d4454d009b
Merge pull request #383 from dcooper16/printSAN
...
Printing of subjectAltName extension
2016-06-13 19:32:31 +02:00
1d0c8cb3f8
Printing of subjectAltName extension
...
Modify the extraction of the subjectAltName extension from certificates in order to address SANs with name forms other than DNS and otherName.
2016-06-13 12:52:19 -04:00
88fd5c4e19
Merge pull request #381 from PeterMosmans/chachanaming
...
Updated ChaCha20 cipher names
2016-06-13 08:27:28 +02:00
a06c71d915
Updated ChaCha20 cipher names
...
See https://tools.ietf.org/html/draft-ietf-tls-chacha20-poly1305-04 (the latest version as of this writing is 04).
The previous version received the suffix _2013. See https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04
2016-06-13 10:34:04 +10:00
1b7653e438
Update Readme.md
2016-06-11 09:08:51 +02:00
61a049ccf9
Merge pull request #380 from dcooper16/runallciphers128limit
...
run_cipher_per_proto() 128-cipher limit
2016-06-10 20:30:47 +02:00
8c86049848
run_cipher_per_proto() 128-cipher limit
...
Ensure that neither run_allciphers() nor run_cipher_per_proto() sends a ClientHello with 128 or more cipher suites.
2016-06-10 13:45:25 -04:00
adbb1932eb
simplified cipher and protocol retrieval in 'Testing server preferences'
2016-06-09 15:56:53 +02:00
d561687554
initial commit
2016-06-09 15:06:42 +02:00
6b07b89946
- added values to curve448 + 25519
2016-06-09 13:18:55 +02:00
5ceace33e0
- FIX #189 with a smart check, introduced global var SERVER_SIZE_LIMIT_BUG
...
- introduced "has_server_protocol()" which can be used to check b4 connecting if protocol is a/v
2016-06-09 11:04:40 +02:00
94d5a8df80
hint for new (etxernal) binaries
2016-06-09 00:06:11 +02:00
f754d67e74
Merge pull request #377 from dcooper16/curve25519
...
Adding x25519 and x448 to ClientHello
2016-06-08 17:32:28 +02:00
4750c3f0d5
Adding x25519 and x448 to ClientHello
...
This added x25519 and x448 to the list of supported elliptic curves in the ClientHello created by socksend_tls_clienthello().
2016-06-08 11:25:47 -04:00
c929fba206
Merge pull request #342 from dcooper16/socksend_tls_clienthello_extensions
...
More extensions in socksend_tls_clienthello()
2016-06-08 10:39:17 +02:00
022dbc687a
Merge branch 'master' of github.com:drwetter/testssl.sh
2016-06-07 23:07:17 +02:00
d858edca1b
- filled PROTOS_OFFERED w sense
...
- minor fixes for fileout
- introduced "fixme()"
2016-06-07 23:06:58 +02:00
1d051a24e0
Merge pull request #374 from dcooper16/CREDITS
...
Update CREDITS.md
2016-06-07 22:40:56 +02:00
fa866f6458
Update CREDITS.md
2016-06-07 14:23:33 -04:00
c13ae4a001
Merge branch 'master' into socksend_tls_clienthello_extensions
2016-06-07 10:35:32 -04:00
8ed6214b6f
preliminary fix for #189 (SIZELMT_W_ARND=true needed)
2016-06-07 13:02:58 +02:00
29072315e5
output correction for IPv6 and --ip=<addr
2016-06-07 09:08:48 +02:00
6f4ba5bda7
- corrected handling of shortened warning periods for LE certs (dual certs were wrong)
...
- (kind of) readded cert_key_algo in output
- smaller output fixes e.g. for GOST certificates
2016-06-06 13:42:17 +02:00
4668b9879a
Update Readme.md
2016-06-04 19:17:10 +02:00
efdcd805a9
Update Readme.md
2016-06-04 19:14:38 +02:00
561cfa16fc
- FIX #367
2016-06-02 21:31:24 +02:00
e8cc32af54
Merge branch 'master' into socksend_tls_clienthello_extensions
2016-06-02 09:16:45 -04:00
6a9b0e01fc
- polishing #366 and IPv6-related
2016-06-02 09:59:52 +02:00
51f4c9ac9e
Merge pull request #366 from typingArtist/365_fix_ipv6_handling
...
drwetter#365 fix ipv6 handling
2016-06-02 09:27:14 +02:00
2c69e83f5b
https://github.com/drwetter/testssl.sh/issues/365 add UNBRACKETED_IPV6 quirks option
...
Since some OpenSSL binaries, namely Gentoo’s, don’t support bracketed
IPv6 addresses but unbracketed ones, specified as the -connect option,
the UNBRACKETED_IPV6 environment variable can be set to true for
disabling the automatic addition of brackets around IPv6 addresses on
such platforms.
2016-05-27 20:11:47 +02:00
cf62353fc6
https://github.com/drwetter/testssl.sh/issues/365 ensure DNS PTR lookups use un-bracketed IPv6 address
...
While standard OpenSSL requires the literal IPv6 address enclosed
in [brackets], standard DNS lookup tools don’t support the additional
characters. Before making reverse PTR lookups, these brackets have to
be removed from the IPv6 addresses.
2016-05-27 19:54:23 +02:00
1074c062c7
Merge branch 'master' of github.com:drwetter/testssl.sh
2016-05-27 17:44:08 +02:00
e1a8306286
- try to address #352
...
- WARNING in fileout is MEDIUM now
- NOT ok for medium on screen squashed
2016-05-27 17:43:45 +02:00
1ecad208fe
Update Readme.md
2016-05-26 18:03:07 +02:00
6fb15e83fa
global $OPENSSL_NR_CIPHERS
2016-05-26 12:56:55 +02:00
acc72a1daf
Merge branch 'master' into socksend_tls_clienthello_extensions
2016-05-25 16:50:56 -04:00
65193cdcee
Merge pull request #361 from dcooper16/run_rc4_show_each_fix
...
run_pfs() and run_rc4() show each fixes
2016-05-24 23:47:23 +02:00
e0c147ec86
run_pfs() and run_rc4() show each fixes
...
When run_rc4() is run with the "--show-each" option, but without the "--wide" option, a list of all RC4 ciphers is printed, without any distinction between those that are supported by the server and those that are not. This is the same issue I noted in #332 for run_pfs().
In run_pfs(), the displayed output was corrected, but all ciphers were still being added to $pfs_ciphers, so the list of supported PFS ciphers sent to fileout() was incorrect.
This PR fixes both issues.
2016-05-24 13:57:47 -04:00
5a03e96304
- consequently removed "NOT ok" for not-av of TLS 1.2
2016-05-23 22:42:40 +02:00
bf17a17b70
- 3DES in standard cipher list is medium, thus "NOT ok" is too much (need for elegant general way for "medium")
...
(see also https://www.keylength.com/en/8/ )
2016-05-23 18:56:05 +02:00
aa99c5eb88
- FIX #347
...
- LF removed in JSON
2016-05-20 13:45:53 +02:00
803e363310
Merge pull request #356 from dcooper16/server_key_size
...
Fix typo in Server key size check
2016-05-20 08:16:48 +02:00
fbf25d7ae1
Merge pull request #357 from dcooper16/cert_sig_algo
...
Recognize more signature algorithms
2016-05-20 08:12:52 +02:00
2ffed62d53
Recognize more signature algorithms
...
This PR adds to the list of signature algorithms recognized in certificate_info().
2016-05-19 16:45:56 -04:00
dccf9bef63
Fix typo in Server key size check
...
When certificate_info() is trying to determine what type of public key the server has so that it can determine whether the key size is acceptable, it sometimes looks at $cert_sig_algo rather than $cert_key_algo. This PR fixes that and also adds support for DSA public keys.
2016-05-19 16:39:06 -04:00
9a1425da14
- FIX #354
...
- polish #353
2016-05-18 19:06:26 +02:00
3dc94d2b3b
Merge pull request #353 from dcooper16/parse_tls_serverhello_with_added_checks
...
parse_tls_serverhello() with added checks
2016-05-18 08:18:47 +02:00
2a0a382321
Don't use dec2hex
...
The dec2hex() was actually converting from hex to decimal. Since it was only being used in one place, and wasn't really needed there, I just deleted it.
2016-05-17 12:02:12 -04:00
cba7fddbdd
Revised parse_tls_serverhello()
...
Revised parse_tls_serverhello() to more carefully check the response for errors, and to provide for more flexibility (e.g., if handshake messages are split across multiple fragments).
2016-05-16 16:52:51 -04:00
07a8bd3143
Support version negotiation test
...
The new test in PR #346 sends a TLSv1.4 ClientHello, so socksend_tls_clienthello() needs to include the signature algorithms extension if $tls_low_byte >= 3 rather than only if it is equal to 3.
2016-05-11 09:24:07 -04:00
Dirk Wetter
David Cooper
Peter Mosmans
typingArtist