Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,047 Commits 16 Branches 39 Tags
c942283b3416b51704f9e7c5a2fecbd90718a0d1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk Wetter c942283b34 Re-add correct version \# 2025-07-03 15:01:04 +02:00
Dirk 49dcd5b854 First try for QUIC (OpenSSL only) 
This is an implementation for QUIC (RFC 9000, RFC 9114). It's purely
OpenSSL based for now. As some distros support newer (>= 3.2) versions
this works on some distros now and will work on more as time goes by.

It has been tested with MacOS and Linux. If there's an OpenSSL version
in /usr/bin/ it will automagically use that version.

A new short sub function named sub_quic() was introduced for handling this as
run_protocols() is already "full".

It appears below TLS 1.3. A check against HTTPS RR #2484 is planned but
not implemented yet. PR #2484 has to be worked on and merged before.

New variables were introduces (HAS_QUIC/ +HAS2_QUIC). Also there's
QUIC_WAIT as we run the connect in the background and we need a wait time.

HAS_UDS2 was renamed to HAS2_UDS as HAS2 should signal this is for OPENSSL2
and UDS2 doesn't make sense.

To clarify:
- check for a proxy and then don't do the check?
- short unit test (t/31_isJSON_valid.t cjecks cloudflare but ...)
 2025-07-03 14:36:55 +02:00
Dirk Wetter 6173d80ca2 Merge branch '3.2' into 3.3dev 2025-07-03 09:00:16 +02:00
Dirk WetterandGitHub 4b5409122c Merge pull request #2820 from testssl/performance_hint 
Performance hint for openssl
 2025-07-02 17:37:21 +02:00
Dirk Wetter 6de18d3a22 was 2x first 2025-07-02 17:36:33 +02:00
Dirk Wetter 6083938a47 Performance hint for openssl 2025-07-02 17:34:29 +02:00
Dirk WetterandGitHub 2829827cc2 Merge pull request #2817 from testssl/errormsg_2807 
Improve error message for sockets fail and Alpine
 2025-06-29 17:06:01 +02:00
Dirk 3792bceeda Improve error message for sockets fail and Alpine 
See $2807 .

Also some prln_magenta were modified (see #2816) to pr_warning.
 2025-06-29 15:24:44 +02:00
Dirk WetterandGitHub 9b1a7ae1f8 Merge pull request #2814 from testssl/revert-2813-revert_2772_for_testing 
Revert "Revert lowercase conversion for repo"
 2025-06-24 12:07:08 +02:00
Dirk 78a613dae3 Remove the scheudule part as it will not work anymore 2025-06-24 12:06:00 +02:00
Dirk WetterandGitHub b56302518b Revert "Revert lowercase conversion for repo" 2025-06-23 23:12:59 +02:00
Dirk WetterandGitHub 6dc26b09fe Merge pull request #2813 from testssl/revert_2772_for_testing 
Revert lowercase conversion for repo
 2025-06-23 21:38:32 +02:00
Dirk d44692331b Revert lowercase conversion for repo 
... which was done in #2772 . This is done for testing as building the container doesn't
work anymore, see #2810 .

Action logs say it was build but it's unclear why it is still based on 3.2rc4 .
Hence this test.

The schedule was commented out as it would not apply either here as 3.3dev is
 now the default version.
 2025-06-23 21:17:49 +02:00
Dirk WetterandGitHub bed43df2df Merge pull request #2812 from testssl/ghcr_workflow_no_unittest 
YAML file doesn't need the unit tests
 2025-06-23 21:04:43 +02:00
Dirk Wetter 58719e4492 YAML file doesn't need the unit tests 2025-06-23 21:00:33 +02:00
Dirk WetterandGitHub 4b71d0e2ce Merge pull request #2811 from testssl/docker_action_rename 
Change action docker file to 3.3dev
 2025-06-23 20:54:24 +02:00
Dirk Wetter d2eaae79cb rename docker ghcr.io action 2025-06-23 20:52:14 +02:00
Dirk Wetter 5e571b4463 no unit test for yml file changes 2025-06-23 20:51:03 +02:00
Dirk Wetter f1621600f4 Change file to 3.3dev 2025-06-23 20:40:54 +02:00
Dirk Wetter da6ec2f695 Merge branch '3.2' into 3.3dev 2025-06-23 20:31:40 +02:00
Dirk WetterandGitHub 5fe854b830 Merge pull request #2809 from testssl/improve_2798 
Minor improvements to #2798
 2025-06-23 20:29:27 +02:00
Dirk WetterandGitHub 4d75527a4b Merge pull request #2808 from testssl/fix_sectigo_x46.forLinux 
Add sectigo CA E46 and R46 for Linux.pem
 2025-06-23 20:29:07 +02:00
Dirk Wetter c9a11a9fb0 Minor improvements to #2798 
see https://github.com/testssl/testssl.sh/pull/2798#issuecomment-2972834180
 2025-06-23 18:43:34 +02:00
Dirk WetterandGitHub 71f0f32cf5 Merge pull request #2798 from secinto/3.2 
Modify grading for incomplete chain. 

suggested corrections will be done after merge
 2025-06-23 18:41:00 +02:00
Dirk Wetter b4f9e51865 Add lf so that gh action doesn't complain 2025-06-23 18:21:44 +02:00
Dirk Wetter 1403503077 Add Sectigo x46 CAs from recent Debian update 2025-06-23 18:20:14 +02:00
Dirk WetterandGitHub 81471c3a22 Merge pull request #2805 from testssl/readme_3.3dev 
Reflect that this is 3.3dev
 2025-06-15 09:48:31 +02:00
Dirk Wetter aa7d0f4311 typo 2025-06-15 09:47:23 +02:00
Dirk Wetter 7cc605aeaf Reflect that this is 3.3dev 
A branch at Docker.io needs to be created, thus that section is commented out.
 2025-06-15 09:42:07 +02:00
Dirk WetterandGitHub a209f92d4f Merge pull request #2804 from testssl/readiness_for_new_stuff 
Reflect version 3.0.10 version is EOL
 2025-06-15 09:28:24 +02:00
Dirk WetterandGitHub 99a05cb261 Merge pull request #2801 from HarrisonTCodes/fix-readme-deepwiki-link 
Fix README DeepWiki Link
 2025-06-14 17:14:37 +02:00
Dirk 637fb86c83 typo 2025-06-14 17:11:30 +02:00
Dirk c4ad4d7d42 Reflect version 3.0.10 version is EOL 2025-06-14 17:09:24 +02:00
Dirk WetterandGitHub b6a951d40a Merge pull request #2797 from testssl/bump_version 
Bump version
 2025-06-13 10:24:25 +02:00
Dirk f2aa87ba66 Bump version 
"just" bugfix release.
 2025-06-12 17:26:06 +02:00
Dirk WetterandGitHub 949042866b Merge pull request #2796 from testssl/plaintext_len_AKA_openssl2conf_problem 
Fix OPENSSL_CONF problem for OPENSSL2
 2025-06-11 20:38:29 +02:00
Dirk 235a6a0f88 add another OPENSSL_CONF='' 2025-06-11 19:02:06 +02:00
Dirk 91a35026b6 Fix OPENSSL_CONF problem for OPENSSL2 
In #2727 there were workarounds introduced which sped up processing decryption of
ChaCha20 and and AES-GCM by using OPENSSL2 when it is supporting such functions.

However when OPENSSL2 is called and OPENSSL_CONF still points to the autogenerated
file which works for `~/bin/openssl.$(uname -s).$(uname -m)` the decryption `$plaintext`
will be empty which later on caused a negative value, see #2780 .

This fixes #2780 by prepending `OPENSSL_CONF=''` to each OPENSSL2 instance. Also it
makes `chacha20()` and `gcm-decrypt()` more robust. It is now more readable now.

At other places $OPENSSL2 were prepended by `OPENSSL_CONF=''` also if there weren't
any obvious errors noticed.

Also now all OPENSSL2 vars will appear in /tmp/testssl.XXXXXX/environment.txt when
debugging.

It was also noticed that the `find_socat()` function had room for improvements, it was
not set in any case when `socat was in $PATH or supplied via env SOCAT.
 2025-06-11 18:47:14 +02:00
Dirk WetterandGitHub 735cc668c0 Merge pull request #2792 from testssl/fix_issuerCN 
Fix missing issuer CN
 2025-06-11 11:13:21 +02:00
Dirk Wetter 0a89d5c94f Some cert need 5 lines to reach the CN 2025-06-11 09:06:41 +02:00
Dirk WetterandGitHub fd6dbb22bd Merge pull request #2790 from testssl/FixServerHeaderParser 
Fix parser for server header
 2025-06-11 08:48:36 +02:00
Dirk Wetter 39029e9995 fix orthographic error 2025-06-10 23:13:00 +02:00
Dirk Wetter 61947405e0 Fix missing issuer CN 
This fixes a problem which was introduced @ 8d8f83ace5.
It caused for some hosts not to parse / display the issuer CN correctly.

Also it adds some code in testssl.sh and in a unit test to detect
this earlier. In general an output string FIXME will now cause a
unit test to fail. This can + should be used at other places too!

Fixes #2789
 2025-06-10 22:54:11 +02:00
Dirk Wetter 889aedc0e4 Fix parser for server header 
Do word match and exclude minus sign

This fixes #2787 for 3.2.
 2025-06-10 21:59:40 +02:00
Dirk WetterandGitHub fbbf68857f Merge pull request #2785 from testssl/stderr 
Ensure that stderr is caught / $prg=testssl.sh
 2025-05-28 20:16:32 +02:00
Dirk Wetter ba360bae7e remove extra quote sign 2025-05-28 10:21:10 +02:00
Dirk Wetter 7183bb1206 Add changed headers at target ... 
... so that runners pass
 2025-05-27 22:48:04 +02:00
Dirk Wetter 1fb3a2224f Ensure that stderr is caught / $prg=testssl.sh 
As suggested in #2780 this PR redirects all stderr on a perl level
to stdout so that we should see all errors which we miss because
we can't redirect (>/dev/null in check) or we haven't redirected yet.

Also old checks are imporved, so that $prg is used as in newer
checks.
 2025-05-27 10:54:25 +02:00
Dirk WetterandGitHub 75d8f8aa90 Merge pull request #2782 from testssl/ccsInjectionFix 
Fix CCS injection regression
 2025-05-22 00:50:04 +02:00
Dirk 0daf83cf76 fix typo 2025-05-21 14:22:13 +02:00
Dirk cd575526a7 Fix CCS injection regression 
The rhs of the pattern was off by one byte and it worked in practise until recent PR #2657.

This fixes #2691 for 3.2 .
 2025-05-21 14:17:54 +02:00
Dirk WetterandGitHub 388f3a3321 Merge pull request #2761 from testssl/mac_runner 
PoC github action runner macos-14
 2025-05-20 17:59:19 +02:00
Dirk Wetter a76e06f887 Polish some sentences 
... wrt to the now even better unit testing.
 2025-05-20 16:50:39 +02:00
Dirk Wetter f8f00de5a0 Shorten name for badge 2025-05-20 16:43:06 +02:00
Dirk Wetter d87f5f68de Sync runners / rename comments for badge 2025-05-20 16:37:48 +02:00
Dirk Wetter ce96cc5816 Add badge for MacOS rummer 2025-05-20 16:36:29 +02:00
Dirk Wetter 7815b67695 Merge branch '3.2' into mac_runner 2025-05-20 16:31:34 +02:00
Dirk WetterandGitHub 242256bd58 Merge pull request #2778 from testssl/drwetter-patch-1 
slight rewording
 2025-05-20 12:38:42 +02:00
Dirk WetterandGitHub 81b377bda9 slight rewording 2025-05-20 12:37:57 +02:00
Dirk Wetter d0143b181b Handle space problem 2025-05-20 10:48:54 +02:00
Dirk Wetter 85d8d44fbe Try to fix the renegotiation problem 
as suggested, see https://github.com/testssl/testssl.sh/issues/2765#issuecomment-2891140503
 2025-05-19 16:24:46 +02:00
Dirk Wetter a685fc252d Take shorter OPenSSL cipher name into account 
AEAD-CHACHA20-POLY1305-SHA256    vs.
TLS_CHACHA20_POLY1305_SHA256
 2025-05-19 13:52:03 +02:00
Dirk WetterandGitHub 54964a9bc6 Merge pull request #2777 from polarathene/chore/consistent-dockerfile 
chore: `Dockerfile` consistency
 2025-05-19 13:10:45 +02:00
Dirk WetterandGitHub 0d0c5d0ab9 Merge pull request #2771 from polarathene/ci/docker-prefer-dist-local 
ci: Docker - Prefer `dist-local` stage
 2025-05-18 16:24:43 +02:00
Dirk WetterandGitHub 35457f9d99 Merge pull request #2776 from testssl/drwetter-patch-1 
More badges
 2025-05-17 18:22:29 +02:00
Dirk WetterandGitHub 9f73f782a1 Update Readme.md 
Bluesky badge
 2025-05-17 16:35:58 +02:00
Dirk WetterandGitHub 05fb3c3fe9 Identation 2025-05-17 16:20:40 +02:00
Dirk WetterandGitHub d0aa6fa84d Update Readme.md 
More badges
 2025-05-17 16:19:42 +02:00
Dirk WetterandGitHub 8d1bcab878 Merge pull request #2775 from testssl/ubuntu_runner 
Fix indentation
 2025-05-16 19:06:57 +02:00
Dirk WetterandGitHub 7df43ea752 More badges 
see https://shields.io/badges
 2025-05-16 19:06:24 +02:00
Dirk Wetter 5b2e8ac12c fix indentation 2025-05-16 18:21:20 +02:00
Dirk Wetter c109cafa17 Merge branch '3.2' into mac_runner 2025-05-16 18:16:58 +02:00
Dirk Wetter 42b3352106 rename Dockerfile 2025-05-16 18:15:57 +02:00
Dirk Wetter b77563951d Rename runner, change suffix for Dockerfile 2025-05-16 18:14:35 +02:00
Dirk 222ad8ae36 Fix indentation 2025-05-16 18:07:09 +02:00
Dirk WetterandGitHub ce6cdfea75 Merge pull request #2774 from testssl/ubuntu_runner 
Update / rename runner to be in sync w Mac runner
 2025-05-16 18:05:34 +02:00
Dirk cbd15020e2 Change reference to badge 2025-05-16 17:59:00 +02:00
Dirk 5e248c05dc Update / rename runner to be in sync w Mac runner 2025-05-16 17:50:33 +02:00
Dirk WetterandGitHub 0ab5e2d878 Merge branch '3.2' into ci/docker-prefer-dist-local 2025-05-16 17:23:30 +02:00
Dirk WetterandGitHub 6aa1c58c34 Merge pull request #2773 from testssl/drwetter-patch-1 
Dockerfile
 2025-05-16 16:11:46 +02:00
Dirk WetterandGitHub 3977057a1e Update unit_tests.yml 
Dockerfile.alpine here
 2025-05-16 16:11:22 +02:00
Dirk WetterandGitHub bc4a1ab402 Merge pull request #2772 from Tazmaniac/docker-fix 
Lowercase the repository name.
 2025-05-16 09:20:14 +02:00
Dirk Wetter 4db9cb5afe Unify ECDH bitlength 2025-05-14 14:07:07 +02:00
Dirk Wetter 5e888ff7ee rename TLS 1.3 ciphers when using LibreSSL 2025-05-14 10:28:59 +02:00
Dirk WetterandGitHub afbbb0f2c1 Merge pull request #2770 from polarathene/patch-3 
ci(fix): Docker workflow `build-args` input should be a string
 2025-05-12 13:44:47 +02:00
Dirk WetterandGitHub 68c148dabe Merge pull request #2768 from polarathene/fix/ci-docker-3.2 
ci(fix): 3.2 - Docker support adjustments
 2025-05-12 12:15:11 +02:00
Dirk Wetter 0aad0a0fac Try /usr/bin/echo for testing 
.. although it seems not an option to include this in prod.
RSsee https://github.com/testssl/testssl.sh/issues/2765

Omitting redirecting stderr
 2025-05-12 10:43:43 +02:00
Dirk WetterandGitHub 7f48b5ffed Merge pull request #2766 from testssl/drwetter-patch-1 
Add DeepWiki doc
 2025-05-09 12:57:18 +02:00
Dirk WetterandGitHub 9e89129e4f Add DeepWiki doc 2025-05-09 12:56:35 +02:00
Dirk Wetter f1daf10c30 make mv visible 2025-05-09 10:09:04 +02:00
Dirk Wetter b7270a49c2 correct printf 2025-05-09 10:06:08 +02:00
Dirk Wetter fe57ed8eea move openssl away 2025-05-09 10:02:30 +02:00
Dirk WetterandGitHub f44464408d Merge pull request #2764 from vinny-pereira/dev 
Fix missing line feed in run_breach() failure output
 2025-05-09 09:36:45 +02:00
Dirk Wetter 18c4428cf4 elSif 2025-05-09 08:53:17 +02:00
Dirk WetterandGitHub a57a92fa1a Merge pull request #2762 from testssl/android15 
Add Android15 handshake simulation
 2025-05-08 23:35:05 +02:00
Dirk Wetter 42f738572b fix spelling error 2025-05-08 23:10:24 +02:00
Dirk Wetter 5f471c76ee Numbering the checks 2025-05-08 23:08:59 +02:00
Dirk Wetter 042b0c160a Naming checks, exempt two checks for MacOS 2025-05-08 23:06:51 +02:00
Dirk Wetter ac49e2e12b Remove engine problem line 
as it may contain the openssl path
 2025-05-08 19:15:56 +02:00
Dirk 2557d2151b Add line 2025-05-08 18:49:51 +02:00