Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,957 Commits 16 Branches 39 Tags
251071081ef14a99a5373aba7e57377cc41030a6
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub 251071081e Merge pull request #1305 from drwetter/renego_fixes 
Add CVE for Secure Client-Initiated Renegotiation vulnerability
 2019-08-09 19:46:51 +02:00
Dirk Wetter fc1206cfea Add CVE for Secure Client-Initiated Renegotiation vulnerability 2019-08-09 19:44:03 +02:00
Dirk WetterandGitHub 5fed82f4c2 Merge pull request #1304 from drwetter/renego_fixes 
Fix misleading CVE in Secure Renegotiation
 2019-08-09 19:38:56 +02:00
Dirk Wetter 95a7b70765 Fix misleading CVE in Secure Renegotiation 
For some reason CVE-2009-3555 ended up in Secure Renegotiation,
whereas CVE-2009-3555 is in fact the Insecure Client-Side Renegotiation
vulnerability with the MiTM problem <= OpenSSl 0.9.8k.

This fixes that (see also #1086 and #933, #907) by removing the CVE #
from the output. Also tyhe output was changed for Secure Renegotiation
into supported/not vulnerable vs. Not supported / VULNERABLE

Some comments were added.
 2019-08-09 19:35:11 +02:00
Dirk Wetter e25a80263f ignore perl version for travis 2019-08-08 21:19:43 +02:00
Dirk WetterandGitHub f3230a870c Merge pull request #1303 from drwetter/contributing 
Fix stale links
 2019-08-08 21:11:28 +02:00
Dirk Wetter 3a1025f886 Fix stale links 2019-08-08 21:10:07 +02:00
Dirk 65e5d58793 Fix travis 2019-08-08 20:59:13 +02:00
Dirk WetterandGitHub 49fc218424 Merge pull request #1302 from drwetter/contributing 
Add CONTRIBUTING.md, docker changes in Readme.md
 2019-08-08 18:36:11 +02:00
Dirk Wetter 642cfe46dd Add CONTRIBUTING.md, docker changes in Readme.md 
.. also reviewed https://github.com/drwetter/testssl.sh/wiki/Coding-Style
 2019-08-08 18:34:14 +02:00
Dirk WetterandGitHub 7468776656 Merge pull request #1299 from drwetter/psql_mysql_fix 2019-08-06 20:13:15 +02:00
Dirk Wetter 42f2b83a92 Improvements for MySQL via STARTTLS 
* labeling is just "experimental"
* use similar functions as in psql
* faster
 2019-08-06 20:04:19 +02:00
Dirk Wetter 75a0f14bff Fix message 'tr : command not found' when debugging in determine_sizelimitbug() 2019-08-06 19:06:23 +02:00
Dirk Wetter 206c80aed5 Fix for STARTTLS+socket of postgresql 
As noted in #1249 STARTTLS with sockets doesn't
work.

This commit fixes that by correcting the STARTTLS
handshake for postgresql. It has to be send via
sockets instead of echo. The server side then will
respond with "S" when STARTTLS is supported. For this
starttls_io() was slightly modified so that also
an input (from the server perspective) is not necessary.

It's fast too
 2019-08-06 18:49:31 +02:00
Dirk WetterandGitHub 00d39693f3 Merge pull request #1295 from pihug12/3.0 
Fix "make-openssl111.sh"
 2019-07-10 10:15:44 +02:00
Dirk WetterandGitHub f405991b8c Merge pull request #1293 from drwetter/alpha_unittest_self 
Enable more tests, change to newer JSON scheme
 2019-07-09 22:51:51 +02:00
Dirk c335ded6d3 Enable more tests, change to newer JSON scheme 2019-07-09 22:49:12 +02:00
Dirk WetterandGitHub eef63b1726 Merge pull request #1289 from drwetter/tput_sgr_fix 
Fix terminal codes / tput
 2019-07-03 11:54:56 +02:00
Dirk Wetter af6f232790 Fix terminal codes / tput 
As noted in #1288 with some terminal settings under Linux there
appeared some ~garbage on the screen.

This fixes that by partly reverting 695d02157a .
At least now and under an older OpenBSD like 6.2 this doesn't seem
to be necessary.
 2019-07-03 11:47:54 +02:00
Dirk WetterandGitHub 3d5982e60b Merge pull request #1285 from dcooper16/fix_color_comparison_typo 
Fix typo in check of $COLOR
 2019-06-25 09:08:28 +02:00
Dirk WetterandGitHub a4d34b0cff Merge pull request #1283 from drwetter/etls_comment 
"eTLS" ~> ETS
 2019-06-17 10:26:36 +02:00
Dirk f1eb2b89b9 "eTLS" -> ETS 
Decription was added with the (future) ETSI name ETS [1]. Also
added as a comment MITRE's CVE data using ETS, amended with NIST's
entry in NVD

[1] EFF's interpretation: extra terrible security
   https://www.eff.org/deeplinks/2019/02/ets-isnt-tls-and-you-shouldnt-use-it
 2019-06-17 10:01:05 +02:00
Dirk WetterandGitHub 6e4abbf33a Merge pull request #1282 from drwetter/1279_related 
Added HAS_ZLIB in run_crime(), declaration of CERT_COMPRESSION fixed
 2019-06-12 21:16:22 +02:00
Dirk 7a1fb0b3b9 Added HAS_ZLIB in run_crime(), declaration of CERT_COMPRESSION fixed 
CERT_COMPRESSION was declared always with fast in ... so that the variable
was always false. This PR fixes that. In addition a informational line
that the new TLS extension has been added (if $DEBUG >3).

Also determine_optimal_proto() is not being run if devel mode
($do_tls_sockets) is enabled.

Furthermore as David added HAS_ZLIB as a global run_crime() now makes
use of it too.
 2019-06-12 21:05:43 +02:00
Dirk WetterandGitHub 53ecacfcbb Merge pull request #1281 from drwetter/SNI_STARTTLS_polish_pwnedkeys 
* SNI STARTTLS
* minor polish for pwned keys and devel option certificate compression
 2019-06-12 15:59:06 +02:00
Dirk Wetter b2bf5b72bd Add SNI/STARTTLS, pwnedkeys 2019-06-12 15:41:07 +02:00
Dirk Wetter 912cd906d2 SNI STARTTLS, minor polish 
This PR addresses #316 and #1280: it implements server name indication
also for STARTTLS which has been supported by a number of server
implemantations, in the meantime.

Also it does a final polish to David's pwnedkeys PR #1274 a while back:
UI improvement and detection of network problems.

In addition to PR #1279 it introduces a env variable to devel
mode so that "CERT_COMPRESSION=true ./testssl.sh --devel <params> <target>"
can be used to explore certificate compression on a host.
 2019-06-12 14:36:46 +02:00
Dirk WetterandGitHub 11add0d4ae Merge pull request #1279 from dcooper16/compressed_certs 
Initial support for certificate compression
 2019-06-07 21:33:36 +02:00
Dirk WetterandGitHub 91e98f1fc3 Merge pull request #1274 from dcooper16/pwnedkeys 
Check pwnedkeys.com database
 2019-05-23 10:45:57 +02:00
Dirk WetterandGitHub d6fb232152 Merge pull request #1271 from drwetter/depr_clients 
Depreciation of more clients
 2019-05-08 23:18:03 +02:00
Dirk d5f90218d1 Deprecation of more clients 
* Tor 17
* Android 4.2.2
* IE 7 Vista
 2019-05-08 23:12:45 +02:00
Dirk WetterandGitHub 0c750c212c Merge pull request #1270 from drwetter/ubuntu2openjdk 
Change the platform for Java from Ubuntu to OpenJDK
 2019-05-07 19:43:58 +02:00
Dirk Wetter 7238a0167a Change the platform for Java from Ubuntu to OpenJDK 2019-05-07 19:39:20 +02:00
Dirk WetterandGitHub 174f4ee527 Merge pull request #1268 from csett86/safari-macos 
Add Safari 12.1 on macOS 10.13.6
 2019-05-07 19:35:09 +02:00
Dirk WetterandGitHub 9273661779 Merge pull request #1269 from csett86/deprecate-java9 
Deprecate Java 9, its EOL since March 2018
 2019-05-07 08:02:44 +02:00
Dirk WetterandGitHub 1ccc8bdcb8 Merge pull request #1263 from csett86/java 
Add Java 11 and 12 client simulations
 2019-05-06 19:40:33 +02:00
Dirk WetterandGitHub 4cae781d98 Merge pull request #1267 from drwetter/hexstream2cipher_fix 
Don't include SSLv2 ciphers in hexstream2cipher.sh
 2019-05-06 19:37:44 +02:00
Dirk 13d3b7329b Don't include SSLv2 ciphers in hexstream2cipher.sh 2019-05-06 19:35:12 +02:00
Dirk WetterandGitHub 29a74713ee Merge pull request #1266 from drwetter/more_unittests1 
t/25_baseline_starttls in line with the new scheme now
 2019-05-06 14:08:54 +02:00
Dirk Wetter 33ece6858d In line with the new scheme now 2019-05-06 14:07:08 +02:00
Dirk WetterandGitHub c5d76fec27 Merge pull request #1265 from drwetter/more_unittests1 
Another (minor) step forwad for unit tests
 2019-05-06 11:22:42 +02:00
Dirk Wetter 51e8373efb Update to newest template 
* die statement if testssl.sh cannot be found from the current path
* comment everything out for JSON
* don't repeat the pattern, use a variable
* use "speaking" variable names
 2019-05-06 11:20:28 +02:00
Dirk Wetter 802d0defe7 Better phrased and provide examples 2019-05-06 11:13:37 +02:00
Dirk WetterandGitHub cf7c1ba4ae Merge pull request #1262 from drwetter/more_unittests1 
More unit / integration tests + Fix client simulation with OpenSSL, LDAP
 2019-05-05 18:43:13 +02:00
Dirk Wetter 710017ba57 Merge branch 'more_unittests1' of github.com:drwetter/testssl.sh into more_unittests1 2019-05-05 15:08:18 +02:00
Dirk Wetter 15df3316c1 Formatting fixed 2019-05-05 15:07:55 +02:00
Dirk WetterandGitHub 62bd23a632 add headline+note 2019-05-05 13:54:56 +02:00
Dirk WetterandGitHub 3785e9d622 Proper formatting 2019-05-05 13:45:23 +02:00
Dirk Wetter c3ff9e85f9 Rename file according to new scheme 
... Readme.md
 2019-05-05 13:44:02 +02:00
Dirk Wetter 666e897623 renamed 2019-05-05 13:42:48 +02:00
Dirk Wetter b63c389b54 Renamed 2019-05-05 12:58:49 +02:00
Dirk Wetter b9aee02978 Split IPv6 + IPv4 
... and disable IPv6 test as it is NOT supported by Travis CI,
see https://docs.travis-ci.com/user/reference/overview/#virtualisation-environment-vs-operating-system

The *.disabled file should provide a start if it'll be available
at some time or one can manage this in travis with a docker container,
see https://github.com/travis-ci/travis-ci/issues/8891
 2019-05-05 12:53:07 +02:00
Dirk Wetter 50a83235fe Renamed + testssl.net (IPv6) 2019-05-05 12:08:13 +02:00
Dirk Wetter df88577ec4 Add basline test for IPv4 and IPv6 
... client simulations come later. One pattern for
failed output added
 2019-05-04 13:51:20 +02:00
Dirk Wetter 19e9137f79 Add --vulnerabilities and LDAP constraints to documentation 2019-05-04 11:57:03 +02:00
Dirk WetterandGitHub 9c0a1459c0 Merge pull request #1261 from drwetter/safari-fix 
Fix error + round brackets
 2019-05-04 11:09:10 +02:00
Dirk Wetter bfd6caa624 Fix error + round brackets 
PR #1260 missed a 'current' line which caused an output problem.

I'd like to add round brackets to the displayed name so that we remember
what comes from wireshark and waht from SSLlabs
 2019-05-04 11:05:57 +02:00
Dirk WetterandGitHub d15fbedaa1 Merge pull request #1260 from csett86/safari121-ios122 
Add Safari 12.1 from iOS 12.2
 2019-05-04 10:53:48 +02:00
Dirk Wetter dc64753085 Add error catcher also for --ssl-native + FTP 2019-05-03 20:46:06 +02:00
Dirk Wetter de45440279 better use the right protocol when checking ldap 2019-05-03 20:26:59 +02:00
Dirk Wetter 9257654522 fix wrong variable 2019-05-03 20:11:42 +02:00
Dirk Wetter b60dbc0fa6 Code + Fix 
- Removed doubled declaration (my)
- hopefully fix error in FTPs (should maybe think about changing
  the line in testssl.sh or filter here always)
 2019-05-03 20:08:31 +02:00
Dirk Wetter 72136437bb Proper file naming 2019-05-03 19:32:59 +02:00
Dirk Wetter 1825a8ca33 Fix output for POP (STARTTLS unit test) 2019-05-03 19:32:25 +02:00
Dirk Wetter 2996d24176 Add several unit tests for STARTTLS protocols 
- SMTP via sockets+OpenSSL
- POP3 via sockets+OpenSSL
- IMAP via sockets+OpenSSL
- XMPP via sockets+OpenSSL
- FTP via sockets+OpenSSL
- LDAP via OpenSSL
- NNTPS via sockets+OpenSSL

Open: IRC, LTMP, mysql, postgres

This PR fixes #923. Partly it addresses #1254
 2019-05-03 19:27:31 +02:00
Dirk Wetter 2d719e5ebe Add cmdlines 
* t / --starttls irc/ircs (which will fail later for now)
* --vulnerabilities : not yet the moment for renaming
 2019-05-03 19:25:37 +02:00
Dirk Wetter bb5450e3f5 Make STARTTLS + LDAP work again (via sockets) 
A couple of checks required sockets but e.g. LDAP via STARTTLS
throwed an error (FIXME: LDAP+STARTTLS over sockets not supported yet)
in fd_sockets().

This adds a temporary workaround so that those functions are bypassed
and LDAP via STARTTLS can be used again.

See also #1258
 2019-05-03 18:55:28 +02:00
Dirk Wetter bdbc194491 Beautify and simplify the code 2019-05-03 16:38:44 +02:00
Dirk Wetter c38a1e6896 Major imporvement to unit test for client simulations 
- we don't check the head line only but errors
- don't use "pass" if you didn't run a test
- add simulation for http too
 2019-05-03 16:24:57 +02:00
Dirk Wetter 2176f29104 Fix bug due to different naming scheme for curves 
... which led to a false output in OpenSSL based handshake simulations.

secp256r1 is prime256v1
secp192r1 is prime192v1

Also a few varaiables were added in debug output (environment.txt)
 2019-05-03 16:16:30 +02:00
Dirk WetterandGitHub 0c45720f6c Merge pull request #1256 from drwetter/no-ssl3-fix 
Fix typo in handshake simulation with openssl 1.1.x
 2019-05-02 18:10:09 +02:00
Dirk Wetter 79a0345213 Fix typo in handshake simulation with openssl 1.1x 
"protos" contained "-no-ssl3" instead of "-no_ssl3"
which lead to an error message "Oops: openssl s_client connect problem"
-- which wasn't caught by the STARTTLS unit test either :-(
 2019-05-02 09:53:51 +02:00
Dirk WetterandGitHub 77c3bca646 Merge pull request #1253 from drwetter/rDNS_chars 
Remove " " ";" in rDnS
 2019-05-01 11:31:27 +02:00
Dirk Wetter 9d84308e3e Remove " " ";" in rDnS 
... as occasionally they showed up when using dig which
made the rDNS output look like it's not supposed to be
 2019-05-01 11:26:39 +02:00
Dirk WetterandGitHub 29e69d1156 Merge pull request #1252 from dcooper16/tls13_rating 
Mark only TLSv1.3 final as pr_svrty_best
 2019-05-01 10:42:40 +02:00
Dirk WetterandGitHub 040976ab49 Merge pull request #1247 from drwetter/outfile_man 
Add documentation to  #1245
 2019-04-25 22:43:07 +02:00
Dirk c9ec73bce8 Add documentation to #1245 
it accepts a directory.

This PR adds documenation for it.
 2019-04-25 22:40:32 +02:00
Dirk WetterandGitHub 6bd5897c82 Merge pull request #1245 from dcooper16/outfile_directory 
The -outfile, -oa, -outFile, and -oA options should accept a directory
 2019-04-25 22:29:31 +02:00
Dirk WetterandGitHub 682537b9f8 Merge pull request #1244 from dcooper16/fix1243 
Fix #1243
 2019-04-25 22:26:43 +02:00
Dirk 5ba95db0b0 Bump version number to 3.0rc5 2019-04-25 09:21:23 +02:00
Dirk WetterandGitHub e85c0b12ee Merge pull request #1241 from drwetter/chrome74 
Update client simulation with Chrome 74
 2019-04-25 09:18:42 +02:00
Dirk 955265afa0 Update to chrome 74 2019-04-25 09:17:23 +02:00
Dirk WetterandGitHub 70dab2edc5 Update Dockerfile.md 2019-04-24 19:52:53 +00:00
Dirk Wetter edcdcc43e9 Polish readme and reflect branch change to 3.0 2019-04-24 21:17:30 +02:00
Dirk WetterandGitHub 893cad542d Delete CHANGELOG.stable-releases.txt 2019-04-24 18:44:14 +00:00
Dirk Wetter 378a5b0547 Fold all Changelogs into one file 2019-04-24 20:42:51 +02:00
Dirk WetterandGitHub 9599a56a16 Merge pull request #1240 from drwetter/more_client_sim 
Major upgrade of some client simulations
 2019-04-24 08:10:10 +02:00
Dirk de0141d967 Copied from readme 2019-04-23 23:14:02 +02:00
Dirk 80c10f5bb3 Merge branch 'more_client_sim' of github.com:drwetter/testssl.sh into more_client_sim 2019-04-23 21:18:50 +02:00
Dirk 1edfcbc909 Added client handshakes 2019-04-23 21:18:08 +02:00
Dirk e72e7728c7 Renamed to avoid confusion 
It needs to be completed from README.md from releases 2.8 on
 2019-04-23 21:15:48 +02:00
Dirk Wetter 64c2bcc949 Add Thunderbird 60.6.1 to client simulation 2019-04-23 13:37:50 +02:00
Dirk Wetter 3f99c2d2c8 Add Opera 60 + Chrome 73 
Chrome 74 update pending
 2019-04-23 11:33:47 +02:00
Dirk Wetter d2f5c2633c Add a few MS client hellos 
* Edge 17 Win 10
* Firefox 66 Win 10

Disable 'Edge 13 Win Phone 10' per default and 'Firefox 62 Win 7'.
 2019-04-23 10:32:17 +02:00
Dirk Wetter 950772cb23 Clarify client sim data 2019-04-23 10:26:30 +02:00
Dirk 31c5107a64 Remove a few redundant quotes in run_client_simulation() 2019-04-20 20:23:50 +02:00
Dirk c183c213e5 Add client simulations 
.. for Android 8.1 and Firefox 66.

Add ciphersuites to the existing handshakes and update
the documentation accordingly.
 2019-04-20 20:21:25 +02:00
Dirk 5f047db92f Add client simlation data and provide howto 
While we are thankful that Ivan Ristic permitted to use the client
data from SSLlabs, it became of bit outdated now (see #1158). Also
as sslhaf [1] was used, the data comes from HTTP traffic only.

This is a start to address it. It provides data from Android 9
(connecting to the play store, so that it is sure we don't capture
a ClientHello from an application having an own TLS stack.

Also it provides documentation how to grab data yourself, and
provide it back to testssl.sh.

Aim is at least for testssl.sh 3.0 to add Android 8 and OpenSSL 1.1.1 (@drwetter).

My hope others can assist with  Safari on OSX 11 and 12. Java 10 and 11,
and a recent Opera and Edge version. (Firefox and Chrome are out of
date too)

Mail clients to follow later.

[1] https://github.com/ssllabs/sslhaf
 2019-04-18 10:06:01 +02:00
Dirk e768ab3f7b Remove file as Not needed 2019-04-18 10:04:08 +02:00
Dirk WetterandGitHub 9c08a9df8c Merge pull request #1239 from drwetter/add_travis_json 
clarify failed test, add new test
 2019-04-17 09:07:09 +02:00