Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,262 Commits 16 Branches 39 Tags
778a7cc12d65d637f18f170663e0abf60e3ec5d2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk 778a7cc12d Fix change of warning logic (no protos offered) 
After changing the logic from $PROTOS_OFFERED
contaning each protocol detected to $PROTOS_OFFERED
contaning each protocol + colon yes or no there
wasn't a change for the sanity check that no protocols
are offered. This fixes it.
 2017-11-24 15:15:50 +01:00
Dirk WetterandGitHub e0a5050553 Merge pull request #903 from dcooper16/fix_901 
Fix #901
 2017-11-21 15:36:18 +01:00
Dirk 77fc111b13 put new socksend() into production 
FIX #902.

Performance improvements LAN (just one shot):

```
	58 / 50
	52 / 44
	53 / 47
	143 / 137
	63 / 53
	48 / 43
```

WAN:

```
	89 / 77
	88/ 67
	234 / 231
	67 / 63
	84 / 81

```
 2017-11-20 16:33:40 +01:00
Dirk 209b21c817 fix travis in cce48a34d0 2017-11-19 23:13:33 +01:00
Dirk cce48a34d0 New socksend(), json flat: scan time 
There's a new socksend() function which gives up to 8% performance
benefit (LAN) as is saves 3 sed and 1 tr command in every socksend call.
It has not been put in production yet as it shows a problem in ticketbleed
check and it is late and I call it a day ;-) and resolve that later (see #902).

For performance tests it's quite handy to also have in the flat json format
a footer with time consumed for each run. fileout_json_footer() was
patched accordingly.
 2017-11-19 20:44:06 +01:00
Dirk WetterandGitHub 9949be750d Merge pull request #900 from dcooper16/fix_heartbleed 
Fix run_heartbleed()
 2017-11-19 18:27:03 +01:00
Dirk fd4e5469fe changed output in CAA and OCSP stapling 
... from "--" to "not offered". Reason: e.g. on a white
terminal background it is hard to detect that there's
an output. Also "not offered" is more consistent with
the value of protocol checks.
 2017-11-19 17:11:22 +01:00
Dirk f20ce1a0f8 replace old school grep/sed/sort in certificate_info() 2017-11-19 17:02:24 +01:00
Dirk 5854607d60 label:experimental 2017-11-19 16:48:05 +01:00
Dirk fb3aa6ad7f fix for filename output beginnng with . 
There was an error in e450eb34e4
which addressed #846 which lead to the problem that an output filename
could start with a "." if no FNAME_PREFiX and if just --html, --csv
or --log or --json* was supplied.

This commit fixes the problem.
 2017-11-17 22:09:56 +01:00
Dirk 98f4f28017 FIX #898 
fix escaping of debugging output.  credits to @dcooper16
 2017-11-17 20:56:18 +01:00
Dirk WetterandGitHub 52809d0800 Merge pull request #899 from dcooper16/yet_another_ossl111_fix 
Yet another fix for OpenSSL 1.1.1
 2017-11-17 20:21:28 +01:00
Dirk c7a0de1280 fixed missing ps 
and removed additional packages for dns clients
 2017-11-16 21:16:06 +01:00
Dirk 54b9119162 FIX #897 2017-11-16 01:07:26 +01:00
Dirk 7ec0d7ffb7 Polish #846, correct level for OCSP and GOST 2017-11-14 20:50:14 +01:00
Dirk e450eb34e4 FIX #846 -- add output filename prefix 
This commit adds the possibility to supply a output
file name prefix via --outprefix or FNAME_PREFIX
 2017-11-14 19:41:25 +01:00
Dirk WetterandGitHub 1a7b761f5b Merge pull request #688 from dr4y/2.9dev 
Dockerfile for testssl.sh
 2017-11-14 17:39:43 +01:00
Dirk 6ce2a98637 updated 
with TLS 1.3 and forgotten improvements so far.
Add interesting projekt privacyscore.
 2017-11-14 13:52:13 +01:00
Dirk 2379af5a5f Rearranged credits 
David needs really really to come first.
The remaining contributors now in alphabtical order
 2017-11-14 13:49:27 +01:00
Dirk WetterandGitHub ea86884e05 Merge pull request #895 from dcooper16/heartbleed_tls_sockets 
Use tls_sockets() for run_heartbleed()
 2017-11-13 16:20:47 +01:00
Dirk WetterandGitHub db9000a955 Merge pull request #894 from dcooper16/fix_std_cipherlists_false_positives 
Fix false positive in std_cipherlists()
 2017-11-08 08:46:30 +01:00
Dirk WetterandGitHub 3c427c31a0 Remove Matt's pointer to the image 
... until it is more up to date
 2017-11-06 21:56:06 +01:00
Dirk 5bd8cb08ba fix #892 (trailing dot in supplied hostname) 
... and do minor updates to do bash internal functions in ``parse_hn_port()``
 2017-11-05 22:41:11 +01:00
Dirk 000f957646 minor changes on TLS 1.3 protocol tests (see #890) 2017-11-05 20:30:18 +01:00
Dirk WetterandGitHub b613f3fcf0 Merge pull request #889 from dcooper16/run_pfs_tls13 
Add TLSv1.3 support for run_pfs()
 2017-11-05 14:40:06 +01:00
Dirk WetterandGitHub a9c0804749 Merge pull request #890 from dcooper16/run_protocols_tls13 
Add TLSv1.3 support for run_protocols()
 2017-11-05 14:39:40 +01:00
Dirk 9daec2a515 Add "auto" keyword to -oA/-oa (FIX #887) 
File names are now auto-generated by using "-oA auto" / -oa "auto"
--similar to --csv and friends.

Also the formerly hidden switches --outFile and --outfile were added in the
help and in the manual.
 2017-11-01 09:58:52 +01:00
Dirk 9b7000e87e Final check to make sure fileout and pr*warning correlates 
Made sure that if fileout has a WARN or DEBUG flag it is
consistent with pr*warning. FIX #518
 2017-10-31 12:23:16 +01:00
Dirk 2aeabd19b2 Better clarification on bit size and encryption strength 
Fix #770
 2017-10-31 12:00:09 +01:00
Dirk 278202ace9 FIX #848 -- determine tls date only when instructed 
Former code implied a determination of the TLS time in
every call of tls_sockets() despite the fact that the
value is only needed at one point in the run.

This removes this behaviour by introducing another global
boolean switch TLS_DIFFTIME_SET which determines whether
the additional cost will be paid or not.

The gain in execution time is a bit meager though. At
most it seems it's 1-3 seconds.
 2017-10-31 11:27:19 +01:00
Dirk dca4da4736 FIX #884, FIX #885 
For servers with client authentication one would need to supply a x509
certificate to check session resumption by ID or ticket. This is not (yet?)
supported in testssl.sh.

This commit fixes the misleading error message so that it is clear what the
problem is.
 2017-10-30 18:41:19 +01:00
Dirk WetterandGitHub bec17e1ad6 Merge pull request #886 from dcooper16/Expect_CT_header 
Add check for the Expect-CT header
 2017-10-30 17:08:41 +01:00
Dirk WetterandGitHub b9723424e7 Merge pull request #882 from dcooper16/suppress_config_file_warn 
Suppress more config file warnings
 2017-10-30 08:41:55 +01:00
Dirk WetterandGitHub fd9ee18ab5 Merge pull request #883 from dcooper16/run_cipher_match_tls13 
Add TLSv1.3 support for run_cipher_match()
 2017-10-27 23:58:28 +02:00
Dirk WetterandGitHub a0fc34763f Merge pull request #881 from dcooper16/libressl_enc_names 
Fix problem with LibreSSL encryption names
 2017-10-27 17:55:15 +02:00
Dirk WetterandGitHub 884fa3ffed Merge pull request #879 from dcooper16/use_helper_function 
Use read_sigalg_from_file() helper function
 2017-10-27 17:13:26 +02:00
Dirk a85ca3c250 FIX #765 
Inconsistency in using optional and mandatory parameters in help and man page
 2017-10-26 11:46:14 +02:00
Dirk 4e70ac6ad5 FIX #870 = testssl.sh -v/-b picks up wrong openssl binary 2017-10-22 23:41:17 +02:00
Dirk WetterandGitHub f88e3d89f1 Merge pull request #826 from dcooper16/fix772 
Complete fix of #772
 2017-10-22 23:28:16 +02:00
Dirk WetterandGitHub b16a86cf46 Merge pull request #827 from dcooper16/OpenSSL_111_fix 
Another fix for OpenSSL 1.1.1
 2017-10-22 23:27:50 +02:00
Dirk WetterandGitHub 90eb1f128c Merge pull request #873 from tomwassenberg/comment-fix 
Correct small inconsistency in code comment
 2017-10-21 11:49:08 +02:00
Dirk e3b254d0a1 FIX #869 2017-10-20 19:58:20 +02:00
Dirk WetterandGitHub f212b609ab Merge pull request #867 from dcooper16/tls13_for_run_allciphers 
Add TLSv1.3 support for run_allciphers()
 2017-10-20 18:12:02 +02:00
Dirk WetterandGitHub d65566921f Merge pull request #868 from dcooper16/tls13_for_run_server_preference 
Add TLSv1.3 support for run_server_preference()
 2017-10-20 18:09:17 +02:00
Dirk 50fa1e74bd Merge branch '2.9dev' of github.com:drwetter/testssl.sh into 2.9dev 2017-10-20 16:45:59 +02:00
Dirk d3795f1254 Add output options similar to nmap (FIX #861) 2017-10-20 16:32:57 +02:00
Dirk WetterandGitHub d83f310baf Merge pull request #872 from dcooper16/fix_871 
Fix #871
 2017-10-20 15:42:16 +02:00
Dirk 52e02d9d43 CAA work 
This fixes #865 and improves #588. All CAA records are now shown,
also with old DNS binaries.
 2017-10-18 18:43:54 +02:00
Dirk 4b187d6253 fix travis error in 8ceb1b5 2017-10-18 17:13:05 +02:00
Dirk 8ceb1b5ad8 use bash internal functions for #864 2017-10-18 15:25:43 +02:00
Dirk WetterandGitHub 76248493a0 Merge pull request #863 from dcooper16/run_server_preference_ssl3_bugfix 
run_server_preference() bug fix
 2017-10-18 13:42:54 +02:00
Dirk WetterandGitHub 5b6344f6fb Merge pull request #864 from seccubus/recursive_caa 
Make CAA record lookups resolve the entire DNS tree (Fixes #862)
 2017-10-18 13:42:02 +02:00
Dirk WetterandGitHub 4adc96b2f7 Merge pull request #856 from dcooper16/run_cipher_per_proto_tls13 
Add TLSv1.3 support to run_cipher_per_proto()
 2017-10-14 09:21:09 +02:00
Dirk WetterandGitHub ac3ff349c9 Merge pull request #859 from dcooper16/rc4 
run_rc4() and #660
 2017-10-14 09:17:19 +02:00
Dirk WetterandGitHub cd4009fed9 Merge pull request #854 from dcooper16/tls13_run_std_cipherlists 
Add TLSv1.3 support for run_std_cipherlists()
 2017-10-14 09:15:16 +02:00
Dirk WetterandGitHub 22fd594334 Merge pull request #857 from dcooper16/use_bash_internal 
Use bash internal functions
 2017-10-12 11:34:20 +02:00
Dirk WetterandGitHub 2129af0537 Merge pull request #858 from dcooper16/sweet32 
Fix #660 for run_sweet32()
 2017-10-12 10:24:34 +02:00
Dirk WetterandGitHub 430917d59f Merge pull request #855 from dcooper16/use_bash_string_manipulation 
Use bash internal functions
 2017-10-11 17:28:17 +02:00
Dirk WetterandGitHub 38b2089c49 Merge pull request #853 from dcooper16/no_sock_reply_file 
Don't maintain SOCK_REPLY_FILE in non-debug mode
 2017-10-11 14:49:10 +02:00
Dirk 6bd1c26a14 FIX #851 2017-10-10 19:54:36 +02:00
Dirk WetterandGitHub 49fcb0d724 Merge pull request #850 from dcooper16/fix_typo 
Fix typo
 2017-10-10 17:28:25 +02:00
Dirk 785e94912d replace grep -q by internal bash operator 
and provide the alias SETX for DEBUG_ALLINONE
 2017-10-09 15:13:46 +02:00
Dirk WetterandGitHub 985c21dfb7 Merge pull request #844 from dcooper16/has_server_protocol_fixes 
has_server_protocol() fixes
 2017-10-09 15:09:17 +02:00
Dirk WetterandGitHub 1758d18672 Merge pull request #842 from dcooper16/tls13_part1 
Initial support for TLSv1.3
 2017-10-09 14:53:32 +02:00
Dirk 6f896a057b add missing \n for html output 2017-10-08 22:03:29 +02:00
Dirk e8e4609495 function safe_echo 
In order to santize input better there's a fucntion
now which does the work . ``safe_echo()``.

It is actually the same as ``tml_out()`` but is a bit snappier.
 2017-10-08 21:40:28 +02:00
Dirk WetterandGitHub 833f724689 Merge pull request #843 from dcooper16/client_sim_data_error 
Fix incorrect client simulation data
 2017-10-04 13:05:32 +02:00
Dirk WetterandGitHub f1efe6b7ba Merge pull request #833 from dcooper16/no_ossl_config 
Suppress config file warning
 2017-10-03 11:14:52 +02:00
Dirk d5e03299e5 Merge branch '2.9dev' of github.com:drwetter/testssl.sh into 2.9dev 2017-10-02 15:19:40 +02:00
Dirk 12c47d1912 FIX #401, first part 2017-10-02 15:18:31 +02:00
Dirk 5b294618c0 first part of #371 2017-10-02 15:11:58 +02:00
Dirk 59d4a9fa65 fix borken conflict resolving editing 2017-10-02 14:58:30 +02:00
Dirk 411accb66d manually resolved conflict from #839 + change it to new logic 2017-10-02 14:55:57 +02:00
Dirk f3dc53f554 Complete $PROTOS_OFFERED / has_server_protocol(), FIX #759 
The logic is complete now, so that if a protocol has been detected as
    supported or not supported it will save a few cycles not to test
    this protocol again.

    There's probably -- also besides #839 space for improvements. The
    advantage of this solution is that ``has_server_protocol()`` also
    marks a protocol as tested if the result of the test is negative.
 2017-10-02 13:48:55 +02:00
Dirk WetterandGitHub 36236b6def Merge pull request #838 from dcooper16/remove_extra_space 
Remove extra space in BEAST output
 2017-09-28 09:12:37 +02:00
Dirk af94d46232 minor additions wrt LibreSSL and OpenBSD 2017-09-27 09:26:36 +02:00
Dirk e32479818d mentioning BiGIP cookies and MongoDB 2017-09-27 09:25:22 +02:00
Dirk WetterandGitHub ce0a00be37 reordered features 2017-09-27 09:07:21 +02:00
Dirk WetterandGitHub fa5700644b Merge pull request #837 from sdann/mongodb_detection 
Add support for MongoDB service detection
 2017-09-27 08:37:58 +02:00
Dirk WetterandGitHub 5a6646ca98 f5 cookie 2017-09-25 22:07:40 +02:00
Dirk WetterandGitHub 2c76025ade Merge pull request #836 from drwetter/bigip 
F5 cookie detection
 2017-09-25 20:02:03 +02:00
Dirk dbab397645 finalized work on integrating my f5 cookie decoder 
see https://github.com/drwetter/F5-BIGIP-Decoder
 2017-09-25 19:51:10 +02:00
Dirk f6cf96d916 polish help for -g option 2017-09-23 12:54:44 +02:00
Dirk 68509694d4 NO_ENGINE (#834) and GREASE (#814) 2017-09-23 11:55:09 +02:00
Dirk 4523eea398 More LibreSSL patches 
As dcooper16 noted in #834 there are checks which test for openssl versions
but don't take LibreSSL in account. This adds checks to it for several
LibreSSL versions (>=2.1.x) which are known to support ``determine_trust()``
and it HAS_DH_BITS.

Moreover engine check has been improved. Older LibreSSL versions (2.1 specifically)
had different error messages, so the previous checks failed. There's also
a CMD_LINE flag now where one can switch the engine support off: NO_ENGINE .

run_renogo from #834 is still an open issue.
 2017-09-23 11:34:37 +02:00
Dirk 695d02157a FIX #829 (OpenBSD fixes) 
All three issues fixed. Terminal code were actually
tow problems: Logging in from Linux with a 256 color xterm
makes tput set AF from  OpenBSD hiccup. And the detection
of not-ncurses style underline e.g. was not working under OpenBSD.

The engine fix was done by David Cooper (see #831).

There's also a name of the binary now (OpenSSL/LibreSSL) for tracking
the flavor used.
 2017-09-22 18:48:38 +02:00
Dirk d3c3d65e1f wording client simulation 2017-09-22 10:32:28 +02:00
Dirk 3abbddbad7 F5 cookie detection works for testcases. Output needs to be worked on 2017-09-21 10:19:47 +02:00
Dirk WetterandGitHub 3e69304e6d Merge pull request #828 from dcooper16/correct_typos 
Correct typos
 2017-09-20 20:06:59 +02:00
Dirk a330fafb3b regression fix: output for CVE-2015-3197 was missing in DROWN 2017-09-20 17:22:54 +02:00
Dirk 84c112561b workaround due to problem with blanks in $SWURL 
SWURL contained for historical reasons trailing blanks
for released versions.
This caused an error in pr_boldurl --> html_out which
didn't write the trailing style info and didn't close
the href tag (travis complained.)

This patch removes the trailing blank but it doesn't
fix the error.
 2017-09-20 10:56:33 +02:00
Dirk 02f4f1bae1 reflect GREASE commit by David 2017-09-19 17:34:22 +02:00
Dirk WetterandGitHub 55db191a2d Merge pull request #814 from dcooper16/grease 
GREASE
 2017-09-19 17:24:00 +02:00
Dirk b9b09f586e added MS CA store, see #825 
Finally complete, thx @naumanshah03
 2017-09-19 15:15:54 +02:00
Dirk WetterandGitHub f48deaaa9d Update README.md 2017-09-19 14:50:08 +02:00
Dirk 4972cda2af FIX #762 (replace which by 'type -p') 2017-09-19 00:08:33 +02:00
Dirk 1c10ad0124 remove echoing ~ /usr/bin/timeout 2017-09-18 23:38:06 +02:00
Dirk b222fe8f53 Merge branch '2.9dev' of github.com:drwetter/testssl.sh into 2.9dev 2017-09-18 23:34:12 +02:00
Dirk WetterandGitHub 95af735862 Update README.md 2017-09-18 23:33:25 +02:00
Dirk WetterandGitHub 3caa73c1b8 Update README.md 2017-09-18 23:32:35 +02:00