Skip to content

Commit 9e9334f

Browse files
drwetterdrwetter
authored
Merge pull request #2619 from testssl/co_header
Add more security headers
2 parents 7d919d4 + 4efe324 commit 9e9334f

File tree

3 files changed

+49
-42
lines changed

3 files changed

+49
-42
lines changed

‎t/61_diff_testsslsh.t‎

Lines changed: 26 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,10 @@
33
# Baseline diff test against testssl.sh (csv output)
44
#
55
# We don't use a full run yet and only the certificate section.
6-
# There we would need to blacklist at least:
6+
# There we would need to blacklist more, like:
77
# cert_serialNumber, cert_fingerprintSHA1, cert_fingerprintSHA256, cert
88
# cert_expirationStatus, cert_notBefore, cert_notAfter, cert_caIssuers, intermediate_cert
99
#
10-
# help is appreciated here
1110

1211
use strict;
1312
use Test::More;
@@ -16,55 +15,54 @@ use Text::Diff;
1615

1716
my $tests = 0;
1817
my $prg="./testssl.sh";
19-
my $master_socket_csv="./t/baseline_data/default_testssl.csvfile";
20-
my $socket_csv="tmp.csv";
21-
my $check2run="-p -s -P --fs -h -U -c -q --ip=one --color 0 --csvfile $socket_csv";
22-
#my $check2run="-p --color 0 --csvfile $socket_csv";
18+
my $baseline_csv="./t/baseline_data/default_testssl.csvfile";
19+
my $cat_csv="tmp.csv";
20+
my $check2run="-p -s -P --fs -h -U -c -q --ip=one --color 0 --csvfile $cat_csv";
2321
my $uri="testssl.sh";
2422
my $diff="";
2523

2624
die "Unable to open $prg" unless -f $prg;
27-
die "Unable to open $master_socket_csv" unless -f $master_socket_csv;
28-
25+
die "Unable to open $baseline_csv" unless -f $baseline_csv;
2926

3027
# Provide proper start conditions
31-
unlink "tmp.csv";
28+
unlink $cat_csv;
3229

33-
# Title
34-
printf "\n%s\n", "Diff unit test IPv4 against \"$uri\"";
30+
my @args=("$prg", "$check2run", "$uri", "2>&1");
3531

3632
#1 run
37-
`$prg $check2run $uri 2>&1`;
38-
39-
$diff = diff $socket_csv, $master_socket_csv;
33+
printf "\n%s\n", "Diff unit test (IPv4) against \"$uri\"";
34+
printf "@args\n";
35+
system("@args") == 0
36+
or die ("FAILED: \"@args\" ");
4037

41-
$socket_csv=`cat tmp.csv`;
42-
$master_socket_csv=`cat $master_socket_csv`;
38+
$cat_csv=`cat $cat_csv`;
39+
$baseline_csv=`cat $baseline_csv`;
4340

4441
# Filter for changes that are allowed to occur
45-
$socket_csv=~ s/HTTP_clock_skew.*\n//g;
46-
$master_socket_csv=~ s/HTTP_clock_skew.*\n//g;
42+
$cat_csv =~ s/HTTP_clock_skew.*\n//g;
43+
$baseline_csv =~ s/HTTP_clock_skew.*\n//g;
44+
45+
# HTTP time
46+
$cat_csv =~ s/HTTP_headerTime.*\n//g;
47+
$baseline_csv =~ s/HTTP_headerTime.*\n//g;
4748

4849
# DROWN
49-
$socket_csv=~ s/censys.io.*\n//g;
50-
$master_socket_csv=~ s/censys.io.*\n//g;
50+
$cat_csv =~ s/censys.io.*\n//g;
51+
$baseline_csv =~ s/censys.io.*\n//g;
5152

52-
# HTTP time
53-
$socket_csv=~ s/HTTP_headerTime.*\n//g;
54-
$master_socket_csv=~ s/HTTP_headerTime.*\n//g;
53+
$diff = diff \$cat_csv, \$baseline_csv;
5554

56-
# Compare the differences to the master file -- and print differences if there were detected.
55+
# Compare the differences to the baseline file -- and print differences if there were detected.
5756
#
58-
cmp_ok($socket_csv, "eq", $master_socket_csv, "Check whether CSV output matches master file from $uri") or
57+
ok($cat_csv eq $baseline_csv, "Check whether CSV output matches baseline file from $uri") or
5958
diag ("\n%s\n", "$diff");
6059

61-
$tests++;
62-
6360
unlink "tmp.csv";
6461

62+
$tests++;
6563
done_testing($tests);
6664
printf "\n";
6765

6866

69-
# vim:ts=5:sw=5:expandtab
67+
# vim:ts=5:sw=5:expandtab
7068

‎t/baseline_data/default_testssl.csvfile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@
7070
"FS_TLS13_sig_algs","testssl.sh/81.169.166.184","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
7171
"HTTP_status_code","testssl.sh/81.169.166.184","443","INFO","200 OK ('/')","",""
7272
"HTTP_clock_skew","testssl.sh/81.169.166.184","443","INFO","0 seconds from localtime","",""
73-
"HTTP_headerTime","testssl.sh/81.169.166.184","443","INFO","1654006271","",""
73+
"HTTP_headerTime","testssl.sh/81.169.166.184","443","INFO","1737570310","",""
7474
"HSTS_time","testssl.sh/81.169.166.184","443","OK","362 days (=31337000 seconds) > 15552000 seconds","",""
7575
"HSTS_subdomains","testssl.sh/81.169.166.184","443","INFO","only for this domain","",""
7676
"HSTS_preload","testssl.sh/81.169.166.184","443","INFO","domain is NOT marked for preloading","",""
@@ -81,6 +81,8 @@
8181
"X-Frame-Options","testssl.sh/81.169.166.184","443","OK","DENY","",""
8282
"X-Content-Type-Options","testssl.sh/81.169.166.184","443","OK","nosniff","",""
8383
"Content-Security-Policy","testssl.sh/81.169.166.184","443","OK","script-src 'unsafe-inline'; style-src 'unsafe-inline' 'self'; object-src 'self'; base-uri 'none'; form-action 'none'; img-src 'self' ; default-src 'self'; frame-ancestors 'self'; upgrade-insecure-requests;","",""
84+
"Cross-Origin-Opener-Policy","testssl.sh/81.169.166.184","443","INFO","same-origin-allow-popups","",""
85+
"Cross-Origin-Resource-Policy","testssl.sh/81.169.166.184","443","INFO","same-site","",""
8486
"banner_reverseproxy","testssl.sh/81.169.166.184","443","INFO","--","","CWE-200"
8587
"heartbleed","testssl.sh/81.169.166.184","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
8688
"CCS","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
@@ -95,7 +97,7 @@
9597
"SWEET32","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
9698
"FREAK","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
9799
"DROWN","testssl.sh/81.169.166.184","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
98-
"DROWN_hint","testssl.sh/81.169.166.184","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=31B44391529821C6A77F3C78B02D716A07F99B8FDB342BF5A78F263C25375968","CVE-2016-0800 CVE-2016-0703","CWE-310"
100+
"DROWN_hint","testssl.sh/81.169.166.184","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=5B4BC205947AED96ECB1879F2668F7F69D696C143BA8D1C69DBB4DC873C92AE9","CVE-2016-0800 CVE-2016-0703","CWE-310"
99101
"LOGJAM","testssl.sh/81.169.166.184","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
100102
"LOGJAM-common_primes","testssl.sh/81.169.166.184","443","OK","--","CVE-2015-4000","CWE-310"
101103
"BEAST_CBC_TLS1","testssl.sh/81.169.166.184","443","MEDIUM","ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA AES256-SHA","CVE-2011-3389","CWE-20"

‎testssl.sh‎

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -582,8 +582,6 @@ tmln_out() { printf -- "%b" "$1\n"; }
582582
out() { printf -- "%b" "$1"; html_out "$(html_reserved "$1")"; }
583583
outln() { printf -- "%b" "$1\n"; html_out "$(html_reserved "$1")\n"; }
584584

585-
#TODO: Still no shell injection safe but if just run it from the cmd line: that's fine
586-
587585
# Color print functions, see also https://www.tldp.org/HOWTO/Bash-Prompt-HOWTO/x329.html
588586
tm_liteblue() { [[ "$COLOR" -ge 2 ]] && { "$COLORBLIND" && tm_out "\033[0;32m$1" || tm_out "\033[0;34m$1"; } || tm_out "$1"; tm_off; } # not yet used
589587
pr_liteblue() { tm_liteblue "$1"; [[ "$COLOR" -ge 2 ]] && { "$COLORBLIND" && html_out "<span style=\"color:#008817;\">$(html_reserved "$1")</span>" || html_out "<span style=\"color:#0000ee;\">$(html_reserved "$1")</span>"; } || html_out "$(html_reserved "$1")"; }
@@ -3127,11 +3125,13 @@ emphasize_stuff_in_headers(){
31273125
-e "s/X-Powered-By/${yellow}X-Powered-By${off}/g" \
31283126
-e "s/X-UA-Compatible/${yellow}X-UA-Compatible${off}/g" \
31293127
-e "s/Link/${yellow}Link${off}/g" \
3128+
-e "s/X-DNS-Prefetch-Control/${yellow}X-DNS-Prefetch-Control${off}/g" \
31303129
-e "s/X-Rack-Cache/${yellow}X-Rack-Cache${off}/g" \
31313130
-e "s/X-Runtime/${yellow}X-Runtime${off}/g" \
31323131
-e "s/X-Pingback/${yellow}X-Pingback${off}/g" \
31333132
-e "s/X-Permitted-Cross-Domain-Policies/${yellow}X-Permitted-Cross-Domain-Policies${off}/g" \
31343133
-e "s/X-AspNet-Version/${yellow}X-AspNet-Version${off}/g" \
3134+
-e "s/X-AspNetMvc-Version/${yellow}X-AspNetMvc-Version${off}/g" \
31353135
-e "s/x-note/${yellow}x-note${off}/g" \
31363136
-e "s/x-global-transaction-id/${yellow}x-global-transaction-id${off}/g" \
31373137
-e "s/X-Global-Transaction-ID/${yellow}X-Global-Transaction-ID${off}/g" \
@@ -3141,7 +3141,7 @@ emphasize_stuff_in_headers(){
31413141
if "$do_html"; then
31423142
if [[ $COLOR -ge 2 ]]; then
31433143
html_out "$(tm_out "$1" | sed -e 's/\&/\&amp;/g' \
3144-
-e 's/</\&lt;/g' -e 's/>/\&gt;/g' -e 's/"/\&quot;/g' -e "s/'/\&apos;/g" \
3144+
-e 's/</\&lt;/g' -e 's/>/\&gt;/g' -e 's/\"/\&quot;/g' -e "s/\'/\&apos;/g" \
31453145
-e "s/\([0-9]\)/${html_brown}\1${html_off}/g" \
31463146
-e "s/Unix/${html_yellow}Unix${html_off}/g" \
31473147
-e "s/Debian/${html_yellow}Debian${html_off}/g" \
@@ -3177,18 +3177,19 @@ emphasize_stuff_in_headers(){
31773177
-e "s/Link/${html_yellow}Link${html_off}/g" \
31783178
-e "s/X-Runtime/${html_yellow}X-Runtime${html_off}/g" \
31793179
-e "s/X-Rack-Cache/${html_yellow}X-Rack-Cache${html_off}/g" \
3180+
-e "s/X-DNS-Prefetch-Control/${html_yellow}X-DNS-Prefetch-Control${html_off}/g" \
31803181
-e "s/X-Pingback/${html_yellow}X-Pingback${html_off}/g" \
31813182
-e "s/X-Permitted-Cross-Domain-Policies/${html_yellow}X-Permitted-Cross-Domain-Policies${html_off}/g" \
3182-
-e "s/X-AspNet-Version/${html_yellow}X-AspNet-Version${html_off}/g")" \
3183+
-e "s/X-AspNet-Version/${html_yellow}X-AspNet-Version${html_off}/g" \
3184+
-e "s/X-AspNetMvc-Version/${html_yellow}X-AspNetMvc-Version${html_off}/g" \
31833185
-e "s/x-note/${html_yellow}x-note${html_off}/g" \
31843186
-e "s/X-Global-Transaction-ID/${html_yellow}X-Global-Transaction-ID${html_off}/g" \
31853187
-e "s/x-global-transaction-id/${html_yellow}x-global-transaction-id${html_off}/g" \
31863188
-e "s/Alt-Svc/${html_yellow}Alt-Svc${html_off}/g" \
3187-
-e "s/system-wsgw-management-loopback/${html_yellow}system-wsgw-management-loopback${html_off}/g"
3188-
#FIXME: this is double code. The pattern to emphasize would fit better into
3189-
# one function.
3190-
# Also we need another function like run_other_header as otherwise "Link" "Alt-Svc" will never be found.
3191-
# And: I matches case sensitive only which might not detect all banners. (sed ignorecase is not possible w/ BSD sed)
3189+
-e "s/system-wsgw-management-loopback/${html_yellow}system-wsgw-management-loopback${html_off}/g" \
3190+
)"
3191+
#FIXME: this is double code. The pattern to emphasize headers should be better in one single function
3192+
# And: It matches case sensitive headers only which won't detect all banners. (sed ignorecase is not a/v for OpenBSD sed)
31923193
else
31933194
html_out "$(html_reserved "$1")"
31943195
fi
@@ -3435,16 +3436,22 @@ run_security_headers() {
34353436

34363437
pr_bold " Security headers "
34373438
# X-XSS-Protection is useless and at worst harmful, see https://news.ycombinator.com/item?id=20472947
3439+
# Expect-CT is deprecated, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT
34383440
for header_and_svrty in "X-Frame-Options OK" \
34393441
"X-Content-Type-Options OK" \
34403442
"Content-Security-Policy OK" \
3441-
"X-Content-Security-Policy OK" \
3442-
"X-WebKit-CSP OK" \
3443+
"X-Content-Security-Policy INFO" \
3444+
"X-WebKit-CSP INFO" \
34433445
"Content-Security-Policy-Report-Only OK" \
3444-
"Expect-CT OK" \
3446+
"Expect-CT INFO" \
34453447
"Permissions-Policy OK" \
3448+
"Cross-Origin-Opener-Policy INFO" \
3449+
"Cross-Origin-Resource-Policy INFO" \
3450+
"Cross-Origin-Embedder-Policy INFO" \
34463451
"X-XSS-Protection INFO" \
34473452
"Access-Control-Allow-Origin INFO" \
3453+
"Access-Control-Allow-Credentials INFO" \
3454+
"Permissions-Policy INFO" \
34483455
"Upgrade INFO" \
34493456
"X-Served-By INFO" \
34503457
"Referrer-Policy INFO" \

0 commit comments

Comments
 (0)