 
Avoid external "/bin/pwd"
 2020-03-06 14:59:15 +01:00
Dirk WetterandGitHub 6f02101ae0 Merge pull request #1499 from dcooper16/fix_printing_percent 
Fix printing percent characters
 2020-03-06 14:35:31 +01:00
Dirk WetterandGitHub 466f08c846 Merge pull request #1481 from dcooper16/fix_html 
Fix HTML generation
 2020-03-06 13:40:41 +01:00
Dirk Wetter 0469d6a2b1 Avoid external "/bin/pwd" 
.. as it may not be available everywhere, see #1521 (NixOS).

This commit replaces all instances from pwd or /bin/pwd by $PWD.
It is a bash internal and the fastest. Also it added some quotes
to PWD a it may contain white spaces in the future (currently
there's a check for it that it won't)
 2020-03-06 13:24:56 +01:00
Dirk WetterandGitHub b8d1a3506a Merge pull request #1525 from drwetter/update_template 
Update ISSUE_TEMPLATE.md
 2020-03-06 13:01:03 +01:00
Dirk WetterandGitHub 9f1fa04e07 Update ISSUE_TEMPLATE.md 2020-03-03 21:18:09 +01:00
Dirk Wetter 1fb96df369 Avoid external "/bin/pwd" 
.. as it may not be everywhere available, see #1521 (NixOS).

This commit replaces all instances from pwd or /bin/pwd by `pwd -P`
(-P -> no symbolic link)
 2020-03-03 12:36:22 +01:00
Dirk WetterandGitHub e0c83b2a38 add more filters 2020-02-24 14:21:28 +01:00
Dirk WetterandGitHub 02b83cc092 Merge pull request #1516 from dcooper16/min_hsts 
Fix use of HSTS_MIN
 2020-02-21 09:59:32 +01:00
Dirk WetterandGitHub 64fea03f66 Merge pull request #1510 from drwetter/rDNS_fixes 
Fix for non compliant DNS PTR records
 2020-02-15 15:22:22 +01:00
Dirk WetterandGitHub 95b6189076 Merge pull request #1509 from drwetter/container1 
remove jq and beautify last line
 2020-02-15 14:08:43 +01:00
Dirk Wetter b81c409135 Fix for non compliant DNS PTR records 
This commit addresses two bugs: #1506 and #1508.

First, the variable rDNS can contain multiple lines due to multiple PTR DNS
records, though this is not recommended.  In those cases the multiple PTR DNS
were concatenated on the screen, without any blank.

Secondly - depending on the name server entries and on the output of the DNS
binaries used it can contain non-printable characters or characters which are
printable but later on interpreted on the output device (\032 was mentioned
in #1506) which on the screen was interpreted as octal 32 (decimal 26 = ▒,
try echo "\032"), so basically a terminal escape sequence was smuggled
from the DNS server to the screen of the users. In JSON pretty output we
had also this escape sequence which was fine for jsonlint but caused jq
to hiccup.

Fix: we use a loop to check for each FQDN returned. There we remove chars which
under those circumstances can show up. The blacklist is taken from RFC 1912
("Allowable characters in a label for a host name are only ASCII, letters, digits,
and the `-' character").
 2020-02-15 13:43:37 +01:00
Dirk Wetter 75be8d9f38 remove jq and beautify last line 2020-02-15 12:09:33 +01:00
Dirk WetterandGitHub f01c1196c0 Merge pull request #1505 from dcooper16/fix_1504 
Fix #1504
 2020-02-13 17:52:06 +01:00
Dirk WetterandGitHub d549c833c8 Merge pull request #1501 from dcooper16/cipher_order_wide 
Wide output for cipher order
 2020-02-13 09:34:40 +01:00
Dirk WetterandGitHub b0cce84a7f Merge pull request #1500 from dcooper16/shellcheck_SC2197 
Fix Shellcheck SC2197
 2020-02-10 20:45:16 +01:00
Dirk WetterandGitHub 6da6335e5b Merge pull request #1498 from dcooper16/minor_code_cleanup 
Minor code cleanup
 2020-02-08 10:32:46 +01:00
Dirk WetterandGitHub 8bdad385d5 Merge pull request #1497 from dcooper16/neat_list_export 
neat_list() and export
 2020-02-07 18:14:11 +01:00
Dirk WetterandGitHub 9a0325875e Merge pull request #1495 from dcooper16/fix_pub_key_length_calculation 
Fix public key length calculation
 2020-02-04 21:45:52 +01:00
Dirk WetterandGitHub e9430bdd23 Merge pull request #1490 from drwetter/dotasurl_fix 
Fix URL when hostname with trailing dot supplied
 2020-02-04 16:20:23 +01:00
Dirk WetterandGitHub 77398af399 Merge pull request #1492 from dcooper16/fix_typos 
Fix typos
 2020-02-04 16:18:46 +01:00
Dirk c2df2f1fc0 Fix URL when hostname with trailing dot supplied 
Hostnames can contain a trailing dot (and sometimes they should).
If they are supplied to testssl.sh however they will be also interpreted
as a URL PATH when the servive is HTTP.

This commit fixes that.
 2020-02-03 22:26:01 +01:00
Dirk WetterandGitHub ccafd9125b Merge pull request #1488 from dcooper16/fix_client_simulation 
Fix client simulation
 2020-01-31 20:23:58 +01:00
Dirk WetterandGitHub 7c85b44a9f Merge pull request #1482 from dcooper16/shellcheck_SC2178 
Suppress shellcheck issue SC2178
 2020-01-31 09:23:06 +01:00
Dirk WetterandGitHub e8b7a04e53 Merge pull request #1487 from simondeziel/dup-cipher 
Remove (harmless) AESGCM dup in the strong ciphers list
 2020-01-31 09:22:03 +01:00
Dirk WetterandGitHub 2f54613d6d Merge pull request #1484 from dcooper16/tls13_post_handshake 
TLS 1.3 post-handshake messages
 2020-01-31 08:55:08 +01:00
Dirk WetterandGitHub 7443a532cf Merge pull request #1486 from drwetter/fix_ids_friendly 
Fix --ids-friendly
 2020-01-31 08:48:01 +01:00
Dirk WetterandGitHub 89fd902b18 Merge pull request #1483 from dcooper16/minor_code_cleanup 
Minor code cleanup
 2020-01-31 08:41:43 +01:00
Dirk Wetter c4920f61e4 rename query_globals() --> count_do_variables() 
.. and fix one problem instroduced with last patch (testssl.sh
din't work correclty if only an URI was supplied)
 2020-01-30 22:25:10 +01:00
Dirk Wetter 073d383f76 Fix switch --ids-friendly 
This switch had no effect. There was probably a regression
problem as it worked before.

Besides fixing that the large case statement in parse_cmd_line()
was simplified, in a sense that banner and help functions were
moved to a separate case statement.
 2020-01-30 21:49:56 +01:00
Dirk WetterandGitHub 3a73a97b67 Merge pull request #1480 from drwetter/readme-patch1 
Status update / mir rephrasing of key features
 2020-01-30 18:14:43 +01:00
Dirk WetterandGitHub 16907cf77e Status update / mir rephrasing of key features 2020-01-30 18:14:20 +01:00
Dirk WetterandGitHub ef21f3f9bf Merge pull request #1476 from dcooper16/tls13_finished_messages 
TLS 1.3 Finished messages
 2020-01-30 10:26:27 +01:00
Dirk WetterandGitHub 5e9767a17c Merge pull request #1477 from dcooper16/faster_gcm 
Speedup AES-GCM
 2020-01-30 10:22:02 +01:00
Dirk WetterandGitHub 3da67437f3 Merge pull request #1475 from dcooper16/reorganize_key_derivation 
Reorganize TLS 1.3 key derivation
 2020-01-27 21:52:24 +01:00
Dirk WetterandGitHub c3bab98b92 Merge pull request #1474 from drwetter/backport_4b573dd 
Suppress displaying an error in maketempf()
 2020-01-26 01:30:58 +01:00
Dirk c63547ca7b Suppress displaying an error in maketempf() 2020-01-26 01:29:18 +01:00
Dirk 4b573dd833 Suppress displaying an error in maketempf() 2020-01-26 01:24:11 +01:00
Dirk WetterandGitHub 51ca429b48 Merge pull request #1473 from dcooper16/aead 
Full AEAD cipher implementations
 2020-01-25 12:37:28 +01:00
Dirk WetterandGitHub 1ad7a65adf Merge pull request #1472 from drwetter/reorder 
Reorder functions and some variables
 2020-01-24 14:46:18 +01:00
Dirk Wetter d44a643fab Reorder functions and some variables 
For a fresh start it seemed a good idea to cleanup
the order of functions and some variables so that
those with the same functionality are somewhat grouped.

Some of the functions have now a header and a foooter
to make it easier to spot and use then. Also for added future
functions the hope is that they will be put where they better
fit
 2020-01-24 13:58:05 +01:00
Dirk 67598e824f Start next release 2020-01-23 22:24:33 +01:00
Dirk WetterandGitHub b0b084dcda Merge pull request #1442 from drwetter/bump_version 
bump version to final
 2020-01-23 18:08:23 +01:00
Dirk WetterandGitHub a11a060acb Merge pull request #1456 from drwetter/changes_etc 
Update attributions and changes for release
 2020-01-23 18:05:50 +01:00
Dirk WetterandGitHub a9e5bcc30c Merge pull request #1470 from drwetter/1xmsg_squash 
Squash the last futile -msg for $OPENSSL
 2020-01-23 11:03:46 +01:00
Dirk ace4098693 Squash the last futile -msg for $OPENSSL 
... see also https://github.com/drwetter/testssl.sh/pull/1468#discussion_r369786007
 2020-01-23 09:46:33 +01:00
Dirk WetterandGitHub 631755ceb1 Merge pull request #1464 from drwetter/further_handshakes 
Further handshakes / minor changes
 2020-01-22 22:30:16 +01:00
Dirk WetterandGitHub fa4f1e4366 Merge pull request #1468 from nosnilmot/fix-xmpp-starttls 
Fix XMPP starttls
 2020-01-22 21:09:51 +01:00
Dirk 5083e950d2 Move debugging remainders detection to t/00_testssl_help.t 2020-01-22 21:04:23 +01:00
Dirk WetterandGitHub ec722e0e9c Merge pull request #1469 from dcooper16/simplify_draft_tls13_version_determination 
Simplify code to determine draft TLS 1.3 version
 2020-01-22 20:39:10 +01:00
Dirk WetterandGitHub f7ab5a0821 Move quotes... 
as David suggested.
 2020-01-22 20:34:00 +01:00
Dirk WetterandGitHub 7619e430f2 Merge pull request #1466 from dcooper16/fix_run_ssl_poodle 
Fix run_ssl_poodle()
 2020-01-22 18:05:08 +01:00
Dirk WetterandGitHub 2602e14191 Merge pull request #1465 from dcooper16/undo_copy_paste_error 
Undo copy and paste error
 2020-01-22 17:25:33 +01:00
Dirk WetterandGitHub 2181061c6e Merge pull request #1463 from drwetter/shortcurt_vulns 
Shortcuts for vulnerability tests for TLS 1.3 only servers
 2020-01-22 15:37:11 +01:00
Dirk Wetter eeb1acd749 Android 9 still has 2 signature hash algos: x0201 + x0203 2020-01-22 11:41:42 +01:00
Dirk d4d5a61a0b Hopefully make Travis shut up now 
picked a TLS 1.2 host
 2020-01-22 11:30:21 +01:00
Dirk cae052cfab Address some HTML check failures in travis 
(shouldn't work too late)
 2020-01-22 11:29:04 +01:00
Dirk Wetter 7c66ed47c0 All self retrieved Android handshakes modified to service ANY 2020-01-22 10:58:00 +01:00
Dirk Wetter a50a660d6c Add Android 10 client simulation 2020-01-22 10:54:50 +01:00
Dirk Wetter ca8054184b remove also leading colon in helper script bc of GREASE 2020-01-22 10:52:07 +01:00
Dirk 39abb27dd9 cloudflare seems not good for html travis checks 2020-01-22 00:28:59 +01:00
Dirk 80530aa34c remove fast as it makes problems especially with Travis+testssl.net 2020-01-21 23:53:52 +01:00
Dirk e0f8c8d43e Relax misunderstanding of DEBUG statemement 
There's a check for >825 days certificate lifetime. That
check emits a debug statement when the lifetime is within
this limit. It does that also when the certificate expired.

This commit adds now the word "total"

DEBUG: all is fine with total certificate life time

to make sure the life time left not is what should be understood.
 2020-01-21 22:47:53 +01:00
Dirk 26a8f23ec1 Shutup Travis 
... by adding the formerly intruoced "DEBUG" statement as a filter.
Note: "DEBUG" can now / should now be taken preferably for extra
output on debug level 1.

Replacing badssl.com by testssl.net. The former needed almost 5 min
for a run, whereas one IP of testssl.net needs ~80 secs. With --fast
even less.
 2020-01-21 22:41:50 +01:00
Dirk 952231dd94 Shortcuts for vulnerability tests 
Several vulnerability checks add a time penalty when the server
side only support TLS 1.3 as The TLS 1.3 RFC 8446 and implementations
known so far don't support the flaws being checked for.

This PR adds "shortcut" checks for all TLS 1.3, assuming that the
TLS 1.3 implementation is correct which seems at this time a valid
assumpution. That either saves a TCP connect or at least some logic to
be executed.  Also in some cases a TLS 1.3 only server emitted unnecessary
warnings, see #1444.

If $DEBUG -eq 1 then it outputs information that a shortcut was
used. It doesn't do that in other cases because the screen output
seems too obtrusive.

It also adds a shortcut for beast when SSL 3 or TLS 1.0 is is known
not to be supported.

This commit radds 747fb039ed which
was accidenially reverted in 45f28d8166.
It fixes #1462.

See also #1459.
 2020-01-20 21:37:02 +01:00
Dirk 431f4fbe5f last walk through the changelog 2020-01-20 12:50:31 +01:00
Dirk 3e8d1983b3 reorder / rephrase some points 2020-01-20 12:49:49 +01:00
Dirk WetterandGitHub c08250d1bb Merge pull request #1461 from drwetter/ci_setx 
add check for forgotten "set -x" + provide defined start conditions
 2020-01-20 12:20:07 +01:00
Dirk 45f28d8166 Revert "Shortcuts for TLS13 only servers in renegotiation checks" 
This reverts commit 747fb039ed.
 2020-01-18 21:55:35 +01:00
Dirk 44d1139e99 Revert "Complete shortcut checks (Renegotiation and CRIME)" 
This reverts commit 8c24d1a6f2.
 2020-01-18 21:54:42 +01:00
Dirk f109d3bbd6 add unlink / start with a clean state 
... good when running "prove -v" locally and previously
the run was interrrupted by e.g. ^C
 2020-01-18 21:47:44 +01:00
Dirk cb6677e2d3 removed comment 2020-01-18 21:45:32 +01:00
Dirk bec9ebdda8 only one ip 2020-01-18 21:44:24 +01:00
Dirk 2563dfb5e5 add set -x 2020-01-18 21:36:19 +01:00
Dirk 8c24d1a6f2 Complete shortcut checks (Renegotiation and CRIME) 
This also makes a short exit when the server side
supports TLS 1.3 only as this protocol doesn't support
TLS renegotiation or compression.

Also it fixes the logic flaw from the previous
commit that "-no_tls1_3" has to be supplied.

Furthermore, it unifies the output presented to the user.
 2020-01-18 12:31:38 +01:00
Dirk WetterandGitHub 155824214b Merge pull request #1460 from drwetter/drwetter-patch-1 
add also here -z
 2020-01-17 15:26:09 +01:00
Dirk WetterandGitHub adfa411e24 add also here -z 2020-01-17 15:24:36 +01:00
Dirk 747fb039ed Shortcuts for TLS13 only servers in renegotiation checks 
As noted in #1444 a few vulnerability checks don't make sense
or aren't working.  This commit addresses the renegotiation checks.

Also a few redundant quotes in parse_tls_serverhello() and
run_crime() were removed.
 2020-01-17 15:16:26 +01:00
Dirk WetterandGitHub 71b6305e00 Merge pull request #1458 from drwetter/drwetter-patch-2 
fix language
 2020-01-17 11:59:50 +01:00
Dirk WetterandGitHub ddc7a56ab0 fix language 2020-01-17 11:59:41 +01:00
Dirk WetterandGitHub a094ebc981 Merge pull request #1457 from drwetter/drwetter-patch-2 
fix missing -z
 2020-01-17 11:57:36 +01:00
Dirk WetterandGitHub 1fb2db02a7 Update docker-debian10.tls13only.start.sh 2020-01-17 11:57:13 +01:00
Dirk 2ea57f0701 Update attributions and Changes for release 
If anything is missing or wrong please let us know or do a PR.

(This is until from earlier time to ~2018. >2019 need to follow)
 2020-01-17 11:01:41 +01:00
Dirk WetterandGitHub 03fb04a9f9 Merge pull request #1455 from drwetter/drwetter-patch-1 
Warning for handshake retrieved by Google apps
 2020-01-16 22:48:07 +01:00
Dirk WetterandGitHub ac7a20f018 Update client-simulation.wiresharked.md 2020-01-16 22:46:43 +01:00
Dirk WetterandGitHub 86afeabf8f Merge pull request #1438 from drwetter/update_clienthandshakes 
Update clienthandshakes
 2020-01-16 22:26:21 +01:00
Dirk WetterandGitHub c2060c08f3 Merge pull request #1454 from dcooper16/basic_auth_polishing 
More polishing of http basic auth
 2020-01-16 20:24:39 +01:00
Dirk WetterandGitHub 91e14a3840 Merge pull request #1452 from drwetter/add_1451 
Last fine tuning for http basic auth
 2020-01-16 16:34:09 +01:00
Dirk WetterandGitHub 0691dc1bf8 Merge pull request #1453 from mkauschi/add-cache-control-header-check 
Check for the Cache-Control and Pragma header
 2020-01-16 16:25:18 +01:00
Dirk Wetter 4603d924be Last fine tuning for http basic auth 
* create roff file and HTML
* add hint to $ENV

Avoid 1x subshell

See #1451.
 2020-01-16 14:29:53 +01:00
Dirk WetterandGitHub 700a727f3f Merge pull request #1451 from mkauschi/http-basic-auth-support 
Add support for HTTP Basic Auth
 2020-01-16 14:13:59 +01:00