Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,136 Commits 16 Branches 39 Tags
710f9156600ddaa37e5ccf7297b25a49b450e913
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub 710f915660 update version 2019-12-12 11:34:33 +01:00
Dirk WetterandGitHub db558de147 Merge pull request #1412 from drwetter/minor_code_improvements1 
fix errorneous insertion
 2019-12-11 22:22:35 +01:00
Dirk c960bd16f9 fix errorneous insertion 2019-12-11 22:20:58 +01:00
Dirk WetterandGitHub 9c2666a2d6 Merge pull request #1411 from drwetter/minor_code_improvements1 
Minor internal code improvements
 2019-12-11 22:10:07 +01:00
Dirk 849a41a371 Minor internal code improvements 
* rename actually_supported_ciphers() to actually_supported_osslciphers()
* remove some redundant quotes at rhs of double brackets checks
 2019-12-11 22:07:53 +01:00
Dirk WetterandGitHub 93a1d9441c Merge pull request #1410 from drwetter/drwetter-clpatch 
Amend with log for upcoming rc6
 2019-12-11 21:49:36 +01:00
Dirk WetterandGitHub 2b08b593a8 Amend with log for upcoming rc6 2019-12-11 21:49:23 +01:00
Dirk WetterandGitHub 442c728187 Merge pull request #1408 from drwetter/connect-timeout 
Connect timeout
 2019-12-10 21:55:02 +01:00
Dirk 055a2e9bb4 --connect-timeout finalized 
* openssl timeout tested
* one openssl related error message fixed when timeout is used (timeout was included)
 2019-12-10 21:02:32 +01:00
Dirk 3fdb5617db --connect-timeout 2019-12-10 20:44:55 +01:00
Dirk 20e77318ca Further improving socket connect timeout 
* Handle case when "timeout" couldn't be found
* Proper error message when timeout requested but isn't available
* Fix errorneous message in help()
 2019-12-10 13:18:45 +01:00
Dirk WetterandGitHub b38e433ec4 Merge pull request #1407 from drwetter/dockerIDcheck 
Handle problem when pulling container fails
 2019-12-09 11:04:17 +01:00
Dirk 8e02b4a261 Improvements to socket timeouts 
* timeouts are not default anymore but need a cmdline param (or ENV param)
* check whether "timeout" exists

Also:
* allow OPENSSL_TIMEOUT to be passed via ENV similar to others
* replace timeout variable in run_robot() by robottimeout, to avoid
  misunderstandings by a human

ToDos: see inline. Mainly if timeout isn't available, testssl.sh doesn't
work.

Not to self: help function still says 60 second is default.
 2019-12-09 10:47:58 +01:00
Dirk ce0be5fefc Handle problem when pulling fails 
... when e.g. sitting in a German train with bad internet connection
 2019-12-09 10:26:39 +01:00
Dirk Wetter b1f4713287 Merge branch '3.0' of https://github.com/goncalor/testssl.sh into goncalor-3.0 2019-12-06 16:29:45 +01:00
Dirk WetterandGitHub c5a13ed689 Merge pull request #1406 from drwetter/drwetter-patch-4 
Upgrade to Alpine 3.10
 2019-12-03 23:10:20 +01:00
Dirk WetterandGitHub 2cf8997635 Upgrade to Alpine 3.10 2019-12-03 23:10:06 +01:00
Dirk WetterandGitHub 37be442b2b Merge pull request #1405 from dcooper16/fix_http_header_formatting 
Fix formatting of HTTP security headers
 2019-12-03 23:04:32 +01:00
Dirk WetterandGitHub 9ee0feef3d Merge pull request #1403 from drwetter/drwetter-patch-3 
simplify Dockerfile
 2019-12-03 12:05:23 +01:00
Dirk WetterandGitHub c163f3ec99 simplify Dockerfile 
.. according to  #1402 and #1142
 2019-12-03 12:05:07 +01:00
Dirk WetterandGitHub 10fc1416b5 Merge pull request #1401 from drwetter/catch_someuser_errors 
Catch user error using --json/--html and friends
 2019-12-02 15:39:15 +01:00
Dirk Wetter 4c1bee181b Catch user error using --json/--html and friends 
testssl.sh hiccups when a user supplied after --json*/--html/-csv
a filename instead of using the corresponding  --json*file/--htmlfile/-csvfile
arguments, see #1397.

This PR adresses that in a sense that it tries to detect to following
argument of --json*/--html/-csv. If that matches a suspected filename
it bails out using fatal().

This is not intended to be perfect (when the pattern doesn't match)
but catches the user error in an early stage. See also #1398
 2019-12-02 15:32:06 +01:00
Dirk WetterandGitHub 58cfe1220b Merge pull request #1396 from dcooper16/align_cipher_rating_numbers 
Align cipher rating numbers
 2019-12-02 14:26:00 +01:00
Dirk WetterandGitHub b4f69fbdf6 Merge pull request #1400 from drwetter/drwetter-patch-2 
Housekeeping
 2019-11-27 09:50:02 +01:00
Dirk WetterandGitHub 8e563e5361 Housekeeping 
* add --rm
* better description of output
 2019-11-27 09:49:51 +01:00
Dirk WetterandGitHub 9ce04a6219 Merge pull request #1399 from max-wittig/patch-1 
docs(readme): delete container after run
 2019-11-27 09:35:47 +01:00
Dirk WetterandGitHub c645dc9f23 Merge pull request #1395 from drwetter/fix_get_caa 
Fix getting CAA record
 2019-11-24 20:33:52 +01:00
Dirk Wetter 61bd71bb14 Fix getting CAA record 
This resolves a regression introduced with IDN support (see also #1370).

* in check_resolver_bins() the determination of HAS_DIG_NOIDNOUT=true was wrong
* in get_*_record() the check for the bool variable was wrong
* in get_*_record() we shouldn't use quotes as they might be expand to a quoted arg
 2019-11-24 20:28:51 +01:00
Dirk WetterandGitHub 4eec2a0981 Merge pull request #1394 from drwetter/drwetter-postgres-gnmap 
Fix #1392
 2019-11-24 17:09:46 +01:00
Dirk WetterandGitHub 35da8c6fdf Fix #1392 
... postgres command building in ``ports2starttls()`` was missing a space.
This is only used when a lookup is performed when supplying a gnmap file.
 2019-11-24 17:09:21 +01:00
Dirk WetterandGitHub 32da607acb Merge pull request #1390 from dcooper16/fix_indentation 
Fix indentation
 2019-11-22 10:06:40 +01:00
Dirk WetterandGitHub c28777aa65 Merge pull request #1383 from szycha76/client-cert-support 
Quick'n'dirty client certificate support for s_client
 2019-11-21 12:53:51 +01:00
Dirk WetterandGitHub f50cf15bff Merge pull request #1387 from drwetter/polish_output_session_resump_client_auth 
Add minor output polish for session resumption and client auth
 2019-11-20 20:50:34 +01:00
Dirk Wetter 1366b187d0 Add minor output polish for session resumption and client auth 
* remove 2x resumption
* [[ ${SESS_RESUMPTION[2]} =~ clientauth ]] isn't needed.
  otherwise fileout needs also to be changed
 2019-11-20 20:47:13 +01:00
Dirk WetterandGitHub 9ce152ba43 Merge pull request #1386 from dcooper16/fix1385 
Fix #1385
 2019-11-20 20:37:02 +01:00
Dirk WetterandGitHub 1e268eca01 Merge pull request #1381 from drwetter/drwetter-patch-1 
add </b>
 2019-11-19 12:39:09 +01:00
Dirk WetterandGitHub dc658637a5 add </b> 
.. so to speak in addition to #1376
 2019-11-19 12:38:58 +01:00
Dirk WetterandGitHub 1c7fe03e20 Merge pull request #1376 from alexander-naumov/3.0 
--html option looks like all others
 2019-11-19 12:35:40 +01:00
Dirk WetterandGitHub f1677c087b Merge pull request #1380 from drwetter/modernize_isHTML_valid 
Modernize 08_isHTML_valid.t a bit ...
 2019-11-16 12:46:04 +01:00
Dirk Wetter c643860701 Modernize 08_isHTML_valid.t 
and make it similar to 07_isJSON_valid.t or 20_baseline_ipv4_http.t
in terms of output and readability
 2019-11-16 12:41:44 +01:00
Dirk WetterandGitHub 325c67d5ef Merge pull request #1379 from drwetter/ticketbleed_minorfix 
Ticketbleed fix: shutting down the connection properly
 2019-11-16 11:58:52 +01:00
Dirk Wetter 7747128c11 Ticketbleed fix: shutting down the connection properly 
In cases where the probes for reading memory from the server side were not
successful (=not vulnerable) the TCP connection was not shut down properly --
leading to and undefined state and probably causing problems to a consecutive
check. The server side then assumably from time to time just didn't return
anything which caused a integration test (t/08_isHTML_valid.t) to fail
randomly.

This PR properly terminates the TCP socket connection. Also, as sending the
close notification before closing the socket was duplicated in testssl.sh
that went to a separate function.

See comment in #1375:
https://github.com/drwetter/testssl.sh/pull/1375#issuecomment-554424814
 2019-11-16 11:48:22 +01:00
Dirk WetterandGitHub fbca5d1b3e Merge pull request #1375 from dcooper16/enhance_run_protocols_ssl_ 
Enhance run_protocols() in --ssl-native mode
 2019-11-15 17:11:33 +01:00
Dirk WetterandGitHub 298628995e Merge pull request #1377 from dcooper16/new_ossl_versions 
Support new OpenSSL/LibreSSL versions
 2019-11-15 17:00:45 +01:00
Dirk WetterandGitHub 93169a3123 Merge pull request #1374 from a666/a666-fix-missing-negation 
Fix missing negation in check_resolver_bins
 2019-11-11 22:00:26 +01:00
Dirk WetterandGitHub 89dd26e043 Merge pull request #1373 from drwetter/cn+rsolver_fix 
Move check_resolver_bins again, handle double CN
 2019-11-10 12:55:38 +01:00
Dirk Wetter 90a1455570 Move check_resolver_bins again, handle double CN 
When running in debugging mode, HAS_DIG and friends was
still false as check_resolver_bins() was called too late.
This amends basically bac0f66112 .

In cases where a certificate has two CNs, the output contained
a linefeed. This replaces the line feed by a space.
 2019-11-10 12:52:12 +01:00
Dirk WetterandGitHub 5c39ceafe1 Merge pull request #1369 from dcooper16/run_protocols_ssl_native1 
Fix issues with run_protocols() in --ssl-native mode
 2019-11-09 19:57:03 +01:00
Dirk WetterandGitHub 29a2ecf88f Merge pull request #1372 from drwetter/resolverbin_earlier 
Earlier initialisation of DNS HAS_* related vars
 2019-11-09 19:42:14 +01:00
Dirk WetterandGitHub bac0f66112 Earlier initialisation of DNS HAS_* related vars 
This fixes a bug e.g. when supplying a proxy by a DNS name, testssl couldn't resolve the name as the HAS_ variables initialized by ``check_resolver_bins()`` was done later than ``check_proxy()``.

The patch just puts ``check_resolver_bins()`` earlier in  "main"
 2019-11-09 19:41:37 +01:00
Dirk WetterandGitHub cd647ba2d0 Merge pull request #1368 from Night1/patch-1 
Fix typo
 2019-11-06 14:29:08 +01:00
Dirk WetterandGitHub ed4bffb5d2 Merge pull request #1367 from dcooper16/fix1366 
Fix #1366
 2019-11-06 08:55:34 +01:00
Dirk WetterandGitHub 6679dd7a16 Merge pull request #1365 from drwetter/drwetter-patch-4 
remove blank in output
 2019-11-03 20:49:36 +01:00
Dirk WetterandGitHub 3b89dc6b0a remove blank in output 
added in bda9c02183
 2019-11-03 20:49:22 +01:00
Dirk WetterandGitHub cbf6422221 Merge pull request #1364 from scottj/3.0 
fix bug in f5_ip_oldstyle() printf format string
 2019-11-03 09:20:19 +01:00
Dirk WetterandGitHub bda9c02183 Merge pull request #1363 from drwetter/drwetter-patch-3 
Marking CBC and SEED ...
 2019-11-02 16:03:39 +01:00
Dirk WetterandGitHub 47baf7c206 Marking CBC and SEED ... 
.. ciphersuites as obsolete in cipher categories
 2019-11-02 16:03:24 +01:00
Dirk WetterandGitHub 21d41b5f68 Merge pull request #1362 from drwetter/drwetter-patch-2 
Amendments + reordering
 2019-11-02 10:21:11 +01:00
Dirk WetterandGitHub 35f70f2375 Amendments + reordering 
add IDN etc. -support and David's work on determine_optimal_* functions
 2019-11-02 10:20:57 +01:00
Dirk WetterandGitHub e909d4cd8c Merge pull request #1327 from drwetter/IDN_improvements 
Idn improvements
 2019-11-02 09:52:52 +01:00
Dirk WetterandGitHub 457ffe78cd Merge pull request #1205 from dcooper16/server_preference_cipher_order 
Separate server preference test (cipher order) for TLS 1.3
 2019-10-30 08:12:43 +01:00
Dirk WetterandGitHub 9a5c8c08d5 Add case in cipher order for TLS != 1.3 2019-10-29 19:03:36 +01:00
Dirk WetterandGitHub 2f9bcea5e6 change another nope to no 2019-10-29 17:36:08 +01:00
Dirk WetterandGitHub 0f40e85f62 TLS 1.3 and cipher order 
If a server offers TLS 1.3 only and the cipher order is server side this commit changes the severity level to INFO.

Also it changes nope to no in two places
 2019-10-29 17:32:50 +01:00
Dirk WetterandGitHub bbd103fe95 Merge pull request #1360 from drwetter/drwetter-patch-1 
Remove c&p relict
 2019-10-28 18:44:42 +01:00
Dirk WetterandGitHub d3e3724d65 Merge pull request #1356 from dcooper16/fix_parse_tls_serverhello_bug 
Fix parse_tls_serverhello() bug
 2019-10-28 18:41:43 +01:00
Dirk WetterandGitHub 326558dec1 Remove c&p relict 2019-10-28 18:36:39 +01:00
Dirk WetterandGitHub 9c27a03c30 Merge pull request #1357 from dcooper16/fix_do_starttls_initialization_bug 
Fix do_starttls initialization bug
 2019-10-28 18:08:01 +01:00
Dirk WetterandGitHub 1335d9ebda Merge pull request #1359 from drwetter/fix_1355 
Adress #1355
 2019-10-28 18:01:58 +01:00
Dirk Wetter bfb94c8acb Adress #1355 
by adding "_hint" to the additional information when
testing for DROWN.
 2019-10-28 18:00:10 +01:00
Dirk WetterandGitHub 10a6c7b9d2 Merge pull request #1358 from dcooper16/use_jsonID 
Use $jsonID rather than literal string
 2019-10-28 17:49:16 +01:00
Dirk WetterandGitHub b64f5afaea Merge pull request #1354 from drwetter/patch-1351 
Changes to HTML header parsing
 2019-10-26 15:13:39 +02:00
Dirk WetterandGitHub c840ea50ec Update testssl.sh 
remove '
 2019-10-26 14:29:35 +02:00
Dirk WetterandGitHub e4f7788899 replace html pattern for header file 
.. with just a pattern for  '<' or '{' maybe with a leading blank
 2019-10-26 14:21:32 +02:00
Dirk WetterandGitHub ca5ff39bce Extend pattern for HTTP header 
Add another pattern because the SEDs tested so far do not seem to be fine with header containing x0d x0a (CRLF) -- which is the usual case. So we also trigger on any sign on a single line which is not alphanumeric (plus _)

See #1351
 2019-10-26 14:14:21 +02:00
Dirk WetterandGitHub 53951fdb06 Merge pull request #1351 from tkaehn/headerfile_vs_ipv4_address_in_header 
'IPv4 address in header' shows body content
 2019-10-26 13:14:04 +02:00
Dirk WetterandGitHub 0cfd30f8b8 make filtering for header more robust 
... by re-adding the former filters after ``sed '/^$q'``
 2019-10-26 13:13:10 +02:00
Dirk WetterandGitHub f5c3b4e41d Merge pull request #1352 from dcooper16/fix_client_simulation 
Fix client simulation bug
 2019-10-23 23:05:05 +02:00
Dirk WetterandGitHub 3c18262389 Merge pull request #1350 from drwetter/fix_1336 
Squash message to use ./bin/openssl.* when --ssl-native is supplied
 2019-10-19 10:07:55 +02:00
Dirk 7964a692ef Squash message to use ./bin/openssl.* when --ssl-native is supplied 
PR #1336 included logic to pre-test the server side with sockets
and/or with openssl. However when the user supplied --ssl-native
sockets were never tested before. As a result ALL_FAILED_SOCKETS
was still true, so that the final eif statement complaint erroneously
that sockets didn't work but openssl does.

Also Travis complaint.

This PR fixes it by checking SSL_NATIVE to the final part of the
if statement.

One could also test sockets before and then set ALL_FAILED_SOCKETS
appropriately but that would only make sense if the socket methods
like run_robot() or run_heartbleed() would check ALL_FAILED_SOCKETS
first.

At the moment I went for this as it is easier and the case that sockets
aren't working but openssl does seems not very likely.
 2019-10-19 09:52:02 +02:00
Dirk WetterandGitHub 764466d710 Merge pull request #1349 from drwetter/add_1336 
Remove double TLS13 only handling
 2019-10-18 21:33:30 +02:00
Dirk 1513d4eb49 Remove double TLS13 only handling 
... as it was moved to determine_optimal_proto(), see #1336.

LF added in message when TLS13 only
 2019-10-18 21:29:14 +02:00
Dirk WetterandGitHub 3389d84103 Merge pull request #1336 from dcooper16/ossl_determine_optimal_proto 
Use OpenSSL for determine_optimal_proto()
 2019-10-18 21:07:15 +02:00
Dirk WetterandGitHub 7a327f5439 Merge branch '3.0' into ossl_determine_optimal_proto 2019-10-18 21:06:49 +02:00
Dirk WetterandGitHub f118085278 Merge pull request #1339 from dcooper16/simplify_determine_sizelimitbug 
Simplify determine_sizelimitbug()
 2019-10-17 09:39:54 +02:00
Dirk WetterandGitHub e7d67e6134 Merge pull request #1341 from dcooper16/run_protocols_speedup 
Use determine_optimal_sockets_params() in run_protocols()
 2019-10-17 09:28:33 +02:00
Dirk WetterandGitHub a8a938470c Merge pull request #1342 from dcooper16/bad_version_negotiation 
Warn if bad version negotiation detected
 2019-10-17 09:22:08 +02:00
Dirk WetterandGitHub 975ee61eee Merge pull request #1346 from csett86/osx10146 
Update Safari to 13.0 and macOS to 10.14
 2019-10-17 08:53:42 +02:00
Dirk WetterandGitHub 35c69bee27 Merge pull request #1338 from drwetter/drwetter-dockerfiles1 
Docker container for testing (generated by a script)
 2019-10-02 17:53:37 +02:00
Dirk WetterandGitHub bcc1298eb3 0-RTT dockerfile script for nginx 2019-10-02 17:52:34 +02:00
Dirk WetterandGitHub fe43d9dd0c Docker files for testing 
docker-debian10.tls13only.start.sh can be linked to e.g. docker-debian10.tls13.start.sh, then also TLS 1.2 is added.
 2019-10-02 17:50:11 +02:00
Dirk WetterandGitHub cf00c8e8ac Merge pull request #1337 from dcooper16/fix_session_resumption 
Fix sub_session_resumption()
 2019-10-02 08:52:23 +02:00
Dirk WetterandGitHub e492b5761d Merge pull request #1334 from dcooper16/reset_ossl_dependent_vars 
Reset OpenSSL dependent variables
 2019-10-01 20:03:55 +02:00
Dirk WetterandGitHub f05eac7003 Merge pull request #1335 from dcooper16/session_tickets 
Fix session ticket issues
 2019-10-01 00:11:22 +02:00
Dirk ba009565a8 swap ldap server as previous one wasn't reachable anymore 2019-09-25 09:36:16 +02:00
Dirk WetterandGitHub 2a635ee62d Merge pull request #1331 from dcooper16/fix1328 
Fix #1328
 2019-09-25 08:39:12 +02:00
Dirk WetterandGitHub 613e1d0133 Merge pull request #1216 from dcooper16/add_determine_optimal_sockets_params 
Add determine_optimal_sockets_params()
 2019-09-24 08:46:49 +02:00
Dirk WetterandGitHub da2beb48d3 Merge pull request #1330 from dcooper16/more_run_protocol_fixes 
More run_protocol() fixes
 2019-09-23 20:40:25 +02:00
Dirk WetterandGitHub 9e3bcfb2ef Merge pull request #1329 from dcooper16/fix_run_protocols 
Fix run_protocols()
 2019-09-21 11:27:01 +02:00
Dirk Wetter 5f572b9200 remove leading blank in global definition 2019-09-20 17:54:56 +02:00