Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,123 Commits 16 Branches 39 Tags
c67d1e250914281359e6a234bb15c751602d9752
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk Wetter c67d1e2509 Merge branch 'goncalor-3.0' into 3.0 2019-12-06 16:30:04 +01:00
Dirk Wetter b1f4713287 Merge branch '3.0' of https://github.com/goncalor/testssl.sh into goncalor-3.0 2019-12-06 16:29:45 +01:00
Dirk WetterandGitHub c5a13ed689 Merge pull request #1406 from drwetter/drwetter-patch-4 
Upgrade to Alpine 3.10
 2019-12-03 23:10:20 +01:00
Dirk WetterandGitHub 2cf8997635 Upgrade to Alpine 3.10 2019-12-03 23:10:06 +01:00
Dirk WetterandGitHub 37be442b2b Merge pull request #1405 from dcooper16/fix_http_header_formatting 
Fix formatting of HTTP security headers
 2019-12-03 23:04:32 +01:00
Dirk WetterandGitHub 9ee0feef3d Merge pull request #1403 from drwetter/drwetter-patch-3 
simplify Dockerfile
 2019-12-03 12:05:23 +01:00
Dirk WetterandGitHub c163f3ec99 simplify Dockerfile 
.. according to  #1402 and #1142
 2019-12-03 12:05:07 +01:00
Dirk WetterandGitHub 10fc1416b5 Merge pull request #1401 from drwetter/catch_someuser_errors 
Catch user error using --json/--html and friends
 2019-12-02 15:39:15 +01:00
Dirk Wetter 4c1bee181b Catch user error using --json/--html and friends 
testssl.sh hiccups when a user supplied after --json*/--html/-csv
a filename instead of using the corresponding  --json*file/--htmlfile/-csvfile
arguments, see #1397.

This PR adresses that in a sense that it tries to detect to following
argument of --json*/--html/-csv. If that matches a suspected filename
it bails out using fatal().

This is not intended to be perfect (when the pattern doesn't match)
but catches the user error in an early stage. See also #1398
 2019-12-02 15:32:06 +01:00
Dirk WetterandGitHub 58cfe1220b Merge pull request #1396 from dcooper16/align_cipher_rating_numbers 
Align cipher rating numbers
 2019-12-02 14:26:00 +01:00
Dirk WetterandGitHub b4f69fbdf6 Merge pull request #1400 from drwetter/drwetter-patch-2 
Housekeeping
 2019-11-27 09:50:02 +01:00
Dirk WetterandGitHub 8e563e5361 Housekeeping 
* add --rm
* better description of output
 2019-11-27 09:49:51 +01:00
Dirk WetterandGitHub 9ce04a6219 Merge pull request #1399 from max-wittig/patch-1 
docs(readme): delete container after run
 2019-11-27 09:35:47 +01:00
Dirk WetterandGitHub c645dc9f23 Merge pull request #1395 from drwetter/fix_get_caa 
Fix getting CAA record
 2019-11-24 20:33:52 +01:00
Dirk Wetter 61bd71bb14 Fix getting CAA record 
This resolves a regression introduced with IDN support (see also #1370).

* in check_resolver_bins() the determination of HAS_DIG_NOIDNOUT=true was wrong
* in get_*_record() the check for the bool variable was wrong
* in get_*_record() we shouldn't use quotes as they might be expand to a quoted arg
 2019-11-24 20:28:51 +01:00
Dirk WetterandGitHub 4eec2a0981 Merge pull request #1394 from drwetter/drwetter-postgres-gnmap 
Fix #1392
 2019-11-24 17:09:46 +01:00
Dirk WetterandGitHub 35da8c6fdf Fix #1392 
... postgres command building in ``ports2starttls()`` was missing a space.
This is only used when a lookup is performed when supplying a gnmap file.
 2019-11-24 17:09:21 +01:00
Dirk WetterandGitHub 32da607acb Merge pull request #1390 from dcooper16/fix_indentation 
Fix indentation
 2019-11-22 10:06:40 +01:00
Dirk WetterandGitHub c28777aa65 Merge pull request #1383 from szycha76/client-cert-support 
Quick'n'dirty client certificate support for s_client
 2019-11-21 12:53:51 +01:00
Dirk WetterandGitHub f50cf15bff Merge pull request #1387 from drwetter/polish_output_session_resump_client_auth 
Add minor output polish for session resumption and client auth
 2019-11-20 20:50:34 +01:00
Dirk Wetter 1366b187d0 Add minor output polish for session resumption and client auth 
* remove 2x resumption
* [[ ${SESS_RESUMPTION[2]} =~ clientauth ]] isn't needed.
  otherwise fileout needs also to be changed
 2019-11-20 20:47:13 +01:00
Dirk WetterandGitHub 9ce152ba43 Merge pull request #1386 from dcooper16/fix1385 
Fix #1385
 2019-11-20 20:37:02 +01:00
Dirk WetterandGitHub 1e268eca01 Merge pull request #1381 from drwetter/drwetter-patch-1 
add </b>
 2019-11-19 12:39:09 +01:00
Dirk WetterandGitHub dc658637a5 add </b> 
.. so to speak in addition to #1376
 2019-11-19 12:38:58 +01:00
Dirk WetterandGitHub 1c7fe03e20 Merge pull request #1376 from alexander-naumov/3.0 
--html option looks like all others
 2019-11-19 12:35:40 +01:00
Dirk WetterandGitHub f1677c087b Merge pull request #1380 from drwetter/modernize_isHTML_valid 
Modernize 08_isHTML_valid.t a bit ...
 2019-11-16 12:46:04 +01:00
Dirk Wetter c643860701 Modernize 08_isHTML_valid.t 
and make it similar to 07_isJSON_valid.t or 20_baseline_ipv4_http.t
in terms of output and readability
 2019-11-16 12:41:44 +01:00
Dirk WetterandGitHub 325c67d5ef Merge pull request #1379 from drwetter/ticketbleed_minorfix 
Ticketbleed fix: shutting down the connection properly
 2019-11-16 11:58:52 +01:00
Dirk Wetter 7747128c11 Ticketbleed fix: shutting down the connection properly 
In cases where the probes for reading memory from the server side were not
successful (=not vulnerable) the TCP connection was not shut down properly --
leading to and undefined state and probably causing problems to a consecutive
check. The server side then assumably from time to time just didn't return
anything which caused a integration test (t/08_isHTML_valid.t) to fail
randomly.

This PR properly terminates the TCP socket connection. Also, as sending the
close notification before closing the socket was duplicated in testssl.sh
that went to a separate function.

See comment in #1375:
https://github.com/drwetter/testssl.sh/pull/1375#issuecomment-554424814
 2019-11-16 11:48:22 +01:00
Dirk WetterandGitHub fbca5d1b3e Merge pull request #1375 from dcooper16/enhance_run_protocols_ssl_ 
Enhance run_protocols() in --ssl-native mode
 2019-11-15 17:11:33 +01:00
Dirk WetterandGitHub 298628995e Merge pull request #1377 from dcooper16/new_ossl_versions 
Support new OpenSSL/LibreSSL versions
 2019-11-15 17:00:45 +01:00
Dirk WetterandGitHub 93169a3123 Merge pull request #1374 from a666/a666-fix-missing-negation 
Fix missing negation in check_resolver_bins
 2019-11-11 22:00:26 +01:00
Dirk WetterandGitHub 89dd26e043 Merge pull request #1373 from drwetter/cn+rsolver_fix 
Move check_resolver_bins again, handle double CN
 2019-11-10 12:55:38 +01:00
Dirk Wetter 90a1455570 Move check_resolver_bins again, handle double CN 
When running in debugging mode, HAS_DIG and friends was
still false as check_resolver_bins() was called too late.
This amends basically bac0f66112 .

In cases where a certificate has two CNs, the output contained
a linefeed. This replaces the line feed by a space.
 2019-11-10 12:52:12 +01:00
Dirk WetterandGitHub 5c39ceafe1 Merge pull request #1369 from dcooper16/run_protocols_ssl_native1 
Fix issues with run_protocols() in --ssl-native mode
 2019-11-09 19:57:03 +01:00
Dirk WetterandGitHub 29a2ecf88f Merge pull request #1372 from drwetter/resolverbin_earlier 
Earlier initialisation of DNS HAS_* related vars
 2019-11-09 19:42:14 +01:00
Dirk WetterandGitHub bac0f66112 Earlier initialisation of DNS HAS_* related vars 
This fixes a bug e.g. when supplying a proxy by a DNS name, testssl couldn't resolve the name as the HAS_ variables initialized by ``check_resolver_bins()`` was done later than ``check_proxy()``.

The patch just puts ``check_resolver_bins()`` earlier in  "main"
 2019-11-09 19:41:37 +01:00
Dirk WetterandGitHub cd647ba2d0 Merge pull request #1368 from Night1/patch-1 
Fix typo
 2019-11-06 14:29:08 +01:00
Dirk WetterandGitHub ed4bffb5d2 Merge pull request #1367 from dcooper16/fix1366 
Fix #1366
 2019-11-06 08:55:34 +01:00
Dirk WetterandGitHub 6679dd7a16 Merge pull request #1365 from drwetter/drwetter-patch-4 
remove blank in output
 2019-11-03 20:49:36 +01:00
Dirk WetterandGitHub 3b89dc6b0a remove blank in output 
added in bda9c02183
 2019-11-03 20:49:22 +01:00
Dirk WetterandGitHub cbf6422221 Merge pull request #1364 from scottj/3.0 
fix bug in f5_ip_oldstyle() printf format string
 2019-11-03 09:20:19 +01:00
Dirk WetterandGitHub bda9c02183 Merge pull request #1363 from drwetter/drwetter-patch-3 
Marking CBC and SEED ...
 2019-11-02 16:03:39 +01:00
Dirk WetterandGitHub 47baf7c206 Marking CBC and SEED ... 
.. ciphersuites as obsolete in cipher categories
 2019-11-02 16:03:24 +01:00
Dirk WetterandGitHub 21d41b5f68 Merge pull request #1362 from drwetter/drwetter-patch-2 
Amendments + reordering
 2019-11-02 10:21:11 +01:00
Dirk WetterandGitHub 35f70f2375 Amendments + reordering 
add IDN etc. -support and David's work on determine_optimal_* functions
 2019-11-02 10:20:57 +01:00
Dirk WetterandGitHub e909d4cd8c Merge pull request #1327 from drwetter/IDN_improvements 
Idn improvements
 2019-11-02 09:52:52 +01:00
Dirk WetterandGitHub 457ffe78cd Merge pull request #1205 from dcooper16/server_preference_cipher_order 
Separate server preference test (cipher order) for TLS 1.3
 2019-10-30 08:12:43 +01:00
Dirk WetterandGitHub 9a5c8c08d5 Add case in cipher order for TLS != 1.3 2019-10-29 19:03:36 +01:00
Dirk WetterandGitHub 2f9bcea5e6 change another nope to no 2019-10-29 17:36:08 +01:00
Dirk WetterandGitHub 0f40e85f62 TLS 1.3 and cipher order 
If a server offers TLS 1.3 only and the cipher order is server side this commit changes the severity level to INFO.

Also it changes nope to no in two places
 2019-10-29 17:32:50 +01:00
Dirk WetterandGitHub bbd103fe95 Merge pull request #1360 from drwetter/drwetter-patch-1 
Remove c&p relict
 2019-10-28 18:44:42 +01:00
Dirk WetterandGitHub d3e3724d65 Merge pull request #1356 from dcooper16/fix_parse_tls_serverhello_bug 
Fix parse_tls_serverhello() bug
 2019-10-28 18:41:43 +01:00
Dirk WetterandGitHub 326558dec1 Remove c&p relict 2019-10-28 18:36:39 +01:00
Dirk WetterandGitHub 9c27a03c30 Merge pull request #1357 from dcooper16/fix_do_starttls_initialization_bug 
Fix do_starttls initialization bug
 2019-10-28 18:08:01 +01:00
Dirk WetterandGitHub 1335d9ebda Merge pull request #1359 from drwetter/fix_1355 
Adress #1355
 2019-10-28 18:01:58 +01:00
Dirk Wetter bfb94c8acb Adress #1355 
by adding "_hint" to the additional information when
testing for DROWN.
 2019-10-28 18:00:10 +01:00
Dirk WetterandGitHub 10a6c7b9d2 Merge pull request #1358 from dcooper16/use_jsonID 
Use $jsonID rather than literal string
 2019-10-28 17:49:16 +01:00
Dirk WetterandGitHub b64f5afaea Merge pull request #1354 from drwetter/patch-1351 
Changes to HTML header parsing
 2019-10-26 15:13:39 +02:00
Dirk WetterandGitHub c840ea50ec Update testssl.sh 
remove '
 2019-10-26 14:29:35 +02:00
Dirk WetterandGitHub e4f7788899 replace html pattern for header file 
.. with just a pattern for  '<' or '{' maybe with a leading blank
 2019-10-26 14:21:32 +02:00
Dirk WetterandGitHub ca5ff39bce Extend pattern for HTTP header 
Add another pattern because the SEDs tested so far do not seem to be fine with header containing x0d x0a (CRLF) -- which is the usual case. So we also trigger on any sign on a single line which is not alphanumeric (plus _)

See #1351
 2019-10-26 14:14:21 +02:00
Dirk WetterandGitHub 53951fdb06 Merge pull request #1351 from tkaehn/headerfile_vs_ipv4_address_in_header 
'IPv4 address in header' shows body content
 2019-10-26 13:14:04 +02:00
Dirk WetterandGitHub 0cfd30f8b8 make filtering for header more robust 
... by re-adding the former filters after ``sed '/^$q'``
 2019-10-26 13:13:10 +02:00
Dirk WetterandGitHub f5c3b4e41d Merge pull request #1352 from dcooper16/fix_client_simulation 
Fix client simulation bug
 2019-10-23 23:05:05 +02:00
Dirk WetterandGitHub 3c18262389 Merge pull request #1350 from drwetter/fix_1336 
Squash message to use ./bin/openssl.* when --ssl-native is supplied
 2019-10-19 10:07:55 +02:00
Dirk 7964a692ef Squash message to use ./bin/openssl.* when --ssl-native is supplied 
PR #1336 included logic to pre-test the server side with sockets
and/or with openssl. However when the user supplied --ssl-native
sockets were never tested before. As a result ALL_FAILED_SOCKETS
was still true, so that the final eif statement complaint erroneously
that sockets didn't work but openssl does.

Also Travis complaint.

This PR fixes it by checking SSL_NATIVE to the final part of the
if statement.

One could also test sockets before and then set ALL_FAILED_SOCKETS
appropriately but that would only make sense if the socket methods
like run_robot() or run_heartbleed() would check ALL_FAILED_SOCKETS
first.

At the moment I went for this as it is easier and the case that sockets
aren't working but openssl does seems not very likely.
 2019-10-19 09:52:02 +02:00
Dirk WetterandGitHub 764466d710 Merge pull request #1349 from drwetter/add_1336 
Remove double TLS13 only handling
 2019-10-18 21:33:30 +02:00
Dirk 1513d4eb49 Remove double TLS13 only handling 
... as it was moved to determine_optimal_proto(), see #1336.

LF added in message when TLS13 only
 2019-10-18 21:29:14 +02:00
Dirk WetterandGitHub 3389d84103 Merge pull request #1336 from dcooper16/ossl_determine_optimal_proto 
Use OpenSSL for determine_optimal_proto()
 2019-10-18 21:07:15 +02:00
Dirk WetterandGitHub 7a327f5439 Merge branch '3.0' into ossl_determine_optimal_proto 2019-10-18 21:06:49 +02:00
Dirk WetterandGitHub f118085278 Merge pull request #1339 from dcooper16/simplify_determine_sizelimitbug 
Simplify determine_sizelimitbug()
 2019-10-17 09:39:54 +02:00
Dirk WetterandGitHub e7d67e6134 Merge pull request #1341 from dcooper16/run_protocols_speedup 
Use determine_optimal_sockets_params() in run_protocols()
 2019-10-17 09:28:33 +02:00
Dirk WetterandGitHub a8a938470c Merge pull request #1342 from dcooper16/bad_version_negotiation 
Warn if bad version negotiation detected
 2019-10-17 09:22:08 +02:00
Dirk WetterandGitHub 975ee61eee Merge pull request #1346 from csett86/osx10146 
Update Safari to 13.0 and macOS to 10.14
 2019-10-17 08:53:42 +02:00
Dirk WetterandGitHub 35c69bee27 Merge pull request #1338 from drwetter/drwetter-dockerfiles1 
Docker container for testing (generated by a script)
 2019-10-02 17:53:37 +02:00
Dirk WetterandGitHub bcc1298eb3 0-RTT dockerfile script for nginx 2019-10-02 17:52:34 +02:00
Dirk WetterandGitHub fe43d9dd0c Docker files for testing 
docker-debian10.tls13only.start.sh can be linked to e.g. docker-debian10.tls13.start.sh, then also TLS 1.2 is added.
 2019-10-02 17:50:11 +02:00
Dirk WetterandGitHub cf00c8e8ac Merge pull request #1337 from dcooper16/fix_session_resumption 
Fix sub_session_resumption()
 2019-10-02 08:52:23 +02:00
Dirk WetterandGitHub e492b5761d Merge pull request #1334 from dcooper16/reset_ossl_dependent_vars 
Reset OpenSSL dependent variables
 2019-10-01 20:03:55 +02:00
Dirk WetterandGitHub f05eac7003 Merge pull request #1335 from dcooper16/session_tickets 
Fix session ticket issues
 2019-10-01 00:11:22 +02:00
Dirk ba009565a8 swap ldap server as previous one wasn't reachable anymore 2019-09-25 09:36:16 +02:00
Dirk WetterandGitHub 2a635ee62d Merge pull request #1331 from dcooper16/fix1328 
Fix #1328
 2019-09-25 08:39:12 +02:00
Dirk WetterandGitHub 613e1d0133 Merge pull request #1216 from dcooper16/add_determine_optimal_sockets_params 
Add determine_optimal_sockets_params()
 2019-09-24 08:46:49 +02:00
Dirk WetterandGitHub da2beb48d3 Merge pull request #1330 from dcooper16/more_run_protocol_fixes 
More run_protocol() fixes
 2019-09-23 20:40:25 +02:00
Dirk WetterandGitHub 9e3bcfb2ef Merge pull request #1329 from dcooper16/fix_run_protocols 
Fix run_protocols()
 2019-09-21 11:27:01 +02:00
Dirk Wetter 5f572b9200 remove leading blank in global definition 2019-09-20 17:54:56 +02:00
Dirk Wetter d526a5d80e Squash error msg 
.. in get_caa_rr_record() due to +noidnout
 2019-09-20 17:10:25 +02:00
Dirk Wetter 817a999394 logic error with host vs. dig fixed 2019-09-20 15:30:33 +02:00
Dirk Wetter ae9cb99365 Added +noidnout to dig 
... to all get_*_record() functions if HAS_DIG_NOIDNOUT was set.
 2019-09-20 15:14:37 +02:00
Dirk Wetter 61238f1a4f Restructure IDN support, DNS improvements 
In order to not repeatedly call check_resolver_bins() the function
was moved to top level. As each check in check_resolver_bins now
is only executed once, it should also work faster. Each get_*_record()
now uses HAS_ variables only.

Also check_resolver_bins() contain now the check whether
idn/idn2 support is available.

Then the IDN URI conversion snipplet was moved to the final function
parse_hn_port() which does operations in the URI supplied.
 2019-09-20 14:41:03 +02:00
Dirk Wetter f10431a49a fix syntax 2019-09-19 20:45:57 +02:00
Dirk Wetter 021264fa24 correcting typo, add variable HAS_NOIDNOUT 2019-09-19 19:50:12 +02:00
Dirk Wetter 837c246173 Robustness + IDN improvements 
This PR adds a few quotes to some arguments which when previous code
was executed properly weren't needed.

Also it improves the IDN code from @teward, so that when idn2 is
available, a conversion will be tried, and when idn is available
and/or idn2 failed, a conversion will be tried.

Finally it'll be tried to continue without conversion, hoping that
the DNS client binaries can cope with the IDN URI.

This is not good enough yet and needs to be complemented, see discussion
@ #1321.
 2019-09-19 13:36:53 +02:00
Dirk WetterandGitHub 1276c6754d Merge pull request #1326 from drwetter/drwetter-idn-docker 
Add idn support to Dockerfile
 2019-09-19 09:14:17 +02:00
Dirk WetterandGitHub 7818f1acc8 Add idn support 2019-09-19 07:12:59 +00:00
Dirk WetterandGitHub 01f73a2249 Merge pull request #1325 from Phylu/patch-1 
remove duplicate header name for other_header in file output
 2019-09-18 20:42:33 +02:00
Dirk WetterandGitHub dcd5acb2af Merge pull request #1323 from drwetter/protocol_improvements 
Protocol improvements
 2019-09-18 17:49:36 +02:00
Dirk WetterandGitHub 987bf845ad Merge pull request #1322 from teward/idn-support 
Add IDN/punycode support for non-ASCII URIs (#1319, #1320, #1321)
 2019-09-18 17:49:13 +02:00
Dirk Wetter 7ec3c6ab99 Don't penalize TLS 1.2 is not available if TLS 1.3 is supported 
... and thus this commit addresses #916.

It does that via a (quite) pre-test which checks for a general availabilty
of TLS 1.3 before the TLS 1.2 protocol test is being run and decides
based on that how a missing TLS 1.2 will be echoed.

Later on the complete TLS 1.3 test will be continued using the results
from the TLS 1.3 pre-test.
 2019-09-14 17:56:31 +02:00