Skip to content

Commit 3152cdf

Browse files
drwetterdrwetter
committed
Banner change + minor fix for curve detection
In order to tell openssl binaries better apart the short banner below the hash tag signs contain now also the date. That is the short version of the build date unless it is not supplied which is the case of opensuse. Then the name contains the date and it's taken from there. The start and end banner lines have the same length now. "sieve" was added in a comment and the sequence where sieve appears in a pattern was trying to match other occurences (i.e. after nntp) While testing the banners it appeared under Linux that a) the vendor supplied openssl sometimes hangs during startup when determining the supported curves using -connect b) a pattern was missing to detect whether the curve was not supported which falsely labeled all supplied curves as supported when using /usr/bin/openssl . The pattern for the latter was added (b). For a) there needs to be a follow up PR to avoid the long delays.
1 parent 21a89e4 commit 3152cdf

1 file changed

Lines changed: 50 additions & 30 deletions

File tree

‎testssl.sh‎

Lines changed: 50 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3512,7 +3512,7 @@ prettyprint_local() {
35123512
fi
35133513

35143514
if [[ -z "$1" ]]; then
3515-
pr_headline " Displaying all $OPENSSL_NR_CIPHERS local ciphers ";
3515+
pr_headline " Displaying all $OPENSSL_NR_CIPHERS local OpenSSL ciphers ";
35163516
else
35173517
pr_headline " Displaying all local ciphers ";
35183518
# pattern provided; which one?
@@ -20345,32 +20345,48 @@ find_openssl_binary() {
2034520345
fi
2034620346
fi
2034720347

20348-
# https://www.openssl.org/news/changelog.html
20349-
# https://web.archive.org/web/20150815130800/http://openssl.org/news/openssl-notes.html
20350-
OSSL_NAME=$($OPENSSL version 2>/dev/null | awk '{ print $1 }')
20351-
OSSL_VER=$($OPENSSL version 2>/dev/null | awk -F' ' '{ print $2 }')
20348+
$OPENSSL version -a 2>/dev/null >$TEMPDIR/openssl_version_all
20349+
ossl_line1=$(head -1 $TEMPDIR/openssl_version_all)
20350+
OSSL_NAME=$(awk '{ print $1 }' <<< "${ossl_line1}")
20351+
OSSL_VER=$(awk -F' ' '{ print $2 }' <<< "${ossl_line1}")
2035220352
OSSL_VER_MAJOR="${OSSL_VER%%\.*}"
20353-
ossl_wo_dev_info="${OSSL_VER%%-*}"
20354-
OSSL_VER_MINOR="${ossl_wo_dev_info#$OSSL_VER_MAJOR\.}"
20353+
OSSL_VER_MINOR="${OSSL_VER%%-*}"
20354+
OSSL_VER_MINOR="${OSSL_VER_MINOR#$OSSL_VER_MAJOR\.}"
2035520355
OSSL_VER_MINOR="${OSSL_VER_MINOR%%[a-zA-Z]*}"
20356+
# like -bad -fips etc:
2035620357
OSSL_VER_APPENDIX="${OSSL_VER#$OSSL_VER_MAJOR\.$OSSL_VER_MINOR}"
20357-
OSSL_VER_PLATFORM=$($OPENSSL version -p 2>/dev/null | sed 's/^platform: //')
20358-
OSSL_BUILD_DATE=$($OPENSSL version -a 2>/dev/null | grep '^built' | sed -e 's/built on//' -e 's/: ... //' -e 's/: //' -e 's/ UTC//' -e 's/ +0000//' -e 's/.000000000//')
20358+
OSSL_VER_PLATFORM="$(awk '/^platform: / { print $2 }' < $TEMPDIR/openssl_version_all)"
20359+
OSSL_BUILD_DATE="$(awk '/^built on/' < $TEMPDIR/openssl_version_all)"
20360+
OSSL_BUILD_DATE=${OSSL_BUILD_DATE#*: }
2035920361

20360-
# Determine an OpenSSL short string for the banner
20361-
# E.g MacOS' homebrew and Debian add a library string: OpenSSL 3.3.1 4 Jun 2024 (Library: OpenSSL 3.3.1 4 Jun 2024),
20362+
# MacOS' homebrew and Debian add a library string: OpenSSL 3.3.1 4 Jun 2024 (Library: OpenSSL 3.3.1 4 Jun 2024),
2036220363
# so we omit the part after the round bracket as it breaks formatting and doesn't provide more useful info
20363-
OSSL_SHORT_STR=$($OPENSSL version 2>/dev/null)
20364-
OSSL_SHORT_STR=${OSSL_SHORT_STR%\(*}
20365-
# Now handle strings like this: OpenSSL 1.1.1l-fips 24 Aug 2021 SUSE release 150500.17.34.1
20366-
# we find the year, remove until first occurrence, re-add it
20364+
OSSL_SHORT_STR=${ossl_line1%\(*}
20365+
# Now handle strings like "OpenSSL 1.1.1l-fips 24 Aug 2021 SUSE release 150500.17.34.1". So we look for
20366+
# the year, remove it until the end and then re-add just the year
2036720367
for yr in {2014..2029} ; do
2036820368
if [[ $OSSL_SHORT_STR =~ \ $yr ]] ; then
2036920369
OSSL_SHORT_STR=${OSSL_SHORT_STR%%$yr*}
2037020370
OSSL_SHORT_STR="${OSSL_SHORT_STR}${yr}"
2037120371
break
2037220372
fi
2037320373
done
20374+
# Now OSSL_SHORT_STR contains for newer binaries "OpenSSL 3.3.1 4 Jun 2024" and for the supplied "OpenSSL 1.0.2-bad".
20375+
# Now, determine the build date if there is one, Opensuse doesn't seem to have one, then we pick the date instead from the first line
20376+
if [[ -z ${OSSL_BUILD_DATE} ]]; then
20377+
# determine date from the form. And take that as a built date internally
20378+
OSSL_NAME=${OSSL_SHORT_STR/?? ??? 20??/}
20379+
OSSL_BUILD_DATE=${OSSL_SHORT_STR/$OSSL_NAME/}
20380+
else
20381+
# Remove TZ
20382+
OSSL_BUILD_DATE=${OSSL_BUILD_DATE/UTC/}
20383+
fi
20384+
# opensuse e.g. has also the version in the name which we don't want there
20385+
OSSL_NAME=${OSSL_NAME/$OSSL_VER/}
20386+
# Reduce double spaces to just one and remove trailing space
20387+
OSSL_BUILD_DATE=${OSSL_BUILD_DATE/ / }
20388+
OSSL_BUILD_DATE="$(strip_trailing_space "$OSSL_BUILD_DATE")"
20389+
OSSL_NAME=${OSSL_NAME// /}
2037420390

2037520391
# see #190, reverting logic: unless otherwise proved openssl has no dh bits
2037620392
case "$OSSL_VER_MAJOR.$OSSL_VER_MINOR" in
@@ -20470,13 +20486,11 @@ find_openssl_binary() {
2047020486
$OPENSSL s_client -no_comp </dev/null 2>&1 | grep -aiq "unknown option" || HAS_NO_COMP=true
2047120487

2047220488
OPENSSL_NR_CIPHERS=$(count_ciphers "$(actually_supported_osslciphers 'ALL:COMPLEMENTOFALL' 'ALL')")
20473-
2047420489
# The following statement works with OpenSSL 1.0.2, 1.1.1 and 3.0 and LibreSSL 3.4
2047520490
if $OPENSSL s_client -curves </dev/null 2>&1 | grep -aiq "unknown option"; then
20476-
# This is e.g. for LibreSSL (tested with version 3.4.1): WSL users will get "127.0.0.1:0" here,
20477-
# all other "invalid.:0". We need a port here, in any case!
20478-
# The $OPENSSL connect call deliberately fails: when the curve isn't available with
20479-
# "getaddrinfo: Name or service not known", newer LibreSSL with "Failed to set groups".
20491+
# LibreSSL (tested with version 3.4.1 and 3.0.2) need -groups instead of -curve
20492+
# WSL users connect to "127.0.0.1:0", others to "invalid." or "invalid.:0"
20493+
# The $OPENSSL connect call deliberately fails: when the curve isn't available with the described error messages
2048020494
for curve in "${curves_ossl[@]}"; do
2048120495
$OPENSSL s_client -groups $curve -connect ${NXCONNECT%:*}:0 </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|Failed to set groups"
2048220496
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
@@ -20485,7 +20499,8 @@ find_openssl_binary() {
2048520499
HAS_CURVES=true
2048620500
for curve in "${curves_ossl[@]}"; do
2048720501
# Same as above, we just don't need a port for invalid.
20488-
$OPENSSL s_client -curves $curve -connect $NXCONNECT </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option"
20502+
#FIXME: openssl 3 sometimes seems somtimes to hang when using '-connect invalid.' for up to 10 seconds
20503+
$OPENSSL s_client -curves $curve -connect $NXCONNECT </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|cannot be set"
2048920504
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
2049020505
done
2049120506
fi
@@ -20712,7 +20727,7 @@ help() {
2071220727
and [options] is/are:
2071320728

2071420729
-t, --starttls <protocol> Does a run against a STARTTLS enabled service which is one of ftp, smtp, lmtp, pop3, imap,
20715-
sieve, xmpp, xmpp-server, telnet, ldap, nntp, postgres, mysql
20730+
xmpp, xmpp-server, telnet, ldap, nntp, sieve, postgres, mysql
2071620731
--xmpphost <to_domain> For STARTTLS xmpp or xmpp-server checks it supplies the domainname (like SNI)
2071720732
--mx <domain/host> Tests MX records from high to low priority (STARTTLS, port 25)
2071820733
--file/-iL <fname> Mass testing option: Reads one testssl.sh command line per line from <fname>.
@@ -21012,11 +21027,11 @@ prepare_arrays() {
2101221027
mybanner() {
2101321028
local bb1 bb2 bb3
2101421029
local spaces=" "
21015-
local full="$1"
21030+
local full="$1" # we have a short version and a longer one (two liner vs 4 liner)
21031+
local short_built_date="" # a reduced version of the build date in the short banner
2101621032

2101721033
"$QUIET" && return
2101821034
"$CHILD_MASS_TESTING" && return
21019-
OPENSSL_NR_CIPHERS=$(count_ciphers "$(actually_supported_osslciphers 'ALL:COMPLEMENTOFALL:@STRENGTH' 'ALL')")
2102021035
bb1=$(cat <<EOF
2102121036

2102221037
#####################################################################
@@ -21030,7 +21045,6 @@ EOF
2103021045
EOF
2103121046
)
2103221047
bb3=$(cat <<EOF
21033-
2103421048
#####################################################################
2103521049
EOF
2103621050
)
@@ -21047,8 +21061,14 @@ EOF
2104721061
pr_boldurl "https://testssl.sh/bugs/"; outln
2104821062
pr_bold "$bb3"
2104921063
outln "\n"
21064+
21065+
# remove clock and dow if the first word if it is a dow and not a dom (suse)
21066+
short_built_date=${OSSL_BUILD_DATE/??:??:?? /}
21067+
if [[ ${short_built_date%% *} =~ [A-Za-z]{3} ]]; then
21068+
short_built_date=${short_built_date#* }
21069+
fi
2105021070
out "${spaces}Using "
21051-
pr_italic "$OSSL_SHORT_STR"
21071+
pr_italic "$OSSL_NAME $OSSL_VER ($short_built_date)"
2105221072
outln " [~$OPENSSL_NR_CIPHERS ciphers]"
2105321073
out "${spaces}on $HNAME:"
2105421074
outln "$OPENSSL_LOCATION"
@@ -22338,7 +22358,7 @@ check_msg() {
2233822358
}
2233922359

2234022360

22341-
# arg1 (optional): ftp smtp, lmtp, pop3, imap, sieve, xmpp, xmpp-server, telnet, ldap, postgres, mysql, irc, nntp (maybe with trailing s)
22361+
# arg1 (optional): ftp smtp, lmtp, pop3, imap, sieve, xmpp, xmpp-server, telnet, ldap, postgres, mysql, irc, nntp, sieve (maybe with trailing s)
2234222362
#
2234322363
determine_service() {
2234422364
local ua
@@ -22387,7 +22407,7 @@ determine_service() {
2238722407
fi
2238822408

2238922409
case "$protocol" in
22390-
ftp|smtp|lmtp|pop3|imap|sieve|xmpp|xmpp-server|telnet|ldap|postgres|mysql|nntp)
22410+
ftp|smtp|lmtp|pop3|imap|xmpp|xmpp-server|telnet|ldap|nntp|sieve|postgres|mysql)
2239122411
STARTTLS="-starttls $protocol"
2239222412
if [[ "$protocol" == xmpp ]] || [[ "$protocol" == xmpp-server ]]; then
2239322413
if [[ -n "$XMPP_HOST" ]]; then
@@ -22457,7 +22477,7 @@ determine_service() {
2245722477
outln
2245822478
;;
2245922479
*) outln
22460-
fatal "momentarily only ftp, smtp, lmtp, pop3, imap, sieve, xmpp, xmpp-server, telnet, ldap, nntp, postgres and mysql allowed" $ERR_CMDLINE
22480+
fatal "momentarily only ftp, smtp, lmtp, pop3, imap, xmpp, xmpp-server, telnet, ldap, nntp, sieve, postgres and mysql allowed" $ERR_CMDLINE
2246122481
;;
2246222482
esac
2246322483
# It comes handy later also for STARTTLS injection to define this global. When we do banner grabbing
@@ -22573,7 +22593,7 @@ datebanner() {
2257322593
scan_time_f="$(printf "%04ss" "$SCAN_TIME")" # 4 digits because of windows
2257422594
pr_reverse "$1 $(date +%F) $(date +%T) [$scan_time_f] -->> $node_banner <<--"
2257522595
else
22576-
pr_reverse "$1 $(date +%F) $(date +%T) -->> $node_banner <<--"
22596+
pr_reverse "$1 $(date +%F) $(date +%T) -->> $node_banner <<--"
2257722597
fi
2257822598
outln "\n"
2257922599
[[ "$1" =~ Start ]] && display_rdns_etc

0 commit comments

Comments
 (0)