Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,547 Commits 16 Branches 39 Tags
b8595856cfc2b42284bdddd316c5ef01b19ebf96
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk Wetter b8595856cf Adding cgroups check as port is suspected to be hidden in GHA environment 2026-09-06 23:52:05 +02:00
Dirk Wetter 2862af8eef Take the right openssl here 2026-09-06 23:49:26 +02:00
Dirk Wetter be9a8385af Re-add -naccept and remove tty hack 
- comment redundant diag line
- make sure $openssl_pid has a value
 2026-09-06 22:48:44 +02:00
Dirk Wetter 437e1a3c83 Try to redirect /dev/null to stdin 
... in orser to try preventing s_server to die .

Doesn't work locally.
 2026-09-06 20:21:04 +02:00
Dirk Wetter e925f054d7 fix -quiet 
It doesn't exist on MacOS' LibreSSL and on older OpenSSL. The
server started locally because the keys were already present.
 2026-09-06 17:42:17 +02:00
Dirk Wetter ca9f3746fe Another try 
- remove -naccept as it was futile
- fix identation
- kill the server when run locally (perl's PID was wrong)
- quiet key generation

This works on both Linux and Mac locally (except some debug stuff unser MacOS)
 2026-09-06 15:03:38 +02:00
Dirk Wetter d715595276 Readd sleep command when trying to start server 2026-09-06 13:06:43 +02:00
Dirk Wetter 17b806ecd3 Add debug statements ... 
in order to find out why it works on regular Linux machines and not on
Github. One guess was different network namespace. However it fails
alos on MacOS .

Also, as I changed the hostname "localhost" to 127.0.0.1 before, I
at least wanted to add the IP address to SAN.
 2026-09-06 11:30:01 +02:00
Dirk 6a36350d50 Try fix problems 
- MacOS: LibreSSL doesn't understand -naccept, so we use homebrew's OpenSSL
- Ubuntu: No idea why that still fails. Maybe the DNS setup is borked, so that scanning and listening is split between IPv4 and IPv6 (weak guess)
 2026-09-04 16:16:38 +02:00
Dirk f08f887ae5 remove file triggers which do not exist 2026-09-04 00:50:49 +02:00
Dirk 75c35bdbc7 fix error (server stopped) 
... , exec server with log and started testssl differently
 2026-09-04 00:49:33 +02:00
Dirk Wetter 6c735af807 Fix connect and other problems 
The previous commit held the socket open in the perl 1..30 loop
which prevented later on testssl.sh to scan.

Also the subtets is gone . It removes and addiotional message which
was confusing.
 2026-09-03 19:10:57 +02:00
Dirk Wetter 4b909a76bc Use IO::Socket::INET instead of IPC::Run 
- hardcode days and protocol as they don't matter
- got rid of the ugly system call with nc
 2026-09-03 16:18:19 +02:00
Dirk Wetter 9b7cddf98a Add modules 2026-09-03 16:17:46 +02:00
Dirk Wetter 9821679938 Provide short unit test for TLS 1.3 only host 
Only the protocol section for now

https://github.com/testssl/testssl.sh/issues/756#issuecomment-5302724956
 2026-09-03 13:12:08 +02:00
Dirk WetterandGitHub 9e09f10380 Merge pull request #3131 from testssl/perl_quality 
Add Perl static analysis
 2026-09-01 20:02:32 +02:00
Dirk 8eb05bd862 '$' should be passed to the shell not '\$' 
... thus not double quoting like \\$
 2026-09-01 16:58:14 +02:00
Dirk c312fb8230 Audit all modules 
but let for now exit the check always with zero
 2026-09-01 16:29:16 +02:00
Dirk bd67671fad double quoting needed in passed expression to grep 2026-09-01 16:19:52 +02:00
Dirk 6b1de564d8 Make the flow finally(TM) work 2026-09-01 15:49:31 +02:00
Dirk 4bab452316 Fix syntax error 2026-09-01 15:42:43 +02:00
Dirk 1880a06110 Enable warnings 2026-09-01 15:27:44 +02:00
Dirk 7e1cd8a8c4 Add "use warnings" + correct subroutine prototypes declaration 2026-09-01 15:21:10 +02:00
Dirk 8ab28557a1 Add "use warnings" 2026-09-01 15:18:46 +02:00
Dirk 71322d89cb Squash complains by perlcritic 
and enable warnings
 2026-09-01 15:07:52 +02:00
Dirk Wetter d857e0fe60 Add .perlcritic policy overrides for test suite 2026-08-31 23:26:36 +02:00
Dirk Wetter 23129834b9 Add all other perl modules too 2026-08-31 22:04:07 +02:00
Dirk Wetter a2027d527f fix perttidy and cpan-audit 2026-08-31 20:50:00 +02:00
Dirk Wetter f77dcbefd5 Selfcheck removed 
(not sure whether that was right to try in the first place, probably not)
 2026-08-31 20:35:02 +02:00
Dirk Wetter d58557b430 Newer versions 
- use newer checkout hash
- use appropriate perl version
 2026-08-31 20:30:35 +02:00
Dirk Wetter f5d228e28e Add Perl static analysis 
* Run perl -c on every t/*.t file as a fast pre-check before prove.
* Add Perl::Critic (a curated policy set) and perltidy --check for the Perl test code — the repo lints its bash with shellcheck but has zero linting for its Perl.
* Add Test::NoWarnings (and/or Test::Fatal) to the test harness so warnings/exceptions in the code under test fail the build.

Not yet sure about using the hash / SHA-pinning. To be reconsidered later
 2026-08-31 20:05:30 +02:00
Dirk WetterandGitHub 978c399798 Merge pull request #3126 from ChrisJr404/banner-utc-offset 
Show the UTC offset in the start and done banner
 2026-08-31 11:02:38 +02:00
Dirk WetterandGitHub fef1f43aff Merge pull request #3129 from dcooper16/declare_jsonID 
Declare jsonID
 2026-08-30 21:48:45 +02:00
Dirk WetterandGitHub 853850e3f4 Merge pull request #3125 from testssl/CA_store_update_2608 
CA store update 2608
 2026-08-28 10:42:04 +02:00
Dirk Wetter 639f45e8d0 Update 2026/08 2026-08-28 00:59:31 +02:00
Dirk Wetter 296575029d Still MS.pem still contains DST Root CA X3 2026-08-28 00:58:59 +02:00
Dirk Wetter 2571730bb1 2026-08-13 from https://curl.haxx.se/docs/caextract.html 2026-08-24 19:45:28 +02:00
Dirk Wetter f9d6355002 store from jdk-25.0.4.1 
from https://download.oracle.com/java/25/latest/jdk-25_linux-x64_bin.tar.gz
 2026-08-24 19:43:12 +02:00
Dirk Wetter 5461110ac4 store from today via git repo 2026-08-24 19:42:19 +02:00
Dirk Wetter 74bfffecae DL link for JDK, --depth=1 for Apple repo 2026-08-24 19:39:32 +02:00
Dirk WetterandGitHub 6d555cac4e Merge pull request #3118 from testssl/dependabot/github_actions/shogo82148/actions-setup-perl-1.43.1 
Bump shogo82148/actions-setup-perl from 1.42.0 to 1.43.1
 2026-08-24 10:52:03 +02:00
Dirk WetterandGitHub 5894d76a63 Merge pull request #3119 from testssl/dependabot/github_actions/docker/login-action-4.6.0 
Bump docker/login-action from 4.5.2 to 4.6.0
 2026-08-24 10:50:22 +02:00
Dirk WetterandGitHub ff51c14b52 Merge pull request #3123 from dcooper16/cleanup3120 
Cleanup #3120
 2026-08-24 10:49:22 +02:00
Dirk WetterandGitHub 1283aff3d4 Merge pull request #3120 from dcooper16/slhdsa 
Support SLH-DSA server keys
 2026-08-15 16:27:02 +02:00
Dirk WetterandGitHub 06adbdccc5 Merge pull request #3115 from testssl/dependabot/github_actions/shogo82148/actions-setup-perl-1.42.0 
Bump shogo82148/actions-setup-perl from 1 to 1.42.0
 2026-08-11 19:20:11 +02:00
Dirk WetterandGitHub e60c4b428f Merge pull request #3114 from testssl/dependabot/github_actions/docker/login-action-4.5.2 
Bump docker/login-action from 4 to 4.5.2
 2026-08-11 19:18:01 +02:00
Dirk WetterandGitHub b578b00440 Merge pull request #3117 from dcooper16/fixtypo 
Fix typo
 2026-08-11 19:13:38 +02:00
Dirk WetterandGitHub 5296954a70 Merge pull request #3108 from testssl/fix_3107_fname-warning 
Remove warning message when supplying a fname
 2026-07-16 14:00:04 +02:00
Dirk WetterandGitHub 18e6938b62 Merge pull request #3110 from petecooper/3.3dev 
Remove broken link to privacyscore.org in `3.3dev`
 2026-07-16 13:57:43 +02:00
Dirk Wetter 498a0dff33 Remove warning message when supplying a fname 
In order ot waran early in file outputs 75376d3 introduced a separate function for checking early
the command line.

As massing scanning option was not considered one got a warning, saying

   Warning: Target is not a server name: results may be completely wrong, at minimum trust may show false results.

This fixes that, see #3107 .
 2026-07-16 11:25:30 +02:00
Dirk WetterandGitHub 2b6180320c Merge pull request #3104 from ericcgu/feat/3097-short-lived-certs 
Improve handling of short-lived certificates (#3097)
 2026-07-15 17:13:21 +02:00
Dirk WetterandGitHub cf45a76b5f Merge pull request #3103 from ericcgu/fix/1246-mass-testing-scantime 
Fix bogus "Scan interrupted" scanTime in mass-testing JSON (#1246)
 2026-07-15 13:01:47 +02:00
Dirk WetterandGitHub 2f37eb069c Merge pull request #3099 from testssl/patch-1 
streamlined
 2026-07-14 20:38:37 +02:00
Dirk WetterandGitHub 7957d0b81c streamlined 
- Comments instead of backticks
- AI section
- version not from GH
 2026-07-14 20:37:27 +02:00
Dirk WetterandGitHub ffbc439897 fix yet another typo 2026-07-14 20:04:52 +02:00
Dirk WetterandGitHub 7956a222c1 Merge pull request #3098 from testssl/drwetter-patch-1 
Create SECURITY.md
 2026-07-14 19:58:21 +02:00
Dirk WetterandGitHub 4e3fdab08e Update Readme.md 2026-07-14 19:56:35 +02:00
Dirk WetterandGitHub 1e80984577 Update SECURITY.md 2026-07-14 19:52:06 +02:00
Dirk WetterandGitHub 0bd118e657 Fix typo in comment, add improvement for LLM 2026-07-14 19:48:10 +02:00
Dirk WetterandGitHub 6c4e0f257f Create SECURITY.md 2026-07-14 19:29:14 +02:00
Dirk WetterandGitHub 580bffeb0f Merge pull request #3096 from ericcgu/fix/3095-ipv6-proxy-bad-substitution 
Fix broken OpenSSL version check for IPv6 proxy in check_proxy() (#3095)
 2026-07-14 18:21:29 +02:00
Dirk WetterandGitHub 611b1b1f39 Merge pull request #3091 from ericcgu/fix/3090-html-xss-pr-url 
Fix stored XSS in HTML report via unescaped Location: header (#3090)
 2026-07-12 14:43:29 +02:00
Dirk WetterandGitHub 21bf1ff19f Merge pull request #3089 from testssl/03_mini_syntax_check 
Small check for semantic unit tests
 2026-07-11 22:47:16 +02:00
Dirk Wetter f6a59dc083 Properly premature exit for MacOS 2026-07-11 19:03:05 +02:00
Dirk ed07c763e1 Check on MacOS returned not ok 2026-07-11 17:12:50 +02:00
Dirk Wetter 20a632844b Now fix the existing non-compliant issues 
18422:          if [[ $tmp_result -eq 1 ]] && [[ loop_reneg -eq 1 ]]; then
19633:          [[ aaa == bbb ]]    # provoke return code=1

450:TRUSTED1ST=""                           # Contains the `-trusted_first` flag, if this version of openssl supports it

The latter check be amended/corrected later, so that backticks in comments are allowed.
 2026-07-11 15:35:21 +02:00
Dirk WetterandGitHub cf17bd7629 Merge pull request #3086 from ericcgu/ericcgu-bugfix 
bugfix: aesgcm_used --> enc_aesgcm_used
 2026-07-11 13:37:12 +02:00
Dirk Wetter 49c26b7e36 perl-style grep for mac 
so skip the while thing
 2026-07-10 22:25:49 +02:00
Dirk 27c432e95d Add more checks 
recommended by Claude Sonnet 5

The backtick pattern will fail in a comment. To be fixed later
 2026-07-10 20:20:38 +02:00
Dirk 0c16ebd6b9 Small check for semantic check 
Staring with a simple pattern for checking for non-variables at left hand
side like [[ LHS == $value ]]. The file is supposed be amended in the future.

This fixes #3074 .

Upon commit it fails first as there are two instances which will be detected
(one is deliberate but will be changed too) .
 2026-07-10 19:33:08 +02:00
Dirk WetterandGitHub 1be2f7472a Merge pull request #3088 from testssl/patch-1 
Update pull_request_template.md
 2026-07-10 16:48:58 +02:00
Dirk WetterandGitHub b7fb813edf Update pull_request_template.md 2026-07-10 16:47:43 +02:00
Dirk WetterandGitHub a46c8baad5 Merge pull request #3084 from testssl/fix_tls13_only_hosts 
Fix confusion when scanning TLS-1.3-only hosts
 2026-07-10 16:41:40 +02:00
Dirk Wetter 0ddba7301e Fix double mistake 🙁 2026-07-10 15:22:34 +02:00
Dirk Wetter d1da2c1dea fix spelling 2026-07-10 13:55:33 +02:00
Dirk Wetter cbd2b4da1e Add HAS_LDAP to global vars 
... and bail out if it is not supported.
 2026-07-10 13:51:39 +02:00
Dirk Wetter d7f5095042 Exempt MacOS with LibreSSL to run STARTTLS via LDAP 2026-07-10 13:40:03 +02:00
Dirk Wetter 8dce14187d Fix confusion when scanning TLS-1.3-only hosts 
When scanning hosts which offer only TLS 1.3 under some circumstances (e.g. using
MacOS) the scan stopped and prompted the user . It happened always when $OPENSSL
supported TLS 1.3. It did not when this was not the case.

This fixes that (see #3083) for 3.3dev by just skipping the rest in determine_optimal_proto()
when TLS13_ONLY is true.

Also it fixes missing line feeds for servoce detecttion and order in which DNS HTTPS
RR are displayed.
 2026-07-09 13:13:15 +02:00
Dirk WetterandGitHub deda4c7627 Merge pull request #3080 from ericcgu/ericcgu-patch-1 
fix: inverted return check in sym-encrypt() at testssl.sh:14741 makes …
 2026-07-08 20:45:06 +02:00
Dirk WetterandGitHub 044cfee81b Merge pull request #3078 from testssl/fix_empty_httpsrr 
Fix empty result for HTTPS_RR for Mac and friends
 2026-07-08 18:24:45 +02:00
Dirk WetterandGitHub 62ca07cc33 Merge pull request #3059 from TheraNinjaCat/fix-cert-trust-wildcard-identifier-3051 
Fixed 'cert_trust_wildcard' identifier when multiple certificates are…
 2026-07-08 18:24:14 +02:00
Dirk 2dba5fea1b fix typo 2026-07-06 11:41:18 +02:00
Dirk 44d6b7adbf Fix empty result for HTTPS_RR for Mac and friends 
... also improve error handling by adding return values in
*https_rr functions.

The error for ~Macs occured because for interpretation of
raw TYPE65 DNS data it was just 1 returned instead of 0
--for empty records.
 2026-07-06 11:36:15 +02:00
Dirk WetterandGitHub 9fdf8028ba Merge pull request #3076 from SteveVaneeckhout/fix-ipv4-only-flag-ignored 
Fix -4/-6 flag being ignored when no specific test is selected
 2026-06-25 22:34:27 +02:00
Dirk WetterandGitHub df6cd77195 Merge pull request #3075 from lapo-luchini/3.3dev_fix_escaping 
Fix escaping.
 2026-06-23 23:15:43 +02:00
Dirk WetterandGitHub 56ba1ab229 Merge pull request #3047 from testssl/https_rr 
Provide DNS HTTPS RR functionality
 2026-06-22 18:16:35 +02:00
Dirk Wetter 859d24df20 HTTPS DNS RR in manual 2026-06-22 16:37:32 +02:00
Dirk Wetter 50966dc1d6 Merge branch '3.3dev' into https_rr 2026-06-22 16:26:38 +02:00
Dirk Wetter dca6434604 Compare QUIC section with DNS HTTPS RR 
Also: make "A(AAA) record via:" bold, to be in line with the other keys
 2026-06-22 16:20:13 +02:00
Dirk Wetter 7e97b243d1 Introduce global HTTPS_RR variable 
... which is initialized with "initt" to distinguish between not being tested yet and no value.
We only display the value once per $NODE for the first IP address being tested.

HTTPS_RR doesn't have to be reset in reset_hostdepended_vars()

Few comments were added / indentation fixed (not relevant to this PR)
 2026-06-22 14:59:13 +02:00
Dirk WetterandGitHub 689516c378 Merge pull request #3073 from testssl/my-patch-2 
clarify what a breaking change is
 2026-06-22 13:06:55 +02:00
Dirk WetterandGitHub 492882577d clarify what a braking change is 2026-06-22 13:01:56 +02:00
Dirk WetterandGitHub 8b653d0abf Merge pull request #3072 from testssl/my-patch-1 
AI section + minor improvements
 2026-06-22 12:56:35 +02:00
Dirk WetterandGitHub a75e25a958 Minor changes 2026-06-22 12:55:45 +02:00
Dirk WetterandGitHub 74ba0c4f1e Add links 2026-06-22 12:47:24 +02:00
Dirk WetterandGitHub efab5f9165 AI section + minor improvements 
- AI generated code becomes more important, so we add a new section (albeit bash support is not really as good as for other languages).
- streamlined comment, which is a comment
 2026-06-22 12:33:11 +02:00
Dirk WetterandGitHub a55fc6d5d4 Merge pull request #3071 from testssl/potato-20-revive-hsts-preload 
Potato 20 revive hsts preload
 2026-06-20 18:34:54 +02:00
Dirk Wetter bfdfaf49a6 Merge branch 'potato-20-revive-hsts-preload' of github.com:testssl/testssl.sh into potato-20-revive-hsts-preload 2026-06-20 17:19:38 +02:00
Dirk Wetter bb408fd7d5 reflect renaming the variable 
and u+x the script
 2026-06-20 17:17:36 +02:00
Dirk Wetter a13eb751ec Credit where credits is due 
Amend manyak
 2026-06-20 16:54:30 +02:00