Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 05:38:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,546 Commits 17 Branches 39 Tags
5b44e43ec4ce1a22bc0bf1e36f430410fcbe2c97
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub 7f071ddbb9 Merge pull request #1688 from drwetter/squash_GOST_msg 
Squash "No engine or GOST support via engine..."
 2020-07-20 20:14:37 +02:00
Dirk 161567f9d2 add quotes 2020-07-20 20:13:41 +02:00
Dirk WetterandGitHub 43c62b13d9 Merge pull request #1687 from drwetter/polish_1686 
Polish completion of json/csv output
 2020-07-20 15:54:56 +02:00
Dirk a51a0a73a7 Squash "No engine or GOST support via engine..." 
This is a legacy warning and seems only needed in a very few cases
whereas in other few cases we don't issue such warnings. So to be
consistent it's right to remove this message as it confuses users
unnecessarily,

It'll appear in debug mode though.

See https://github.com/drwetter/testssl.sh/issues/1119#issuecomment-656271849
 2020-07-20 11:43:52 +02:00
Dirk 86c730b74e Polish completion of json/csv output 
To be more consistent with the screen output:

* grade --> overall grade
* add rating doc url
 2020-07-20 11:34:44 +02:00
Dirk WetterandGitHub 1f388d8b94 Merge pull request #1686 from magnuslarsen/3.1dev 
[Rating] Added complete json/csv output
 2020-07-20 11:28:35 +02:00
Dirk WetterandGitHub 00779eb639 Merge pull request #1685 from dcooper16/bad_ocsp 
Check for bad OCSP intermediate certificates
 2020-07-16 19:50:48 +02:00
Dirk WetterandGitHub 19f2c2872a Merge pull request #1680 from drwetter/badocspcert 
Implementation of hanno's bad OCSP intermediate CA detector
 2020-07-15 11:51:34 +02:00
Dirk d07d1f102e Works now 
* open: generation of intermediate certificate files. We do that
  at several places. But for some reasons I do not understand currently
  we remove those files.
* we don't name the offending certificate
 2020-07-14 23:42:06 +02:00
Dirk eb7b0c9644 add hash file 2020-07-14 22:26:23 +02:00
Dirk 903eeec97b Start of implementing of hanno's bad OCSP intermediate CA detector 
see https://github.com/hannob/badocspcert
 2020-07-14 22:23:11 +02:00
Dirk WetterandGitHub 41ac04ef27 Merge pull request #1677 from drwetter/breach2medium 
Revised risk for BREACH --> medium
 2020-07-10 19:56:53 +02:00
Dirk cec5726f30 Revised risk for BREACH --> medium 2020-07-10 19:52:47 +02:00
Dirk WetterandGitHub b941d7db4a Merge pull request #1674 from dcooper16/rate_ciphers_in_json 
Include cipher quality in JSON and CSV
 2020-07-10 12:34:06 +02:00
Dirk WetterandGitHub 6071ae9883 Merge pull request #1672 from dcooper16/fix_unrecognized_option 
Fix printing of unrecognized option
 2020-07-07 15:53:49 +02:00
Dirk WetterandGitHub d881140cac Merge pull request #1669 from dcooper16/separate_pr_cipher_quality 
Separate pr_cipher_quality() into two functions
 2020-07-07 08:36:31 +02:00
Dirk WetterandGitHub 9122ffec1d Merge pull request #1668 from drwetter/1657_polish 
Polish STARTTLS rating output
 2020-06-26 10:02:23 +02:00
Dirk Wetter 7c75993746 remove unused spaces var 2020-06-25 20:54:43 +02:00
Dirk Wetter 288223c707 Polish STARTTLS rating output 
Moved the sentence ~i "A grade better than T would lead to a false sense of security"
to the documentation. No reason for excuses in the output. ;-) Explanation fits
better in the doc.

See also #1657
 2020-06-25 20:47:51 +02:00
Dirk WetterandGitHub ae72592959 Merge pull request #1666 from dcooper16/fix1665 
Fix #1665
 2020-06-25 20:45:19 +02:00
Dirk WetterandGitHub b1f64a50df Merge pull request #1663 from dcooper16/fix1662 
Fix #1662
 2020-06-25 13:39:58 +02:00
Dirk Wetter b2d41330e0 port typo fixes to html and roff doc 2020-06-25 13:05:47 +02:00
Dirk WetterandGitHub 55f7f7d69a Merge pull request #1657 from magnuslarsen/3.1dev 
[Rating] STARTTLS output styling
 2020-06-24 09:51:21 +02:00
Dirk WetterandGitHub 3c30887f39 Merge pull request #1659 from csett86/wireshark-android-7-0 
Add wiresharked Android 7.0 (native)
 2020-06-24 09:49:24 +02:00
Dirk WetterandGitHub e9d6462ee9 Merge pull request #1656 from magnuslarsen/3.1dev 
[Rating] Clearer grade cap reasons
 2020-06-19 09:50:24 +02:00
Dirk WetterandGitHub d19aed2345 Merge pull request #1652 from dcooper16/fix_wildcard 
Fix and enhance CN matching
 2020-06-09 10:48:59 +02:00
Dirk WetterandGitHub 4f13298938 Merge pull request #1651 from dcooper16/missing_space 
Fix missing spaces
 2020-06-09 09:17:37 +02:00
Dirk WetterandGitHub 6a91dadb31 Merge pull request #1637 from magnuslarsen/3.1dev 
[Rating] simple DH group length
 2020-06-02 16:48:45 +02:00
Dirk WetterandGitHub 9a22e9af1a Merge pull request #1649 from dcooper16/SC2034 
Fix Shellcheck SC2034 issues
 2020-06-02 11:08:33 +02:00
Dirk WetterandGitHub 4f9c5158dc Merge pull request #1646 from drwetter/get_TXT_record 
Add get_txt_record(), fix variable declaration in get_mx_record()
 2020-05-25 21:31:18 +02:00
Dirk a4ae05c90c Add get_txt_record(), fix variable declaration in get_mx_record() 
This commit adds a function for querying the TXT DNS record, so
that subsequently we'll can build on top of that a function for
checking MTA-STS, see #1073.

Also it modifies a local variable mxs in get_mx_record() which
was declared as mx but mxs was used. (That is pending an backport
to 3.0.)
 2020-05-25 13:23:49 +02:00
Dirk WetterandGitHub e87880ee92 Merge pull request #1643 from dcooper16/EdDSA 
Support EdDSA
 2020-05-18 14:39:33 +02:00
Dirk WetterandGitHub 42386e512b Merge pull request #1642 from dcooper16/peer_signature_type 
Extract server's signature algorithm
 2020-05-16 12:46:55 +02:00
Dirk WetterandGitHub 2022754b4a Merge pull request #1636 from drwetter/breach_improvements 
Improve compression detection for BREACH
 2020-05-12 10:16:14 +02:00
Dirk WetterandGitHub 7fbb79b147 Merge pull request #1638 from dcooper16/fix_show_sigalgo 
Fix $SHOW_SIGALGO
 2020-05-12 10:13:22 +02:00
Dirk Wetter 78a95d73c8 Add BREACH extension 2020-05-11 14:07:02 +02:00
Dirk Wetter 25f87455a4 Amendment for compression detection (BREACH) 
This commit saves more or less time for a detection of the compression.

First it assembles the GET command with all available compressions and send them all.
If the result is negative: we can just tell the finding and return. If it's
positive: We already have identified 1x compression. Then we cycle through the
remaining compressions with single GET requests.

In order to not duplicate code we introduced a helper function sub_breach_helper()
which takes care sending the request and analysis the result.

We treat now failed requests differently: When the first fails we don't
continue anymore.
 2020-05-11 13:57:50 +02:00
Dirk Wetter 825cbf7b1d Improve compression detection for BREACH 
This commit tries to enummerate through all possible compressions
instead of just raising the arm because of the first one detected.

As far as the performance is concerned there's room for improvements
which subsequent commits will address.
 2020-05-11 10:41:48 +02:00
Dirk WetterandGitHub 78612c86a0 Merge pull request #1635 from drwetter/dockerfile+_31dev 
Better Dockerfile: doesn't require "git clone"
 2020-05-09 13:18:57 +02:00
Dirk d065bda3b8 Better Dockerfile: doesn't require "git clone" 
.. see also #1559.

It "mkdirs" the needed etc and bin directories first, then copies
stuff over. It also reduces a few layers.

Also it corrects a mistake in the Readme.md (docker exec --> run)

Thanks for the discussion @Alex131089
 2020-05-09 13:17:02 +02:00
Dirk WetterandGitHub bbd46b4e03 Merge pull request #1631 from dcooper16/has_sigalgs 
Implement $HAS_SIGALGS
 2020-05-09 10:38:03 +02:00
Dirk WetterandGitHub cc8a83ccc0 Merge pull request #1630 from dcooper16/cipher_pre_check_local_problem 
Fix "local problem" output in ciher_pref_check()
 2020-05-09 10:36:17 +02:00
Dirk WetterandGitHub 6897b4abeb Merge pull request #1632 from unit193/3.1dev 
Fix a couple typos in the documentation.
 2020-05-09 10:34:44 +02:00
Dirk WetterandGitHub 4f868a76a7 Merge pull request #1629 from dcooper16/bad_exponent_rating 
Rate RSA e=1 as CRITICAL
 2020-05-08 17:13:09 +02:00
Dirk WetterandGitHub d16f8a20c5 Merge pull request #1621 from drwetter/drwetter-patch-1 
Labelling, look @ 3.0.2
 2020-05-07 19:57:49 +02:00
Dirk WetterandGitHub e53ea4a115 Merge pull request #1623 from dcooper16/fix_cp_error 
Fix copy and paste error
 2020-05-07 19:38:28 +02:00
Dirk WetterandGitHub a137f73926 Merge pull request #1620 from dcooper16/improve_key_exchange_grading 
Improve key exchange grading
 2020-05-07 19:37:36 +02:00
Dirk WetterandGitHub e243b3d77a Merge pull request #1619 from dcooper16/fix_1576 
Fix #1576
 2020-05-07 19:35:42 +02:00
Dirk Wetter 6fa82ea2f7 Fix typos 2020-05-07 17:15:11 +02:00
Dirk WetterandGitHub 7b3adf8195 Labelling, look @ 3.0.2 
* label 3.1dev it as a ~rolling release
* outlook to 3.0.2 (~tomorrow)
 2020-05-07 10:50:41 +02:00
Dirk WetterandGitHub f492cf0336 Merge pull request #1616 from dcooper16/tls_sockets_return_value 
tls_sockets() return value
 2020-05-06 16:34:40 +02:00
Dirk WetterandGitHub 7c5fc48d25 Merge pull request #1618 from dcooper16/fix_1433 
Fix #1433
 2020-05-06 15:42:05 +02:00
Dirk WetterandGitHub 693cb216f7 Merge pull request #1615 from drwetter/license_patch3.1dev 
Amendment to "Relax the possible GPL license contradiction"
 2020-05-06 09:18:51 +02:00
Dirk 908975380d Amendment to "Relax the possible GPL license contradiction" 
fix it also in the man pages. See #1590 / #1593
 2020-05-06 09:17:42 +02:00
Dirk WetterandGitHub 41259d2f1b Merge pull request #1612 from drwetter/TYPO3-Parsetime 
Add X-TYPO3-Parsetime
 2020-05-05 19:53:15 +02:00
Dirk Wetter 918d358e95 Add X-TYPO3-Parsetime 2020-05-05 13:37:58 +02:00
Dirk WetterandGitHub ec37a6e1bd Merge pull request #1610 from drwetter/xmpp_improvements 
Fix STARTTLS pretests, improve XMPP handshakes
 2020-05-05 08:47:34 +02:00
Dirk Wetter d949b305c0 Fix STARTTLS pretests, improve XMPP handshakes 
There was a empty variable in determine_optimal_proto() which prevented to save
STARTTLS_OPTIMAL_PROTO. This is fixed.

The buffers and return codes for XMPP in starttls_io() were under not every
circumstances correct. This fixes those cases and making that in general more
robust (hopefully).  (There's still code commented out which I'll leave it for
now).

When openssl did not support -starttls xmpp-server there was a copy
and paste error saying that -xmpphost option was not supported.
 2020-05-04 22:38:02 +02:00
Dirk WetterandGitHub 1a0ade585e Merge pull request #1609 from dcooper16/check_server_response 
Check server's response
 2020-05-04 21:35:50 +02:00
Dirk WetterandGitHub 308582bd0e Merge pull request #1608 from drwetter/1590_2_3.1dev 
Address further potential license restriction
 2020-05-04 20:35:37 +02:00
Dirk cdc1a08819 Address further potential license restriction 
.. see https://github.com/drwetter/testssl.sh/issues/1590#issuecomment-623526604

Added some formatting and verbal improvements in the intruductory comment section.
 2020-05-04 20:34:32 +02:00
Dirk WetterandGitHub 934c5fc60c Merge pull request #1603 from drwetter/aes_cgm_doc 
Fix typo in docs: Strong grade Ciphers / AEAD
 2020-05-02 19:54:54 +02:00
Dirk 381fdfa985 Fix typo in docs: Strong grade Ciphers / AEAD 2020-05-02 19:49:01 +02:00
Dirk WetterandGitHub 8e6c80ffba Merge pull request #1601 from drwetter/xmpp_server_polish 
STARTTLS xmpp-server polish
 2020-05-02 19:41:24 +02:00
Dirk 7981a238a5 Comment out S2S XMPP server test for now 2020-05-02 19:40:45 +02:00
Dirk 05c90d4c3a remove add_tls_offered 2020-05-02 18:37:02 +02:00
Dirk 485bcc1888 Change Travis/CI environment to bionic 
... as it comes with openssl 1.1.1 and we can check also XMPP S2S
protocol
 2020-05-02 18:34:10 +02:00
Dirk 5da54b9ce8 fix var declaration 2020-05-01 21:42:41 +02:00
Dirk 9e61d6605e Perl needs a semicolon ;-/ 2020-05-01 19:17:58 +02:00
Dirk 191c69fbdd Minor probe for STARTTLS xmpp-server 
... don't know whether this gets through -- depends on the
version openssl used (1.0.2 doesn't have that)
 2020-05-01 18:39:36 +02:00
Dirk 1d7adebb4e Add HAS_XMPP_SERVER 
... see also #1575
 2020-05-01 18:32:22 +02:00
Dirk 0e6fb44bd3 add xmpp-server 2020-05-01 18:31:35 +02:00
Dirk 53ee37b046 XMPP server 2020-05-01 18:03:19 +02:00
Dirk WetterandGitHub 2b174821e4 Merge pull request #1575 from horazont/feature/xmpp-server 
STARTTLS: add support for xmpp-server
 2020-05-01 17:53:34 +02:00
Dirk f5a1884439 Merge branch 'magnuslarsen-grading_dev' into 3.1dev 2020-05-01 17:37:13 +02:00
Dirk ebe75252fa Merge branch '3.1dev' into magnuslarsen-grading_dev 2020-05-01 17:36:29 +02:00
Dirk WetterandGitHub aa702369c1 Merge pull request #1597 from dcooper16/use_has_x25519 
Use $HAS_X25519 and $HAS_X448
 2020-05-01 16:21:47 +02:00
Dirk WetterandGitHub ece209886c Merge pull request #1598 from dcooper16/improve_libressl_302_compat 
Improve compatibility with LibreSSL 3.0.2 and earlier
 2020-05-01 16:16:28 +02:00
Dirk WetterandGitHub c52ba088cf Merge pull request #1599 from dcooper16/improve_libressl_310_compat 
Improve LibreSSL 3.1.0 compatibility
 2020-05-01 16:12:28 +02:00
Dirk WetterandGitHub a1f6fe49ba Merge pull request #1595 from dcooper16/ticketbleed_no_tls1_3 
Ticketbleed and TLS 1.3
 2020-04-30 10:01:28 +02:00
Dirk a9d28949fe Clarify responsilility for rating 2020-04-28 21:13:36 +02:00
Dirk Wetter 97ac4c452e Update documentation (ADDITIONAL_CA_FILES -> ADDTL_CA_FILES) 
which happened in d44a643fab in
testssl.sh .

This fixes it in the related files. See also #1581
 2020-04-28 15:07:33 +02:00
Dirk Wetter 3745e12673 Add latest changes (cherry picked from 3.1dev) 
including the one since 3.0
 2020-04-28 14:59:35 +02:00
Dirk db84e5c87c Add grade cap reasons and warnings to JSON/CSV 2020-04-28 13:38:23 +02:00
Dirk 13a76bc719 (try to) resolve merge conflict 2020-04-28 13:35:24 +02:00
Dirk WetterandGitHub 67780b1c3c Merge pull request #1593 from drwetter/1590_readme_dev 
Relax the possible GPL license contradiction
 2020-04-28 10:08:19 +02:00
Dirk 88c04f5345 Relax the possible GPL license contradiction 
... see also #1590
 2020-04-28 10:06:29 +02:00
Dirk WetterandGitHub a3b84ce0c3 Merge pull request #1591 from drwetter/1583_changelog 
Add latest changes
 2020-04-27 19:20:14 +02:00
Dirk Wetter 50d10d00f7 Add latest changes 
including the one since 3.0
 2020-04-27 19:19:19 +02:00
Dirk WetterandGitHub 2854aafca6 Merge pull request #1583 from drwetter/dcooper16-extend_run_server_preference 
WIP: Extended run_server_preference()
 2020-04-27 18:52:51 +02:00
Dirk Wetter 680aff48e4 Update documentation related to extended run_server_preference() 2020-04-27 17:19:30 +02:00
Dirk Wetter 1e0ef23c81 Rename add_tls_offered --> add_proto_offered 
... last but not least SSLv2 and SSLv3 are no TLS protocols
 2020-04-27 17:12:25 +02:00
Dirk Wetter 8938c21703 Renaming proto variables in cipher_pref_check() 
... to be consistent with ciphers_by_strength:

- proto --> proto_text
- proto_ossl --> proto
 2020-04-27 17:08:43 +02:00
Dirk Wetter 3b92b0cf85 Remember better protocol settings in ciphers_by_strength() / cipher_pref_check() 
... in cases where the protcol section has not been run before.

Also add " -\n" on the screen/html if protocol is not supported. Also for
SSLv2 which can be supported but at the same time not offer any ciphers
mention there will be an output on the screen.
 2020-04-27 16:51:45 +02:00
Dirk Wetter 0a859d7b98 rename $p --> $proto_ossl in cipher_pref_check() 
plus remove redundant quotes for that
 2020-04-27 15:32:43 +02:00
Dirk WetterandGitHub 59b790ab3a Merge pull request #1588 from drwetter/np_fix31 
Negotiated protocol showed no warning for TLS 1.1/1.0
 2020-04-25 11:13:43 +02:00
Dirk Wetter 4defa95d0b Negotiated protocol showed no warning for TLS 1.1/1.0 
.. whereas the protocol section did that.

This fixes the inconsistency.
 2020-04-25 11:12:36 +02:00
Dirk Wetter 3e54f4e4cd Further changes to run_server_preference() 
In order not to provide redundant information run_allciphers() is
now not being run via default (1). Therefore run_server_preference()
runs always in wide mode.

In order to archieve that cipher_pref_check() was modified to
accept a fifth argument whether it'll run in wide mode. As
of now cipher_pref_check() is only called by run_server_preference(),
so the code referring to non-wide mode in cipher_pref_check() may also
be deleted in the future.

To provide a better view the run_fs() section is now being run after
run_server_preference().

(1) saves also 5-6 seconds
 2020-04-24 13:32:26 +02:00
Dirk WetterandGitHub 1a6abb6ab8 Merge pull request #1584 from dcooper16/fix_logjam_ssl_native 
Fix run_logjam() in --ssl-native mode
 2020-04-24 09:41:59 +02:00
Dirk WetterandGitHub b5840153d3 Merge pull request #1586 from dcooper16/improve_ossl30_support 
Improve compatibility with OpenSSL 3.0
 2020-04-24 09:38:03 +02:00