Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-10-04 23:48:13 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,572 Commits 16 Branches 39 Tags
23b41bd3f350a29632bce953d5eca41fdd627d10
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk 23b41bd3f3 Fix starttls_io() 
As noted in #3154 there was an unused variable `waitsleep` in `starttls_io`
which was filled with argument passed \#3. The loop search for the pattern
in `$2` however was the filled with another variable `nr_waits` which was
pre-set to 10 (`STARTTLS_SLEEP`)

This PR fixes that by
- removing STARTTLS_SLEEP from this function
- passing a value of 4 to this function when called *)

For ~1200 xmpp tests 2 was the maximum in less than 10% of the cases, so
4 should be really safe. `starttls_postgres_dialog()` uses also `starttls_io`
but it should be a safe bet when searching for the pattern `S`
 2026-09-30 18:07:15 +02:00
Dirk WetterandGitHub d1fe32efc6 Merge pull request #3163 from testssl/docker_baseimageupdate 
Docker baseimageupdate
 2026-09-29 17:20:24 +02:00
Dirk dffdb69533 Upgrade as November 2026 3.21 will be EOL 2026-09-29 17:10:38 +02:00
Dirk 863b17a02d replaced 3.2 by 3.3dev 
The instructions still could need an update as many commands will fail
using modern docker binaries.
 2026-09-29 17:08:06 +02:00
Dirk 7c9c66e4de Upgrade to Leap 16.0 2026-09-29 17:07:36 +02:00
Dirk WetterandGitHub 0bb6581629 Merge pull request #3162 from testssl/instructions 
better instructions
 2026-09-29 16:52:04 +02:00
Dirk WetterandGitHub 815999d760 better instructions 2026-09-29 16:51:01 +02:00
Dirk WetterandGitHub eeef7a72c0 Merge pull request #3158 from dcooper16/fix_sc2027 
Fix Shellcheck SC2027
 2026-09-29 16:03:40 +02:00
Dirk WetterandGitHub 7ff3008c03 Merge pull request #3159 from dcooper16/declare_more_local_vars 
Declare more local variables
 2026-09-28 14:31:29 +02:00
Dirk WetterandGitHub 43564c57d3 Merge pull request #3161 from dcooper16/ecdhe_mlkem512 
Support draft-rosomakho-tls-ecdhe-mlkem512
 2026-09-28 14:29:52 +02:00
Dirk WetterandGitHub 31f4e85d8a Merge pull request #3156 from dcooper16/cmdline_warnings 
No command line warnings on display only
 2026-09-23 09:47:25 +02:00
Dirk WetterandGitHub d0c633ef63 Merge pull request #3160 from dcooper16/improve_emphasize_stuff_in_headers 
Improve emphasize_stuff_in_headers()
 2026-09-23 09:33:17 +02:00
Dirk WetterandGitHub 4dfbbbaf92 Merge pull request #3153 from dcooper16/fix_SC2313 
Fix Shellcheck SC2313
 2026-09-22 10:09:21 +02:00
Dirk WetterandGitHub 68d27904f7 Merge pull request #3152 from dcooper16/fix_SC2015 
Fix Shellcheck SC2015
 2026-09-21 22:10:22 +02:00
Dirk WetterandGitHub 129019f5ba Merge pull request #3151 from dcooper16/fix_undeclared_vars 
Declare local variables
 2026-09-21 22:01:09 +02:00
Dirk WetterandGitHub a080c03ec1 Merge pull request #3149 from dcooper16/fix_shellcheck_issues 
Fix some Shellecheck issues
 2026-09-18 17:00:48 +02:00
Dirk WetterandGitHub 080a656f18 Merge pull request #3144 from dcooper16/avoid_color_functions 
Avoid use of color functions
 2026-09-16 19:19:04 +02:00
Dirk WetterandGitHub a572046f14 Merge pull request #3145 from dcooper16/redo_emphasize_stuff_in_headers 
Rewrite emphasize_stuff_in_headers()
 2026-09-16 14:46:38 +02:00
Dirk WetterandGitHub 0fc53e6f12 Merge pull request #3141 from testssl/dependabot/github_actions/shogo82148/actions-setup-perl-1.44.0 
Bump shogo82148/actions-setup-perl from 1.43.1 to 1.44.0
 2026-09-14 10:12:53 +02:00
Dirk WetterandGitHub 25fcac5ee4 Merge pull request #3138 from dcooper16/fix_SC2021 
Fix Shellcheck SC2021
 2026-09-14 10:00:28 +02:00
Dirk WetterandGitHub ab2e753f30 Merge pull request #3137 from dcooper16/fix_SC2125 
Fix Shellcheck SC2125
 2026-09-14 09:51:21 +02:00
Dirk WetterandGitHub 06c1955f63 Merge pull request #3140 from dcooper16/fix_SC2076 
Fix Shellcheck SC2076
 2026-09-14 09:42:47 +02:00
Dirk WetterandGitHub 98bd9d66a4 Merge pull request #3133 from testssl/socket_timeout_parser 
Fix error which prohibited passing an equal sign after "--socket-timeout"
 2026-09-03 19:07:43 +02:00
Dirk d2df98d03a Fix error which prohibited passing an equal sign after "--socket-timeout" 2026-09-03 18:09:45 +02:00
Dirk WetterandGitHub 9e09f10380 Merge pull request #3131 from testssl/perl_quality 
Add Perl static analysis
 2026-09-01 20:02:32 +02:00
Dirk 8eb05bd862 '$' should be passed to the shell not '\$' 
... thus not double quoting like \\$
 2026-09-01 16:58:14 +02:00
Dirk c312fb8230 Audit all modules 
but let for now exit the check always with zero
 2026-09-01 16:29:16 +02:00
Dirk bd67671fad double quoting needed in passed expression to grep 2026-09-01 16:19:52 +02:00
Dirk 6b1de564d8 Make the flow finally(TM) work 2026-09-01 15:49:31 +02:00
Dirk 4bab452316 Fix syntax error 2026-09-01 15:42:43 +02:00
Dirk 1880a06110 Enable warnings 2026-09-01 15:27:44 +02:00
Dirk 7e1cd8a8c4 Add "use warnings" + correct subroutine prototypes declaration 2026-09-01 15:21:10 +02:00
Dirk 8ab28557a1 Add "use warnings" 2026-09-01 15:18:46 +02:00
Dirk 71322d89cb Squash complains by perlcritic 
and enable warnings
 2026-09-01 15:07:52 +02:00
Dirk Wetter d857e0fe60 Add .perlcritic policy overrides for test suite 2026-08-31 23:26:36 +02:00
Dirk Wetter 23129834b9 Add all other perl modules too 2026-08-31 22:04:07 +02:00
Dirk Wetter a2027d527f fix perttidy and cpan-audit 2026-08-31 20:50:00 +02:00
Dirk Wetter f77dcbefd5 Selfcheck removed 
(not sure whether that was right to try in the first place, probably not)
 2026-08-31 20:35:02 +02:00
Dirk Wetter d58557b430 Newer versions 
- use newer checkout hash
- use appropriate perl version
 2026-08-31 20:30:35 +02:00
Dirk Wetter f5d228e28e Add Perl static analysis 
* Run perl -c on every t/*.t file as a fast pre-check before prove.
* Add Perl::Critic (a curated policy set) and perltidy --check for the Perl test code — the repo lints its bash with shellcheck but has zero linting for its Perl.
* Add Test::NoWarnings (and/or Test::Fatal) to the test harness so warnings/exceptions in the code under test fail the build.

Not yet sure about using the hash / SHA-pinning. To be reconsidered later
 2026-08-31 20:05:30 +02:00
Dirk WetterandGitHub 978c399798 Merge pull request #3126 from ChrisJr404/banner-utc-offset 
Show the UTC offset in the start and done banner
 2026-08-31 11:02:38 +02:00
Dirk WetterandGitHub fef1f43aff Merge pull request #3129 from dcooper16/declare_jsonID 
Declare jsonID
 2026-08-30 21:48:45 +02:00
Dirk WetterandGitHub 853850e3f4 Merge pull request #3125 from testssl/CA_store_update_2608 
CA store update 2608
 2026-08-28 10:42:04 +02:00
Dirk Wetter 639f45e8d0 Update 2026/08 2026-08-28 00:59:31 +02:00
Dirk Wetter 296575029d Still MS.pem still contains DST Root CA X3 2026-08-28 00:58:59 +02:00
Dirk Wetter 2571730bb1 2026-08-13 from https://curl.haxx.se/docs/caextract.html 2026-08-24 19:45:28 +02:00
Dirk Wetter f9d6355002 store from jdk-25.0.4.1 
from https://download.oracle.com/java/25/latest/jdk-25_linux-x64_bin.tar.gz
 2026-08-24 19:43:12 +02:00
Dirk Wetter 5461110ac4 store from today via git repo 2026-08-24 19:42:19 +02:00
Dirk Wetter 74bfffecae DL link for JDK, --depth=1 for Apple repo 2026-08-24 19:39:32 +02:00
Dirk WetterandGitHub 6d555cac4e Merge pull request #3118 from testssl/dependabot/github_actions/shogo82148/actions-setup-perl-1.43.1 
Bump shogo82148/actions-setup-perl from 1.42.0 to 1.43.1
 2026-08-24 10:52:03 +02:00
Dirk WetterandGitHub 5894d76a63 Merge pull request #3119 from testssl/dependabot/github_actions/docker/login-action-4.6.0 
Bump docker/login-action from 4.5.2 to 4.6.0
 2026-08-24 10:50:22 +02:00
Dirk WetterandGitHub ff51c14b52 Merge pull request #3123 from dcooper16/cleanup3120 
Cleanup #3120
 2026-08-24 10:49:22 +02:00
Dirk WetterandGitHub 1283aff3d4 Merge pull request #3120 from dcooper16/slhdsa 
Support SLH-DSA server keys
 2026-08-15 16:27:02 +02:00
Dirk WetterandGitHub 06adbdccc5 Merge pull request #3115 from testssl/dependabot/github_actions/shogo82148/actions-setup-perl-1.42.0 
Bump shogo82148/actions-setup-perl from 1 to 1.42.0
 2026-08-11 19:20:11 +02:00
Dirk WetterandGitHub e60c4b428f Merge pull request #3114 from testssl/dependabot/github_actions/docker/login-action-4.5.2 
Bump docker/login-action from 4 to 4.5.2
 2026-08-11 19:18:01 +02:00
Dirk WetterandGitHub b578b00440 Merge pull request #3117 from dcooper16/fixtypo 
Fix typo
 2026-08-11 19:13:38 +02:00
Dirk WetterandGitHub 5296954a70 Merge pull request #3108 from testssl/fix_3107_fname-warning 
Remove warning message when supplying a fname
 2026-07-16 14:00:04 +02:00
Dirk WetterandGitHub 18e6938b62 Merge pull request #3110 from petecooper/3.3dev 
Remove broken link to privacyscore.org in `3.3dev`
 2026-07-16 13:57:43 +02:00
Dirk Wetter 498a0dff33 Remove warning message when supplying a fname 
In order ot waran early in file outputs 75376d3 introduced a separate function for checking early
the command line.

As massing scanning option was not considered one got a warning, saying

   Warning: Target is not a server name: results may be completely wrong, at minimum trust may show false results.

This fixes that, see #3107 .
 2026-07-16 11:25:30 +02:00
Dirk WetterandGitHub 2b6180320c Merge pull request #3104 from ericcgu/feat/3097-short-lived-certs 
Improve handling of short-lived certificates (#3097)
 2026-07-15 17:13:21 +02:00
Dirk WetterandGitHub cf45a76b5f Merge pull request #3103 from ericcgu/fix/1246-mass-testing-scantime 
Fix bogus "Scan interrupted" scanTime in mass-testing JSON (#1246)
 2026-07-15 13:01:47 +02:00
Dirk WetterandGitHub 2f37eb069c Merge pull request #3099 from testssl/patch-1 
streamlined
 2026-07-14 20:38:37 +02:00
Dirk WetterandGitHub 7957d0b81c streamlined 
- Comments instead of backticks
- AI section
- version not from GH
 2026-07-14 20:37:27 +02:00
Dirk WetterandGitHub ffbc439897 fix yet another typo 2026-07-14 20:04:52 +02:00
Dirk WetterandGitHub 7956a222c1 Merge pull request #3098 from testssl/drwetter-patch-1 
Create SECURITY.md
 2026-07-14 19:58:21 +02:00
Dirk WetterandGitHub 4e3fdab08e Update Readme.md 2026-07-14 19:56:35 +02:00
Dirk WetterandGitHub 1e80984577 Update SECURITY.md 2026-07-14 19:52:06 +02:00
Dirk WetterandGitHub 0bd118e657 Fix typo in comment, add improvement for LLM 2026-07-14 19:48:10 +02:00
Dirk WetterandGitHub 6c4e0f257f Create SECURITY.md 2026-07-14 19:29:14 +02:00
Dirk WetterandGitHub 580bffeb0f Merge pull request #3096 from ericcgu/fix/3095-ipv6-proxy-bad-substitution 
Fix broken OpenSSL version check for IPv6 proxy in check_proxy() (#3095)
 2026-07-14 18:21:29 +02:00
Dirk WetterandGitHub 611b1b1f39 Merge pull request #3091 from ericcgu/fix/3090-html-xss-pr-url 
Fix stored XSS in HTML report via unescaped Location: header (#3090)
 2026-07-12 14:43:29 +02:00
Dirk WetterandGitHub 21bf1ff19f Merge pull request #3089 from testssl/03_mini_syntax_check 
Small check for semantic unit tests
 2026-07-11 22:47:16 +02:00
Dirk Wetter f6a59dc083 Properly premature exit for MacOS 2026-07-11 19:03:05 +02:00
Dirk ed07c763e1 Check on MacOS returned not ok 2026-07-11 17:12:50 +02:00
Dirk Wetter 20a632844b Now fix the existing non-compliant issues 
18422:          if [[ $tmp_result -eq 1 ]] && [[ loop_reneg -eq 1 ]]; then
19633:          [[ aaa == bbb ]]    # provoke return code=1

450:TRUSTED1ST=""                           # Contains the `-trusted_first` flag, if this version of openssl supports it

The latter check be amended/corrected later, so that backticks in comments are allowed.
 2026-07-11 15:35:21 +02:00
Dirk WetterandGitHub cf17bd7629 Merge pull request #3086 from ericcgu/ericcgu-bugfix 
bugfix: aesgcm_used --> enc_aesgcm_used
 2026-07-11 13:37:12 +02:00
Dirk Wetter 49c26b7e36 perl-style grep for mac 
so skip the while thing
 2026-07-10 22:25:49 +02:00
Dirk 27c432e95d Add more checks 
recommended by Claude Sonnet 5

The backtick pattern will fail in a comment. To be fixed later
 2026-07-10 20:20:38 +02:00
Dirk 0c16ebd6b9 Small check for semantic check 
Staring with a simple pattern for checking for non-variables at left hand
side like [[ LHS == $value ]]. The file is supposed be amended in the future.

This fixes #3074 .

Upon commit it fails first as there are two instances which will be detected
(one is deliberate but will be changed too) .
 2026-07-10 19:33:08 +02:00
Dirk WetterandGitHub 1be2f7472a Merge pull request #3088 from testssl/patch-1 
Update pull_request_template.md
 2026-07-10 16:48:58 +02:00
Dirk WetterandGitHub b7fb813edf Update pull_request_template.md 2026-07-10 16:47:43 +02:00
Dirk WetterandGitHub a46c8baad5 Merge pull request #3084 from testssl/fix_tls13_only_hosts 
Fix confusion when scanning TLS-1.3-only hosts
 2026-07-10 16:41:40 +02:00
Dirk Wetter 0ddba7301e Fix double mistake 🙁 2026-07-10 15:22:34 +02:00
Dirk Wetter d1da2c1dea fix spelling 2026-07-10 13:55:33 +02:00
Dirk Wetter cbd2b4da1e Add HAS_LDAP to global vars 
... and bail out if it is not supported.
 2026-07-10 13:51:39 +02:00
Dirk Wetter d7f5095042 Exempt MacOS with LibreSSL to run STARTTLS via LDAP 2026-07-10 13:40:03 +02:00
Dirk Wetter 8dce14187d Fix confusion when scanning TLS-1.3-only hosts 
When scanning hosts which offer only TLS 1.3 under some circumstances (e.g. using
MacOS) the scan stopped and prompted the user . It happened always when $OPENSSL
supported TLS 1.3. It did not when this was not the case.

This fixes that (see #3083) for 3.3dev by just skipping the rest in determine_optimal_proto()
when TLS13_ONLY is true.

Also it fixes missing line feeds for servoce detecttion and order in which DNS HTTPS
RR are displayed.
 2026-07-09 13:13:15 +02:00
Dirk WetterandGitHub deda4c7627 Merge pull request #3080 from ericcgu/ericcgu-patch-1 
fix: inverted return check in sym-encrypt() at testssl.sh:14741 makes …
 2026-07-08 20:45:06 +02:00
Dirk WetterandGitHub 044cfee81b Merge pull request #3078 from testssl/fix_empty_httpsrr 
Fix empty result for HTTPS_RR for Mac and friends
 2026-07-08 18:24:45 +02:00
Dirk WetterandGitHub 62ca07cc33 Merge pull request #3059 from TheraNinjaCat/fix-cert-trust-wildcard-identifier-3051 
Fixed 'cert_trust_wildcard' identifier when multiple certificates are…
 2026-07-08 18:24:14 +02:00
Dirk 2dba5fea1b fix typo 2026-07-06 11:41:18 +02:00
Dirk 44d6b7adbf Fix empty result for HTTPS_RR for Mac and friends 
... also improve error handling by adding return values in
*https_rr functions.

The error for ~Macs occured because for interpretation of
raw TYPE65 DNS data it was just 1 returned instead of 0
--for empty records.
 2026-07-06 11:36:15 +02:00
Dirk WetterandGitHub 9fdf8028ba Merge pull request #3076 from SteveVaneeckhout/fix-ipv4-only-flag-ignored 
Fix -4/-6 flag being ignored when no specific test is selected
 2026-06-25 22:34:27 +02:00
Dirk WetterandGitHub df6cd77195 Merge pull request #3075 from lapo-luchini/3.3dev_fix_escaping 
Fix escaping.
 2026-06-23 23:15:43 +02:00
Dirk WetterandGitHub 56ba1ab229 Merge pull request #3047 from testssl/https_rr 
Provide DNS HTTPS RR functionality
 2026-06-22 18:16:35 +02:00
Dirk Wetter 859d24df20 HTTPS DNS RR in manual 2026-06-22 16:37:32 +02:00
Dirk Wetter 50966dc1d6 Merge branch '3.3dev' into https_rr 2026-06-22 16:26:38 +02:00
Dirk Wetter dca6434604 Compare QUIC section with DNS HTTPS RR 
Also: make "A(AAA) record via:" bold, to be in line with the other keys
 2026-06-22 16:20:13 +02:00
Dirk Wetter 7e97b243d1 Introduce global HTTPS_RR variable 
... which is initialized with "initt" to distinguish between not being tested yet and no value.
We only display the value once per $NODE for the first IP address being tested.

HTTPS_RR doesn't have to be reset in reset_hostdepended_vars()

Few comments were added / indentation fixed (not relevant to this PR)
 2026-06-22 14:59:13 +02:00
Dirk WetterandGitHub 689516c378 Merge pull request #3073 from testssl/my-patch-2 
clarify what a breaking change is
 2026-06-22 13:06:55 +02:00