Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,268 Commits 16 Branches 39 Tags
2274c6cd5b5e200a767155606cfbdf4239b85d4b
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub 2274c6cd5b Merge pull request #2974 from testssl/robot_timeout_doc 
Add ROBOT_TIMEOUT to documentation
 2025-12-19 15:18:50 +01:00
Dirk 3ac39032fa Add ROBOT_TIMEOUT to documentation 
Also
* remove VULN_THRESHLD from docs

Note: pandoc was a different version, so the roff output has different
encodings for different special chars.
 2025-12-19 15:07:40 +01:00
Dirk WetterandGitHub 61d0189f8f Merge pull request #2969 from testssl/mitigate_2083 
Mitigate inconsistent test results for ROBOT
 2025-12-19 13:59:48 +01:00
Dirk Wetter 6cd5b4364c Merge branch '3.3dev' into mitigate_2083 2025-12-15 13:13:50 +01:00
Dirk WetterandGitHub 28baa6be44 Merge pull request #2968 from testssl/fix_missing_vulnHeadline 
ROBOT is also a vulnerability
 2025-12-15 13:12:56 +01:00
Dirk Wetter 81f25a6674 Mitigate inconsistent test results for ROBOT 
As reported a longer while back in #2083 there were trailing bytes
when receiving a TLS alert by the ROBOT check.

This PR corrects and thus normalizes the length of the TLS alert message to the
correct value, supposed the length in the TLS alart is two bytes and it is an
TLS alert.

Also this PR now uses a separate variable for the timeout. In 2ce0110e the timeout
was changed by mistake as MAX_WAITSOCK was reduced from 10 to 5. For this check it
is still 5 which seemed fine (TBC). Using a separate global variable however may offer
some possibility for tuning the check when the latency to the target is high.
 2025-12-15 12:52:41 +01:00
Dirk Wetter 51a35b0344 ROBOT is also a vulnerability 
We missed somehow to add in the big while loop to add the fact that
ROBOT is a vulnerability which become apparent with #2967.

This PR adds that.
 2025-12-15 11:44:42 +01:00
Dirk WetterandGitHub 08398b3ac2 Merge pull request #2967 from testssl/address_2943 
Remove underlined headline for each vulnerability
 2025-12-15 11:07:17 +01:00
Dirk Wetter 26e90d44c3 Remove underlined headline for each vulnerability 
This PR removes this legacy feature. There's a single
headline for vulnerabilties instead.

Fixes #2943.
 2025-12-14 21:24:30 +01:00
Dirk WetterandGitHub 3430bd97d2 Merge pull request #2965 from testssl/fix_2944 
Add missing LF after pwnkeys DB check
 2025-12-14 21:03:51 +01:00
Dirk Wetter eeb8e7dbf1 Add missing LF after pwnkeys DB check 
This fixes #2940 .
 2025-12-14 17:43:44 +01:00
Dirk WetterandGitHub 651ddc1876 Merge pull request #2963 from dcooper16/fix2959 
Fix #2959
 2025-12-13 15:37:16 +01:00
Dirk WetterandGitHub 7a0b62e689 Merge pull request #2961 from testssl/fix_2960 
Label missing KEMs as LOW severity
 2025-12-09 12:43:05 +01:00
Dirk Wetter 03f43ecd68 Label missing KEMs as LOW severity 2025-12-09 10:15:50 +01:00
Dirk WetterandGitHub 1250d6f853 Merge pull request #2958 from testssl/fix_early_data_empty 
Fix error when early data empty
 2025-11-29 22:38:18 +01:00
Dirk ece7bce138 Merge branch '3.3dev' into fix_early_data_empty 2025-11-29 20:55:56 +01:00
Dirk WetterandGitHub 2b73544efc Merge pull request #2954 from testssl/address_2952 
Address 2952
 2025-11-29 20:53:43 +01:00
Dirk Wetter 8ed4b4218c this may fix it 2025-11-29 18:43:00 +01:00
Dirk Wetter d92769d15c trying again to make Mac work 2025-11-29 13:45:00 +01:00
Dirk 17896a44a5 move unlink 2025-11-28 17:23:50 +01:00
Dirk 4bc0a5ccba Change back to google.com, avoid 0-RTT for Mac 
... as we can't make it to get proper results unless
on the laptop
 2025-11-28 16:26:25 +01:00
Dirk Wetter d3c33867d7 Rather try cloudflare... 
instead of google.com. Maybe google's edge server to github has
different configuration and thus has not 0-RTT.

On my Mac it worked fine before.
 2025-11-28 13:28:58 +01:00
Dirk 2b06c97f19 Add 0-RTT, more in line with other files 
... and simplyfied
 2025-11-28 03:20:10 +01:00
Dirk Wetter d648a0851d Fix error when early data empty 
This PR fixes an error when early data was empty
which caused testssl.sh to exit instead of marking
that there was no file returned.

Also it changes HEAD to GET as the latter is probably
more often supported.

There needs to be a unit test for 0-RTT / early data!
 2025-11-28 01:46:16 +01:00
Dirk b1d79b6d72 change style to be in line w others 2025-11-28 01:21:19 +01:00
Dirk 3a0a6eaf88 re-add $ 2025-11-27 22:17:54 +01:00
Dirk 7823699982 json and html unit tests more seamless 
- html_file / json_file
- file name comes in command, not earlier
- Both a title
- avoid fixed string for file names over and over
 2025-11-27 20:38:12 +01:00
Dirk 964e8924a4 define file var before using it 2025-11-27 19:45:39 +01:00
Dirk Wetter a4b6d1fca0 spellcheck 2025-11-27 18:49:12 +01:00
Dirk Wetter f3ebf0e971 Add autoflush thingy for MAcOS 2025-11-27 18:46:19 +01:00
Dirk Wetter 853da2a9de term pattern seems better than the "colorized list" 2025-11-27 18:39:52 +01:00
Dirk Wetter 3591f70a17 reorder lines 2025-11-27 18:31:43 +01:00
Dirk Wetter 8103a0e24d Make this work undeer MacOS 
- URI is now example.com bc Akamai doesn't block too many checks
  (MacOS runner was delayed and often hiccuped here)
- failed to flush message --prevention
- term pattern seems better than the "colorized list"
 2025-11-27 18:24:15 +01:00
Dirk Wetter 7e97fef030 remove LFs and comment 2025-11-27 18:22:48 +01:00
Dirk Wetter fc499cb67f Akamai keeps connection open (opossum check problem) 2025-11-27 18:21:26 +01:00
Dirk Wetter 0ef742a17a Just add comments, reorder lines 2025-11-27 17:44:31 +01:00
Dirk Wetter 4582bd8d73 Merge branch '3.3dev' into address_2952 2025-11-27 16:37:16 +01:00
Dirk WetterandGitHub 86700dbd7a Merge pull request #2957 from testssl/flush 
Try to remove the "failed to flush stdout" messages
 2025-11-27 16:34:40 +01:00
Dirk Wetter de6e92826a Add stdout flush 2025-11-27 14:23:27 +01:00
Dirk Wetter 5111804b75 Try to remove the "failed to flush stdout" messages 2025-11-25 00:23:13 +01:00
Dirk Wetter e8098fc1d2 fix remainder from old os definition 2025-11-24 12:03:03 +01:00
Dirk WetterandGitHub dd696bb871 Merge pull request #2955 from testssl/shellcheck_path_improvement 
No shellcheck in ./t/
 2025-11-24 11:20:18 +01:00
Dirk WetterandGitHub 92e0195118 No shellcheck in ./t/ 2025-11-24 11:19:13 +01:00
Dirk Wetter d359e1108d proper definition of os variable 2025-11-24 11:07:16 +01:00
Dirk Wetter 7ba99cd1e9 For MacOS we rather use homebrew's OpenSSL 2025-11-24 11:04:59 +01:00
Dirk Wetter 7b2804df41 remove STARTTLS 2025-11-24 10:48:41 +01:00
Dirk WetterandGitHub 4ad81cea9b Merge pull request #2953 from testssl/dependabot/github_actions/actions/checkout-6 
Bump actions/checkout from 5 to 6
 2025-11-21 15:12:34 +01:00
Dirk WetterandGitHub 7423aa8add Merge pull request #2951 from testssl/fixAndImprove_opossum_check_2950 
Fix and improve Opossum check
 2025-11-21 15:11:07 +01:00
Dirk 76824b5762 Fix and improve Opossum 
Under some circumstances the opossum vulnerability check got stuck
because the cat commdn was waiting for reading from the descriptor.
In some case like #2950 this happened when the HTTP head command
was incorrectly send in the first place.

This PR makes sure that the HTTP head is correct and it replaces
cat by read in a loop so that the HTTP response is read without
being blocked.

Also for http_head_printf() the argumensats passed were cleaned up.
 2025-11-19 20:55:20 +01:00
Dirk WetterandGitHub 718c6fe4ed Merge pull request #2947 from 24icewolf42/fix-mtls-client-pem-check 
Add support for EC private key in mTLS check
 2025-11-17 11:19:09 +01:00
Dirk WetterandGitHub 1394cc8d7d Merge pull request #2949 from testssl/shellcheck_ignore_files 
Ignore files types for shellcheck
 2025-11-15 14:43:59 +01:00
Dirk Wetter fd97a75241 Add comments for paths_ignore 2025-11-15 14:05:08 +01:00
Dirk Wetter c07d17ea8f Fix indentation + comment wrt paths_ignore 2025-11-15 13:56:19 +01:00
Dirk Wetter 00476b751a Ignore files types for shellcheck 2025-11-15 13:39:09 +01:00
Dirk WetterandGitHub 12e4ebd203 Merge pull request #2948 from testssl/ratingdoc_update 
Update docs after raiting only switch
 2025-11-15 13:37:06 +01:00
Dirk Wetter c9a886c396 Update docs after riing only swicth 
see #2945
 2025-11-15 13:31:42 +01:00
Dirk WetterandGitHub ae48b680fa Merge pull request #2945 from magnuslarsen/3.3dev 
feat: --rating-only flag to only test checks required for rating
 2025-11-13 08:00:15 +01:00
Dirk WetterandGitHub 932c91f67c Merge pull request #2941 from testssl/dependabot/github_actions/actions/checkout-5 
Bump actions/checkout from 4 to 5
 2025-11-11 16:46:21 +01:00
Dirk WetterandGitHub 4ba3500b0b Merge pull request #2940 from testssl/shellcheck_cherrypicked_2428 
Shellcheck cherrypicked from PR #2428
 2025-11-10 14:37:35 +01:00
Dirk Wetter d4cc41405f Skipping push as it seems expensive and may cause delays 
... no bypasses for direct commit for those changes anyway
 2025-11-10 12:29:05 +01:00
Dirk Wetter 2fcd01c693 fix FP 2025-11-10 12:15:58 +01:00
Dirk Wetter 0347f2ffee 24.04 Ubuntu's instead of latest 2025-11-10 12:05:42 +01:00
Dirk WetterandGitHub f219fd6ca3 Merge pull request #2938 from testssl/fix_2937 
Fix pattern for matching /etc/hosts entries
 2025-11-03 23:39:04 +01:00
Dirk da8a6f2f34 Fix pattern for matching /etc/hosts entries 
`grep -w` matches also `string1-whatsoever` so that entries like

```
192.168.0.10 anystring anystring-apache
192.168.0.11 anystring-tomcat
```

matched 3 entries over 2 lines.

This PR fixes #2937 by improving the match pattern, so that
`string1` needs a trailing whitespace or a EOL -- besides a
leaing whitespace.
 2025-11-03 22:30:26 +01:00
Dirk WetterandGitHub c19d3fff0c Merge pull request #2935 from testssl/fix_2933 
Add new Sectigo R46 cert, update Java/Mozilla.pem
 2025-11-01 18:00:27 +01:00
Dirk 3e495f456a Add new Sectigo R46 certs + update Java/Mozilla.pem 
Fixes #2933 .
 2025-11-01 14:15:36 +01:00
Dirk WetterandGitHub a0c99d855e Merge pull request #2934 from testssl/shorten_badssl 
Shorten badssl GHA as they fail too often
 2025-10-30 20:41:46 +01:00
Dirk 1ce514d95f Shorten badssl GHA as they fail too often 
* Remove checks which aren't needed in t/51_badssl.com.t t/33_isJSON_severitylevel_valid.t
* tryying to make some files more readable
 2025-10-30 18:35:43 +01:00
Dirk WetterandGitHub 0b9715c239 Merge pull request #2930 from testssl/fix_2929 
Fix date parsing bc of locale problem
 2025-10-30 15:54:23 +01:00
Dirk da436e7d87 Fix date parsing bc of locale problem 
The new block making sure that rust coreutils work properly (PR #2913)
introduced a new check in order to determine which date functions
to use.

The function however parsed only for English error messages ("No such file").
This PR fixes that by setting LC_ALL to C.

Fixes #2929 .
 2025-10-30 13:30:08 +01:00
Dirk WetterandGitHub d3a96d9382 Merge pull request #2927 from testssl/fix_2926_ua_sneaky 
Update "sneaky" user agent
 2025-10-28 15:16:04 +01:00
Dirk Wetter ce820cdaf5 Update "sneaky" user agent 
fixes #2926 for 3.3dev.
 2025-10-28 10:26:06 +01:00
Dirk WetterandGitHub 08ed5521a9 Merge pull request #2922 from testssl/shellcheck1 
Squash some shellcheck *errors*
 2025-10-13 22:10:44 +02:00
Dirk Wetter c53e7a3955 Fix more shellcheck complaints (high severity) 
... and fine tune some comments in the beginning
 2025-10-13 21:06:02 +02:00
Dirk WetterandGitHub 8bc2185a72 Merge pull request #2923 from testssl/drwetter-patch-1 
Minor fine tuning
 2025-10-12 11:49:26 +02:00
Dirk WetterandGitHub 2cfa23e7f7 Minor fine tuning 
* version 3.2 was removed from links
* badges updated
* minor language improvements
 2025-10-12 11:34:56 +02:00
Dirk Wetter 672493ebe7 Fix check for /bin/sh 2025-10-11 18:59:51 +02:00
Dirk Wetter 7090d5fbdd Saving everything before commit/push is supposed to be better ;-) 2025-10-11 18:00:48 +02:00
Dirk Wetter 8392a4aed5 Squash some shellcheck *errors* 
and some warnings.

Five errors of type [SC2145](https://www.shellcheck.net/wiki/SC2145) are left as I am not sure whether
it'll be safe to follow the recommendation
 2025-10-11 13:19:28 +02:00
Dirk WetterandGitHub ae69789ecb Merge pull request #2916 from testssl/update_Linux_CA_store 
Update Linux CA store
 2025-10-09 22:12:09 +02:00
Dirk WetterandGitHub 07a0aa4bef Merge pull request #2919 from testssl/update_GHAs 
Update GHAs
 2025-10-09 21:27:38 +02:00
Dirk 9ff79c472f Remove workflows/docker-3.2.yml for 3.3dev 2025-10-09 21:25:30 +02:00
Dirk d732088923 Roff pages won't trigger a unit test anymore 2025-10-09 21:24:45 +02:00
Dirk Wetter 0a7810ea47 Update Linux CA store 
from Debian 13. Fixes #2915
 2025-10-09 20:42:21 +02:00
Dirk WetterandGitHub df100d986b Merge pull request #2913 from testssl/fix_2909 
Fix date for Ubuntu >= 25.10
 2025-10-09 20:30:15 +02:00
Dirk WetterandGitHub 80d05c0831 Merge pull request #2912 from testssl/early_data 
TLS 1.3 early data / 0-RTT
 2025-10-09 18:55:14 +02:00
Dirk Wetter aacde5dadb Merge branch '3.3dev' into early_data 2025-10-09 15:50:12 +02:00
Dirk 3353627373 Fix unit test for Mac and Ubuntu Linux 2025-10-09 15:44:53 +02:00
Dirk Wetter 32defa1864 Ignore MLKEMs for TLS 1.3 2025-10-09 15:44:53 +02:00
Dirk Wetter eb915110c9 Update baseline 2025-10-09 15:44:53 +02:00
Dirk e226a56486 Update basline scan for unit test 
This PR updates the baseline after switching to the new server.
 2025-10-09 15:44:53 +02:00
Dirk WetterandGitHub 8534e72dc3 Merge pull request #2914 from testssl/unittest_new_baseline 
Update baseline scan for unit test
 2025-10-09 15:38:37 +02:00
Dirk 6201627298 Fix unit test for Mac and Ubuntu Linux 2025-10-09 13:29:36 +02:00
Dirk Wetter accd1f20cd Rearrange order of date checks 
works for all "older" Linux systems, MacOS, OpenBSD and according to #teki69
also Ubuntu 25.10 .
 2025-10-08 23:26:48 +02:00
Dirk Wetter 6af5377507 Ignore MLKEMs for TLS 1.3 2025-10-08 23:15:49 +02:00
Dirk Wetter f081db83e1 Update baseline 2025-10-08 23:14:54 +02:00
Dirk Wetter da7c713b08 Add 0-RTT 
also:
* fine tuning protocol section
* reference RFC 8470 (well..) and FIPS 203
* add a general linkto TLS related  RFCs
 2025-10-08 10:31:48 +02:00
Dirk Wetter d637daefeb Add 0-RTT 2025-10-08 10:15:14 +02:00
Dirk a4b6ded123 Update basline scan for unit test 
This PR updates the baseline after switching to the new server.
 2025-10-08 10:03:19 +02:00
Dirk Wetter 36bc08ce18 Fix date for Ubuntu >= 25.10 
works for
- ubuntu 24.04
- Debian 13
- openbsd 6.6 / 7.x
- macos 15.7.1

Fixes #2909
 2025-10-07 23:23:09 +02:00