Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,190 Commits 16 Branches 39 Tags
ce820cdaf53e721ad429894deee64860a4dba1d3
Commit Graph
5190 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk Wetter 44d9f520fb Add check for proxy IPv6 support 
... of the binary. Testing needs to be done.
 2025-04-01 23:37:54 +02:00
Dirk 672d253981 Fix typo 2025-04-01 18:58:12 +02:00
Dirk b149fc4da4 Reorder, rephrase, timing 
Also provide a runtime table, from a little research.
 2025-04-01 15:24:40 +02:00
Dirk 45a264e4e4 Fix typo 2025-03-31 18:08:27 +02:00
Dirk f55abf56af Add new 64 Bit binaries (Linux, FreeBSD) 
... from https://github.com/testssl/openssl-1.0.2.bad .
 2025-03-31 17:54:40 +02:00
Dirk 093e8ddd10 Remove redundant statements 2025-03-31 17:54:01 +02:00
Dirk WetterandGitHub 2dfd192f27 Typos / when needed 2025-03-30 19:59:23 +02:00
Dirk 3a414d60bf Comment the removal of binaries 2025-03-30 18:14:41 +02:00
Dirk f208c09803 Rename file 2025-03-30 18:11:21 +02:00
Dirk 0e765986dc Remove output from openssl Kerberos binary 
... as we don't supply the kerberos binary anymore
 2025-03-30 18:08:58 +02:00
Dirk 1852ef6a1d Remove 32 Bit Linux binary 
... as it is a niche thing. It might be available @ the contibuted
build directory @ https://testssl.sh
 2025-03-30 18:06:58 +02:00
Dirk 5a1d90f310 Fix link 2025-03-28 18:33:14 +01:00
Dirk Wetter 87edb78b3e Add docu for IPv6 proxy 2025-03-27 18:27:00 +01:00
Dirk Wetter 36a58e2b3e Allow square bracket notation for IPv6 proxy 2025-03-27 18:26:17 +01:00
Dirk WetterandGitHub a348839f60 Merge pull request #2720 from testssl/add_comment_get_server_cert 
Comment the first lines get_server_certificate()
 2025-03-25 21:56:32 +01:00
Dirk Wetter e81b09176d Distunguish between LibreSSL and OpenSSL IPv6 proxy 
Somehow the proxy now shows only IPv6 source addresses when specifying
--proxy=IPV6ADDRESS:PORT
 2025-03-25 19:42:54 +01:00
Dirk Wetter 18da1b8df5 Fix some IPv6 proxy issues 
As a quick hack this PR enables *basically* the IPv6 proxy which results that testssl.sh
will use an IPv6 proxy when

* the binary supports that
* the binary is used an not tls_sockets()
* there's no A record but an AAAA record of the proxy or an IPv6 address as proxy address was specified.

The latter should guarantee that it doesn't break anything.

However tls_sockets() still uses IPv4 for the connection to the proxy.

See #1105
 2025-03-25 19:13:30 +01:00
Dirk Wetter 040ef1e0c9 Comment the first lines get_server_certificate() 
See https://github.com/testssl/testssl.sh/issues/2707#issuecomment-2741053487
 2025-03-25 17:22:10 +01:00
Dirk WetterandGitHub 5359befc60 Merge pull request #2716 from testssl/sanitze_http_header_better 
Sanitze HTTP header early and better
 2025-03-20 15:44:28 +01:00
Dirk Wetter a17bb42a37 Sanitze HTTP header early and better 
On MacOS `run_http_header()` hiccuped when in any place of the web site unprintable chars were returned, see https://github.com/testssl/testssl.sh/issues/2708#issuecomment-2738347784 .

This PR fixes that by moving the sanitization to a separate function and run it earlier before any processing of the returned content (header plus body) takes place.

Output was:

```
'HTTP Status Code           awk: towc: multibyte conversion failure on: '� disabilitato");

 input record number 36, file /tmp/testssl.FHu8E0/AAA.BBB.CCC.DDD.http_header.txt
 source line number 1
'wk: towc: multibyte conversion failure on: '� disabilitato");

 input record number 36, file /tmp/testssl.FHu8E0/AAA.BBB.CCC.DDD.http_header.txt
 source line number 1
  200 OK
```
 2025-03-20 13:34:46 +01:00
Dirk WetterandGitHub 692b9c9260 Merge pull request #2710 from testssl/fix_2708_TLS_FALLBACK_SCSV 
Set POODLE var when exiting run_ssl_poodle()
 2025-03-20 10:45:57 +01:00
Dirk WetterandGitHub 70dacdf9fa Merge pull request #2709 from testssl/nameopt_utf8_2705 
Fix LibreSSL parsing (-nameopt utf8)
 2025-03-19 23:41:47 +01:00
Dirk Wetter e4bbd6b517 Set POODLE var when exiting run_ssl_poodle() 
... so that run_tls_fallback_scsv() doesn't exit with a warning.

This fixes #2708 .
 2025-03-19 23:30:06 +01:00
Dirk Wetter 8d8f83ace5 Fix LibreSSL parsing (-nameopt utf8) 
When parsing the intermediate cerificates there was a parser problem when using
LibreSSL and not OpenSSL.

This PR fixes the issue #2705 and addresses the problem by using the -nameopt multiline command
of LibreSSL/OpenSSL .
 2025-03-19 22:36:37 +01:00
Dirk WetterandGitHub a43261fc6f Merge pull request #2703 from dcooper16/ocsp_check_rev_ossl_ver 
OpenSSL version check in check_revocation_ocsp()
 2025-03-18 13:04:23 +01:00
David CooperandGitHub ebeb3e7b9d OpenSSL version check in check_revocation_ocsp() 
The current code for setting $host_header in check_revocation_ocsp() will not work for LibreSSL 3.* or for upcoming versions of OpenSSL (version 4 or greater). The check will also not work correctly if $OPENSSL2 is used and $OPENSSL2 is not /usr/bin/openssl. This commit fixes these issues.
 2025-03-17 08:53:19 -07:00
Dirk WetterandGitHub 0c64e09203 Merge pull request #2702 from testssl/dependabot/github_actions/docker/login-action-3.4.0 
Bump docker/login-action from 3.3.0 to 3.4.0
 2025-03-17 10:26:57 +01:00
dependabot[bot]andGitHub 997646570e Bump docker/login-action from 3.3.0 to 3.4.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.3.0 to 3.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v3.3.0...v3.4.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-03-17 01:00:40 +00:00
Dirk WetterandGitHub 87d57bbf2f Merge pull request #2700 from testssl/unitttest_revocation 
Unit test revocation
 2025-03-15 21:38:57 +01:00
Dirk 52476b8a46 Fix finger confusion ;-) 2025-03-15 17:27:28 +01:00
Dirk c7e095305f Add unit test for certificate revocation 
One positive, one negative

This should detect failures in the future like in #2667, #2516
and #1275 .
 2025-03-15 17:24:22 +01:00
Dirk WetterandGitHub 2090bdc849 Merge pull request #2698 from testssl/fixDockerOcspCall 
Fix --phone-out + ocsp, also in docker container
 2025-03-15 17:11:52 +01:00
Dirk 633503cd17 Fix complaint wrt Lowercase "as" 2025-03-15 16:02:32 +01:00
Dirk 430c5c8d09 Fix --phone-out + ocsp, also in docker container 
Previously in 4f1a91f92e there was a
double header sent to the server to check whether the certificate
was revoked.

This PR addresses that and fixes #2667 .
 2025-03-15 15:58:28 +01:00
Dirk WetterandGitHub 098aa4ad8b Merge pull request #2697 from dcooper16/fix_ossl_version_check 
Fix OpenSSL version check
 2025-03-15 09:22:26 +01:00
David CooperandGitHub ad8684d324 Fix OpenSSL version check 
Before version 3.0.0, OpenSSL versions includes letters (e.g., 1.1.1w). Such version numbers confuse [[ ${OSSL_VER//./} -ge 210 ]]. Since this check is only needed for LibreSSL, this commit adds a conditional so that the check is only performed for LibreSSL.
 2025-03-14 14:06:17 -07:00
Dirk WetterandGitHub 73be4f7381 Merge pull request #2695 from testssl/fix_segfault_error4 
Fix segfault with error 4 in check_revocation_ocsp() when using --phone-out
 2025-03-14 19:19:38 +01:00
Dirk 4f1a91f92e Fix segfault with error 4 in check_revocation_ocsp() when using --phone-out 
As `--phone-out` sometimes doesn't work with our binary we switch transparently/automagically
to the vendor support openssl binary -- if available.

This fixes at least #2516 where the issue has been explained/debugged in detail.
See also #2667 and #1275.
 2025-03-14 17:06:42 +01:00
Dirk WetterandGitHub c53f4a3e44 Merge pull request #2682 from testssl/speedup_curvetests 
Speed up startup checks for supported curves and more
 2025-03-13 10:59:42 +01:00
Dirk WetterandGitHub 31a09ec593 Merge pull request #2692 from testssl/more_extension_numbers 
Add a few extension numbers in the server hello
 2025-03-12 10:29:15 +01:00
Dirk WetterandGitHub cab5bd7b13 Merge pull request #2694 from dcooper16/changes_update 
Update CHANGELOG.md and CREDITS.md
 2025-03-12 10:27:31 +01:00
David Cooper ec1d28ea24 Update CHANGELOG.md and CREDITS.md 
This commit adds information about #2687, #2688, and #2690 to the change log.
 2025-03-11 12:48:48 -07:00
Dirk WetterandGitHub 1e63bd296d Merge pull request #2693 from testssl/drwetter-patch-1 
Update pull_request_template.md
 2025-03-11 16:25:19 +01:00
Dirk WetterandGitHub 011bcc7223 Update pull_request_template.md 2025-03-11 16:21:24 +01:00
Dirk WetterandGitHub bad917f193 Update pull_request_template.md 2025-03-11 16:20:25 +01:00
Dirk 8b00ab4c47 Add a few extension numbers in the server hello 
Issue #2686 showed a server which listed an unknown extension number from
RFC 8446. THis PR adds this number and a few (later) ones.

It just lists them when detected in `parse_tls_serverhello()`

See also https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
 2025-03-11 15:57:25 +01:00
Dirk WetterandGitHub 830af44953 Merge pull request #2690 from dcooper16/mlkem 
Support draft-connolly-tls-mlkem-key-agreement
 2025-03-11 15:33:22 +01:00
Dirk WetterandGitHub 70e1c4d693 Merge pull request #2689 from dcooper16/sort_tls_extns 
Sort TLS extensions
 2025-03-11 15:20:36 +01:00
Dirk WetterandGitHub 6ed6db500b Merge pull request #2688 from dcooper16/ossl4_compat 
OpenSSL 4 compatibility
 2025-03-11 15:16:45 +01:00
Dirk WetterandGitHub ac83b79680 Merge pull request #2687 from dcooper16/ossl35_compat 
OpenSSL 3.5 compatibility
 2025-03-11 15:13:44 +01:00