Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,025 Commits 16 Branches 39 Tags
db0a6db620a24a4e8ff9d49152521db105b920a7
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David CooperandGitHub db0a6db620 Remove fixes for test_just_one() 2016-07-25 16:54:19 -04:00
David CooperandGitHub d2f1e15243 Remove fixes for run_rc4() 2016-07-25 16:30:30 -04:00
David Cooper b142962063 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-07-25 16:24:35 -04:00
David Cooper bb29e3c917 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-07-25 09:39:28 -04:00
David Cooper 36a3230b84 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-07-25 09:36:50 -04:00
David CooperandGitHub ae38670067 Fix check for self-signed certificate 
The check for whether a certificate is self-signed was using the undefined variable $CN rather than $cn.
 2016-07-22 12:06:52 -04:00
David CooperandGitHub 59002c1088 Update JSON id for chain-of-trust 2016-07-22 11:57:16 -04:00
David CooperandGitHub df64e47fb9 CN <--> hostname match 
PR to address issue #94 (CN <--> hostname match)
 2016-07-22 11:31:52 -04:00
David Cooper 603ed33f57 Merge branch 'master' into version_negotiation 2016-07-20 13:39:11 -04:00
David Cooper 6730ed8340 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-07-20 13:37:54 -04:00
David Cooper e8d10a5e05 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-07-20 13:34:39 -04:00
David Cooper bdea1a0971 Merge branch 'master' into issuer2 
Conflicts:
	testssl.sh
 2016-07-20 11:45:08 -04:00
David CooperandGitHub 346c52dc7c CA names with domain component attributes 
`certificate_info()` does not correctly display the Issuer name for CAs that use domain component attributes.

There is a server on the NIST intra-net that I test against that has a certificate issued by a NIST CA, and the issuer name in the certificate is of the form: `/DC=net/DC=example/DC=internal/CN=CAname`

Since there is no organizational name, testssl.sh displays the name as:
```
 Issuer                       "CAname" ("")
```
In this PR, if the Issuer name has 'DC=' attributes, but does not have an 'O=' attribute, the "DC=" attributes are combined into a DNS name that is used as if it were the organizational name:
```
 Issuer                       "CAname" ("internal.example.net")
```
I should note, however, that I have not been able to find any other examples of TLS server certificates that have been issued by CAs that have domain components ("DC=") in their names. So, it may not be worthwhile to change the code to try to accommodate such CAs.
 2016-07-20 11:37:51 -04:00
David CooperandGitHub d9f8024d9a Fix JSON output of Issuer name 
`certificate_info()` currently outputs `$issuer` to the JSON file, where is should be outputting `$issuer_CN` in order for the information in the JSON file to match the information that is displayed.

This PR also fixes the problem that if an Issuer name contains a domain component attribute (DC=) then it will be mistakenly treated as a country attribute (C=).
 2016-07-20 10:50:38 -04:00
David CooperandGitHub a06ac81df3 Speed up finding supported curves 
Rather than try each curve one at a time, follow model in `cipher_pref_check()`.  First include all curves in ClientHello, then successively remove from the ClientHello those curves that have been offered by the server until the connection fails. This makes the number of calls to `$OPENSSL s_client` one more than the number of supported curves rather than the number of curves in NamedCurve supported by $OPENSSL.

Note, however, that OpenSSL defines MAX_CURVELIST as 28 and fails if the `-curves` option includes more than 28 curves. Since OpenSSL 1.1.0 offers 29 curves from NamedCurve, this PR breaks the list of supported curves in 2. At the cost of one additional calls to `$OPENSSL s_client` it ensures that the number of curves provides to the `-curves` option is below the limit.
 2016-07-14 13:23:50 -04:00
David CooperandGitHub 891c56f8bf Determine support elliptic curves for ECDHE- ciphers 
This PR extends run_pfs() to display the set of elliptic curves supported by the server, if the server supports any ECDHE- ciphers.
 2016-07-11 11:00:56 -04:00
David CooperandGitHub fb94221ce0 Reorder supported curves 
Reorder the supported curves sent by socksend_tls_clienthello() from strongest to weakest.
 2016-07-11 10:52:48 -04:00
David Cooper f968bd8346 Merge branch 'master' into version_negotiation 2016-07-11 10:45:59 -04:00
David Cooper 197bee8658 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-07-11 10:44:37 -04:00
David Cooper 08953416e8 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-07-11 10:42:28 -04:00
David Cooper f216cbe61f Merge branch 'master' into version_negotiation 2016-07-08 09:39:12 -04:00
David Cooper 02a39e4859 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-07-08 09:38:06 -04:00
David Cooper 788042ba37 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-07-08 09:35:52 -04:00
David CooperandGitHub ec6c0ce605 Check for all CBC ciphers in Poodle test 
This PR should address issue #399.

I created the list of ciphers using the CIPHERS_BY_STRENGTH file from PR #373, making a list of all ciphers that had "CBC" in the RFC name and for which I had been able to find a corresponding OpenSSL name. Then, since that list contained more than 128 ciphers, I removed any ciphers from the list where the name ended in "-SHA256" or "-SHA384", as it is my understanding that those ciphers can only be used with TLS 1.2.
 2016-07-06 10:52:54 -04:00
David Cooper b6accbe737 Merge branch 'master' into version_negotiation 2016-07-05 10:24:53 -04:00
David Cooper 1102ef324c Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-07-05 10:23:13 -04:00
David Cooper 6ec00c33db Merge branch 'master' into more_sslv2_sslv3_fixes 
Conflicts:
	testssl.sh
 2016-07-05 10:19:53 -04:00
David Cooper 0af62efb4f Merge branch 'master' into version_negotiation 2016-06-29 11:03:45 -04:00
David Cooper a534b8de5f Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-29 11:02:14 -04:00
David Cooper df55d4af51 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-29 09:57:38 -04:00
David Cooper 53dec241f1 Merge branch 'master' into fix_issue_276 2016-06-29 09:56:08 -04:00
David CooperandGitHub be85fbf2b7 Update IE client simulation data 
Change client data for IE 8-10 and IE 11 to match ssllabs.
 2016-06-24 16:14:41 -04:00
David CooperandGitHub 799c6a5fd0 Handle missing $MAPPING_FILE_RFC 
Changed code for run_client_simulation() so that cipher is output when sockets are used even if $MAPPING_FILE_RFC is missing. Also, updated the client data.
 2016-06-24 15:48:40 -04:00
David Cooper b6ccdec614 Merge branch 'master' into version_negotiation 2016-06-24 13:27:35 -04:00
David Cooper 31c3a87a72 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-24 13:26:28 -04:00
David Cooper 0adac7a9a4 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-24 13:24:17 -04:00
David Cooper f2077b7726 Merge branch 'master' into fix_issue_276 2016-06-24 13:23:07 -04:00
David Cooper 0e58e272f8 Merge branch 'master' into client_sim_sockets 
Conflicts:
	testssl.sh
 2016-06-24 13:18:25 -04:00
David Cooper dd8788d670 Merge branch 'master' into fix_issue_276 2016-06-23 09:42:18 -04:00
David Cooper 8c14ba37d6 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-23 09:40:34 -04:00
David Cooper df2904edbf Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-23 09:36:58 -04:00
David Cooper df4edd4152 Merge branch 'master' into version_negotiation 2016-06-23 09:36:06 -04:00
David Cooper bebdc3c70e Merge branch 'master' into client_sim_sockets 2016-06-23 09:24:54 -04:00
David CooperandGitHub b8b779b419 Use sockets for client simulations 
Modify run_client_simulation() to send the ClientHello from https://api.dev.ssllabs.com/api/v3/getClients (modified to use the correct value in the server name extension) if $EXPERIMENTAL is true, $STARTTLS is empty, and $SSL_NATIVE is false.
 2016-06-17 16:33:00 -04:00
David Cooper 1275ce5ed2 Merge branch 'master' into version_negotiation 2016-06-17 16:18:09 -04:00
David Cooper 0a51239cda Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-17 16:17:31 -04:00
David Cooper aeef882476 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-17 16:14:59 -04:00
David Cooper 2b4d10137a Merge branch 'master' into fix_issue_276 2016-06-17 16:14:24 -04:00
David Cooper 34e983c301 Merge branch 'master' into version_negotiation 2016-06-13 16:07:35 -04:00
David Cooper a53ee051f6 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-13 16:07:01 -04:00
David Cooper 4d9e7eef78 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-13 16:05:34 -04:00
David Cooper 5c0368c476 Merge branch 'master' into fix_issue_276 2016-06-13 16:04:10 -04:00
David Cooper b590ecedcf Merge branch 'master' into version_negotiation 2016-06-13 15:03:11 -04:00
David Cooper 321a8bfe57 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-13 15:02:20 -04:00
David Cooper 35deb6a40d Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-13 15:00:52 -04:00
David Cooper 5f120f8021 Merge branch 'fix_issue_276' of https://github.com/dcooper16/testssl.sh into fix_issue_276 2016-06-13 14:57:51 -04:00
David Cooper 3420c86e7f Merge branch 'master' into fix_issue_276 2016-06-13 14:55:55 -04:00
David CooperandGitHub 1d0c8cb3f8 Printing of subjectAltName extension 
Modify the extraction of the subjectAltName extension from certificates in order to address SANs with name forms other than DNS and otherName.
 2016-06-13 12:52:19 -04:00
David CooperandGitHub b264714fd9 Add check of IP address 
compare_server_name_to_cert() now checks the DNS names and IP addresses in the subjectAltName extension for a match.
 2016-06-13 11:09:15 -04:00
David Cooper 0a1c4d565c Merge branch 'master' into fix_issue_276 2016-06-13 10:59:34 -04:00
David Cooper 706db7553f Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-10 15:30:56 -04:00
David Cooper 76ea57863a Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-10 15:29:00 -04:00
David Cooper f84ebd99b5 Merge branch 'master' into fix_issue_276 2016-06-10 15:27:46 -04:00
David Cooper 52d6eabdf7 Merge branch 'master' into version_negotiation 
Conflicts:
	testssl.sh
 2016-06-10 15:26:29 -04:00
David CooperandGitHub 8c86049848 run_cipher_per_proto() 128-cipher limit 
Ensure that neither run_allciphers() nor run_cipher_per_proto() sends a ClientHello with 128 or more cipher suites.
 2016-06-10 13:45:25 -04:00
David Cooper b8348c6454 Merge branch 'master' into version_negotiation 2016-06-09 10:21:49 -04:00
David Cooper bf4134844c Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-09 10:21:09 -04:00
David Cooper c20d2dfc6f Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-09 10:20:20 -04:00
David Cooper 189fe662f5 Merge branch 'master' into fix_issue_276 2016-06-09 10:17:49 -04:00
David Cooper c656015312 Merge branch 'master' into version_negotiation 
Conflicts:
	testssl.sh
 2016-06-09 09:34:37 -04:00
David Cooper d2bded1114 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-09 09:33:05 -04:00
David Cooper aa9eeaf6af Merge branch 'master' into more_sslv2_sslv3_fixes 
Conflicts:
	testssl.sh
 2016-06-09 09:31:46 -04:00
David Cooper a46b6791db Merge branch 'master' into fix_issue_276 2016-06-09 09:29:40 -04:00
David Cooper eb9e2d85a0 Merge branch 'master' into version_negotiation 2016-06-08 13:47:35 -04:00
David Cooper ce9b277b2c Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-08 13:47:01 -04:00
David Cooper 90fcb3500c Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-08 13:45:22 -04:00
David Cooper a224bb5068 Merge branch 'master' into fix_issue_276 2016-06-08 13:44:16 -04:00
David Cooper 4750c3f0d5 Adding x25519 and x448 to ClientHello 
This added x25519 and x448 to the list of supported elliptic curves in the ClientHello created by socksend_tls_clienthello().
 2016-06-08 11:25:47 -04:00
David Cooper 5edd005df0 Merge branch 'master' into version_negotiation 
Conflicts:
	testssl.sh
 2016-06-08 09:52:45 -04:00
David Cooper 130aa350d2 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-08 09:48:18 -04:00
David Cooper cbb20bf661 Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-08 09:46:58 -04:00
David Cooper eaad4c7dd8 Merge branch 'master' into fix_issue_276 2016-06-08 09:46:25 -04:00
David Cooper fa866f6458 Update CREDITS.md 2016-06-07 14:23:33 -04:00
David Cooper ec8420144d Merge branch 'master' into version_negotiation 2016-06-07 10:36:52 -04:00
David Cooper c13ae4a001 Merge branch 'master' into socksend_tls_clienthello_extensions 2016-06-07 10:35:32 -04:00
David Cooper c50f2cc796 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-07 10:33:21 -04:00
David Cooper 366025256b Merge branch 'master' into more_sslv2_sslv3_fixes 
Conflicts:
	testssl.sh
 2016-06-07 10:30:46 -04:00
David Cooper a6d59b5380 Merge branch 'master' into fix_issue_276 2016-06-07 10:24:56 -04:00
David Cooper b1e2fc7448 Merge branch 'master' into version_negotiation 2016-06-02 09:19:37 -04:00
David Cooper e8cc32af54 Merge branch 'master' into socksend_tls_clienthello_extensions 2016-06-02 09:16:45 -04:00
David Cooper f5fcff22d6 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-06-02 09:14:20 -04:00
David Cooper c593675b8e Merge branch 'master' into more_sslv2_sslv3_fixes 2016-06-02 09:09:57 -04:00
David Cooper fc6b5070af Merge branch 'master' into fix_issue_276 2016-06-02 09:08:24 -04:00
David Cooper 6825c0b363 Allow for certificates with no subjectAltName extension 
While it seems that almost all certificates include a subjectAltName extension, need to allow for the possibility that the two certificates being compared don't have subjectAltName extensions.
 2016-06-01 16:20:10 -04:00
David Cooper 3bc0d6b45c Fix issue #276 
Here is my proposed change to fix issue #276.
 2016-06-01 15:57:40 -04:00
David Cooper a9cd3ec6ca Merge branch 'master' into version_negotiation 
Conflicts:
	testssl.sh
 2016-05-31 09:51:13 -04:00
David Cooper 4d059f7106 Merge branch 'master' into version_negotiation 2016-05-25 16:57:37 -04:00
David Cooper acc72a1daf Merge branch 'master' into socksend_tls_clienthello_extensions 2016-05-25 16:50:56 -04:00
David Cooper a503d883c7 Merge branch 'master' into run_allciphers(),run_cipher_per_proto(),-and-SSLv2 2016-05-25 16:38:23 -04:00
David Cooper f9757c4e4d Merge branch 'master' into more_sslv2_sslv3_fixes 2016-05-25 16:32:04 -04:00