Commit Graph

4608 Commits

Author SHA1 Message Date
Dirk Wetter ab33f6c0b6
Merge pull request #2163 from drwetter/fix-permissions-githubdockeraction
Hotfix reenabling write permissions
2022-04-25 10:18:49 +02:00
Dirk e5efdd6cb4 Hotfix reenabling write permissions
see #2158
2022-04-25 10:17:05 +02:00
Dirk Wetter db80ef14f0
Merge pull request #2156 from dcooper16/fix_run_server_defaults
Fix run_server_defaults()
2022-04-25 08:54:52 +02:00
Dirk Wetter 5053105d3f
Merge pull request #2154 from dcooper16/server_pref_no_default_cipher
Fix run_server_preference() with no default protocol
2022-04-24 19:30:18 +02:00
Dirk Wetter cc8c02d653
Merge pull request #2139 from dcooper16/fix2131
Fix #2131
2022-04-24 18:17:17 +02:00
Dirk Wetter 4d7357a64e
Merge pull request #2158 from turrisxyz/setup-permissions
Set permissions for GitHub actions
2022-04-24 18:03:10 +02:00
Dirk Wetter 61eb164875
Merge pull request #2157 from dcooper16/update_protos_offered
Update PROTOS_OFFERED
2022-04-22 15:45:49 +02:00
Dirk Wetter ca71b2e374
Merge pull request #2162 from dcooper16/ossl_ciphers
Fix calls to $OPENSSL ciphers
2022-04-22 15:38:30 +02:00
Dirk Wetter 3a460b40e1
Merge pull request #2160 from dcooper16/try_more_ciphers
Try more ciphers
2022-04-22 15:26:07 +02:00
David Cooper 1e0c1a8134 Fix calls to $OPENSSL ciphers
This commit fixes testssl.sh's calls to the "$OPENSSL ciphers" command.

The main issue it fixes is when actually_supported_osslciphers() is called to get a list of non-SSLv2 ciphers supported by $OPENSSL. With OpenSSL 1.0.2, the "-tls1" option needs to be used to exclude SSLv2 ciphers. With LibreSSL, the "-tls1" option may be provided, but it has no effect. With OpenSSL 1.1.1 and newer, the "-tls1" option causes TLSv1.2-only ciphers (e.g., AES256-SHA256) to be excluded (when the "-s" option is also used).

This commit fixes the problem by allowing "-no_ssl2" to be provided as an option to actually_supported_osslciphers(). For versions of $OPENSSL that support SSLv2, "-no_ssl2" is replaced by "-tls1". For versions of $OPENSSL that do not support SSLv2, "-no_ssl2" is simply removed.

This commit also changes openssl2hexcode() to include the "-tls1" option when $OPENSSL supports SSLv2, since openssl2hexcode() should only return a non-SSLv2 cipher.
2022-04-19 14:35:02 -04:00
David Cooper 50b09267d0 Try more ciphers
determine_optimal_sockets_params() makes two attempts to send a TLS 1.2 ClientHello, with each attempt trying 127 ciphers. However, this leaves 97 ciphers from etc/cipher-mapping.txt that are not tried, most of which use ARIA or CAMELLIA. This commit adds a third attempt a send a ClientHello that offers these 97 remaining ciphers. This helps to ensure that support for TLS 1.2 is detected and that later calls to tls_sockets() work, even if the server only supports the ARIA/CAMELLIA ciphers that are not included in TLS12_CIPHER or TLS12_CIPHER_2ND_TRY.
2022-04-18 11:53:28 -04:00
naveensrinivasan 2d03d82fd9
Set permissions for GitHub actions
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

 Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
2022-04-15 21:17:06 -05:00
David Cooper b90db257a1 Update PROTOS_OFFERED
In some rare cases, a connection to the server will fail with tls_sockets() but not with $OPENSSL. This can cause determine_optimal_sockets_params() to call add_proto_offered() to indicate that the protocol is not supported, and then determine_optimal_proto() to later call add_proto_offered() to indicate that it is supported. However, PROTOS_OFFERED does not get changed, since add_proto_offered() only modifies PROTOS_OFFERED if the protocol is not already listed.

This commit fixes the problem by allowing add_proto_offered() to change an entry for a protocol from "no" to "yes".

If determine_optimal_proto() happens to connect to the server using TLS 1.2, then this commit will set TLS12_CIPHER_OFFERED to the cipher from that connection, if TLS12_CIPHER_OFFERED was not set in determine_optimal_sockets_params(). This will allow run_protocols()'s test of a TLS 1.3 ClientHello to work better, if the problem is that no cipher supported by the server is included in TLS12_CIPHER or TLS12_CIPHER_2ND_TRY.
2022-04-15 09:40:02 -04:00
David Cooper 15f8fc5a3f Fix run_server_defaults()
PR #1960 created a bug by placing code between the call to determine_tls_extensions() and a check of its return code. This commit fixes the problem.
2022-04-14 11:01:26 -04:00
David Cooper a2252168f1 Fix run_server_preference() with no default protocol
run_server_preference() calls "default_proto=$(get_protocol $TMPFILE)" even if all attempts to connect to the server failed. This will result in default_proto incorrectly being set to TLS 1.2. This commit fixes the issue by only calling get_protocol() if an attempt to connect to the server was successful.
2022-04-14 10:50:13 -04:00
David Cooper 0be5ca5309 Support DHE/ECDHE servers with uncommon curves
When running in --ssl-native mode, run_fs() will not detect ECDHE ciphers if the server supports both DHE and ECDHE ciphers and the ECDHE ciphers are only supported with curves that are not offered by $OPENSSL by default. This commit fixes this by adding extra connection attempts with the -curves parameter explicitly provided.
2022-04-14 08:51:25 -04:00
David Cooper ac662f8699 Improve compatibility with LibreSSL
Older versions of LibreSSL that do not support TLS 1.3 only include a small list of curves in the supported_groups extension by default, so need to retry with curves explicitly defined even with versions of $OPENSSL that do not support TLS 1.3.
2022-04-14 08:51:25 -04:00
David Cooper dd35be2e4b Fix #2131
This commit fixes #2131 by having run_fs() attempt a TLS 1.2 ClientHello if the initial TLS 1.3 ClientHello fails. The TLS 1.2 ClientHello will offer many more curves than the TLS 1.3 ClientHello offers, and so it may succeed if the server supports ECDHE ciphers, but only with curves that were removed by RFC 8446.
2022-04-14 08:51:25 -04:00
Dirk Wetter 54e5469411
Merge pull request #2150 from dcooper16/no_session_id
Fix setting NO_SESSION_ID
2022-04-14 13:19:24 +02:00
Dirk Wetter 225f1286b4
Merge pull request #2149 from dcooper16/fix2147
Fix #2147
2022-04-14 13:12:16 +02:00
David Cooper cc74256091 Fix setting NO_SESSION_ID
With a TLS 1.3 connection using $OPENSSL, a session ID will only appears as part of a post-handshake session ticket. However, when $OPENSSL s_client is called as in determine_optimal_proto() (i.e., with "< /dev/null"), a post-handshake session ticket will not always be received, even if the server supports it. This can result in NO_SESSION_ID incorrectly being set to true. This commit fixes the issue by setting NO_SESSION_ID to true by default, and then setting it to false if a session ID is returned by any connection to the server.
2022-04-13 09:26:36 -04:00
David Cooper 70b1ee643f Fix #2147
This commit fixes #2147 by having awk search for additional possible strings to start the CRL Distribution Points output. Unless the CRLDP extension is malformed, it will begin with "Full Name", "Relative Name", "Reasons", or "CRL Issuer".
2022-04-12 14:01:02 -04:00
Dirk Wetter 6054be6dff
Merge pull request #2145 from dcooper16/ossl3_fix
More OpenSSL compatibility fixes
2022-04-12 18:50:26 +02:00
David Cooper 618de1c24e More OpenSSL compatibility fixes
This commit fixes two more issues with using OpenSSL 3.X. When $OPENSSL is used to obtain a fingerprint, OpenSSL 3.X prepends the fingerprint with "sha1" or "sha256" rather than "SHA1" or "SHA256". In addition, the way that OpenSSL 3.X writes distinguished names causes a space character to appear at the beginning of "$cn" and "$issuer_CN" in certificate_info().
2022-04-11 11:23:09 -04:00
Dirk Wetter e82178719d
Merge pull request #2141 from dcooper16/ossl3_compat
OpenSSL compatibility fix
2022-04-07 21:29:20 +02:00
Dirk Wetter fc07b379d0
Merge pull request #2142 from dcooper16/fix_flat_json
Fix flat JSON file
2022-04-07 21:28:32 +02:00
David Cooper 09973c8c44 Fix flat JSON file
PR #2140 contains a bug when handling flat JSON files. FIRST_FINDING should only be set to true in the case of structured JSON output, since it is only in that case that fileout_insert_warning() appends a comma to the JSON file. This commit fixes the problem.
2022-04-07 13:57:49 -04:00
David Cooper 6f55a4d08b OpenSSL compatibility fix
OpenSSL 3.0.X uses different names for some elliptic cures in the "Server Temp Key" line than previous previous versions. This commit addresses this issue by checking for both names.
2022-04-07 13:44:42 -04:00
Dirk Wetter 46b66c777a
Merge pull request #2140 from dcooper16/fix2138
Fix #2138
2022-04-07 17:33:59 +02:00
David Cooper 3d0dab4da3 Fix #2138
This commit fixes #2138 by having testssl.sh not wrap early JSON findings in a clientProblem object if the finding is created by a mass testing child and all findings are being placed in a common file. It also sets FIRST_FINDING to true in case another finding is written before the "service" information is written.

Since fileout_insert_warning() adds a comma after the finding is written, the JSON can become corrupted in mass testing if a clientProblem finding is written and then no additional findings are written for that test. In order to try to prevent this, the commit adds several fileout() calls to determine_optimal_proto() in cases in which testssl.sh might exit before testing begins.
2022-04-06 15:41:52 -04:00
Dirk b6c18f5e4e Remove trailing spaces to get rid of failing status of CI 2022-04-01 18:05:27 +02:00
Dirk Wetter ed38cbeed3
Merge pull request #2137 from drwetter/2074_md_fixes
Fix makefile
2022-04-01 15:10:44 +02:00
Dirk fe010c87d2 Fix makefile
* add title
* feature to just rebuild html and roff with force target
2022-04-01 15:08:55 +02:00
Dirk Wetter 429655de55
Merge pull request #2133 from drwetter/2074_md_fixes
Implement fixes in documentation from #2074
2022-04-01 14:48:24 +02:00
Dirk 83d4075465 fixes for roff and html 2022-04-01 14:45:48 +02:00
Dirk db932c2bdc prevent CI from running in doc dir s/docs/doc/ 2022-04-01 14:14:59 +02:00
Dirk 28085e5ec9 Implement fixes in documentation from #2074
kudos @k0lter

* numbering
* some ticks / backticks

For now I left the html and roff files like they were. That should be reconsidered
later.
2022-04-01 13:12:02 +02:00
Dirk ab81558ba4 Merge branch 'k0lter-doc-fixes' into 3.1dev 2022-04-01 12:52:28 +02:00
David Cooper 9829105450 Reorder output of run_server_preference()
This commit reorders the output of run_server_preference() as discussed in #1311.
2022-04-01 12:50:12 +02:00
David Cooper c14ea2efc8 Use tls_sockets() in run_tls_fallback_scsv()
This commit adds the use of tls_sockets() to run_tls_fallback_scsv() to perform testing when the --ssl-native flag is not used. With this commit, run_tls_fallback_scsv() only uses tls_sockets() instead of $OPENSSL if the ClientHello needs to include the TLS_FALLBACK_SCSV flag, but it is not supported by $OPENSSL, or if the protocol that would be negotiated is SSLv3 and $OPENSSL does not support SSLv3.
2022-04-01 12:50:12 +02:00
dependabot[bot] b3979a8979 Bump docker/build-push-action from 2.9.0 to 2.10.0
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2.9.0 to 2.10.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v2.9.0...v2.10.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-04-01 12:50:12 +02:00
David Cooper 16369853d5 Working NNTP server
Switch NNTP server testing to a currently working server from http://vivil.free.fr/nntpeng.htm.
2022-04-01 12:50:12 +02:00
enxio c0fb2d1f70 Declare missing variable, style. 2022-04-01 12:50:12 +02:00
enxio bcacee1e4c Conform to style with local variables: declare "ret" properly. 2022-04-01 12:50:12 +02:00
David Cooper 008fa228c0 Add DH groups to supported_groups
There is at least one server that will not negotiate TLS_DHE_* cipher suites with TLS 1.2 and below if the supported_groups extension is present but does not include any DH groups. This commit adds the DH groups that are currently in the TLS 1.3 ClientHello to the TLS 1.2 and earlier ClientHello.
2022-04-01 12:50:12 +02:00
David Cooper 7a3ce9c677 Fix sclient_auth
If $connect_success is false, then sclient_auth() does not "return" any value, and the calling function treats this as if sclient_auth() had returned 0.

This commit fixes sclient_auth() so that 1 is returned if $client_success is false.
2022-04-01 12:50:12 +02:00
David Cooper bddf9c967f Include RSA-PSS in ClientHello
This commit changes prepare_tls_clienthello() so that the RSA-PSS algorithms are offered in the signature algorithms extension of TLS 1.2 and below ClientHello messages.
2022-04-01 12:50:12 +02:00
enxio 1c2e340506 Conform to style. Add some more info on the TN3270 STARTTLS negotiation. 2022-04-01 12:50:12 +02:00
enxio 1eb5b2949e Add support for TN3270/telnet STARTTLS (similar to OpenSSL's approach). 2022-04-01 12:50:12 +02:00
dependabot[bot] 60885e0c15 Bump actions/checkout from 2 to 3
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-04-01 12:50:12 +02:00