Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,298 Commits 16 Branches 39 Tags
e516ba1b9db5b7e19799e2a80ce844e996f313b1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub e516ba1b9d Update ISSUE_TEMPLATE.md 2017-12-04 14:04:41 +01:00
Dirk 4aec5664d5 introducing sentence added 2017-12-04 13:59:12 +01:00
Dirk WetterandGitHub a9e1ca4440 Delete .issue_template 2017-12-04 13:55:52 +01:00
Dirk 3150cfed0e new issue template 2017-12-04 13:54:55 +01:00
Dirk WetterandGitHub 374fb2a85c Create .issue_template 2017-12-04 13:48:37 +01:00
Dirk 62f925a1bc Merge branch '2.9dev' of github.com:drwetter/testssl.sh into 2.9dev 2017-12-01 21:21:22 +01:00
Dirk WetterandGitHub 137f2fa3c3 Merge pull request #920 from dcooper16/client_auth_and_assume_http 
HTTP-related checks and certificate based client authentication
 2017-12-01 21:19:23 +01:00
Dirk WetterandGitHub 9c8fa5419d Merge pull request #917 from dcooper16/check_version 
Compare selected version against supported_versions
 2017-12-01 21:03:52 +01:00
Dirk dda07cd1d0 commenting #918 2017-12-01 21:02:03 +01:00
Dirk WetterandGitHub 4be759afea Merge pull request #918 from sdann/mysql_read_timeout 
Reduce read timeout for MySQL back to 1 second
 2017-12-01 20:54:37 +01:00
Dirk 99d12434dd fix strip_*_space() 2017-12-01 20:09:16 +01:00
Dirk 851030ea8f Fixes in headers 
- double word match: Content-Security-Policy matched also X-Content-Security-Policy
- X-UA-Compatible always appeared twice
 2017-12-01 13:31:43 +01:00
Dirk 1b7e6630d7 Extending OPTIMAL_PROTO tests with TLS 1.3 
It partly addresses #915, supposedly the openssl binary used supports
TLS 1.3 (and the correct draft/final).

It also reduces handshakes by not trying protocols which aren't supported
on the client side.
 2017-11-30 16:07:51 +01:00
Dirk WetterandGitHub f9d8d4df7b Merge pull request #912 from dcooper16/draft22 
Support TLSv1.3 draft 22
 2017-11-30 09:55:16 +01:00
Dirk WetterandGitHub affc9d6bb6 Merge pull request #909 from dcooper16/remove_extra_spaces 
Remove extra spaces
 2017-11-29 19:39:54 +01:00
Dirk WetterandGitHub 34f4a8cb4f Merge pull request #910 from dcooper16/hrr_socket 
Don't open new socket for second ClientHello
 2017-11-29 19:39:15 +01:00
Dirk f61b701f5a recognise TLS alert as a sign that SSLv2 is not supported 
Revert the exception from previous commit 20b38d5aa6
that TLS alerts on SSLv2 client hello won't be a proper reply -- due to a reality check,
see #908.

In order to have better debugging info the TLS alert message is printed
in clear. Messages code and text assignements was moveed to a separate
function.
 2017-11-29 11:43:35 +01:00
Dirk ece1d868c4 change wording and color for not valid SSLv2 server hello 2017-11-28 10:03:49 +01:00
Dirk 20b38d5aa6 Make SSLv2 parsing more robust 2017-11-27 21:55:17 +01:00
Dirk WetterandGitHub 0633ca595d Merge pull request #904 from dcooper16/negotiated_proto_and_cipher 
Add TLSv1.3 support for negotiated protocol and cipher
 2017-11-27 12:42:29 +01:00
Dirk d840209b2b don't run as root 2017-11-25 18:19:52 +01:00
Dirk 0896c901db fix problem with servers which return gzip encoded body 
Some servers like the one from the satire magazine "focus.de"
choose to return gzip encoded body during run_http_haders().
This has led sometimes to misintepretation that an IPv4 address
is present in the header.

This commit fixes that by telling the server not to want a gzipped
response and if still returned grep properly the return.
 2017-11-25 17:55:55 +01:00
Dirk 47409a32d6 delayed commit for file prefix 
Also added David
 2017-11-24 23:13:38 +01:00
Dirk d1e7498458 Increase STARTTLS_SLEEP for lame servers 
.. as otherwise the connection will be tore down too early.
It doens't cost anything for faster servers as it is the max
time to wait.
 2017-11-24 22:55:13 +01:00
Dirk f2b37c767d Remove output of ticketbleed for STARTTLS 2017-11-24 22:43:35 +01:00
Dirk e9aaae0d46 remove any spdy + alpn output for STARTTLS 
... as it's being done all other places
 2017-11-24 22:39:18 +01:00
Dirk 9fe02e45fa Add robustness to STARTTLS+sockets 
When testing servers which fall back after succeeding the STARTTLS handshake
to the underlying protocol (smtp, ftp etc.) there was often misleading output
=not available instead of notifying the user that there's a problem.

Now it is being tested in parse*serverhello() functions whether the first
by resembles a 5XX code and STARTTLS is supposed to be tested and then
passes an error code back to the caller , i.e. tls_sockets() and then
run_protocols(). Also other error code after the handshake are passed
better.

This is only an addition to the top level function run_protocols().
We might want to look into other top level functions too
 2017-11-24 19:28:55 +01:00
Dirk ad97b6fc4e Polish screen output "protos" not offered 
In scenarios where --ssl-native was chosen AND the
openssl binary wasn't supporting the protocol
there were two warnings. This has been addressed.

Also tls_sockets() can return different values -- for now: 6 -- as
tested by the caller in run_protocols. In order to make
it more robust a fixme statement was added so that the
user becomes iat least aware of it.
 2017-11-24 16:21:06 +01:00
Dirk 778a7cc12d Fix change of warning logic (no protos offered) 
After changing the logic from $PROTOS_OFFERED
contaning each protocol detected to $PROTOS_OFFERED
contaning each protocol + colon yes or no there
wasn't a change for the sanity check that no protocols
are offered. This fixes it.
 2017-11-24 15:15:50 +01:00
Dirk WetterandGitHub e0a5050553 Merge pull request #903 from dcooper16/fix_901 
Fix #901
 2017-11-21 15:36:18 +01:00
Dirk 77fc111b13 put new socksend() into production 
FIX #902.

Performance improvements LAN (just one shot):

```
	58 / 50
	52 / 44
	53 / 47
	143 / 137
	63 / 53
	48 / 43
```

WAN:

```
	89 / 77
	88/ 67
	234 / 231
	67 / 63
	84 / 81

```
 2017-11-20 16:33:40 +01:00
Dirk 209b21c817 fix travis in cce48a34d0 2017-11-19 23:13:33 +01:00
Dirk cce48a34d0 New socksend(), json flat: scan time 
There's a new socksend() function which gives up to 8% performance
benefit (LAN) as is saves 3 sed and 1 tr command in every socksend call.
It has not been put in production yet as it shows a problem in ticketbleed
check and it is late and I call it a day ;-) and resolve that later (see #902).

For performance tests it's quite handy to also have in the flat json format
a footer with time consumed for each run. fileout_json_footer() was
patched accordingly.
 2017-11-19 20:44:06 +01:00
Dirk WetterandGitHub 9949be750d Merge pull request #900 from dcooper16/fix_heartbleed 
Fix run_heartbleed()
 2017-11-19 18:27:03 +01:00
Dirk fd4e5469fe changed output in CAA and OCSP stapling 
... from "--" to "not offered". Reason: e.g. on a white
terminal background it is hard to detect that there's
an output. Also "not offered" is more consistent with
the value of protocol checks.
 2017-11-19 17:11:22 +01:00
Dirk f20ce1a0f8 replace old school grep/sed/sort in certificate_info() 2017-11-19 17:02:24 +01:00
Dirk 5854607d60 label:experimental 2017-11-19 16:48:05 +01:00
Dirk fb3aa6ad7f fix for filename output beginnng with . 
There was an error in e450eb34e4
which addressed #846 which lead to the problem that an output filename
could start with a "." if no FNAME_PREFiX and if just --html, --csv
or --log or --json* was supplied.

This commit fixes the problem.
 2017-11-17 22:09:56 +01:00
Dirk 98f4f28017 FIX #898 
fix escaping of debugging output.  credits to @dcooper16
 2017-11-17 20:56:18 +01:00
Dirk WetterandGitHub 52809d0800 Merge pull request #899 from dcooper16/yet_another_ossl111_fix 
Yet another fix for OpenSSL 1.1.1
 2017-11-17 20:21:28 +01:00
Dirk c7a0de1280 fixed missing ps 
and removed additional packages for dns clients
 2017-11-16 21:16:06 +01:00
Dirk 54b9119162 FIX #897 2017-11-16 01:07:26 +01:00
Dirk 7ec0d7ffb7 Polish #846, correct level for OCSP and GOST 2017-11-14 20:50:14 +01:00
Dirk e450eb34e4 FIX #846 -- add output filename prefix 
This commit adds the possibility to supply a output
file name prefix via --outprefix or FNAME_PREFIX
 2017-11-14 19:41:25 +01:00
Dirk WetterandGitHub 1a7b761f5b Merge pull request #688 from dr4y/2.9dev 
Dockerfile for testssl.sh
 2017-11-14 17:39:43 +01:00
Dirk 6ce2a98637 updated 
with TLS 1.3 and forgotten improvements so far.
Add interesting projekt privacyscore.
 2017-11-14 13:52:13 +01:00
Dirk 2379af5a5f Rearranged credits 
David needs really really to come first.
The remaining contributors now in alphabtical order
 2017-11-14 13:49:27 +01:00
Dirk WetterandGitHub ea86884e05 Merge pull request #895 from dcooper16/heartbleed_tls_sockets 
Use tls_sockets() for run_heartbleed()
 2017-11-13 16:20:47 +01:00
Dirk WetterandGitHub db9000a955 Merge pull request #894 from dcooper16/fix_std_cipherlists_false_positives 
Fix false positive in std_cipherlists()
 2017-11-08 08:46:30 +01:00
Dirk WetterandGitHub 3c427c31a0 Remove Matt's pointer to the image 
... until it is more up to date
 2017-11-06 21:56:06 +01:00
Dirk 5bd8cb08ba fix #892 (trailing dot in supplied hostname) 
... and do minor updates to do bash internal functions in ``parse_hn_port()``
 2017-11-05 22:41:11 +01:00
Dirk 000f957646 minor changes on TLS 1.3 protocol tests (see #890) 2017-11-05 20:30:18 +01:00
Dirk WetterandGitHub b613f3fcf0 Merge pull request #889 from dcooper16/run_pfs_tls13 
Add TLSv1.3 support for run_pfs()
 2017-11-05 14:40:06 +01:00
Dirk WetterandGitHub a9c0804749 Merge pull request #890 from dcooper16/run_protocols_tls13 
Add TLSv1.3 support for run_protocols()
 2017-11-05 14:39:40 +01:00
Dirk 9daec2a515 Add "auto" keyword to -oA/-oa (FIX #887) 
File names are now auto-generated by using "-oA auto" / -oa "auto"
--similar to --csv and friends.

Also the formerly hidden switches --outFile and --outfile were added in the
help and in the manual.
 2017-11-01 09:58:52 +01:00
Dirk 9b7000e87e Final check to make sure fileout and pr*warning correlates 
Made sure that if fileout has a WARN or DEBUG flag it is
consistent with pr*warning. FIX #518
 2017-10-31 12:23:16 +01:00
Dirk 2aeabd19b2 Better clarification on bit size and encryption strength 
Fix #770
 2017-10-31 12:00:09 +01:00
Dirk 278202ace9 FIX #848 -- determine tls date only when instructed 
Former code implied a determination of the TLS time in
every call of tls_sockets() despite the fact that the
value is only needed at one point in the run.

This removes this behaviour by introducing another global
boolean switch TLS_DIFFTIME_SET which determines whether
the additional cost will be paid or not.

The gain in execution time is a bit meager though. At
most it seems it's 1-3 seconds.
 2017-10-31 11:27:19 +01:00
Dirk dca4da4736 FIX #884, FIX #885 
For servers with client authentication one would need to supply a x509
certificate to check session resumption by ID or ticket. This is not (yet?)
supported in testssl.sh.

This commit fixes the misleading error message so that it is clear what the
problem is.
 2017-10-30 18:41:19 +01:00
Dirk WetterandGitHub bec17e1ad6 Merge pull request #886 from dcooper16/Expect_CT_header 
Add check for the Expect-CT header
 2017-10-30 17:08:41 +01:00
Dirk WetterandGitHub b9723424e7 Merge pull request #882 from dcooper16/suppress_config_file_warn 
Suppress more config file warnings
 2017-10-30 08:41:55 +01:00
Dirk WetterandGitHub fd9ee18ab5 Merge pull request #883 from dcooper16/run_cipher_match_tls13 
Add TLSv1.3 support for run_cipher_match()
 2017-10-27 23:58:28 +02:00
Dirk WetterandGitHub a0fc34763f Merge pull request #881 from dcooper16/libressl_enc_names 
Fix problem with LibreSSL encryption names
 2017-10-27 17:55:15 +02:00
Dirk WetterandGitHub 884fa3ffed Merge pull request #879 from dcooper16/use_helper_function 
Use read_sigalg_from_file() helper function
 2017-10-27 17:13:26 +02:00
Dirk a85ca3c250 FIX #765 
Inconsistency in using optional and mandatory parameters in help and man page
 2017-10-26 11:46:14 +02:00
Dirk 4e70ac6ad5 FIX #870 = testssl.sh -v/-b picks up wrong openssl binary 2017-10-22 23:41:17 +02:00
Dirk WetterandGitHub f88e3d89f1 Merge pull request #826 from dcooper16/fix772 
Complete fix of #772
 2017-10-22 23:28:16 +02:00
Dirk WetterandGitHub b16a86cf46 Merge pull request #827 from dcooper16/OpenSSL_111_fix 
Another fix for OpenSSL 1.1.1
 2017-10-22 23:27:50 +02:00
Dirk WetterandGitHub 90eb1f128c Merge pull request #873 from tomwassenberg/comment-fix 
Correct small inconsistency in code comment
 2017-10-21 11:49:08 +02:00
Dirk e3b254d0a1 FIX #869 2017-10-20 19:58:20 +02:00
Dirk WetterandGitHub f212b609ab Merge pull request #867 from dcooper16/tls13_for_run_allciphers 
Add TLSv1.3 support for run_allciphers()
 2017-10-20 18:12:02 +02:00
Dirk WetterandGitHub d65566921f Merge pull request #868 from dcooper16/tls13_for_run_server_preference 
Add TLSv1.3 support for run_server_preference()
 2017-10-20 18:09:17 +02:00
Dirk 50fa1e74bd Merge branch '2.9dev' of github.com:drwetter/testssl.sh into 2.9dev 2017-10-20 16:45:59 +02:00
Dirk d3795f1254 Add output options similar to nmap (FIX #861) 2017-10-20 16:32:57 +02:00
Dirk WetterandGitHub d83f310baf Merge pull request #872 from dcooper16/fix_871 
Fix #871
 2017-10-20 15:42:16 +02:00
Dirk 52e02d9d43 CAA work 
This fixes #865 and improves #588. All CAA records are now shown,
also with old DNS binaries.
 2017-10-18 18:43:54 +02:00
Dirk 4b187d6253 fix travis error in 8ceb1b5 2017-10-18 17:13:05 +02:00
Dirk 8ceb1b5ad8 use bash internal functions for #864 2017-10-18 15:25:43 +02:00
Dirk WetterandGitHub 76248493a0 Merge pull request #863 from dcooper16/run_server_preference_ssl3_bugfix 
run_server_preference() bug fix
 2017-10-18 13:42:54 +02:00
Dirk WetterandGitHub 5b6344f6fb Merge pull request #864 from seccubus/recursive_caa 
Make CAA record lookups resolve the entire DNS tree (Fixes #862)
 2017-10-18 13:42:02 +02:00
Dirk WetterandGitHub 4adc96b2f7 Merge pull request #856 from dcooper16/run_cipher_per_proto_tls13 
Add TLSv1.3 support to run_cipher_per_proto()
 2017-10-14 09:21:09 +02:00
Dirk WetterandGitHub ac3ff349c9 Merge pull request #859 from dcooper16/rc4 
run_rc4() and #660
 2017-10-14 09:17:19 +02:00
Dirk WetterandGitHub cd4009fed9 Merge pull request #854 from dcooper16/tls13_run_std_cipherlists 
Add TLSv1.3 support for run_std_cipherlists()
 2017-10-14 09:15:16 +02:00
Dirk WetterandGitHub 22fd594334 Merge pull request #857 from dcooper16/use_bash_internal 
Use bash internal functions
 2017-10-12 11:34:20 +02:00
Dirk WetterandGitHub 2129af0537 Merge pull request #858 from dcooper16/sweet32 
Fix #660 for run_sweet32()
 2017-10-12 10:24:34 +02:00
Dirk WetterandGitHub 430917d59f Merge pull request #855 from dcooper16/use_bash_string_manipulation 
Use bash internal functions
 2017-10-11 17:28:17 +02:00
Dirk WetterandGitHub 38b2089c49 Merge pull request #853 from dcooper16/no_sock_reply_file 
Don't maintain SOCK_REPLY_FILE in non-debug mode
 2017-10-11 14:49:10 +02:00
Dirk 6bd1c26a14 FIX #851 2017-10-10 19:54:36 +02:00
Dirk WetterandGitHub 49fcb0d724 Merge pull request #850 from dcooper16/fix_typo 
Fix typo
 2017-10-10 17:28:25 +02:00
Dirk 785e94912d replace grep -q by internal bash operator 
and provide the alias SETX for DEBUG_ALLINONE
 2017-10-09 15:13:46 +02:00
Dirk WetterandGitHub 985c21dfb7 Merge pull request #844 from dcooper16/has_server_protocol_fixes 
has_server_protocol() fixes
 2017-10-09 15:09:17 +02:00
Dirk WetterandGitHub 1758d18672 Merge pull request #842 from dcooper16/tls13_part1 
Initial support for TLSv1.3
 2017-10-09 14:53:32 +02:00
Dirk 6f896a057b add missing \n for html output 2017-10-08 22:03:29 +02:00
Dirk e8e4609495 function safe_echo 
In order to santize input better there's a fucntion
now which does the work . ``safe_echo()``.

It is actually the same as ``tml_out()`` but is a bit snappier.
 2017-10-08 21:40:28 +02:00
Dirk WetterandGitHub 833f724689 Merge pull request #843 from dcooper16/client_sim_data_error 
Fix incorrect client simulation data
 2017-10-04 13:05:32 +02:00
Dirk WetterandGitHub f1efe6b7ba Merge pull request #833 from dcooper16/no_ossl_config 
Suppress config file warning
 2017-10-03 11:14:52 +02:00
Dirk d5e03299e5 Merge branch '2.9dev' of github.com:drwetter/testssl.sh into 2.9dev 2017-10-02 15:19:40 +02:00
Dirk 12c47d1912 FIX #401, first part 2017-10-02 15:18:31 +02:00
Dirk 5b294618c0 first part of #371 2017-10-02 15:11:58 +02:00
Dirk 59d4a9fa65 fix borken conflict resolving editing 2017-10-02 14:58:30 +02:00