3c55eec654
PR #346 added a test for version tolerance to `run_protocols()`, but I think it may now be more appropriate to remove that test. Draft -16 of TLS 1.3, which was posted on September 22, changed the way that version negotiation is handled for TLS 1.3 and above. The current version tolerance test sends a ClientHello with the version field set to "03, 05", to represent a TLS 1.4 ClientHello. While this was consistent with RFC 5246 and with drafts of TLS 1.3 up to -15, draft -16 changed the version field to `legacy_version` and declared that its value should be "03, 03" for TLS 1.2 and above. (For TLS 1.3 and above a Supported Versions extension is included to inform the server which versions of TLS the client supports.) The change in draft -16 was made as a result of the problems with servers not handling version negotiation correctly. Since the current draft suggests that a server should never be presented with a ClientHello with a version higher than "03, 03" (even for clients that support TLS versions higher than 1.2), it seems there is no reason to include the version tolerance test anymore. For servers that do not support TLS 1.2, the additional checks that were added by PR #346 will already detect if the server cannot perform version negotiation correctly. |
||
|---|---|---|
| bin | ||
| etc | ||
| t | ||
| utils | ||
| .gitignore | ||
| .travis.yml | ||
| CHANGELOG.stable-releases.txt | ||
| CREDITS.md | ||
| LICENSE | ||
| openssl-rfc.mappping.html | ||
| Readme.md | ||
| testssl.sh | ||
Intro
testssl.sh is a free command line tool which checks a server's service on
any port for the support of TLS/SSL ciphers, protocols as well as some
cryptographic flaws.
Key features
- Clear output: you can tell easily whether anything is good or bad
- Ease of installation: It works for Linux, Darwin, FreeBSD, NetBSD and MSYS2/Cygwin out of the box: no need to install or configure something, no gems, CPAN, pip or the like.
- Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not only webservers at port 443
- Toolbox: Several command line options help you to run YOUR test and configure YOUR output
- Reliability: features are tested thoroughly
- Verbosity: If a particular check cannot be performed because of a missing capability on your client side, you'll get a warning
- Privacy: It's only you who sees the result, not a third party
- Freedom: It's 100% open source. You can look at the code, see what's going on and you can change it.
- Heck, even the development is open (github)
General
Here in the master branch you find the stable version 2.8rc2 of the software, it superseds 2.6. Version 2.8 is currently being finalized. The 2.9dev branch is the developemnet -- with new features and maybe some bugs. For the stable version and a more thorough description of the command line options please see testssl.sh or https://github.com/drwetter/testssl.sh/wiki/Usage-Documentation.
testssl.sh is working on every Linux/BSD distribution out of the box with
some limitations of disabled features from the openssl client -- some
workarounds are done with bash-socket-based checks. It also works on other
unixoid system out of the box, supposed they have /bin/bash and standard
tools like sed and awk installed. MacOS X and Windows (using MSYS2 or
cygwin) work too. OpenSSL version >= 1 is a must. OpenSSL version >= 1.0.2
is needed for better LOGJAM checks and to display bit strengths for key
exchanges.
Features in 2.8 stable
Done so far:
- Trust chain check against certificate stores from Apple (OS), Linux (OS), Microsoft (OS), Mozilla (Firefox Browser), works for openssl >=1.0.1
- IPv6 (status: 80% working, details see https://github.com/drwetter/testssl.sh/issues/11
- works now on servers requiring a x509 certificate for authentication
- extensive CN <--> hostname check
- SSL Session ID check
- Avahi/mDNS based name resolution
- HTTP2/ALPN protocol check
- Logging to a file / dir
- Logging to (flat) JSON + CSV
- Check for multiple server certificates
- Browser cipher simulation: what client will connect with which cipher + protocol
- GOST cipher+certificate improvements
- Assistance for color-blind users
- Even more compatibility improvements for FreeBSD, NetBSD, Gentoo, RH-ish, F5 and Cisco systems
- Considerable speed improvements for each cipher runs (-e/-E)
- More robust SSLv2 + TLS socket interface
- seperate check for curves
- OpenSSL 1.1.0 compliant
- check for DROWN
- Whole number of bugs squashed
Update notification here or @ twitter.
Features in 2.9dev
- timeout in OpeenSL connect
- TLS 1.2 protocol check via socket
Contributions
Contributions, feedback, bug reports are welcome! For contributions please note: One patch per feature -- bug fix/improvement. Please test your changes thouroughly as reliability is important for this project.
There's coding guideline.
Please file bug reports @ https://github.com/drwetter/testssl.sh/issues.
Documentation
For a start see the wiki. Help is needed here.
Bug reports
Please file bugs in the issue tracker. Do not forget to provide detailed information, see https://github.com/drwetter/testssl.sh/wiki/Bug-reporting. (Nobody can read your thoughts -- yet. And only agencies your screen) ;-)
External/related projects
Please address questions not specifically to the code of testssl.sh to the respective projects