Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,240 Commits 16 Branches 39 Tags
964e8924a44f1e704daf2734a6c4abd0577b94bd
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk 964e8924a4 define file var before using it 2025-11-27 19:45:39 +01:00
Dirk Wetter a4b6d1fca0 spellcheck 2025-11-27 18:49:12 +01:00
Dirk Wetter f3ebf0e971 Add autoflush thingy for MAcOS 2025-11-27 18:46:19 +01:00
Dirk Wetter 853da2a9de term pattern seems better than the "colorized list" 2025-11-27 18:39:52 +01:00
Dirk Wetter 3591f70a17 reorder lines 2025-11-27 18:31:43 +01:00
Dirk Wetter 8103a0e24d Make this work undeer MacOS 
- URI is now example.com bc Akamai doesn't block too many checks
  (MacOS runner was delayed and often hiccuped here)
- failed to flush message --prevention
- term pattern seems better than the "colorized list"
 2025-11-27 18:24:15 +01:00
Dirk Wetter 7e97fef030 remove LFs and comment 2025-11-27 18:22:48 +01:00
Dirk Wetter fc499cb67f Akamai keeps connection open (opossum check problem) 2025-11-27 18:21:26 +01:00
Dirk Wetter 0ef742a17a Just add comments, reorder lines 2025-11-27 17:44:31 +01:00
Dirk Wetter 4582bd8d73 Merge branch '3.3dev' into address_2952 2025-11-27 16:37:16 +01:00
Dirk WetterandGitHub 86700dbd7a Merge pull request #2957 from testssl/flush 
Try to remove the "failed to flush stdout" messages
 2025-11-27 16:34:40 +01:00
Dirk Wetter de6e92826a Add stdout flush 2025-11-27 14:23:27 +01:00
Dirk Wetter 5111804b75 Try to remove the "failed to flush stdout" messages 2025-11-25 00:23:13 +01:00
Dirk Wetter e8098fc1d2 fix remainder from old os definition 2025-11-24 12:03:03 +01:00
Dirk WetterandGitHub dd696bb871 Merge pull request #2955 from testssl/shellcheck_path_improvement 
No shellcheck in ./t/
 2025-11-24 11:20:18 +01:00
Dirk WetterandGitHub 92e0195118 No shellcheck in ./t/ 2025-11-24 11:19:13 +01:00
Dirk Wetter d359e1108d proper definition of os variable 2025-11-24 11:07:16 +01:00
Dirk Wetter 7ba99cd1e9 For MacOS we rather use homebrew's OpenSSL 2025-11-24 11:04:59 +01:00
Dirk Wetter 7b2804df41 remove STARTTLS 2025-11-24 10:48:41 +01:00
Dirk WetterandGitHub 4ad81cea9b Merge pull request #2953 from testssl/dependabot/github_actions/actions/checkout-6 
Bump actions/checkout from 5 to 6
 2025-11-21 15:12:34 +01:00
Dirk WetterandGitHub 7423aa8add Merge pull request #2951 from testssl/fixAndImprove_opossum_check_2950 
Fix and improve Opossum check
 2025-11-21 15:11:07 +01:00
Dirk 76824b5762 Fix and improve Opossum 
Under some circumstances the opossum vulnerability check got stuck
because the cat commdn was waiting for reading from the descriptor.
In some case like #2950 this happened when the HTTP head command
was incorrectly send in the first place.

This PR makes sure that the HTTP head is correct and it replaces
cat by read in a loop so that the HTTP response is read without
being blocked.

Also for http_head_printf() the argumensats passed were cleaned up.
 2025-11-19 20:55:20 +01:00
Dirk WetterandGitHub 718c6fe4ed Merge pull request #2947 from 24icewolf42/fix-mtls-client-pem-check 
Add support for EC private key in mTLS check
 2025-11-17 11:19:09 +01:00
Dirk WetterandGitHub 1394cc8d7d Merge pull request #2949 from testssl/shellcheck_ignore_files 
Ignore files types for shellcheck
 2025-11-15 14:43:59 +01:00
Dirk Wetter fd97a75241 Add comments for paths_ignore 2025-11-15 14:05:08 +01:00
Dirk Wetter c07d17ea8f Fix indentation + comment wrt paths_ignore 2025-11-15 13:56:19 +01:00
Dirk Wetter 00476b751a Ignore files types for shellcheck 2025-11-15 13:39:09 +01:00
Dirk WetterandGitHub 12e4ebd203 Merge pull request #2948 from testssl/ratingdoc_update 
Update docs after raiting only switch
 2025-11-15 13:37:06 +01:00
Dirk Wetter c9a886c396 Update docs after riing only swicth 
see #2945
 2025-11-15 13:31:42 +01:00
Dirk WetterandGitHub ae48b680fa Merge pull request #2945 from magnuslarsen/3.3dev 
feat: --rating-only flag to only test checks required for rating
 2025-11-13 08:00:15 +01:00
Dirk WetterandGitHub 932c91f67c Merge pull request #2941 from testssl/dependabot/github_actions/actions/checkout-5 
Bump actions/checkout from 4 to 5
 2025-11-11 16:46:21 +01:00
Dirk WetterandGitHub 4ba3500b0b Merge pull request #2940 from testssl/shellcheck_cherrypicked_2428 
Shellcheck cherrypicked from PR #2428
 2025-11-10 14:37:35 +01:00
Dirk Wetter d4cc41405f Skipping push as it seems expensive and may cause delays 
... no bypasses for direct commit for those changes anyway
 2025-11-10 12:29:05 +01:00
Dirk Wetter 2fcd01c693 fix FP 2025-11-10 12:15:58 +01:00
Dirk Wetter 0347f2ffee 24.04 Ubuntu's instead of latest 2025-11-10 12:05:42 +01:00
Dirk WetterandGitHub f219fd6ca3 Merge pull request #2938 from testssl/fix_2937 
Fix pattern for matching /etc/hosts entries
 2025-11-03 23:39:04 +01:00
Dirk da8a6f2f34 Fix pattern for matching /etc/hosts entries 
`grep -w` matches also `string1-whatsoever` so that entries like

```
192.168.0.10 anystring anystring-apache
192.168.0.11 anystring-tomcat
```

matched 3 entries over 2 lines.

This PR fixes #2937 by improving the match pattern, so that
`string1` needs a trailing whitespace or a EOL -- besides a
leaing whitespace.
 2025-11-03 22:30:26 +01:00
Dirk WetterandGitHub c19d3fff0c Merge pull request #2935 from testssl/fix_2933 
Add new Sectigo R46 cert, update Java/Mozilla.pem
 2025-11-01 18:00:27 +01:00
Dirk 3e495f456a Add new Sectigo R46 certs + update Java/Mozilla.pem 
Fixes #2933 .
 2025-11-01 14:15:36 +01:00
Dirk WetterandGitHub a0c99d855e Merge pull request #2934 from testssl/shorten_badssl 
Shorten badssl GHA as they fail too often
 2025-10-30 20:41:46 +01:00
Dirk 1ce514d95f Shorten badssl GHA as they fail too often 
* Remove checks which aren't needed in t/51_badssl.com.t t/33_isJSON_severitylevel_valid.t
* tryying to make some files more readable
 2025-10-30 18:35:43 +01:00
Dirk WetterandGitHub 0b9715c239 Merge pull request #2930 from testssl/fix_2929 
Fix date parsing bc of locale problem
 2025-10-30 15:54:23 +01:00
Dirk da436e7d87 Fix date parsing bc of locale problem 
The new block making sure that rust coreutils work properly (PR #2913)
introduced a new check in order to determine which date functions
to use.

The function however parsed only for English error messages ("No such file").
This PR fixes that by setting LC_ALL to C.

Fixes #2929 .
 2025-10-30 13:30:08 +01:00
Dirk WetterandGitHub d3a96d9382 Merge pull request #2927 from testssl/fix_2926_ua_sneaky 
Update "sneaky" user agent
 2025-10-28 15:16:04 +01:00
Dirk Wetter ce820cdaf5 Update "sneaky" user agent 
fixes #2926 for 3.3dev.
 2025-10-28 10:26:06 +01:00
Dirk WetterandGitHub 08ed5521a9 Merge pull request #2922 from testssl/shellcheck1 
Squash some shellcheck *errors*
 2025-10-13 22:10:44 +02:00
Dirk Wetter c53e7a3955 Fix more shellcheck complaints (high severity) 
... and fine tune some comments in the beginning
 2025-10-13 21:06:02 +02:00
Dirk WetterandGitHub 8bc2185a72 Merge pull request #2923 from testssl/drwetter-patch-1 
Minor fine tuning
 2025-10-12 11:49:26 +02:00
Dirk WetterandGitHub 2cfa23e7f7 Minor fine tuning 
* version 3.2 was removed from links
* badges updated
* minor language improvements
 2025-10-12 11:34:56 +02:00
Dirk Wetter 672493ebe7 Fix check for /bin/sh 2025-10-11 18:59:51 +02:00
Dirk Wetter 7090d5fbdd Saving everything before commit/push is supposed to be better ;-) 2025-10-11 18:00:48 +02:00
Dirk Wetter 8392a4aed5 Squash some shellcheck *errors* 
and some warnings.

Five errors of type [SC2145](https://www.shellcheck.net/wiki/SC2145) are left as I am not sure whether
it'll be safe to follow the recommendation
 2025-10-11 13:19:28 +02:00
Dirk WetterandGitHub ae69789ecb Merge pull request #2916 from testssl/update_Linux_CA_store 
Update Linux CA store
 2025-10-09 22:12:09 +02:00
Dirk WetterandGitHub 07a0aa4bef Merge pull request #2919 from testssl/update_GHAs 
Update GHAs
 2025-10-09 21:27:38 +02:00
Dirk 9ff79c472f Remove workflows/docker-3.2.yml for 3.3dev 2025-10-09 21:25:30 +02:00
Dirk d732088923 Roff pages won't trigger a unit test anymore 2025-10-09 21:24:45 +02:00
Dirk Wetter 0a7810ea47 Update Linux CA store 
from Debian 13. Fixes #2915
 2025-10-09 20:42:21 +02:00
Dirk WetterandGitHub df100d986b Merge pull request #2913 from testssl/fix_2909 
Fix date for Ubuntu >= 25.10
 2025-10-09 20:30:15 +02:00
Dirk WetterandGitHub 80d05c0831 Merge pull request #2912 from testssl/early_data 
TLS 1.3 early data / 0-RTT
 2025-10-09 18:55:14 +02:00
Dirk Wetter aacde5dadb Merge branch '3.3dev' into early_data 2025-10-09 15:50:12 +02:00
Dirk 3353627373 Fix unit test for Mac and Ubuntu Linux 2025-10-09 15:44:53 +02:00
Dirk Wetter 32defa1864 Ignore MLKEMs for TLS 1.3 2025-10-09 15:44:53 +02:00
Dirk Wetter eb915110c9 Update baseline 2025-10-09 15:44:53 +02:00
Dirk e226a56486 Update basline scan for unit test 
This PR updates the baseline after switching to the new server.
 2025-10-09 15:44:53 +02:00
Dirk WetterandGitHub 8534e72dc3 Merge pull request #2914 from testssl/unittest_new_baseline 
Update baseline scan for unit test
 2025-10-09 15:38:37 +02:00
Dirk 6201627298 Fix unit test for Mac and Ubuntu Linux 2025-10-09 13:29:36 +02:00
Dirk Wetter accd1f20cd Rearrange order of date checks 
works for all "older" Linux systems, MacOS, OpenBSD and according to #teki69
also Ubuntu 25.10 .
 2025-10-08 23:26:48 +02:00
Dirk Wetter 6af5377507 Ignore MLKEMs for TLS 1.3 2025-10-08 23:15:49 +02:00
Dirk Wetter f081db83e1 Update baseline 2025-10-08 23:14:54 +02:00
Dirk Wetter da7c713b08 Add 0-RTT 
also:
* fine tuning protocol section
* reference RFC 8470 (well..) and FIPS 203
* add a general linkto TLS related  RFCs
 2025-10-08 10:31:48 +02:00
Dirk Wetter d637daefeb Add 0-RTT 2025-10-08 10:15:14 +02:00
Dirk a4b6ded123 Update basline scan for unit test 
This PR updates the baseline after switching to the new server.
 2025-10-08 10:03:19 +02:00
Dirk Wetter 36bc08ce18 Fix date for Ubuntu >= 25.10 
works for
- ubuntu 24.04
- Debian 13
- openbsd 6.6 / 7.x
- macos 15.7.1

Fixes #2909
 2025-10-07 23:23:09 +02:00
Dirk Wetter e0401b6207 TLS 1.3 early data / 0-RTT 
This PR implements a check for TLS early data. It needs a compatible OpenSSL or
LibreSSL version. For modern OS versionis it should automagically pick the right,
modern binary for the check.

Mitigations like Defer processing or HTTP 425 are not yet tested.

To clarify is
* whether to penalize SSLlabs rating (@magnuslarsen). testssl.net has it
   enabled but the Web UI claims it's not a/v, see
  https://www.ssllabs.com/ssltest/analyze.html?d=testssl.net&s=172.67.205.231&hideResults=on&latest
* Man pages

To be in line with other HAS2_* global vars (HAS2_QUIC, HAS2_UDS), the following
vars were renamed from their OPENSSL2_HAS_* counter parts:

- HAS2_TLS13
- HAS2_CHACHA20=false
- HAS2_AES128_GCM=false
- HAS2_AES256_GCM=false
 2025-10-06 17:03:56 +02:00
Dirk WetterandGitHub 3ece1e4b11 Merge pull request #2911 from testssl/early_data_preparation 
Define vars for early data
 2025-10-05 21:34:53 +02:00
Dirk Wetter ffa1ffdbb3 fix syntax 2025-10-05 20:16:39 +02:00
Dirk Wetter 5b0b771c52 Define vars for early data 
It seems needed to introduce two variables for upcoming early data tests,
see #1186. This is not needed for OpenSSL as it introduced that
together with TLS 1.3. For LibreSSL it is though.
 2025-10-05 18:19:41 +02:00
Dirk WetterandGitHub 637ad03a36 Merge pull request #2904 from testssl/jdvorak001-fix_file_naming 
Jdvorak001 fix file naming
 2025-09-30 17:31:33 +02:00
Dirk WetterandGitHub d6decc7f79 Merge pull request #2905 from testssl/fix_2884 
Consistency for function ciphers_by_strength()
 2025-09-30 15:53:34 +02:00
Dirk 78ecf53b67 Consistency for function ciphers_by_strength() 
* keys now always with v, like supportedciphers_TLSv1_2 and also
  ciphers (e.g. TLSv1.2   x35     AES256-SHA)
* add word "server" to file output so that it reads "NOT a server cipher order configured"

Fixes #2884
 2025-09-30 14:30:52 +02:00
Dirk 123684f554 make spellchecker and myself happy ;-) 2025-09-30 13:58:28 +02:00
Dirk e8ab2c74e6 straighten global definitions in the very bottom 2025-09-30 13:56:25 +02:00
Dirk 1d6ddfb352 rename datetime_started 
.. to fname_date as it's more consitent with fname_prefix
 2025-09-30 13:35:08 +02:00
Dirk WetterandGitHub d66b67befe Merge pull request #2897 from dcooper16/fix2896 
Fix #2896
 2025-09-21 23:49:10 +02:00
Dirk WetterandGitHub 97faadf425 Merge pull request #2894 from testssl/faq_update 
Restructure, load balancer issue, STARTTLS SMTP better explained
 2025-09-18 10:59:25 +02:00
Dirk WetterandGitHub 8dec13ba62 Update FAQ.md 2025-09-18 10:57:35 +02:00
Dirk WetterandGitHub 94f03a1f1f Merge pull request #2891 from testssl/fix_indentation_3.3dev 
Fix indentation @ Intermediate cert validity
 2025-09-16 19:52:42 +02:00
Dirk Wetter 75feb05a0c Fix indentation @ Intermediate cert validity 
... when there were two server and >1 intermediate CA certificates.
 2025-09-16 13:03:48 +02:00
Dirk WetterandGitHub a90b2cfd4e Merge pull request #2886 from testssl/fix_http_age 
Fix garbled screen when HTTP Age is not a non-negative int
 2025-09-15 17:37:20 +02:00
Dirk WetterandGitHub d08b54b5e1 Merge pull request #2882 from testssl/update_faq 
Additions to FAQ
 2025-09-15 17:37:07 +02:00
Dirk 52d24925e0 > was a problem 
trying to get it right in GiHub MD and retext
 2025-09-15 17:35:37 +02:00
Dirk f36462b14a fix spell checking 2025-09-15 17:26:06 +02:00
Dirk 0b47f24bbd Add STARTTLS + rating amend paragraphs 
... and try to avoid "crypto"
 2025-09-15 17:20:54 +02:00
Dirk ef82cd37be fix typo 2025-09-15 16:00:53 +02:00
Dirk 15ebceca84 Fix garbled screen when HTTP Age is not a non-negative int 
As suggested in https://github.com/testssl/testssl.sh/pull/2885 parsing
of the server determined HTTP age var wasn't strict enough.

https://www.rfc-editor.org/rfc/rfc7234#section-1.2.1 requires the
variable to be a non-negative integer but testssl.sh assumed it was
like that but did't check whether that really was the case. This was
labled as a (potential) security problem. Potential as it didn't
look exploitable after review -- the header as a whole was already
sanitized.

This PR fixes the typs confusion and the garbled screen by checking
the variable early in run_http_header() and reset it to NaN. That
will be used later in run_http_date() to raise a low severity finding.

Kudos to @Tristanhx for catching this and for the suggested PR.

Also, only when running in debug mode, this PR fixes that during
service_detection() parts of the not-yet-sanitized header ended
up on the screen. The fix just calls sanitze_http_header() for the
temporary variable $TMPFILE.
 2025-09-15 15:41:43 +02:00
Dirk WetterandGitHub 89a0d8d2c4 Micro additions 2025-09-03 10:51:55 +02:00
Dirk WetterandGitHub e75ef95547 Merge pull request #2879 from testssl/newfaq 
Provide an FAQ
 2025-09-02 15:46:11 +02:00
Dirk Wetter 0d8150e088 add faq to changes 2025-09-02 15:43:28 +02:00
Dirk Wetter b1a7c287e8 Include the FAQ 2025-09-02 15:40:54 +02:00
Dirk Wetter 08e6e4f1b5 typo / omitting few words 2025-09-02 15:31:38 +02:00