https://github.com/drwetter/testssl.sh

sort by:
Revision Author Date Message Commit Date
5581499 Merge pull request #2487 from Tazmaniac/renego-fix3 [Client Renego] Small important fixes 02 April 2024, 09:15:12 UTC
6d80ec1 Small important fixes: - In case of multiple IP testing, clear ERRFILE bettween runs - Zero return value with server connection close should be taken into account in the looping logic case too. Add it. - Break the wait loop in case of connection close for faster result. - Ignore "notAfter" in the wait loop for expired certificates. - Indentation and tab cleanup. Tested on 57 url with previously suspicious results with success. No regressions on 50 others. 26 March 2024, 11:23:38 UTC
979a22c Merge pull request #2480 from drwetter/dependabot/github_actions/docker/build-push-action-5.3.0 Bump docker/build-push-action from 5.2.0 to 5.3.0 15 March 2024, 10:48:46 UTC
8704b45 Bump docker/build-push-action from 5.2.0 to 5.3.0 Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.2.0 to 5.3.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v5.2.0...v5.3.0) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> 15 March 2024, 00:50:35 UTC
375ddf5 Merge pull request #2475 from Tazmaniac/renego_timing_fix2 Renego timing fix2 14 March 2024, 12:57:53 UTC
16efbd6 Merge pull request #2476 from akabe1/3.2 Fix mtls option location in s_client_options() and code cleanup 14 March 2024, 09:13:57 UTC
db9aa23 Merge pull request #2478 from drwetter/dependabot/github_actions/docker/login-action-3.1.0 Bump docker/login-action from 3.0.0 to 3.1.0 14 March 2024, 08:51:26 UTC
8ca8ead Bump docker/login-action from 3.0.0 to 3.1.0 Bumps [docker/login-action](https://github.com/docker/login-action) from 3.0.0 to 3.1.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3.0.0...v3.1.0) --- updated-dependencies: - dependency-name: docker/login-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> 14 March 2024, 00:47:01 UTC
ed7bdf1 Merge pull request #2477 from drwetter/dependabot/github_actions/docker/build-push-action-5.2.0 Bump docker/build-push-action from 5.1.0 to 5.2.0 12 March 2024, 09:03:11 UTC
bba7299 Bump docker/build-push-action from 5.1.0 to 5.2.0 Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.1.0 to 5.2.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v5.1.0...v5.2.0) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> 11 March 2024, 00:58:43 UTC
a1dae24 Fix: modified mtls option location in s_client_options() and code cleanup 09 March 2024, 08:21:50 UTC
426bfa6 Fix the cleanup ... 06 March 2024, 15:02:19 UTC
2824e34 Cleanup bash $(( )) arithmetic usage 06 March 2024, 14:44:34 UTC
43e5561 errorlog filtering fix Filter out verify and deph lines to not reintrodure timing race condition. 06 March 2024, 13:53:34 UTC
91367ca Fix and optimisation There is a race condition if openssl exit during a renego but after the RENEGOTIATING printing. In this case we could issue a R before the process exit and be blocked in the waiting loop. With the safety guards in place (loop count + timeout) this is harmless but not optimal. Fix this by: - reordering the sleep vs echo to let the process exit and catch the pipe error more frequently. - exit the while loop if RENEGOTIATING is not the last log line. We will catch the pipe error on the next for loop echo. - correct the k variable initialisation - correct the for (( ; ; )) variable $ convention usage - reduce the while loop count limit to 120 to align with the global timeout 06 March 2024, 12:57:21 UTC
35496e5 Clean up watchdog file logic 04 March 2024, 18:16:48 UTC
81167dc Fixes: - Add safety gards againts infinite sleep loop - correct the for loop test - reverse the watchdog file logic for sleep loop. No timing dependance. 04 March 2024, 17:48:21 UTC
8627ba5 Kill the heuristic an count the real number of renegociations The heuristic is too fragile and timing dependant. - As for the initial TLS negociation, wait for the result of the renegociation request before sending the next one. - Remove the result ratio calculation and message as we now reach the timeout in case of exponential backoff or connection hang. This commit depend on the fix of the timeout, broken by the zombi fix. 01 March 2024, 21:02:00 UTC
2bdbdec Do not wait on pid you are not a parent. The zombi fix did too much modifications breaking the global time-out function. As the wait $pid failed, we no longer create the watchdog file. Fix by reverting unnecessary changes. 01 March 2024, 16:40:43 UTC
a2fdfb0 Merge pull request #2474 from drwetter/mtls_beta Polish PR2461 (mTLS) + label as beta 28 February 2024, 09:22:11 UTC
55ae9bf Polish PR2461 (mTLS) + label as beta also revert #1383 27 February 2024, 14:59:16 UTC
94ef475 Merge pull request #2461 from akabe1/3.2 Add mTLS new feature to support scans with client authentication 27 February 2024, 14:47:03 UTC
f84e8c0 Merge pull request #2470 from Tazmaniac/renego_timing_fix Correct client_renego timing bug. 21 February 2024, 16:17:51 UTC
32a2797 Merge pull request #2472 from Tazmaniac/zombies-fix-3.2 Fix subshell killing to avoid zombies 20 February 2024, 09:03:19 UTC
af20952 Fix subshell killing to avoid zombies Learned from the rest of the code ... 19 February 2024, 15:19:23 UTC
19607d7 Merge pull request #2467 from Tazmaniac/mongodb-detection-fix MongoDB identification fix 13 February 2024, 16:15:01 UTC
6277613 Usual spell fixes. 13 February 2024, 14:41:35 UTC
4066766 MongoDB identification fix The actual code grep for "MongoDB" keyword in the head of the HTTP session. In case of "compressed" HTML, a big page is on one line. On a IT page, we could encounter the "MongoDB" keyword and miss-identify the application protocol. Fixed by matching on a longuer string taken from a live MogoDB server. 13 February 2024, 14:00:19 UTC
faae91e Correct client_renego timing bug. OpenSSL will buffer only the first command till the establishment of the session. In case of slow session establishment, we could: * loose some renego trys missing proper mitigation implementation * loose some renego trys missing a real vulnerable host if 2/3 of the tries are lost during session establishment (very slow startup). Wait for the session to be fully establised before starting the renego loop. 13 February 2024, 13:40:53 UTC
62b5859 Merge pull request #2465 from Odinmylord/3.2 Add SNI to ticketbleed check 09 February 2024, 08:56:58 UTC
eb661da Add SNI to ticketbleed check 08 February 2024, 14:01:12 UTC
c30e541 Merge pull request #2463 from janbrasna/fix-docker-md-quotes Fix Dockerfile.md formatting 02 February 2024, 19:25:46 UTC
1db2df3 Fix Dockerfile.md formatting 02 February 2024, 18:33:08 UTC
7ec7f8c Merge pull request #2460 from Tazmaniac/client-renego-regression Fixed regression in printing results 22 January 2024, 08:51:11 UTC
51ab05e Update testssl.1.html 20 January 2024, 10:49:56 UTC
55ef4c0 Update testssl.1.md 20 January 2024, 10:49:50 UTC
83fb9b5 Update CHANGELOG.md 20 January 2024, 10:49:41 UTC
bdab5f6 Update CREDITS.md 20 January 2024, 10:49:32 UTC
ec4ceb2 Add mTLS feature Added new feature to support mutual TLS via client certificate and private key, when a remote server requires client authentication. 20 January 2024, 10:49:05 UTC
4cc02a6 One more spell fix... 19 January 2024, 16:09:44 UTC
02a3c2c Fixed regression in printing results And improve it with the effective number of renego before disconnection as it is now tracked. 19 January 2024, 15:22:50 UTC
ad04a90 Merge pull request #2459 from Tazmaniac/client-renego-fix Secure Client-Initiated Renegotiation : fixes/enhancements 18 January 2024, 17:37:58 UTC
67c362c One more spell fix 15 January 2024, 09:07:09 UTC
de364b0 Introduce SSL_REGEG_WAIT and reduce wait to 0.25s Reduce wait between reneg test to 0.25s. Still robust and accelerates the test as now we do up to 10 renego tests. With the global loop timeout, the backoff identification seem unneeded. But if we switch to 0.25s, we no longuer trigger the global timeout so it is still valuable. Adjust write out messages as bash do not support floating point number arithmetic. 12 January 2024, 10:30:35 UTC
9b79e39 Bump SSL_RENEG_ATTEMPTS=10 for Stormshield Stormshield allows 9x and then blocks. So then 10x should be tested. Example: https://ems.ocapiat.fr 11 January 2024, 17:34:47 UTC
b793f54 Add timeout for the client initiated renego loop Some site hang/block the connection after some renego reties Example: https://feedback.amadeus.com Hand written timeout logic because: - we want to get the result of the command in case of normal exit - we want to have working log fd redirection - we want to known the timeout condition 11 January 2024, 17:30:44 UTC
b6fdfb1 Merge pull request #2458 from drwetter/drwetter-patch-1 Create pull_request_template.md 10 January 2024, 18:28:22 UTC
6e84f5f Fill pull_request_template.md 10 January 2024, 18:27:24 UTC
9a494b1 Create pull_request_template.md 10 January 2024, 18:03:23 UTC
d30d8e0 tab/space corrections and "grep -ac" in place of "grep -a | wc -l" 10 January 2024, 17:31:41 UTC
7c0c066 Merge pull request #2437 from drwetter/disclaimer Disclaimer 10 January 2024, 11:22:34 UTC
810e870 Merge pull request #2454 from Odinmylord/3.2 Make cert_keysize output consistent 10 January 2024, 11:21:42 UTC
69664cb Merge pull request #2455 from Odinmylord/fix_intermediate_cert add utf8 support to intermediate cert names 06 January 2024, 19:38:32 UTC
e404cf8 add utf8 support to intermediate cert names 03 January 2024, 13:27:11 UTC
f4b1bb2 Update certificate_info function to include key algorithm in error messages 02 January 2024, 13:06:18 UTC
3f9cc7b Merge pull request #1871 from dcooper16/quit_on_cmd_line_errors Quit testssl.sh on all command line errors 24 December 2023, 14:34:00 UTC
bbf770a Merge pull request #2447 from Odinmylord/3.2 Add Brainpool signature algorithms to output 24 December 2023, 13:00:42 UTC
23c2b24 MUST update hashes 24 December 2023, 13:00:34 UTC
3d63b62 Merge pull request #2450 from drwetter/fix_stupid_umaskerror Bail out if user error bc of umask 23 December 2023, 14:02:20 UTC
c5265e3 fix wrong temp file var 23 December 2023, 12:13:16 UTC
3b5f202 fix typo 23 December 2023, 12:03:57 UTC
8e517e0 Bail out if user error bc of umask If a user chose a broken umask testssl.sh will start but emits subsequent errors. This patch adds two sanity checks whether it is allowed to create and read files in the temp directory. Fixes #2449 23 December 2023, 11:58:05 UTC
90272f1 Add Brainpool signature algorithms to output 13 December 2023, 13:23:28 UTC
7829821 Merge pull request #2441 from drwetter/dependabot/github_actions/docker/build-push-action-5.1.0 Bump docker/build-push-action from 5.0.0 to 5.1.0 09 December 2023, 17:13:24 UTC
2c84a52 Fix mitigation detection with debug level 0 07 December 2023, 17:58:58 UTC
52c6ac7 Spell fix. 28 November 2023, 14:22:01 UTC
429db59 Crudely detect exponential backoff as a mitigation 28 November 2023, 13:41:25 UTC
30129b5 Bump docker/build-push-action from 5.0.0 to 5.1.0 Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.0.0 to 5.1.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v5.0.0...v5.1.0) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> 20 November 2023, 00:50:39 UTC
1a9a486 Merge pull request #2438 from drwetter/wildcard Implement warning for wildcard match 10 November 2023, 18:41:08 UTC
81ba1fe Implement warning for wildcard match fixes #2122 10 November 2023, 14:37:13 UTC
6540867 wording, typos 06 November 2023, 13:40:52 UTC
b87634b Disclaimer 06 November 2023, 13:34:55 UTC
e867e53 Quit testssl.sh on all command line errors As suggested in #1844, this commit changes testssl.sh so that the parent process quits immediately if there is an error in the command line for one of the child processes. Currently, a signal is sent to the parent process to quit if the child process encounters an error and calls help(), but sometimes parse_cmd_line() just prints an error message and calls fatal() rather than help(), in which case the parent process does not stop. This commit addresses the issue by creating a new function, fatal_cmd_line(), which is almost the same as fatal(), but additionally sends a signal to the parent indicating that the parent should stop. This commit also changes calls to fatal() to calls to fatal_cmd_line() if json_header(), csv_header(), html_header(), or prepare_logging() encounter a problem. The same is done if prettyprint_local() with the command-line option provided for it. There may be other places in which it would be appropriate to call fatal_cmd_line() rather than fatal() (e.g., in parse_hn_port() or check_proxy()), but those changes are not made in this commit. 01 November 2023, 18:55:06 UTC
f59f3bd Merge pull request #2436 from drwetter/fix_ProxyVar Fix output: PROXY string vs $PROXY variable 31 October 2023, 19:36:32 UTC
cbb32d3 Fix output: PROXY string vs $PROXY variable See also #2428. 30 October 2023, 20:39:30 UTC
a6f9745 Merge pull request #2425 from drwetter/drwetter-patch-1 Use Alpine 3.18 30 October 2023, 16:53:57 UTC
0a8dd68 Merge pull request #2433 from drwetter/fix_2429 Fix weird bash globbing #2429 30 October 2023, 16:53:32 UTC
a9103fd Put the redirection into the right spot 30 October 2023, 14:27:37 UTC
92b28c5 Fix weird bash globbing #2429 What was problematic was the error message when the certificate stores were missing. This fixes it by redirecting the error message to /dev/null so that if the sub function detects the missing file it returns with an error by the program and not by executing "basename" 30 October 2023, 14:11:10 UTC
40be025 Use Alpine 3.18 .. to at least be on par with 3.0 13 October 2023, 15:36:19 UTC
f3c7eb4 Merge pull request #2424 from drwetter/fix_utilLinux_Dockerfile Make sure util_Linux gets replaced as intended 13 October 2023, 15:33:25 UTC
781757f polish phrasing 13 October 2023, 15:32:35 UTC
f39564d Make sure util_Linux gets replaced as intended There were some discussions in #2420 whether the zypper install commend worked as intended. While there's liitle doubt that those packages weren't installed this PR makes really sure that this is the case. Also it does an update via ``zypper up`` as the image provided from dockerhub seemed to be somewhat behind. 13 October 2023, 15:07:38 UTC
6431104 Merge pull request #2423 from drwetter/update_container_leap15.5 Upgrade to leap 15.5 13 October 2023, 08:41:58 UTC
dda89c6 Upgrade to leap 15.5 13 October 2023, 08:36:05 UTC
b21c5ee Add IP protocol to debug msg 11 October 2023, 13:22:46 UTC
f50a958 Merge pull request #2417 from vsbs-david/local_hostname_drill Added drill command to get_a[aaa]_record() for local hostname 11 October 2023, 13:19:44 UTC
3f74280 Used debugme function 11 October 2023, 07:26:43 UTC
cbefcf0 Fixed redirect stderr to /dev/null, added debug echo for mDNS resolution failure, fixed some spelling 10 October 2023, 11:55:34 UTC
30e0c84 Merge pull request #2298 from drwetter/changelog_3.2 Start listing changes and contributions for 3.2 10 October 2023, 09:53:26 UTC
2b2e363 Merge branch '3.2' into changelog_3.2 10 October 2023, 09:32:12 UTC
b0d035c went though the log from today back to Nov 22 10 October 2023, 09:13:44 UTC
4e574d6 Merge pull request #2416 from drwetter/prepare4release Bump version number 10 October 2023, 08:29:03 UTC
b8f770d Added drill command to get_a[aaa]_record() for local hostname 10 October 2023, 07:05:48 UTC
bdeda3a Bump version number 09 October 2023, 20:51:44 UTC
4c6e8d7 Merge pull request #2414 from drwetter/update_certstore Update of certificate stores 09 October 2023, 20:20:42 UTC
db175a8 Update of certificate stores Mozilla: 2023-08-22 Debian 10 JDK 22 Windows 10 22H2, Patched until 2023-10 Apple: 2023-10 09 October 2023, 20:08:48 UTC
8f295cb Merge pull request #2411 from ghen2/servicedetection Improve detection for POP3, IMAP and SMTP services. 07 October 2023, 13:09:11 UTC
e09e2c5 Fix SMTP detection. Extended regex was missing -E. 07 October 2023, 12:15:40 UTC
16e6826 Improve detection for POP3 and IMAP. 07 October 2023, 11:56:39 UTC
back to top