Commit Graph

4270 Commits

Author SHA1 Message Date
c67cefaf8e add info about error handling 2022-12-26 19:15:49 +01:00
336d3c947a better use safe_echo() 2022-12-26 16:14:26 +01:00
b633efae69 make starttls_ldap_dialog() more readable...
... add references + better debugging output
2022-12-26 16:10:31 +01:00
198bb09d51 Merge pull request #2282 from drwetter/drwetter-patch-2
Reflect past update for docker hub's Dockerfile
2022-11-28 17:09:04 +01:00
0c807bea5b Reflect past update for docker hub's Dockerfile
... using alpine 3.16
2022-11-28 14:10:13 +01:00
9304bb80b8 Merge pull request #2281 from dcooper16/fix_whitespace
Fix whitespace issues
2022-11-25 18:23:58 +01:00
e2942966d2 Fix whitespace issues
This commit fixes incorrect indentations introduced in #2276 and #2278, and also removes the extra whitespace that would have been removed by #2279.
2022-11-25 07:44:48 -08:00
6ba21a937a Merge pull request #2278 from dcooper16/fix_extract_calist
Fix extract_calist()
2022-11-24 11:15:10 +01:00
907126a285 Fix extract_calist()
When a server supports client authentication, extract_calist() extracts the list of supported certification authorities sent by the server. extract_calist() uses different code to extract the list from a TLS 1.3 response than from a TLS 1.2 or earlier response, since the CertificateRequest message was changed for TLS 1.3.

For TLS 1.2 and earlier, extract_calist() assumes that the CertificateRequest message is a sequence of certificate types, signature algorithms, and certification authorities. However, the signature algorithms field was added in TLS 1.2 and does not appear in TLS 1.1 and earlier. So, the current code does not work unless the server supports TLS 1.2 or TLS 1.3.

This commit fixes the problem by checking whether the response is a TLS 1.2 response, and skipping over the extraction of the signature algorithms field if the response is neither TLS 1.2 nor TLS 1.3.
2022-11-23 08:35:45 -08:00
a4666087e8 Merge pull request #2265 from dcooper16/server_sig_algs
Show server supported signature algorithms
2022-11-23 11:11:02 +01:00
c7644ad58e Limit size of signature_algorithms extension
Some servers get confused if the signature_algorithms extension is too large. This commit addresses the problem by:

* For TLS 1.2, generally limiting the signature algoritms to those consistent with the key type being tested.

* For TLS 1.3, breaking the list of signature schemes in two, and testing each half of the list separately.
2022-11-18 06:23:24 -08:00
6088eddab6 Show server supported signature algorithms
This commit modifies run_fs() to show the signature algorithms the server supports in the ServerKeyExchange message for TLS 1.2 and in the CertificateVerify message for TLS 1.3.

Signature algorithms are not shown for TLS 1.1 and earlier, since for those protocol versions the signature algorithm to use is specified by the protocol. While the signature algorithm used in TLS 1.1 and earlier is weak, testssl.sh already warns if these protocol versions are supported.
2022-11-18 06:23:24 -08:00
462a602625 Merge pull request #2276 from dcooper16/pem_fileout
Fix #1747
2022-11-18 11:06:26 +01:00
3eb8cf6754 Fix #1747
This commit fixes #1747 by converting PEM encoded certificates that are sent to fileout() to a single line. As suggested in #1747, '\n' is added after the '----- BEGIN ... -----' line and before the '------ END ... ------' line.

In order to ensure that '\n' appears in the string in the JSON and CSV files, '\\n' is sent to fileout() so that 'printf -- "%b"' converts '\\n' to '\n' rather than converting '\n' to a newline character.

In order to prevent fileout() from converting '\\n' to '\ ', this commit move the fix for #2049 (see PR #2050) from fileout() to fatal().
2022-11-17 06:31:52 -08:00
827782cd58 Merge pull request #2275 from drwetter/remove_negotiated
Remove Negotiated cipher / protocol in server preferences
2022-11-15 09:28:38 +01:00
e918a2c31f remove negotiated cipher / protocol also in baseline file 2022-11-14 20:25:56 +01:00
1842b9eefb Remove Negotiated cipher / protocol in server preferences
As a first cleanup action I removed in run_server_preference()
the line with Negotiated Protocol and Negotiated Cipher as
the don't have any real information, see #2235 , comment below:
https://github.com/drwetter/testssl.sh/pull/2235
2022-11-14 17:23:13 +01:00
0dac50c830 Merge pull request #2272 from dcooper16/fix2271
Fix #2271
2022-11-11 16:27:18 +01:00
43fade414c Fix #2271
This commit fixes #2271 by adding the `-no_ssl2` option to the call to get_host_cert() in run_drown(). There is at least one server that causes OpenSSL to hang if this call to get_host_cert() results in an SSLv2 ClientHello being sent. Since this call to get_host_cert() only needs to find the server's certificate in cases in which the server does not support SSLv2, there is no need to send an SSLv2 ClientHello.
2022-11-10 11:24:56 -08:00
92a80f7f86 Merge pull request #2268 from drwetter/mastodon
Hint for mastodon
2022-11-10 15:11:41 +01:00
c403249678 Hint for mastodon
... and to a separate account
2022-11-10 15:09:03 +01:00
6716dc7465 Merge pull request #2261 from osown/3.1dev
if PROXY variable is set there is no need to do a direct connection attempt
2022-11-10 10:52:14 +01:00
2b0fdfdf64 Merge pull request #2262 from dcooper16/run_fs_infnite_loop
Fix infinite loop in run_fs()
2022-11-10 09:43:29 +01:00
a4419fa9c9 Merge pull request #2264 from dcooper16/padding
Clean up adding padding
2022-11-10 09:37:42 +01:00
dda579cdf2 Merge pull request #2266 from dcooper16/fix2249
Fix #2249
2022-11-10 09:22:35 +01:00
f5162c9897 Fix #2249
This commit fixes #2249 by recognizing "sha1WithRSA" synonym for "sha1WithRSAEncryption."

OpenSSL uses "sha1WithRSAEncryption" to represent 1.2.840.113549.1.1.5 and "sha1WithRSA" to represent 1.3.14.3.2.29. While 1.2.840.113549.1.1.5 is generally recognized as the "standard" OID for RSA with SHA-1 (see, for example, RFC 3279), 1.3.14.3.2.29 has been used in some places as well (https://codereview.chromium.org/1223763002, https://bugzilla.mozilla.org/show_bug.cgi?id=1042479, https://github.com/pyca/cryptography/issues/3160).
2022-11-09 10:26:38 -08:00
e59d6ab9f6 Clean up adding padding
This commit simplifies the adding of padding data in a few places. Rather than adding one or two bytes at a time in a "for" loop, all of the padding is added in one step by extracting it from a long padding string. (The one exception is in run_robot(), where a "for" loop is used to add additional padding in case in which the RSA modulus is longer than the pre-defined padding string.)

Extracting the padding from a long string is faster than using a "for" loop and it makes the debugging file a little cleaner.

The idea is the same as PR #1940.
2022-11-07 14:13:45 -08:00
305855eef7 if PROXY variable is set there is no need to do a direct connection attempt 2022-11-02 13:19:28 +01:00
a4c24d58f4 Fix infinite loop in run_fs()
This commit fixes an infinite loop in run_fs() that occurs in cases in which $OPENSSL supports TLS 1.3 and the server supports all of the non-TLS 1.3 FS ciphers that $OPENSSL supports but not all of the TLS 1.3 ciphers that $OPENSSL supports.

The problem is that testing for supported ciphers using $OPENSSL, testing should stop if there are no more ciphers to test (because all of the ciphers supported by $OPENSSL have been determined to be supported by the server). However, currently testing only stops if both the list of TLS 1.3 ciphers and non-TLS 1.3 ciphers is empty. In the problematic case, only the list of non-TLS 1.3 ciphers is empty. Instead of stopping, s_client_options() is called with a -cipher option with an empty list, and s_client_options() simply removes the -cipher option from the command, resulting in a call to $OPENSSL s_client with a full list of non-TLS 1.3 ciphers. Since this call succeeds, the loop continues.

This commit fixes the problem by stopping TLS 1.3 ClientHello testing when the list of TLS 1.3 ciphers is empty and stopping non-TLS 1.3 ClientHello testing when the list of non-TLS 1.3 ciphers is empty.
2022-11-01 14:03:27 -07:00
f5d41ff26f Merge pull request #2258 from drwetter/minor
Fix indentation + clarify openssl warning
2022-10-21 15:44:55 +02:00
7c38cc7290 Merge pull request #2235 from dcooper16/fix1311
Fix #1311
2022-10-21 15:41:24 +02:00
5c889bde0f Include cipher order information in file output on a per protocol basis
This commit fileout() calls to ciphers_by_strength() and cipher_pref_check() to indicate whether or not the server enforces a cipher order for a protocol version.
2022-10-20 12:49:22 -07:00
55558b86d8 Fix indentation + clarify openssl warning 2022-10-20 14:55:22 +02:00
045778b2d8 Fix #1311
This commit fixes #1311 by only rating the lack of a server-enforced ciper order negatively if there is a difference in the quality rating of the ciphers offered for a particular protocol.
2022-10-19 10:03:53 -07:00
8d9b11be40 Merge pull request #2257 from drwetter/drwetter-patch-1
Fix typo
2022-10-19 14:09:48 +02:00
ea67c4f4a8 Fix typo
See #2256
2022-10-19 14:06:26 +02:00
73fa3e5aef Merge pull request #2251 from drwetter/dependabot/github_actions/docker/setup-qemu-action-2.1.0
Bump docker/setup-qemu-action from 2.0.0 to 2.1.0
2022-10-13 09:37:40 +02:00
f823c0528e Merge pull request #2252 from drwetter/dependabot/github_actions/docker/build-push-action-3.2.0
Bump docker/build-push-action from 3.1.1 to 3.2.0
2022-10-13 09:37:23 +02:00
fa412b1a33 Merge pull request #2250 from drwetter/dependabot/github_actions/docker/login-action-2.1.0
Bump docker/login-action from 2.0.0 to 2.1.0
2022-10-13 09:37:06 +02:00
681fd6e8d7 Bump docker/build-push-action from 3.1.1 to 3.2.0
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 3.1.1 to 3.2.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v3.1.1...v3.2.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-10-13 00:12:49 +00:00
e735c022b0 Bump docker/setup-qemu-action from 2.0.0 to 2.1.0
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 2.0.0 to 2.1.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v2.0.0...v2.1.0)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-10-13 00:12:46 +00:00
35a6fe94bf Bump docker/login-action from 2.0.0 to 2.1.0
Bumps [docker/login-action](https://github.com/docker/login-action) from 2.0.0 to 2.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v2.0.0...v2.1.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-10-13 00:12:43 +00:00
0ed2bf0ada Merge pull request #2234 from cancom/fix/grade-cap-sorting
Fix grade cap reasons not showing weak public keys
2022-10-07 16:48:06 +02:00
09a479cb7a Merge pull request #2238 from dcooper16/SC2235
Fix Shellcheck SC2235
2022-10-07 16:24:04 +02:00
bbe8987053 Fix Shellcheck SC2235
SC2235 is "Use { ..; } instead of (..) to avoid subshell overhead."

In a large number of places testssl.sh uses paraenthesis in complex boolean expressions in order to specify an evaluation order. The paranthesis results in the expression being evaluated in a subshell, which makes evaluation very expensive. This commit addresses the problem by rewriting any expressions that unnecessarily create subshells.
2022-09-29 15:37:51 -07:00
b03d8ca1e3 Merge pull request #2248 from war59312/patch-1
Readme.md - Small Fixes To Docs Section
2022-09-29 19:16:25 +02:00
7fee2381dc Update Readme.md 2022-09-29 13:00:13 -04:00
2e04127f06 Readme.md - Small Fixes To Docs Section
Small fix for Documentation section
2022-09-28 15:36:05 -04:00
c487f911aa Merge pull request #2247 from drwetter/bump_version_rc
Bump rc version
2022-09-28 17:17:52 +02:00
77a2d891cf Bump rc version
... so that distributors feel more encouraged to switch to this version
and drop 3.0.x
2022-09-28 09:21:25 +02:00