d66e5ec0d7
This PR fixes a few bugs in `sslv2_sockets()`. The main issue is that a server may not send the entire ServerHello in a single packet. If it doesn't and the full response is being parsed (i.e., certificate and list of ciphers), then `parse_sslv2_serverhello()` will encounter errors, since it assumes that it has the entire ServerHello. This PR compares the length of the response to the length of the ServerHello as specified in the first two bytes of the response and requests more data from the server if the response appears incomplete. This PR also modifies `parse_sslv2_serverhello()` to check for more errors. It compares the length of the response it has been provided to the specified length (`$v2_hello_length`) and returns an error if the response is shorter than `$v2_hello_length` and the full response is supposed to be parsed. It will also check whether there was an error in converting the certificate from DER to PEM format and will return an error if there was (and it will suppress the error message). |
||
|---|---|---|
| bin | ||
| etc | ||
| t | ||
| utils | ||
| .gitignore | ||
| .travis.yml | ||
| CHANGELOG.stable-releases.txt | ||
| CREDITS.md | ||
| LICENSE | ||
| openssl-rfc.mappping.html | ||
| Readme.md | ||
| testssl.sh | ||
Intro
testssl.sh is a free command line tool which checks a server's service on
any port for the support of TLS/SSL ciphers, protocols as well as some
cryptographic flaws.
Key features
- Clear output: you can tell easily whether anything is good or bad
- Ease of installation: It works for Linux, Darwin, FreeBSD, NetBSD and MSYS2/Cygwin out of the box: no need to install or configure something, no gems, CPAN, pip or the like.
- Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not only webservers at port 443
- Toolbox: Several command line options help you to run YOUR test and configure YOUR output
- Reliability: features are tested thoroughly
- Verbosity: If a particular check cannot be performed because of a missing capability on your client side, you'll get a warning
- Privacy: It's only you who sees the result, not a third party
- Freedom: It's 100% open source. You can look at the code, see what's going on and you can change it.
- Heck, even the development is open (github)
Status
Here in the 2.9dev branch you find the development version of the software -- with new features and maybe some bugs. For the stable version and a more thorough description of the command line options please see testssl.sh or https://github.com/drwetter/testssl.sh/wiki/Usage-Documentation.
Compatibility
testssl.sh is working on every Linux/BSD distribution out of the box with
some limitations of disabled features from the openssl client -- some
workarounds are done with bash-socket-based checks. It also works on other
unixoid system out of the box, supposed they have /bin/bash and standard
tools like sed and awk installed. MacOS X and Windows (using MSYS2 or
cygwin) work too. OpenSSL version >= 1 is a must. OpenSSL version >= 1.0.2
is needed for better LOGJAM checks and to display bit strengths for key
exchanges.
Update notification here or @ twitter.
Features implemented in 2.9dev
- Support of supplying timeout value for
openssl connect-- useful for batch/mass scanning - TLS 1.2 protocol check via socket
- Further TLS socket improvements (handshake parsing, completeness, robustness)
- non-flat JSON support
- in file output (CSV, JSON flat, JSON non-flat) support of a minimum severity level (only above supplied level there will be output)
- testing 359 default ciphers (
testssl.sh -e) with a mixture of sockets and openssl. Same speed as with openssl only but addtional ciphers such as post-quantum ciphers, new CHAHA20/POLY1305, CamelliaGCM etc. - finding more TLS extensions via sockets
- TLS Supported Groups Registry (RFC 7919), key shares extension
Features planned in 2.9dev
https://github.com/drwetter/testssl.sh/issues?q=is%3Aopen+is%3Aissue+milestone%3A2.9dev
Contributions
Contributions, feedback, bug reports are welcome! For contributions please note: One patch per feature -- bug fix/improvement. Please test your changes thouroughly as reliability is important for this project.
There's coding guideline.
Please file bug reports @ https://github.com/drwetter/testssl.sh/issues.
Documentation
For a start see the wiki. Help is needed here.
Bug reports
Please file bugs in the issue tracker. Do not forget to provide detailed information, see https://github.com/drwetter/testssl.sh/wiki/Bug-reporting. (Nobody can read your thoughts -- yet. And only agencies your screen) ;-)
External/related projects
Please address questions not specifically to the code of testssl.sh to the respective projects