Skip to content

Commit 9807bc3

Browse files
drwetterdrwetter
authored
Merge pull request #2679 from testssl/banner_change
Banner change
2 parents f555fb0 + e6cfe8c commit 9807bc3

1 file changed

Lines changed: 51 additions & 30 deletions

File tree

‎testssl.sh‎

Lines changed: 51 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3512,7 +3512,7 @@ prettyprint_local() {
35123512
fi
35133513

35143514
if [[ -z "$1" ]]; then
3515-
pr_headline " Displaying all $OPENSSL_NR_CIPHERS local ciphers ";
3515+
pr_headline " Displaying all $OPENSSL_NR_CIPHERS local OpenSSL ciphers ";
35163516
else
35173517
pr_headline " Displaying all local ciphers ";
35183518
# pattern provided; which one?
@@ -20397,6 +20397,7 @@ find_openssl_binary() {
2039720397
local openssl_location cwd=""
2039820398
local ossl_wo_dev_info
2039920399
local curve
20400+
local ossl_line1="" yr=""
2040020401
local -a curves_ossl=("sect163k1" "sect163r1" "sect163r2" "sect193r1" "sect193r2" "sect233k1" "sect233r1" "sect239k1" "sect283k1" "sect283r1" "sect409k1" "sect409r1" "sect571k1" "sect571r1" "secp160k1" "secp160r1" "secp160r2" "secp192k1" "prime192v1" "secp224k1" "secp224r1" "secp256k1" "prime256v1" "secp384r1" "secp521r1" "brainpoolP256r1" "brainpoolP384r1" "brainpoolP512r1" "X25519" "X448" "brainpoolP256r1tls13" "brainpoolP384r1tls13" "brainpoolP512r1tls13" "ffdhe2048" "ffdhe3072" "ffdhe4096" "ffdhe6144" "ffdhe8192")
2040120402

2040220403
# 0. check environment variable whether it's executable
@@ -20432,32 +20433,48 @@ find_openssl_binary() {
2043220433
fi
2043320434
fi
2043420435

20435-
# https://www.openssl.org/news/changelog.html
20436-
# https://web.archive.org/web/20150815130800/http://openssl.org/news/openssl-notes.html
20437-
OSSL_NAME=$($OPENSSL version 2>/dev/null | awk '{ print $1 }')
20438-
OSSL_VER=$($OPENSSL version 2>/dev/null | awk -F' ' '{ print $2 }')
20436+
$OPENSSL version -a 2>/dev/null >$TEMPDIR/openssl_version_all
20437+
ossl_line1=$(head -1 $TEMPDIR/openssl_version_all)
20438+
OSSL_NAME=$(awk '{ print $1 }' <<< "${ossl_line1}")
20439+
OSSL_VER=$(awk -F' ' '{ print $2 }' <<< "${ossl_line1}")
2043920440
OSSL_VER_MAJOR="${OSSL_VER%%\.*}"
20440-
ossl_wo_dev_info="${OSSL_VER%%-*}"
20441-
OSSL_VER_MINOR="${ossl_wo_dev_info#$OSSL_VER_MAJOR\.}"
20441+
OSSL_VER_MINOR="${OSSL_VER%%-*}"
20442+
OSSL_VER_MINOR="${OSSL_VER_MINOR#$OSSL_VER_MAJOR\.}"
2044220443
OSSL_VER_MINOR="${OSSL_VER_MINOR%%[a-zA-Z]*}"
20444+
# like -bad -fips etc:
2044320445
OSSL_VER_APPENDIX="${OSSL_VER#$OSSL_VER_MAJOR\.$OSSL_VER_MINOR}"
20444-
OSSL_VER_PLATFORM=$($OPENSSL version -p 2>/dev/null | sed 's/^platform: //')
20445-
OSSL_BUILD_DATE=$($OPENSSL version -a 2>/dev/null | grep '^built' | sed -e 's/built on//' -e 's/: ... //' -e 's/: //' -e 's/ UTC//' -e 's/ +0000//' -e 's/.000000000//')
20446+
OSSL_VER_PLATFORM="$(awk '/^platform: / { print $2 }' < $TEMPDIR/openssl_version_all)"
20447+
OSSL_BUILD_DATE="$(awk '/^built on/' < $TEMPDIR/openssl_version_all)"
20448+
OSSL_BUILD_DATE=${OSSL_BUILD_DATE#*: }
2044620449

20447-
# Determine an OpenSSL short string for the banner
20448-
# E.g MacOS' homebrew and Debian add a library string: OpenSSL 3.3.1 4 Jun 2024 (Library: OpenSSL 3.3.1 4 Jun 2024),
20450+
# MacOS' homebrew and Debian add a library string: OpenSSL 3.3.1 4 Jun 2024 (Library: OpenSSL 3.3.1 4 Jun 2024),
2044920451
# so we omit the part after the round bracket as it breaks formatting and doesn't provide more useful info
20450-
OSSL_SHORT_STR=$($OPENSSL version 2>/dev/null)
20451-
OSSL_SHORT_STR=${OSSL_SHORT_STR%\(*}
20452-
# Now handle strings like this: OpenSSL 1.1.1l-fips 24 Aug 2021 SUSE release 150500.17.34.1
20453-
# we find the year, remove until first occurrence, re-add it
20452+
OSSL_SHORT_STR=${ossl_line1%\(*}
20453+
# Now handle strings like "OpenSSL 1.1.1l-fips 24 Aug 2021 SUSE release 150500.17.34.1". So we look for
20454+
# the year, remove it until the end and then re-add just the year
2045420455
for yr in {2014..2029} ; do
2045520456
if [[ $OSSL_SHORT_STR =~ \ $yr ]] ; then
2045620457
OSSL_SHORT_STR=${OSSL_SHORT_STR%%$yr*}
2045720458
OSSL_SHORT_STR="${OSSL_SHORT_STR}${yr}"
2045820459
break
2045920460
fi
2046020461
done
20462+
# Now OSSL_SHORT_STR contains for newer binaries "OpenSSL 3.3.1 4 Jun 2024" and for the supplied "OpenSSL 1.0.2-bad".
20463+
# Now, determine the build date if there is one, Opensuse doesn't seem to have one, then we pick the date instead from the first line
20464+
if [[ -z ${OSSL_BUILD_DATE} ]]; then
20465+
# determine date from the form. And take that as a built date internally
20466+
OSSL_NAME=${OSSL_SHORT_STR/?? ??? 20??/}
20467+
OSSL_BUILD_DATE=${OSSL_SHORT_STR/$OSSL_NAME/}
20468+
else
20469+
# Remove TZ
20470+
OSSL_BUILD_DATE=${OSSL_BUILD_DATE/UTC/}
20471+
fi
20472+
# opensuse e.g. has also the version in the name which we don't want there
20473+
OSSL_NAME=${OSSL_NAME/$OSSL_VER/}
20474+
# Reduce double spaces to just one and remove trailing space
20475+
OSSL_BUILD_DATE=${OSSL_BUILD_DATE/ / }
20476+
OSSL_BUILD_DATE="$(strip_trailing_space "$OSSL_BUILD_DATE")"
20477+
OSSL_NAME=${OSSL_NAME// /}
2046120478

2046220479
# see #190, reverting logic: unless otherwise proved openssl has no dh bits
2046320480
case "$OSSL_VER_MAJOR.$OSSL_VER_MINOR" in
@@ -20557,13 +20574,11 @@ find_openssl_binary() {
2055720574
$OPENSSL s_client -no_comp </dev/null 2>&1 | grep -aiq "unknown option" || HAS_NO_COMP=true
2055820575

2055920576
OPENSSL_NR_CIPHERS=$(count_ciphers "$(actually_supported_osslciphers 'ALL:COMPLEMENTOFALL' 'ALL')")
20560-
2056120577
# The following statement works with OpenSSL 1.0.2, 1.1.1 and 3.0 and LibreSSL 3.4
2056220578
if $OPENSSL s_client -curves </dev/null 2>&1 | grep -aiq "unknown option"; then
20563-
# This is e.g. for LibreSSL (tested with version 3.4.1): WSL users will get "127.0.0.1:0" here,
20564-
# all other "invalid.:0". We need a port here, in any case!
20565-
# The $OPENSSL connect call deliberately fails: when the curve isn't available with
20566-
# "getaddrinfo: Name or service not known", newer LibreSSL with "Failed to set groups".
20579+
# LibreSSL (tested with version 3.4.1 and 3.0.2) need -groups instead of -curve
20580+
# WSL users connect to "127.0.0.1:0", others to "invalid." or "invalid.:0"
20581+
# The $OPENSSL connect call deliberately fails: when the curve isn't available with the described error messages
2056720582
for curve in "${curves_ossl[@]}"; do
2056820583
$OPENSSL s_client -groups $curve -connect ${NXCONNECT%:*}:0 </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|Failed to set groups"
2056920584
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
@@ -20572,7 +20587,8 @@ find_openssl_binary() {
2057220587
HAS_CURVES=true
2057320588
for curve in "${curves_ossl[@]}"; do
2057420589
# Same as above, we just don't need a port for invalid.
20575-
$OPENSSL s_client -curves $curve -connect $NXCONNECT </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|Call to SSL_CONF_cmd(.*) failed"
20590+
#FIXME: openssl 3 sometimes seems to hang when using '-connect invalid.' for up to 10 seconds
20591+
$OPENSSL s_client -curves $curve -connect $NXCONNECT </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|Call to SSL_CONF_cmd(.*) failed|cannot be set"
2057620592
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
2057720593
done
2057820594
fi
@@ -20799,7 +20815,7 @@ help() {
2079920815
and [options] is/are:
2080020816

2080120817
-t, --starttls <protocol> Does a run against a STARTTLS enabled service which is one of ftp, smtp, lmtp, pop3, imap,
20802-
sieve, xmpp, xmpp-server, telnet, ldap, nntp, postgres, mysql
20818+
xmpp, xmpp-server, telnet, ldap, nntp, sieve, postgres, mysql
2080320819
--xmpphost <to_domain> For STARTTLS xmpp or xmpp-server checks it supplies the domainname (like SNI)
2080420820
--mx <domain/host> Tests MX records from high to low priority (STARTTLS, port 25)
2080520821
--file/-iL <fname> Mass testing option: Reads one testssl.sh command line per line from <fname>.
@@ -21099,11 +21115,11 @@ prepare_arrays() {
2109921115
mybanner() {
2110021116
local bb1 bb2 bb3
2110121117
local spaces=" "
21102-
local full="$1"
21118+
local full="$1" # we have a short version and a longer one (two liner vs 4 liner)
21119+
local short_built_date="" # a reduced version of the build date in the short banner
2110321120

2110421121
"$QUIET" && return
2110521122
"$CHILD_MASS_TESTING" && return
21106-
OPENSSL_NR_CIPHERS=$(count_ciphers "$(actually_supported_osslciphers 'ALL:COMPLEMENTOFALL:@STRENGTH' 'ALL')")
2110721123
bb1=$(cat <<EOF
2110821124

2110921125
#####################################################################
@@ -21117,7 +21133,6 @@ EOF
2111721133
EOF
2111821134
)
2111921135
bb3=$(cat <<EOF
21120-
2112121136
#####################################################################
2112221137
EOF
2112321138
)
@@ -21134,8 +21149,14 @@ EOF
2113421149
pr_boldurl "https://testssl.sh/bugs/"; outln
2113521150
pr_bold "$bb3"
2113621151
outln "\n"
21152+
21153+
# remove clock and dow if the first word is a dow and not a dom (suse)
21154+
short_built_date=${OSSL_BUILD_DATE/??:??:?? /}
21155+
if [[ ${short_built_date%% *} =~ [A-Za-z]{3} ]]; then
21156+
short_built_date=${short_built_date#* }
21157+
fi
2113721158
out "${spaces}Using "
21138-
pr_italic "$OSSL_SHORT_STR"
21159+
pr_italic "$OSSL_NAME $OSSL_VER ($short_built_date)"
2113921160
outln " [~$OPENSSL_NR_CIPHERS ciphers]"
2114021161
out "${spaces}on $HNAME:"
2114121162
outln "$OPENSSL_LOCATION"
@@ -22425,7 +22446,7 @@ check_msg() {
2242522446
}
2242622447

2242722448

22428-
# arg1 (optional): ftp smtp, lmtp, pop3, imap, sieve, xmpp, xmpp-server, telnet, ldap, postgres, mysql, irc, nntp (maybe with trailing s)
22449+
# arg1 (optional): ftp smtp, lmtp, pop3, imap, sieve, xmpp, xmpp-server, telnet, ldap, postgres, mysql, irc, nntp, sieve (maybe with trailing s)
2242922450
#
2243022451
determine_service() {
2243122452
local ua
@@ -22474,7 +22495,7 @@ determine_service() {
2247422495
fi
2247522496

2247622497
case "$protocol" in
22477-
ftp|smtp|lmtp|pop3|imap|sieve|xmpp|xmpp-server|telnet|ldap|postgres|mysql|nntp)
22498+
ftp|smtp|lmtp|pop3|imap|xmpp|xmpp-server|telnet|ldap|nntp|sieve|postgres|mysql)
2247822499
STARTTLS="-starttls $protocol"
2247922500
if [[ "$protocol" == xmpp ]] || [[ "$protocol" == xmpp-server ]]; then
2248022501
if [[ -n "$XMPP_HOST" ]]; then
@@ -22544,7 +22565,7 @@ determine_service() {
2254422565
outln
2254522566
;;
2254622567
*) outln
22547-
fatal "momentarily only ftp, smtp, lmtp, pop3, imap, sieve, xmpp, xmpp-server, telnet, ldap, nntp, postgres and mysql allowed" $ERR_CMDLINE
22568+
fatal "momentarily only ftp, smtp, lmtp, pop3, imap, xmpp, xmpp-server, telnet, ldap, nntp, sieve, postgres and mysql allowed" $ERR_CMDLINE
2254822569
;;
2254922570
esac
2255022571
# It comes handy later also for STARTTLS injection to define this global. When we do banner grabbing
@@ -22660,7 +22681,7 @@ datebanner() {
2266022681
scan_time_f="$(printf "%04ss" "$SCAN_TIME")" # 4 digits because of windows
2266122682
pr_reverse "$1 $(date +%F) $(date +%T) [$scan_time_f] -->> $node_banner <<--"
2266222683
else
22663-
pr_reverse "$1 $(date +%F) $(date +%T) -->> $node_banner <<--"
22684+
pr_reverse "$1 $(date +%F) $(date +%T) -->> $node_banner <<--"
2266422685
fi
2266522686
outln "\n"
2266622687
[[ "$1" =~ Start ]] && display_rdns_etc

0 commit comments

Comments
 (0)