Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 05:38:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,396 Commits 17 Branches 39 Tags
4f874b3ebfc21f74dcc69dcb521e0323b8c1956d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk Wetter 4f874b3ebf should better run on PR 2026-06-17 10:51:38 +02:00
Dirk Wetter 1d6045ccd8 Add workflow for pandoc 2026-06-17 10:43:05 +02:00
Dirk Wetter 0359a363ae Change title --> trigger pandoc 2026-06-17 10:41:49 +02:00
Dirk WetterandGitHub e0af44a7be Merge pull request #3058 from testssl/debug_hooks 
Provide better debugging means for GH runners
 2026-06-10 14:11:14 +02:00
Dirk 8e25163625 Remove QUIC from runner 2026-06-10 10:03:25 +02:00
Dirk 457f8fd0a0 Provide better debugging means 
This is just to assist debugging of the runners, so that
we can grab in a case needed the screen and stderr .

* there's a script t/03_debug.t.DISABLED which needs to be renamed then
* it utilises IPC::Run3
- also showing the PATH is added for both runners
- Readme amended accordingly
 2026-06-09 13:43:43 +02:00
Dirk WetterandGitHub c25a0ad491 Merge pull request #3057 from testssl/drwetter-patch-1 
Hide CI badges for now
 2026-06-09 10:39:41 +02:00
Dirk WetterandGitHub 2f591423f2 fix spelling 2026-06-09 10:39:03 +02:00
Dirk WetterandGitHub 5205310c0c Remove CI badges 
... as they reflect the PR status and not the current branch

See #2794
 2026-06-09 10:36:24 +02:00
Dirk WetterandGitHub e7204bd524 Merge pull request #3056 from testssl/revert-3055-drwetter-patch-1 
Revert "Trying to fix the badge issue"
 2026-06-09 10:32:16 +02:00
Dirk WetterandGitHub f634570af7 Revert "Trying to fix the badge issue" 2026-06-09 10:31:37 +02:00
Dirk WetterandGitHub fbedfe5f5f Merge pull request #3055 from testssl/drwetter-patch-1 
Trying to fix the badge issue
 2026-06-09 10:19:40 +02:00
Dirk WetterandGitHub 01f9b49549 Update unit_tests_ubuntu.yml 
... also for the ubuntu runner
 2026-06-09 10:18:52 +02:00
Dirk WetterandGitHub b9dda9312d Trying to fix the badge issue 
... by having the runner only act on 3.3dev. Sounds counter intuitive but I was recommended to try
 2026-06-09 10:16:50 +02:00
Dirk WetterandGitHub db014a6289 Merge pull request #3054 from testssl/drwetter-patch-1 
Fix badges, try 2
 2026-06-09 09:58:42 +02:00
Dirk WetterandGitHub ea16c81e97 Fix badges, try 2 
* comment in status badges (try)
* stars getting to work again
 2026-06-09 09:57:21 +02:00
Dirk WetterandGitHub fe080150cf Merge pull request #3053 from testssl/drwetter-patch-1 
Handle badges, remove 1 bracket
 2026-06-09 09:45:10 +02:00
Dirk WetterandGitHub 1bf15f41e1 Handle badges 2026-06-09 09:42:50 +02:00
Dirk WetterandGitHub cfde1df489 Merge pull request #3050 from potato-20/add-modern-security-headers 
Report additional modern security headers (INFO)
 2026-06-09 09:22:54 +02:00
Dirk WetterandGitHub 8f588813c0 Merge pull request #3049 from potato-20/fix-mx-host-port-2986 
Fix --mx host:port parsing and incorrect no-MX message (#2986)
 2026-06-08 18:33:32 +02:00
Dirk WetterandGitHub 654dc18760 Merge pull request #3052 from testssl/mac_runner_update 
Update runner to macos-26 (arm64 as before)
 2026-06-08 17:08:16 +02:00
Dirk Wetter 3c5b733431 Update runneer to macos-26 (arm64 as before) 
... as they were strange failures in the past.

Supported runners: https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners .
Details: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-arm64-Readme.md
 2026-06-08 16:41:37 +02:00
Dirk WetterandGitHub 7f63e73ec3 Merge pull request #3046 from SteveVaneeckhout/fix-permissions-policy-duplicate 
Fix Permissions-Policy header listed twice in output
 2026-05-30 17:47:56 +02:00
Dirk WetterandGitHub 316b1a8014 Merge pull request #3045 from testssl/add_fs_data_clientsimulation_json 
Add fs data clientsimulation json
 2026-05-29 16:07:24 +02:00
Dirk 209e76541e Using a compariable Linux distro in the firstplace for updating handshake would have been great ;-) 2026-05-29 15:20:17 +02:00
Dirk ec99148700 Fix html output runner 2026-05-29 13:00:58 +02:00
Dirk 1ee1a60a99 var name append_fileout is clearer 2026-05-29 10:53:28 +02:00
Dirk 566e1b1f65 Fix diff complaint raised by ./t/12_diff_opensslversions.t 2026-05-29 10:33:03 +02:00
Dirk cff2c0810c Add Linux, not Mac baseline ;-) 2026-05-28 20:41:00 +02:00
Dirk Wetter 01d58f5e9c update client simulation data 2026-05-28 19:07:28 +02:00
Dirk Wetter cf66ad61bd Add forward secrecy data to file output 
This fixes #3040 .

Also this removes the debug lines within the if statement (bottom of run_client_simulation() ), probably
a historic leftover.
 2026-05-28 19:03:39 +02:00
Dirk WetterandGitHub 9567e65a01 Merge pull request #3043 from testssl/issue_cmdline_warnings 
Introduce early warning function
 2026-05-28 13:31:27 +02:00
Dirk Wetter 75376d38bf Introduce early warning function 
... which warns also via file output when not recommended command
line options are used.

This function named issue_cmdline_warnings() is being called in
lets roll after all fileout() functions has been initialized.
It needs to make use of fileout_insert_warning() though because
otherwise the JSON output is not correct.

Besides the previoulsy introduced warning when scanning IP addresses,
warnings of usage of '--fast' and '--ssl-native' will end up also
in a file now which gives ther tools using the machine readable
output to detect bad scan conditions.

Also warnings when scanning the most known IPv4 addresses
from Cloudflare, Google and Quad9, are avoided.
 2026-05-28 10:37:16 +02:00
Dirk WetterandGitHub ca99b45f1f Merge pull request #3042 from testssl/grhza-3.3dev 
Improve PR #3041
 2026-05-27 18:16:42 +02:00
Dirk Wetter f8af511952 Improve PR #3041 
* move message when scanning IP address to the very beginning, inside parse_cmd_line()
* improve message
* just check whether there are no chars a-zA-Z

* move [[ $caa_node =~ '.'$ ]] || caa_node+="." into the while loop
 2026-05-27 16:53:06 +02:00
Dirk WetterandGitHub 2f51cff728 Merge pull request #3039 from phpipam/3.3dev 
Added link to php-ssl Certificate scanning integration
 2026-05-19 17:27:07 +02:00
Dirk WetterandGitHub 84235d35c0 Merge pull request #3038 from testssl/more_handshakes_updates 
Client handshake updates
 2026-05-18 22:14:26 +02:00
Dirk 7871d800f9 adjust baseline runner output 2026-05-18 21:30:57 +02:00
Dirk 01b7ad7cc8 correct name 2026-05-18 21:30:34 +02:00
Dirk 56697cee48 Consolidate handshakes for all Safaris 26.4 
Looked before at ja3, but for Chromium-browsers ja4 is relevant.
The client column needed to be extended with 1 space.
 2026-05-18 21:16:43 +02:00
Dirk b4e58dfbb5 Consolidated Handshakes 
went through a couple of pcap files and determined ja3 + ja4 sums.

- Android 15/16 are the same (previously ja3 taken instead of ja4 and wrong host. One has to use chrome !)
- Edge 101/Chrome 101 are the same (will be deprated next time)
- surprisingly Java 17.0.3 and 21.0.6 were the same.

- Added: Ja3/ja4 for old Apple Mail and Thunderbird
 2026-05-18 18:45:04 +02:00
Dirk 7897cdcd84 Android 16 
As mentioned in the comment: For Androids ja3 is is not unique, probably because of GREASE.
One can add two handshakes after another and they are different. ja4 seems more consistent here.

This should be kept in mind for all clients "supplying some grease"
 2026-05-18 16:50:06 +02:00
Dirk 56e4a74485 Add OpenSSL 4.0 2026-05-17 15:23:42 +02:00
Dirk a35e9f816d Broaden table for client simulation 
... as some clients are the same and space wasn't enough.
 2026-05-16 16:14:24 +02:00
Dirk dd4c0b371d Handshakes for iOS + iPadOS 26.4. added 2026-05-16 16:04:13 +02:00
Dirk 7be3897437 Update MacOS/Safari 26.4 
it has PQC kx finally, whohoo
 2026-05-15 21:31:06 +02:00
Dirk 14e8df3fab Update readme wrt ja3/ja4 + imotr tweaks 2026-05-15 21:30:07 +02:00
Dirk 60131b4b5d - Update Apple Client Simulations 2026-05-15 21:28:54 +02:00
Dirk WetterandGitHub 0e59b983f1 Merge pull request #3030 from testssl/fix_unicode_3003 
Fix DN conversion when reading certificate issuer
 2026-04-22 15:34:21 +02:00
Dirk WetterandGitHub 146605e740 Merge pull request #3031 from testssl/fix_doc-problem_3029 
Fix doc error regarding MAX_SOCKET_FAIL + MAX_OSSL_FAIL
 2026-04-20 18:58:51 +02:00
Dirk b773fa9939 Fix doc error regarding MAX_SOCKET_FAIL + MAX_OSSL_FAIL 
The trailing error messages were swapped in the paragraphs /
description for MAX_SOCKET_FAIL + MAX_OSSL_FAIL .

This fixes the confusion for 3.3dev , see #3028 .
 2026-04-20 18:43:59 +02:00
Dirk b573a4f786 Fix DN conversion when reading certificate issuer 
This fixes #3003 .

The conversion to proper UTF-8 should have taken place by just using
`-nameopt RFC2253`, see manpage openssl-namedisplay-options(1ssl).

As @dcooper16 suggested removing esc_msb should help. This may look
counterintuitive but works.
 2026-04-20 18:09:36 +02:00
Dirk WetterandGitHub d2d684e31b Merge pull request #3029 from testssl/fix_fix_2809 
Address missing extended_master secret extension properly
 2026-04-20 17:49:24 +02:00
Dirk cff949bb90 Address missing extended_master secret extension properly 
This PR "fixes feature" #2809 which was formerly not properly implemented in #2982,
see comment https://github.com/testssl/testssl.sh/issues/2806#issuecomment-4164847538.

Now TLS 1.3.-only servers won't get penalized when the master secret extension
is missing.
 2026-04-20 16:31:44 +02:00
Dirk WetterandGitHub 7c47d8a8eb Merge pull request #3023 from dcooper16/identity_ossl_tls13_ciphers 
Identify TLS 1.3 ciphers by OpenSSL name
 2026-04-17 11:59:10 +02:00
Dirk WetterandGitHub 24eb5dec8a Merge pull request #3024 from dcooper16/missing_groups 
Add missing TLS 1.3 Brainpool groups
 2026-04-15 11:41:14 +02:00
Dirk WetterandGitHub 57cca5c2a0 Merge pull request #3020 from dcooper16/use_sigalgs 
Use OpenSSL with -sigalgs option to obtain server's certificate
 2026-04-13 09:36:47 +02:00
Dirk WetterandGitHub 93ae5d78f4 Merge pull request #3021 from dcooper16/missing_sigschemes 
Add missing TLS signature schemes
 2026-04-13 09:34:20 +02:00
Dirk WetterandGitHub e3ec72a359 Merge pull request #3018 from dcooper16/ossl4_ocsp 
OpenSSL 4 compatibility for stapled OCSP responses
 2026-04-12 13:24:01 +02:00
Dirk WetterandGitHub b14ed4def5 Merge pull request #3017 from dcooper16/tls_data 
Clean up etc/tls_data.txt
 2026-04-11 11:22:17 +02:00
Dirk WetterandGitHub 012a296184 Merge pull request #3015 from testssl/dcooper16-1 
Add draft-yang-tls-hybrid-sm2-mlkem
 2026-04-09 11:53:23 +02:00
Dirk WetterandGitHub e370aabb33 Update CREDITS.md 2026-04-09 11:52:50 +02:00
Dirk WetterandGitHub 48b29194b9 Add draft-yang-tls-hybrid-sm2-mlkem 2026-04-09 11:43:02 +02:00
Dirk WetterandGitHub adff28d50c Merge pull request #3014 from dcooper16/rfc8998 
Add support for RFC 8998 and draft-yang-tls-hybrid-sm2-mlkem
 2026-04-09 11:29:08 +02:00
Dirk WetterandGitHub 3f9eb84778 Merge pull request #3012 from testssl/fix_3009_date-detection 
Make sure date -r hits a dir readable
 2026-04-07 16:00:04 +02:00
Dirk Wetter ec95862790 Make sure date -r hits a dir readable 
When checking early for date flavors, there might be an edge case when
a directory with a referred file (for the date command) isn't readable
which might cause testssl.sh to not detect the date flavor correctly.

This fixes that by cd'ing to / in a subshell which should be cd'able
and readable under every platform.
 2026-04-07 10:27:46 +02:00
Dirk WetterandGitHub 802061f492 Merge pull request #3010 from testssl/patch-1 
Fix typo
 2026-04-07 09:48:37 +02:00
Dirk WetterandGitHub 693a7c1682 Fix typo 2026-04-07 09:47:36 +02:00
Dirk WetterandGitHub 5958f063f6 Merge pull request #3005 from dcooper16/ossl4 
OpenSSL 4 compatibility
 2026-03-25 09:49:42 +01:00
Dirk WetterandGitHub 9c086b2e15 Merge pull request #3002 from testssl/dependabot/github_actions/docker/build-push-action-7 
Bump docker/build-push-action from 6 to 7
 2026-03-12 11:02:37 +01:00
Dirk WetterandGitHub 3142e73b99 Merge pull request #3001 from testssl/dependabot/github_actions/docker/setup-buildx-action-4 
Bump docker/setup-buildx-action from 3 to 4
 2026-03-12 11:02:13 +01:00
Dirk WetterandGitHub a24990ef90 Merge pull request #3000 from testssl/dependabot/github_actions/docker/metadata-action-6 
Bump docker/metadata-action from 5 to 6
 2026-03-12 11:01:45 +01:00
Dirk WetterandGitHub 63a07e38e1 Merge pull request #2999 from testssl/dependabot/github_actions/docker/setup-qemu-action-4 
Bump docker/setup-qemu-action from 3 to 4
 2026-03-12 11:01:01 +01:00
Dirk WetterandGitHub a7f16fd189 Merge pull request #2998 from testssl/dependabot/github_actions/docker/login-action-4 
Bump docker/login-action from 3 to 4
 2026-03-12 11:00:30 +01:00
Dirk WetterandGitHub 87ecc1c9f2 Merge pull request #2997 from testssl/drwetter-patch-1 
don't use 3.0 docker images anymore
 2026-02-19 10:53:34 +01:00
Dirk WetterandGitHub 81fb5f967f don't use 3.0 anymore 2026-02-19 10:52:31 +01:00
Dirk WetterandGitHub 552e10ce8a Merge pull request #2995 from testssl/drwetter-patch-1 
Amend IPv6 with host networking
 2026-02-18 10:32:48 +01:00
Dirk WetterandGitHub 8aca6f0665 Amend IPv6 with host networking 2026-02-18 10:31:24 +01:00
Dirk WetterandGitHub aef8616e5b Merge pull request #2992 from testssl/back2thedev 
Change banner back to 3.3dev
 2026-02-18 10:25:29 +01:00
Dirk WetterandGitHub 4086cb593e Merge pull request #2994 from testssl/drwetter-patch-1 
Docker + IPv6
 2026-02-18 10:01:48 +01:00
Dirk WetterandGitHub 6cc8c857a8 Docker + IPv6 2026-02-18 10:00:57 +01:00
Dirk 094c61caea Change banner back to 3.3dev 2026-02-13 14:25:58 +01:00
Dirk WetterandGitHub cdc892e323 Merge pull request #2991 from testssl/3.3snap1 
Add "dev" to the version banner to clarify
 2026-02-13 13:46:54 +01:00
Dirk c895a5c268 Add "dev" to the version banner to clarify 
And modify the banner accordingly depending on whether it's a
snapshot release or not.
 2026-02-13 11:18:13 +01:00
Dirk WetterandGitHub a9fc8a17c5 Merge pull request #2989 from testssl/3.3snap1 
Prepare for a snapshot release
 2026-02-13 08:36:20 +01:00
Dirk c600b2cb38 Prepare for a snapshot release 
- "3.3" still signals it's not oldstable
- "snapshot-YYMM" speaks for itself
 2026-02-12 23:15:07 +01:00
Dirk WetterandGitHub 18a1264223 Merge pull request #2985 from testssl/fix_2983_robot_timeout 
Finalize renaming MAX_WAITSOCK --> ROBOT_TIMEOUT
 2026-02-11 21:36:17 +01:00
Dirk ee316ef7ee Google has KEMs wjhich openssl doesn't show 2026-02-11 20:06:24 +01:00
Dirk 98d3c8399f Fix typo in ROBOT_TIMEOUT 
... which may led to false positives

Also in a number of tests the timeout was re-adjusted so that the robot check
performs ~25% faster -- on MacOS. On Linux it's about the same.
 2026-02-11 19:00:38 +01:00
Dirk 496373a60f Finalize renaming MAX_WAITSOCK --> ROBOT_TIMEOUT 
The commit 51a35b0344 changed variable names but there were leftovers. Also
before the tiemout values were reduced, so that the check may run faster. What was left were that some
timeout values were still too long. Thus MAX_WAITSOCK is now completely changed to ROBOT_TIMEOUT .
Also when the ROBOT check identified something as potentially vulnerable, the timeout value ist increased to
8 seconds which is less than in 3.2 . Tests however showed so far that there were no false positives or
negatives.

Moreover it changes the local variable robottimeout to robot_timeout.

This PR fixes #2983 for 3.3dev .
 2026-01-22 19:57:32 +01:00
Dirk WetterandGitHub 79db2763b6 Merge pull request #2982 from testssl/feature_2806 
Flag absence of extended master secret extension
 2026-01-15 15:19:45 +01:00
Dirk ca55c5b180 Exempt the debug statement "Extended master secret extension detected" 2026-01-15 11:20:01 +01:00
Dirk d78fae2dce Add extended_master_secret extension 2026-01-14 20:37:33 +01:00
Dirk 52ffa95696 Flag absence of extended master secret extension 
This PR fixes #2806 and implements a feature request. TLS >=1.2 MUST support
support the extended_master_secret extension to address an attack resulting
from TLS session parameters not being properly authenticated in a Triple
Handshake scanario (https://ieeexplore.ieee.org/document/6956559).

Only if the extension is missing there will be a medium severity level
finding. JSON output will be generated in any case.

Also in determine_tls_extensions() some documenation about tls extensions
to be send were added.
 2026-01-14 20:22:59 +01:00
Dirk WetterandGitHub 251d5ac02a Merge pull request #2981 from testssl/fix_2973 
Remove VULN_THRESHLD relic
 2026-01-13 20:05:44 +01:00
Dirk cf77cd2ad4 fix spelling 2026-01-13 17:33:33 +01:00
Dirk 3e10b3a9a2 Remove VULN_THRESHLD relic 
This fixes #2973.

There was a while back an extra headline when one or a defined other
number of vulnerabilities were checked. The extra headline was removed
n #2967 but some leftover code needed to be removed as well.

In the aforementioned previous PR it seems run_starttls_injection()
and run_rc4() were forgotten. This PR removes extra headlines in
those functions as well.
 2026-01-13 17:24:27 +01:00
Dirk WetterandGitHub 4e10bd24da Merge pull request #2979 from testssl/drwetter-patch-1 
general remarks, check boxes
 2026-01-13 10:36:30 +01:00
Dirk WetterandGitHub 62934191d3 minor tweaking 2026-01-13 10:35:50 +01:00
Dirk WetterandGitHub edbec494c6 Merge pull request #2980 from testssl/OPENSSL2_hint 
Suggest alternative $OPENSSL2 when $OPENSSL fails
 2026-01-13 10:30:31 +01:00