Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,395 Commits 16 Branches 39 Tags
68cbdf8dc8f50b4a9eb8099b5d57093e385a6147
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk Wetter 68cbdf8dc8 Fix "off by one" error in HSTS 
There was by mistake a 179 days threshold and also the error message
was wrong when HSTS was exactly set to 179 days, see #1879.

This commit sets it to 180 days and corrects the error messages on
screen.
 2021-05-08 14:55:30 +02:00
Dirk WetterandGitHub 835abd6acb Merge pull request #1870 from dcooper16/fix_ossl30 
Improve compatibility with OpenSSL 3.0
 2021-04-09 10:44:12 +02:00
Dirk WetterandGitHub 52ed92ca87 Merge pull request #1866 from drwetter/fix1860_svSE_etc_charset_3.0 
Ensure certain regex patterns work as expected and aren't localized (3.0)
 2021-04-05 14:29:22 +02:00
Dirk c461702112 Ensure certain regex patterns work as expected and aren't localized (3.0) 
Same as #1865.

This PR is trying to address an issue where probably newer bash versions treat
regexes differently in other locales. W is with a swedish locale just a variant
of V (#1860) see also e.g.

https://collation-charts.org/opensolaris/opensolaris.2008.05.sv_SE.UTF-8.html
https://www.sqlservercentral.com/forums/topic/order-by-name-not-works#post-1644177
 2021-04-05 11:38:17 +02:00
Dirk WetterandGitHub 7723a309b5 Merge pull request #1858 from jschauma/3.0 
add codepoints for RFC7905, ChaCha20-Poly1305
 2021-03-25 21:34:04 +01:00
Dirk WetterandGitHub acc9a82a07 Merge pull request #1848 from elfranne/ianaopenssl3.0 
IANA <-> Openssl mapping issue for 3.0
 2021-02-25 17:17:39 +01:00
Dirk WetterandGitHub bf966a9b2f Merge pull request #1831 from drwetter/fix_heartbleed_json.1828_3.0 
Fix file output formatting for heartbleed (3.0)
 2021-01-20 10:11:51 +01:00
Dirk a1777cdd0e Fix file output formatting for heartbleed 
Quotes were wrong for different results, which lead to some confusion
for finding, cve and cwe.

Fixes #1828
 2021-01-20 09:04:11 +01:00
Dirk WetterandGitHub 2627d9db13 Merge pull request #1825 from drwetter/fix_travis_3.0 
Travis CI didn't run. Trying to fix it (3.0)
 2021-01-18 09:15:14 +01:00
Dirk 4ee936dc52 Travis CI didn't run. Trying to fix it 2021-01-13 22:35:34 +01:00
Dirk WetterandGitHub 4b800b0ae5 Merge pull request #1822 from drwetter/fix_dot@NODE 
Fixes trailing dot error in URL handling (3.0)
 2021-01-13 21:56:48 +01:00
Dirk Wetter b8e76a3861 Fixes trailing dot error in URL handling 
For DNS queries a trailing dot in the variable $NODE is always fine. For
HTTP queries it is not. and causes the https request to fail.

Backport from 4f1da9b192

Also: removal of ancient CVS_REL relict in $TEMPDIR/environment.txt
 2021-01-13 11:35:31 +01:00
Dirk WetterandGitHub 666a2c4edb Merge pull request #1818 from drwetter/le_issuer_fix1816_3.0 
Fix issuer check for Let's Encrypt (3.0)
 2021-01-07 10:32:12 +01:00
Dirk Wetter 0de00f4322 Fix issuer check for Let's Encrypt (3.0) 
Fixes #1816 for 3.0 by a proper halving of the dates
 2021-01-07 10:29:08 +01:00
Dirk WetterandGitHub cb94ffaa13 Merge pull request #1796 from drwetter/no_code_update3.0 
Trying to save resources for Travis/CI (3.0)
 2020-11-28 10:15:13 +01:00
Dirk 98d1bd64bc Trying to save resources for Travis/CI (3.0) 
See https://github.com/google/EarlGrey/pull/383/files/3b38a5dea36a88aba42a42931e77a7c5429a1837
 2020-11-28 10:12:43 +01:00
Dirk WetterandGitHub dc08a120ba Merge pull request #1793 from drwetter/docker_docu_polish3.0 
Consolidate docker sections in Readme.md and Dockerfile.md (3.0)
 2020-11-27 16:54:26 +01:00
Dirk Wetter 7c835470be Consolidate docker sections in Readme.md and Dockerfile.md 
see #1791
 2020-11-27 16:53:28 +01:00
Dirk WetterandGitHub 7dac1a20f7 Merge pull request #1780 from drwetter/fix_1779 
Fix 1779
 2020-11-20 16:27:10 +01:00
Dirk ca89328ed4 Change version number 
To avoid clashes with distributors it may be is smarter to stick
to three numbers and not intoducing another digit.

3.0.4 <-- 3.0.3.1
 2020-11-20 11:09:17 +01:00
Dirk e441357efe Fix reading SSLv2 socket (3.0 branch) 
This fixes #1779. There was a problem introduced in
3c97412a61 which counted
the size of the file name rather than the size of the
socket reply.
 2020-11-20 11:06:22 +01:00
Dirk b08b5d8b98 Bump version to 3.0.3 2020-11-19 09:41:12 +01:00
Dirk WetterandGitHub 0abaa6d2bf Merge pull request #1774 from drwetter/ca-update_3.0 
Update certificate stores (3.0 branch)
 2020-11-14 11:11:03 +01:00
Dirk Wetter 2f18dcbd58 Update remaining stores: Apple / Java / Microsoft 
* also ca_hashes.txt

* Used Java SDK 15 instead of JRE 8
* Used Windows 10 20H2
* Java Keystore has added 5 certificates (90 --> 95)

Updated Readme and make instructions more reproducible

Fixes #1772
 2020-11-13 22:13:10 +01:00
Dirk WetterandGitHub d536c07b72 Merge pull request #1776 from drwetter/fix_1762_3.0 
Stop labeling X-XSS-Protection as green (3.0 branch)
 2020-11-13 15:24:22 +01:00
Dirk Wetter 99a158d952 Stop labeling X-XSS-Protection as green (3.0 branch) 
* X-XSS-Protection is now labled as a neutral finding as suggested in #1762
* Also it adds colons to header values

This a quick fix for the stable version as opposed to #1764 ff.
It also changes the color from lite cyan to neutral
 2020-11-13 13:57:21 +01:00
Dirk Wetter a180ec4f80 update Linux.pem + Mozilla.pem 2020-11-11 18:37:56 +01:00
Dirk WetterandGitHub f3abf77ed8 Merge pull request #1761 from keisentraut/fix-1757-3.0 
fix #1757: manpage: --c has one dash to much (backport 3.0)
 2020-10-29 20:28:23 +01:00
Dirk WetterandGitHub 0cf5a49762 Merge pull request #1759 from drwetter/fix_1754_3.0 
Fix run_freak() when sslv2 server hello is empty (3.0 branch)
 2020-10-28 15:05:51 +01:00
Dirk Wetter 3c97412a61 Address complaint by Travis + RC4 SSLv2 ciphers shortcut 
Despite the fact google doesn't support RC4 ciphers, testssl.sh called
sslv2_sockets(). Google answered with a >= TLS alert. Building a sum then
failed then in sslv2_sockets().

This fixes sslv2_sockets() and introduces count_chars() as a helper function
(tested also under old FreeBSD to make sure it works under MacOSX).

Also it adds a shortcut: if we are sure we don't have sslv2 we don't need
to test any RC4 SSLv2 ciphers
 2020-10-28 11:45:41 +01:00
Dirk 4ddc90d98d Fix run_freak() when sslv2 server hello is empty (3.0 branch) 
This fixes #1754 by avoiding further string operations if the SSLv2 socket reply is empty as bash 5.1 seems to have a problem with that. The fix is done in sslv2_sockets() .

Also sslv2 is not being used in run_freak() if known not to be supported.
 2020-10-27 22:48:50 +01:00
Dirk WetterandGitHub cd9b98ca70 Merge pull request #1727 from drwetter/fix_1725_SCIR_3.0 
Fix Secure Client-Initiated Renegotiation false positive (3.0 branch)
 2020-09-16 20:13:33 +02:00
Dirk 08feaf4a0c Fix Secure Client-Initiated Renegotiation false positive (3.0 branch) 
Server side closed the connection but openssl retrieved
a zero exit code. In addition now we look for "closed"
and if that was returned from the server we label it
as not vulnerable.

This fixes #1725.

Same fix as for 3.1dev, see #1726
 2020-09-16 18:13:47 +02:00
Dirk WetterandGitHub c0581afeeb Merge pull request #1712 from dcooper16/fix1699_3.0 
Fix #1699 in 3.0 branch
 2020-08-31 17:07:46 +02:00
Dirk d9866d875a Revised risk for BREACH --> medium 2020-07-10 19:56:18 +02:00
Dirk WetterandGitHub e1b0f2d55f Merge pull request #1673 from dcooper16/fix_unrecognized_option_3.0 
Fix printing of unrecognized option in 3.0 branch
 2020-07-07 15:54:11 +02:00
Dirk WetterandGitHub 2949b95937 Merge pull request #1667 from dcooper16/fix1665_3.0 
Fix #1665 in 3.0 branch
 2020-06-25 20:45:42 +02:00
Dirk WetterandGitHub 916d942b00 Merge pull request #1664 from dcooper16/fix1662_3.0 
Fix #1662 in 3.0 branch
 2020-06-25 13:40:41 +02:00
Dirk WetterandGitHub 2cdcf1564b Merge pull request #1661 from csett86/wireshark-android-7-0-backport 
Add wiresharked Android 7.0 (native) (backport of #1659)
 2020-06-25 08:31:17 +02:00
Dirk WetterandGitHub 594f09e858 Merge pull request #1647 from drwetter/fix_mxs_in_get_mx_record 
Fix wrong variable declaraton in get_mx_record()
 2020-05-26 09:35:54 +02:00
Dirk 11c03790bf Fix wrong variable declaraton in get_mx_record() 
mx was declared, mxs used instead. This fixes
it by correcting the declaration.
 2020-05-25 21:28:44 +02:00
Dirk WetterandGitHub c6ca746954 Merge pull request #1634 from drwetter/dockerfile+ 
Better Dockerfile: doesn't require "git clone"
 2020-05-09 12:54:02 +02:00
Dirk e5bb789dd3 Better Dockerfile: doesn't require "git clone" 
.. see also #1559.

It "mkdirs" the needed etc and bin directories first, then copies
stuff over. It also reduces a few layers.

Also it corrects a mistake in the Readme.md (docker exec --> run)
 2020-05-09 12:48:11 +02:00
Dirk WetterandGitHub 747b1e20ac Merge pull request #1633 from unit193/3.0 
Fix a couple typos.
 2020-05-09 12:20:03 +02:00
Dirk WetterandGitHub 4e887e3ee4 Merge pull request #1628 from drwetter/bump_version302 
Bump version to 3.0.2
 2020-05-08 11:44:48 +02:00
Dirk WetterandGitHub eb1398c04c Merge pull request #1627 from drwetter/dockerhub_workaround 
Provide the correct branch to Dockerhub builds
 2020-05-08 11:36:36 +02:00
Dirk f16ed46e76 Provide the correct branch to Dockerhub builds 
... and at the same time allow correct local builds --
the default branch is 3.1dev at the moment.

It still clones the repo from github which isn't
needed. A pure copy command would be the best. However
it might cause other problems.

See also #1559
 2020-05-08 11:32:39 +02:00
Dirk WetterandGitHub e628c16155 Merge pull request #1626 from drwetter/revert-1625-dockerfile_fixtest 
Revert "Try to fix builds by Dockerhub"
 2020-05-08 10:30:42 +02:00
Dirk WetterandGitHub 1edb6159be Revert "Try to fix builds by Dockerhub" 2020-05-08 10:21:24 +02:00
Dirk WetterandGitHub 003f35d273 Merge pull request #1625 from drwetter/dockerfile_fixtest 
Try to fix builds by Dockerhub
 2020-05-07 20:44:31 +02:00
Dirk 3eba7ab0f2 Try to fix builds by Dockerhub 
see also #1559
 2020-05-07 20:42:43 +02:00
Dirk WetterandGitHub 0ba2b6e862 Merge pull request #1622 from drwetter/drwetter-patch-2 
Labelling, look @ 3.0.2
 2020-05-07 19:57:04 +02:00
Dirk Wetter b1eda9b2bf Just bump version 2020-05-07 19:55:04 +02:00
Dirk WetterandGitHub fb80e1cc44 Merge pull request #1624 from dcooper16/fix_cp_error_30 
Fix copy and paste error
 2020-05-07 19:44:16 +02:00
Dirk WetterandGitHub 0393cb42f9 Labelling, look @ 3.0.2 
* outlook to 3.0.2 (~tomorrow), remove ref. to rc
* fix docker cmd line (albeit there's still a problem w dockerhub) 
* label 3.1dev it as a ~rolling release
 2020-05-07 11:16:59 +02:00
Dirk WetterandGitHub f49d73498a Merge pull request #1617 from dcooper16/backport_1609_and_1616 
Backport #1609 and #1616
 2020-05-06 16:34:57 +02:00
Dirk WetterandGitHub 005abad35c Merge pull request #1614 from drwetter/license_patch3.0 
Amendment to "Relax the possible GPL license contradiction"
 2020-05-06 09:19:04 +02:00
Dirk 1325178f8d Amendment to "Relax the possible GPL license contradiction" 
fix it also in the man pages. See #1590 / #1592
 2020-05-06 09:12:38 +02:00
Dirk WetterandGitHub 870b78034d Merge pull request #1611 from drwetter/xmpp_improvements_3.0 
Fix STARTTLS pretests, improve XMPP handshakes (backport)
 2020-05-05 08:47:30 +02:00
Dirk Wetter 6df3f2bd4e Remove not needed if clause in starttls_io() 
.. amends 35833c1979
 2020-05-04 23:05:53 +02:00
Dirk Wetter 35833c1979 Fix STARTTLS pretests, improve XMPP handshakes (backport) 
There was a empty variable in determine_optimal_proto() which prevented to save STARTTLS_OPTIMAL_PROTO. This is fixed.

The buffers and return codes for XMPP in starttls_io() were under not every
circumstances correct. This fixes those cases and making that in general more
robust (hopefully).
 2020-05-04 23:03:01 +02:00
Dirk WetterandGitHub 47e16b08c5 Merge pull request #1607 from drwetter/1590_2 
Address further potential license restriction
 2020-05-04 20:27:52 +02:00
Dirk c5cee3ddb6 Address further potential license restriction 
.. see https://github.com/drwetter/testssl.sh/issues/1590#issuecomment-623526604

Added some formatting and verbal improvements in the intruductory comment section.
 2020-05-04 20:24:24 +02:00
Dirk WetterandGitHub 85faf9d096 Merge pull request #1606 from drwetter/add_brotli_3.0 
Add brotli compression detection for BREACH (backport)
 2020-05-04 17:50:32 +02:00
Dirk Wetter 85a529ee00 Add brotli compression detection for BREACH (backport) 
As noted in #1605 the brotli compression check was missing. So hosts
which didn't offer gzip deflate or compress but brotli seemed to
be fine but they shoould have been labled as potentially VULNERABLE.

This also fixes a bug: The HTTP header returned was only checking
for case-sensitive "Content-Encoding". RFC 2616 states in 4.2
(Message Headers): "Field names are case-insensitive"
 2020-05-04 13:23:05 +02:00
Dirk WetterandGitHub dbff0f9673 Merge pull request #1604 from drwetter/aes_cgm_doc_3.0 
Fix typo in docs: Strong grade Ciphers / AEAD
 2020-05-02 20:01:27 +02:00
Dirk e3ecd72deb Fix typo in docs: Strong grade Ciphers / AEAD 2020-05-02 19:57:02 +02:00
Dirk WetterandGitHub 5521063620 Merge pull request #1602 from dcooper16/improve_libressl_302_compat_30branch 
Improve compatibility with LibreSSL 3.0.2 and earlier
 2020-05-01 20:44:16 +02:00
Dirk WetterandGitHub ef535b6282 Merge pull request #1596 from dcooper16/ticketbleed_no_tls1_3_30branch 
Ticketbleed and TLS 1.3
 2020-04-30 13:52:27 +02:00
Dirk WetterandGitHub 3d6d1ac9d7 Merge pull request #1594 from dcooper16/ossl30_compat_for_30branch 
Improve compatibility with OpenSSL 3.0
 2020-04-29 16:14:01 +02:00
Dirk WetterandGitHub 09fe651b36 Merge pull request #1592 from drwetter/1590_readme 
Relax the possible GPL license contradiction
 2020-04-28 10:03:40 +02:00
Dirk 126e501143 Relax the possible GPL license contradiction 
... see also #1590
 2020-04-28 10:02:03 +02:00
Dirk WetterandGitHub 3c403a2484 Merge pull request #1587 from drwetter/np_fix30 
Negotiated protocol showed no warning for TLS 1.1/1.0
 2020-04-25 11:13:49 +02:00
Dirk Wetter 5c73a23cfe Negotiated protocol showed no warning for TLS 1.1/1.0 
.. whereas the protocol section did that.

This fixes the inconsistency.
 2020-04-25 11:06:35 +02:00
Dirk WetterandGitHub ac53ec2531 Merge pull request #1585 from dcooper16/fix_logjam_ssl_native_3.0 
Fix run_logjam() in --ssl-native mode (3.0 branch)
 2020-04-24 09:42:43 +02:00
Dirk WetterandGitHub 2fcbcbe9d1 Merge pull request #1577 from drwetter/drwetter-patch-1 
Update reference to ZIP file
 2020-04-21 20:30:50 +02:00
Dirk WetterandGitHub 11123840a7 Merge pull request #1578 from drwetter/1571_30 
Fix misleading phrasing in run of standard ciphers
 2020-04-21 20:30:38 +02:00
Dirk WetterandGitHub 5fdeb32f94 Update reference to ZIP file 
to 3.0.1
 2020-04-21 18:58:27 +02:00
Dirk Wetter 4809c763cc Fix misleading phrasing in run of standard ciphers 
see #1571. Bit size doesn't matter. It only matters to the
user which ciphers they are.
 2020-04-21 18:46:57 +02:00
Dirk Wetter af86cce011 Better version naming 
bugfix releases for 3.0 are    3.0.x instead of 3.0-1
 2020-04-15 12:35:51 +02:00
Dirk WetterandGitHub 27948d80a8 Merge pull request #1564 from drwetter/release.3.0-1 
Preparing bugfix release for 3.0
 2020-04-15 09:28:41 +02:00
Dirk Wetter 3f5735a1a0 make the sneaky user agent sneaky again 2020-04-14 14:14:45 +02:00
Dirk 8b1b9f9f27 Preparing bugfix release for 3.0 
* Bump version
* Removed ancient CVS tag detection code
* ~ backported code doc changes (http --> https and more) from @multiflexi
  see 7eba0fbb41
 2020-04-14 13:18:52 +02:00
Dirk WetterandGitHub e51a90d7e1 Merge pull request #1557 from dcooper16/fix1551_30 
Fix #1551 in 3.0
 2020-04-01 22:28:47 +02:00
Dirk WetterandGitHub ec6b724433 Merge pull request #1547 from dcooper16/display_ciphernames_bug_3.0 
Fix bug in setting DISPLAY_CIPHERNAMES in 3.0
 2020-03-25 18:28:30 +01:00
Dirk WetterandGitHub b2252002f4 Merge pull request #1539 from mkauschi/http-basic-auth-backport-patch 
backport patch for the http basic auth bug from PR 1538
 2020-03-18 14:51:36 +01:00
Dirk WetterandGitHub 4601670bac Merge pull request #1534 from drwetter/breach_output3 
Fix output for BEAST when no SSL3 or TLS
 2020-03-07 12:15:55 +01:00
Dirk 3f5aa1b7df Fix output for BEAST when no SSL3 or TLS 
LF added
 2020-03-06 22:09:00 +01:00
Dirk WetterandGitHub 1f6ebae401 Merge pull request #1532 from dcooper16/fix_typo_emphasize_stuff_in_headers_3.0 
Fix typo in emphasize_stuff_in_headers()
 2020-03-06 21:28:55 +01:00
Dirk WetterandGitHub c4d2c2de48 Merge pull request #1529 from dcooper16/percent_printing_3.0 
Fix printing percent characters
 2020-03-06 20:04:45 +01:00
Dirk WetterandGitHub 069baa0b6e Merge pull request #1522 from drwetter/pwdfix3 
avoid external pwd
 2020-03-06 15:04:18 +01:00
Dirk WetterandGitHub 488009d0cd Merge pull request #1528 from dcooper16/fix_html_3.0 
Fix HTML generation in 3.0
 2020-03-06 14:55:27 +01:00
Dirk Wetter 8e06fcc644 Avoid external "/bin/pwd" 
.. as it may not be available everywhere, see #1521 (NixOS).

This commit replaces all instances from pwd or /bin/pwd by $PWD.
It is a bash internal and the fastest. Also it added some quotes
to PWD a it may contain white spaces in the future (currently
there's a check for it that it won't)
 2020-03-06 13:31:48 +01:00
Dirk Wetter 4fcfb5d8f8 avoid external pwd 
.. as it may not be everywhere available, see #1521 (NixOS).

This commit replaces it by `pwd -P` (-P -> no symbolic link)
 2020-03-03 12:30:12 +01:00
Dirk WetterandGitHub 4dbd9a98ba Merge pull request #1511 from drwetter/rDNS_fixes3 
Fix for non compliant DNS PTR records (backport)
 2020-02-15 15:23:07 +01:00
Dirk bc9cf9f428 Fix for non compliant DNS PTR records 
This commit addresses two bugs: #1506 and #1508.

First, the variable rDNS can contain multiple lines due to multiple PTR DNS
records, though this is not recommended.  In those cases the multiple PTR DNS
were concatenated on the screen, without any blank.

Secondly - depending on the name server entries and on the output of the DNS
binaries used it can contain non-printable characters or characters which are
printable but later on interpreted on the output device (\032 was mentioned
in #1506) which on the screen was interpreted as octal 32 (decimal 26 = ▒,
try echo "\032"), so basically a terminal escape sequence was smuggled
from the DNS server to the screen of the users. In JSON pretty output we
had also this escape sequence which was fine for jsonlint but caused jq
to hiccup.

Fix: we use a loop to check for each FQDN returned. There we remove chars which
under those circumstances can show up. The blacklist is taken from RFC 1912
("Allowable characters in a label for a host name are only ASCII, letters, digits,
and the `-' character").
 2020-02-15 13:56:25 +01:00
Dirk WetterandGitHub 7d38f3c365 Merge pull request #1494 from dcooper16/fix_typos_3.0 
Fix typos
 2020-02-04 17:56:58 +01:00
Dirk WetterandGitHub 20daaa667c Merge pull request #1493 from drwetter/dotasurl_fix_3.0 
Fix URL when hostname with trailing dot supplied
 2020-02-04 17:17:57 +01:00
Dirk Wetter f11b9023d6 Fix URL when hostname with trailing dot supplied 
Hostnames can contain a trailing dot (and sometimes they should).
If they are supplied to testssl.sh however they will be also interpreted
as a URL PATH when the servive is HTTP.

This commit fixes that.

See also #1490
 2020-02-04 16:32:34 +01:00
Dirk WetterandGitHub 0252316637 Merge pull request #1485 from drwetter/fix_ids_friendly 
Fix --ids-friendly
 2020-01-31 08:46:37 +01:00