Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-01-10 10:40:57 +01:00
Code Issues Packages Projects Releases Wiki Activity
398 Commits 15 Branches 30 Tags 212 MiB
eb49c37718
Commit Graph

211 Commits

Author SHA1 Message Date
Dirk Wetter
eb49c37718 * EXPERIMETAL=yes is used, testssl.sh uses for protocols, heartbleed, ccs sockets also for STARTTLS! 
* it's slow though (to be improved)
* renamed vars for proxy
* cleanups
 2015-07-07 22:59:31 +02:00
Dirk Wetter
b742c54358 * NEW: xmpphost support 
* FIX for regression (80e26a75ef), config file GOST
 2015-07-06 20:42:43 +02:00
Dirk Wetter
c08baa94b3 * CHANGE: some tuning variable are now booleans (see help) 
* help() to reflect this
* cleanups
 2015-07-06 10:10:46 +02:00
Dirk
80e26a75ef * Warning if LibreSSL is used #126 
* FIX for screwed up output for fixed ciphers (FREAK, LOGJAM), see also #126
* GOST support now doesn't complain if MY confif file aleady exists (minor fix)
 2015-07-02 16:39:41 +02:00
Dirk
5acfc93d79 * couple of checks for new proxy option from John Newbigin #124 
* minor cleanups for #124
 2015-06-29 23:28:37 +02:00
Dirk
ddd680ac93 * merge #124 from jnewbigin 
* fix my run time error
 2015-06-29 22:29:15 +02:00
Dirk
15a672b521 * assertion vs. condition fixed 2015-06-29 10:41:56 +02:00
Dirk
93f5b8216d * FIX #125 
* beautified some code / function names
 2015-06-28 13:52:42 +02:00
Dirk
5d78c9421f * first tls_low_byte is now always 01 in TLS 1.0 --> TLS 1.2 (see openssl) 
* removing TLS 1.2 check from sockets as IIS has a problem with it
 2015-06-24 11:08:09 +02:00
Dirk
e121f944e9 * FIX: added missed downgrade (ret=2) in socket protcol check 
* resorted helper functions to top
* cleanups (ok, renamed some functions)
 2015-06-23 21:54:47 +02:00
Dirk
b575710634 * FIX in --ip=one 
* straighthen help()
* FIX ret value for no response in parse_tls_serverhello
 2015-06-23 12:58:40 +02:00
Dirk
ae8f998f8f * help corrected, -e is standard 2015-06-23 07:56:56 +02:00
Dirk
a6c5a2af0d * handshake works now with SNI 2015-06-22 23:19:08 +02:00
Dirk
d3c793e6bc * help without <> now and | 
* socket SNI issue: As it turns out Apache 2.2/2.4 is not behaving according to https://tools.ietf.org/html/rfc6066#section-3
   .
 2015-06-22 18:32:40 +02:00
Dirk
58a6f501b5 - better addressed no clear fallback repsonses, see #121 2015-06-20 19:36:11 +02:00
Dirk
633cdc209b - NEW: IP address detection now in HTTP header 
- NEW: Varnish and Squid header detected
- NEW: option --ip=one is a shortcut and means just test the first ip
- CSP Report-Only in security headers
- New: Varnish and Squid header detected, OWA header
- all single tests in bold now
- no support for TLS 1.2 spits out "NOT ok" as it is not ok
- Medium ciphers and DES ciphers are not having aNULL and aDH ciphers anymore and have different colors --> ratings
- http-date is now in http header(), tls_time in server_defaults()
- http header reply is indented to same row as server defaults
- http status code is displayed clearly now
- BUGFIX: IPv6 address wasn't displayed
- cleanup
- application banner now in two lines if needed
- try a second time to get a http header if first one fails
- fix: case where % sign in ip address made prinf hiccup (sanitized)
- fix: $url was in some functions empty
- fixed bug where some headers were displayed twice
 2015-06-19 20:36:32 +02:00
Dirk
59299ce9e1 - FIX #119 (sed -E fails for old sed versions) 
- std_cipherlists tuned
- fix for selfsigned certs (missed sometimes because of trailing space)
 2015-06-17 11:33:29 +02:00
Dirk
06899f3cbf - introduced Reverse Proxy header 
- FIX for OWA header
- beautfied some header funcs
- fixed GET_REQ1?/HEAD_REQ1?
 2015-06-16 23:00:47 +02:00
Dirk
478b8afac7 FIX: bail out better if $NODE doesn't resolve 
cipher lists now wth plural ending
added Liferay-Portal + X-OWA-Version for application banner
new http_header (still leaving old one in)
readability improvements
 2015-06-16 19:53:40 +02:00
Dirk
e16ccd06b6 - testing all IP addresses of a node works now (refactoring of parse_hn_port into three functions) FIX #96 
- SNI is unset if STARTTLS is set
- some BSD fixes (sed)
 2015-06-16 14:04:44 +02:00
Dirk
4432faf497 "--ip" works now (see help) 
little cleanups
 2015-06-15 12:13:16 +02:00
Dirk
a98b67013a FIX #116 
CRIME is lightred/litegreen as it is not that bad as ccs or heartbleed
 resorted some functions
 2015-06-11 21:41:25 +02:00
Dirk
bdff6ba1bd - TLS_FALLBACK* was missing in the help #22 #118 2015-06-11 18:46:22 +02:00
Dirk
f9e4526f70 - polish of #118 
- FIX #22
 2015-06-11 18:33:06 +02:00
JonnyHightower
dc548f1cfc Added check for TLS_FALLBACK_SCSV support in local OpenSSL binary. 
In TLS_FALLBACK_SCSV check, added unique socket address to temporary
file name in order to support multiple simultaneous instances.
 2015-06-10 17:38:39 +01:00
JonnyHightower
0e36255fb9 Added a check for TLS_FALLBACK_SCSV 2015-06-08 17:19:34 +01:00
Dirk
0f5c4981cb - more or less desperate try to figure out the real installation path (and find the mapping file) 
- help extended (equal sign, logjam)
 2015-06-02 22:13:19 +02:00
Dirk
4081b2eef4 - wrong arg for dirname ($1) 2015-06-02 15:59:17 +02:00
Dirk
06c3b06a7a - regression fix on mapping file 2015-06-02 15:53:46 +02:00
Peter Mosmans
8e4970c408 Minor textual fix (added space) 2015-06-01 14:16:31 +02:00
Dirk
cac985967f - first prototype for using = in cmdline, see #108. Tests needed 
- beautified big case loop
 2015-06-01 12:01:38 +02:00
Dirk
452fd6762a - local dns matches don't need lookup anymore over net --> saves timeouts+time 
- further banner tuning + funtion mybanner, 2 addtl global vars for debugging
- cosmetic improvements
 2015-05-31 14:40:12 +02:00
Dirk
77ad7c9252 - the outsticking part was kind of not handy, see #113, remove commit message 2015-05-30 11:36:47 +02:00
Peter Mosmans
764f20dbcf FIX: Show version when specified on command line 
ADDITION: Show git commit information, to support troubleshooting.
 2015-05-30 11:13:57 +02:00
António Meireles
faa9c49a2b fix spelling typos. 
Signed-off-by: António Meireles <antonio.meireles@reformi.st>
 2015-05-29 18:56:57 +01:00
António Meireles
4064332234 trim all whitespace at EOL. 
also, align comment blocks for better code readability.

Signed-off-by: António Meireles <antonio.meireles@reformi.st>
 2015-05-29 18:44:32 +01:00
Dirk
9b2b897a43 - make date even more beautiful, see #110 
- fix RUN_DIR
 2015-05-29 14:12:22 +02:00
Dirk Wetter
e14453b607 Merge pull request #110 from AntonioMeireles/master 
simplify life for OSX users running gnu's coreutils...
 2015-05-29 11:01:47 +02:00
Dirk
41ee37f0dc - per default we do a allciphers run in the end 
- option long changed to wide
- PFS now is per default not wide
- PFS comes after standard cipher lists
- debug output improved (in terms of privacy and additional info)
 2015-05-29 10:36:14 +02:00
Dirk
2ac34c1424 - early check to make sure people really use bash, see #109 2015-05-29 10:08:17 +02:00
António Meireles
4063e38ccf simplify life for OSX users running gnu's coreutils... 
Signed-off-by: António Meireles <antonio.meireles@reformi.st>
 2015-05-28 16:56:37 +01:00
Dirk Wetter
8b10dc9638 - code improvements rc4, beast, logjam, freak 2015-05-27 23:31:25 +02:00
Dirk Wetter
f9605c4f35 - BEAST now also works in wide mode 
- renamed --long in --wide
- added --show-each to help
- inserted help
 2015-05-27 17:04:35 +02:00
Dirk Wetter
a76ca52c4c - first candidate for logjam (missing the precomuted primes though) 
- 1024 DH is now brown instead of red, 768 will be red, 512 bold red
- dumped calls to ok()
- further cosmetic stuff
 2015-05-27 14:28:18 +02:00
Dirk
ed38a365ae - fix regression on missing rfc cipher names 
- cosmetic stuff
 2015-05-27 11:19:30 +02:00
Dirk
060178071d - for pfs. allciphers and cipher_per_proto we WARN now because of weak DH param (if openssl supports it) 
FIX #106, $85
- logjam not yet named *#105, #107) but addressed
- --openssl switch
- reorder find_openssl_binary / mybanner
- proper identation of help
 2015-05-26 12:51:10 +02:00
Dirk
3c161f9ce4 - blanks in headlines added 2015-05-25 21:22:21 +02:00
Dirk
9c7d385098 - omit 1xblank in almost all colored output (and adjust the functions using it) 
- little bit more robust for strange keysize and dh bits
- added ecdsa-with-SHA256 to Signature Algorithm
- FIX: no TLS1+SSL3 resulted in no output for BEAST
 2015-05-25 21:14:59 +02:00
Dirk
e58b53eeae - dh key lenghth in negotiated cipher at first, see $85, #105, #106 
- got rid of ok function calls in protocols
- detection of apache banner win32/win64
 2015-05-25 15:10:09 +02:00
Dirk
a7a19428d6 - FIX for #104: check for hpkp pin match failed if \" was present 2015-05-18 23:10:34 +02:00