942ceb04d9
FIX "built on: reproducible build, date unspecified" problem
Dirk Wetter2015-07-06 20:33:05 +02:00
0e1a7002b9
FIX "built on: reproducible build, date unspecified" problem
Dirk Wetter2015-07-06 20:22:45 +02:00
c08baa94b3
* CHANGE: some tuning variable are now booleans (see help) * help() to reflect this * cleanups
Dirk Wetter2015-07-06 10:10:46 +02:00
80e26a75ef
* Warning if LibreSSL is used #126 * FIX for screwed up output for fixed ciphers (FREAK, LOGJAM), see also #126 * GOST support now doesn't complain if MY confif file aleady exists (minor fix)
Dirk2015-07-02 16:39:41 +02:00
1186bf4229
- try to interpret server protocol (SMTP, FTP,...) handshake
Dirk2015-07-01 19:50:38 +02:00
93f5b8216d
* FIX#125 * beautified some code / function names
Dirk2015-06-28 13:52:42 +02:00
5d78c9421f
* first tls_low_byte is now always 01 in TLS 1.0 --> TLS 1.2 (see openssl) * removing TLS 1.2 check from sockets as IIS has a problem with it
Dirk2015-06-24 11:08:09 +02:00
e121f944e9
* FIX: added missed downgrade (ret=2) in socket protcol check * resorted helper functions to top * cleanups (ok, renamed some functions)
Dirk2015-06-23 21:54:47 +02:00
b575710634
* FIX in --ip=one * straighthen help() * FIX ret value for no response in parse_tls_serverhello
Dirk2015-06-23 12:58:40 +02:00
ae8f998f8f
* help corrected, -e is standard
Dirk2015-06-23 07:56:56 +02:00
a6c5a2af0d
* handshake works now with SNI
Dirk2015-06-22 23:19:08 +02:00
58a6f501b5
- better addressed no clear fallback repsonses, see #121Dirk2015-06-20 19:36:11 +02:00
633cdc209b
- NEW: IP address detection now in HTTP header - NEW: Varnish and Squid header detected - NEW: option --ip=one is a shortcut and means just test the first ip - CSP Report-Only in security headers - New: Varnish and Squid header detected, OWA header - all single tests in bold now - no support for TLS 1.2 spits out "NOT ok" as it is not ok - Medium ciphers and DES ciphers are not having aNULL and aDH ciphers anymore and have different colors --> ratings - http-date is now in http header(), tls_time in server_defaults() - http header reply is indented to same row as server defaults - http status code is displayed clearly now - BUGFIX: IPv6 address wasn't displayed - cleanup - application banner now in two lines if needed - try a second time to get a http header if first one fails - fix: case where % sign in ip address made prinf hiccup (sanitized) - fix: $url was in some functions empty - fixed bug where some headers were displayed twice
Dirk2015-06-19 20:36:32 +02:00
59299ce9e1
- FIX#119 (sed -E fails for old sed versions) - std_cipherlists tuned - fix for selfsigned certs (missed sometimes because of trailing space)
Dirk2015-06-17 11:33:29 +02:00
478b8afac7
FIX: bail out better if $NODE doesn't resolve cipher lists now wth plural ending added Liferay-Portal + X-OWA-Version for application banner new http_header (still leaving old one in) readability improvements
Dirk2015-06-16 19:53:40 +02:00
e16ccd06b6
- testing all IP addresses of a node works now (refactoring of parse_hn_port into three functions) FIX#96 - SNI is unset if STARTTLS is set - some BSD fixes (sed)
Dirk2015-06-16 14:04:44 +02:00
ac92ffb3c2
Merge branch 'master' of github.com:drwetter/testssl.sh
Dirk2015-06-15 12:13:45 +02:00
4432faf497
"--ip" works now (see help) little cleanups
Dirk2015-06-15 12:13:16 +02:00
dc548f1cfc
Added check for TLS_FALLBACK_SCSV support in local OpenSSL binary. In TLS_FALLBACK_SCSV check, added unique socket address to temporary file name in order to support multiple simultaneous instances.
JonnyHightower2015-06-10 17:38:39 +01:00
8acc17b4bc
- ease of making openssl binary with make-openssl.sh - Hint where the Readme is - removal of old binaries
Dirk2015-06-10 08:15:28 +02:00
0f5c4981cb
- more or less desperate try to figure out the real installation path (and find the mapping file) - help extended (equal sign, logjam)
Dirk2015-06-02 22:13:19 +02:00
cac985967f
- first prototype for using = in cmdline, see #108. Tests needed - beautified big case loop
Dirk2015-06-01 12:01:38 +02:00
452fd6762a
- local dns matches don't need lookup anymore over net --> saves timeouts+time - further banner tuning + funtion mybanner, 2 addtl global vars for debugging - cosmetic improvements
Dirk2015-05-31 14:40:12 +02:00
77ad7c9252
- the outsticking part was kind of not handy, see #113, remove commit message
Dirk2015-05-30 11:36:47 +02:00
4e18c35271
Merge branch 'master' of github.com:drwetter/testssl.sh
Dirk2015-05-29 10:36:47 +02:00
41ee37f0dc
- per default we do a allciphers run in the end - option long changed to wide - PFS now is per default not wide - PFS comes after standard cipher lists - debug output improved (in terms of privacy and additional info)
Dirk2015-05-29 10:36:14 +02:00
b48ac9874e
- early check to make sure people really use bash, see #109Dirk2015-05-29 10:10:53 +02:00
2ac34c1424
- early check to make sure people really use bash, see #109Dirk2015-05-29 10:08:17 +02:00
4063e38ccf
simplify life for OSX users running gnu's coreutils...
António Meireles2015-05-28 16:51:33 +01:00
f9605c4f35
- BEAST now also works in wide mode - renamed --long in --wide - added --show-each to help - inserted help
Dirk Wetter2015-05-27 17:04:35 +02:00
a76ca52c4c
- first candidate for logjam (missing the precomuted primes though) - 1024 DH is now brown instead of red, 768 will be red, 512 bold red - dumped calls to ok() - further cosmetic stuff
Dirk Wetter2015-05-27 14:28:18 +02:00
f261884499
Merge branch 'master' of github.com:drwetter/testssl.sh
Dirk2015-05-27 11:24:47 +02:00
8ab0aef84b
Merge branch 'master' of github.com:drwetter/testssl.sh
Dirk2015-05-26 12:56:17 +02:00
060178071d
- for pfs. allciphers and cipher_per_proto we WARN now because of weak DH param (if openssl supports it) FIX#106, $85 - logjam not yet named *#105, #107) but addressed - --openssl switch - reorder find_openssl_binary / mybanner - proper identation of help
Dirk2015-05-26 12:51:10 +02:00
3c161f9ce4
- blanks in headlines added
Dirk2015-05-25 21:22:21 +02:00
9c7d385098
- omit 1xblank in almost all colored output (and adjust the functions using it) - little bit more robust for strange keysize and dh bits - added ecdsa-with-SHA256 to Signature Algorithm - FIX: no TLS1+SSL3 resulted in no output for BEAST
Dirk2015-05-25 21:14:59 +02:00
e58b53eeae
- dh key lenghth in negotiated cipher at first, see $85, #105, #106 - got rid of ok function calls in protocols - detection of apache banner win32/win64
Dirk2015-05-25 15:10:09 +02:00
a7a19428d6
- FIX for #104: check for hpkp pin match failed if \" was present
Dirk2015-05-18 23:10:34 +02:00
0c4a36121e
- NEW / FIX#104: check for hpkp pin match
Dirk2015-05-18 21:51:45 +02:00
2919a7c40e
- 2.4! - FIX#92 - FIX for TLS time (difftime was too small for local clock skew) - warning for freebsd/macosx w/o ports need now a "yes" - TLS 1.0 not offered is not bold anymore - output weirdness fixed for cipher order in spdy
Dirk2015-05-17 22:30:49 +02:00
6e74b3bd5c
- FIX of output whene there's no CBC cipher in BEAST - FIX: 2 occurrances of OPENSSL calls had a hostname instead of an IP address - FIX: starttls protocol correctly displayed - NEW added duplicate detection for header flags - NEW: added four GOST cipher to standard socket handshake - recommends if openssl 1.0.2 is used and results were strange and IIS6 --> run wqith openssl 1.0.1 - declared some global vars as readonly
Dirk2015-05-15 21:32:11 +02:00
7614ac6f87
Merge branch 'master' of github.com:drwetter/testssl.sh
Dirk2015-05-12 13:38:20 +02:00
16d2b33459
- Workarounds for IIS6 #99 : some places where openssl 1.0.2 cannot connect (as opposed to =< 1.0.1) finding the right protocol before - hints for IIS6+openssl 1.0.2 non-conformity #99 - version bumped up to 2.4rc2 - better formatting for BSD in cipher order - FIX: 2x bug for cipher order + sslv2 - preambel revisited
Dirk2015-05-12 13:37:39 +02:00
Dirk Wetter
JonnyHightower
Thomas Ward
Peter Mosmans
António Meireles