Commit Graph

2958 Commits

Author SHA1 Message Date
Dirk Wetter ddd9d76d3b try to fix travis 2019-08-09 21:08:48 +02:00
Dirk Wetter 251071081e
Merge pull request #1305 from drwetter/renego_fixes
Add CVE for Secure Client-Initiated Renegotiation vulnerability
2019-08-09 19:46:51 +02:00
Dirk Wetter fc1206cfea Add CVE for Secure Client-Initiated Renegotiation vulnerability 2019-08-09 19:44:03 +02:00
Dirk Wetter 5fed82f4c2
Merge pull request #1304 from drwetter/renego_fixes
Fix misleading CVE in Secure Renegotiation
2019-08-09 19:38:56 +02:00
Dirk Wetter 95a7b70765 Fix misleading CVE in Secure Renegotiation
For some reason CVE-2009-3555 ended up in Secure Renegotiation,
whereas CVE-2009-3555 is in fact the Insecure Client-Side Renegotiation
vulnerability with the MiTM problem <= OpenSSl 0.9.8k.

This fixes that (see also #1086 and #933, #907) by removing the CVE #
from the output. Also tyhe output was changed for Secure Renegotiation
into supported/not vulnerable vs. Not supported / VULNERABLE

Some comments were added.
2019-08-09 19:35:11 +02:00
Dirk Wetter e25a80263f ignore perl version for travis 2019-08-08 21:19:43 +02:00
Dirk Wetter f3230a870c
Merge pull request #1303 from drwetter/contributing
Fix stale links
2019-08-08 21:11:28 +02:00
Dirk Wetter 3a1025f886 Fix stale links 2019-08-08 21:10:07 +02:00
Dirk 65e5d58793 Fix travis 2019-08-08 20:59:13 +02:00
Dirk Wetter 49fc218424
Merge pull request #1302 from drwetter/contributing
Add CONTRIBUTING.md, docker changes in Readme.md
2019-08-08 18:36:11 +02:00
Dirk Wetter 642cfe46dd Add CONTRIBUTING.md, docker changes in Readme.md
.. also reviewed https://github.com/drwetter/testssl.sh/wiki/Coding-Style
2019-08-08 18:34:14 +02:00
Dirk Wetter 7468776656
Merge pull request #1299 from drwetter/psql_mysql_fix 2019-08-06 20:13:15 +02:00
Dirk Wetter 42f2b83a92 Improvements for MySQL via STARTTLS
* labeling is just "experimental"
* use similar functions as in psql
* faster
2019-08-06 20:04:19 +02:00
Dirk Wetter 75a0f14bff Fix message 'tr : command not found' when debugging in determine_sizelimitbug() 2019-08-06 19:06:23 +02:00
Dirk Wetter 206c80aed5 Fix for STARTTLS+socket of postgresql
As noted in #1249 STARTTLS with sockets doesn't
work.

This commit fixes that by correcting the STARTTLS
handshake for postgresql. It has to be send via
sockets instead of echo. The server side then will
respond with "S" when STARTTLS is supported. For this
starttls_io() was slightly modified so that also
an input (from the server perspective) is not necessary.

It's fast too
2019-08-06 18:49:31 +02:00
Dirk Wetter 00d39693f3
Merge pull request #1295 from pihug12/3.0
Fix "make-openssl111.sh"
2019-07-10 10:15:44 +02:00
pihug12 dbacbe7912 Fix "make-openssl111.sh" 2019-07-10 08:54:55 +02:00
Dirk Wetter f405991b8c
Merge pull request #1293 from drwetter/alpha_unittest_self
Enable more tests, change to newer JSON scheme
2019-07-09 22:51:51 +02:00
Dirk c335ded6d3 Enable more tests, change to newer JSON scheme 2019-07-09 22:49:12 +02:00
Dirk Wetter eef63b1726
Merge pull request #1289 from drwetter/tput_sgr_fix
Fix terminal codes / tput
2019-07-03 11:54:56 +02:00
Dirk Wetter af6f232790 Fix terminal codes / tput
As noted in #1288 with some terminal settings under Linux there
appeared some ~garbage on the screen.

This fixes that by partly reverting 695d02157a .
At least now and under an older OpenBSD like 6.2 this doesn't seem
to be necessary.
2019-07-03 11:47:54 +02:00
Dirk Wetter 3d5982e60b
Merge pull request #1285 from dcooper16/fix_color_comparison_typo
Fix typo in check of $COLOR
2019-06-25 09:08:28 +02:00
David Cooper 2a141ab0f4
Fix typo in check of $COLOR
In emphasize_stuff_in_headers() there is a check of the $COLOR value, which checks whether $COLOR is 2. It should check whether $COLOR is 2 or higher.
2019-06-24 14:49:20 -04:00
Dirk Wetter a4d34b0cff
Merge pull request #1283 from drwetter/etls_comment
"eTLS" ~> ETS
2019-06-17 10:26:36 +02:00
Dirk f1eb2b89b9 "eTLS" -> ETS
Decription was added with the (future) ETSI name ETS [1]. Also
added as a comment MITRE's CVE data using ETS, amended with NIST's
entry in NVD

[1] EFF's interpretation: extra terrible security
   https://www.eff.org/deeplinks/2019/02/ets-isnt-tls-and-you-shouldnt-use-it
2019-06-17 10:01:05 +02:00
Dirk Wetter 6e4abbf33a
Merge pull request #1282 from drwetter/1279_related
Added HAS_ZLIB in run_crime(), declaration of CERT_COMPRESSION fixed
2019-06-12 21:16:22 +02:00
Dirk 7a1fb0b3b9 Added HAS_ZLIB in run_crime(), declaration of CERT_COMPRESSION fixed
CERT_COMPRESSION was declared always with fast in ... so that the variable
was always false. This PR fixes that. In addition a informational line
that the new TLS extension has been added (if $DEBUG >3).

Also determine_optimal_proto() is not being run if devel mode
($do_tls_sockets) is enabled.

Furthermore as David added HAS_ZLIB as a global run_crime() now makes
use of it too.
2019-06-12 21:05:43 +02:00
Dirk Wetter 53ecacfcbb
Merge pull request #1281 from drwetter/SNI_STARTTLS_polish_pwnedkeys
* SNI STARTTLS
* minor polish for pwned keys and devel option certificate compression
2019-06-12 15:59:06 +02:00
Dirk Wetter b2bf5b72bd Add SNI/STARTTLS, pwnedkeys 2019-06-12 15:41:07 +02:00
Dirk Wetter 912cd906d2 SNI STARTTLS, minor polish
This PR addresses #316 and #1280: it implements server name indication
also for STARTTLS which has been supported by a number of server
implemantations, in the meantime.

Also it does a final polish to David's pwnedkeys PR #1274 a while back:
UI improvement and detection of network problems.

In addition to PR #1279 it introduces a env variable to devel
mode so that "CERT_COMPRESSION=true ./testssl.sh --devel <params> <target>"
can be used to explore certificate compression on a host.
2019-06-12 14:36:46 +02:00
Dirk Wetter 11add0d4ae
Merge pull request #1279 from dcooper16/compressed_certs
Initial support for certificate compression
2019-06-07 21:33:36 +02:00
David Cooper e2042e99d6 Initial support for certificate compression
draft-ietf-tls-certificate-compression specifies a new TLS extension that allows a client to indicate support for receiving the server's certificates in compressed form. This PR adds initial support for that extension to testssl.sh. It was developed based on an announcement that facebook.com has implemented support for the extension.

This PR does not add a test for a server's support for the new extension, it just adds code to parse_tls_serverhello() that will parse a compressed certificate message if one is present in the server's response. So, in practice, the code in this PR will not actually be used until additional code has been added that sends a ClientHello with the compress_certificate extension.

The code in this PR can be tested by using the --devel option and by changing line 19347 from

     tls_sockets "$TLS_LOW_BYTE" "$HEX_CIPHER" "ephemeralkey"

to

     tls_sockets "$TLS_LOW_BYTE" "$HEX_CIPHER" "all+" "00,1b, 00,03, 02, 00,01"

testssl.sh can then be called using

     testssl.sh --debug 3 --devel 04 "13,01" facebook.com

Note that this PR adds a test for zlib support to find_openssl_binary(). The test uses $OPENSSL zlib in the same way it is used in parse_tls_serverhello(). The test asks $OPENSSL zlib to uncompress the compressed version of the string "zlib" and the checks to see whether the decompression was performed correctly. There is already a test for zlib support in run_crime(), but I did not check to see whether the check in run_crime() could be replaced with a check of the new $HAS_ZLIB variable.
2019-06-06 12:17:32 -04:00
Dirk Wetter 91e98f1fc3
Merge pull request #1274 from dcooper16/pwnedkeys
Check pwnedkeys.com database
2019-05-23 10:45:57 +02:00
David Cooper 0d2b955e21
Check pwnedkeys.com database
This PR adds a check of whether the server's public key appears in the https://pwnedkeys.com database.
2019-05-22 10:11:34 -04:00
Dirk Wetter d6fb232152
Merge pull request #1271 from drwetter/depr_clients
Depreciation of more clients
2019-05-08 23:18:03 +02:00
Dirk d5f90218d1 Deprecation of more clients
* Tor 17
* Android 4.2.2
* IE 7 Vista
2019-05-08 23:12:45 +02:00
Dirk Wetter 0c750c212c
Merge pull request #1270 from drwetter/ubuntu2openjdk
Change the platform for Java from Ubuntu to OpenJDK
2019-05-07 19:43:58 +02:00
Dirk Wetter 7238a0167a Change the platform for Java from Ubuntu to OpenJDK 2019-05-07 19:39:20 +02:00
Dirk Wetter 174f4ee527
Merge pull request #1268 from csett86/safari-macos
Add Safari 12.1 on macOS 10.13.6
2019-05-07 19:35:09 +02:00
Dirk Wetter 9273661779
Merge pull request #1269 from csett86/deprecate-java9
Deprecate Java 9, its EOL since March 2018
2019-05-07 08:02:44 +02:00
Christoph Settgast c41b1f0055 Revert diff noise at end of file 2019-05-06 21:35:58 +02:00
Christoph Settgast fa77a9c80e Deprecate Java 9, its EOL since March 2018
No current distro (Ubuntu, Debian, Fedora) is still shipping it,
Oracle has EOLed it in March 2018 according to

https://www.oracle.com/technetwork/java/java-se-support-roadmap.html
2019-05-06 21:26:30 +02:00
Christoph Settgast a17f45b563 Add Safari 12.1 on macOS 10.13.6
manually wiresharked
2019-05-06 21:19:46 +02:00
Dirk Wetter 1ccc8bdcb8
Merge pull request #1263 from csett86/java
Add Java 11 and 12 client simulations
2019-05-06 19:40:33 +02:00
Dirk Wetter 4cae781d98
Merge pull request #1267 from drwetter/hexstream2cipher_fix
Don't include SSLv2 ciphers in hexstream2cipher.sh
2019-05-06 19:37:44 +02:00
Dirk 13d3b7329b Don't include SSLv2 ciphers in hexstream2cipher.sh 2019-05-06 19:35:12 +02:00
Christoph Settgast 8c8a626b49 Remove erroneous DES-CBC-MD5 from Java 11 and 12
DES-CBC-MD5 was included by utils/hexstream2cipher.sh,
heres the relevant snippet, line 160:

148: c025 --> 0xc0,0x25 --> ECDH-ECDSA-AES128-SHA256
152: c029 --> 0xc0,0x29 --> ECDH-RSA-AES128-SHA256
156: 0067 --> 0x00,0x67 --> DHE-RSA-AES128-SHA256
160: 0040 --> 0x00,0x40 --> DHE-DSS-AES128-SHA256 DES-CBC-MD5
164: c009 --> 0xc0,0x09 --> ECDHE-ECDSA-AES128-SHA
168: c013 --> 0xc0,0x13 --> ECDHE-RSA-AES128-SHA
172: 002f --> 0x00,0x2f --> AES128-SHA
176: c004 --> 0xc0,0x04 --> ECDH-ECDSA-AES128-SHA

Unfortunately I don't know how to fix utils/hexstream2cipher.sh,
but I have manually removed the erroneous cipher and space from
the client-sim.
2019-05-06 18:07:43 +02:00
Dirk Wetter 29a74713ee
Merge pull request #1266 from drwetter/more_unittests1
t/25_baseline_starttls in line with the new scheme now
2019-05-06 14:08:54 +02:00
Dirk Wetter 33ece6858d In line with the new scheme now 2019-05-06 14:07:08 +02:00
Dirk Wetter c5d76fec27
Merge pull request #1265 from drwetter/more_unittests1
Another (minor) step forwad for unit tests
2019-05-06 11:22:42 +02:00