Skip to content

Commit c109caf

Browse files
drwetterdrwetter
committed
Merge branch '3.2' into mac_runner
2 parents 42b3352 + ce6cdfe commit c109caf

10 files changed

Lines changed: 153 additions & 30 deletions

‎.github/workflows/docker-3.2.yml‎

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,25 +5,30 @@ on:
55
branches:
66
- 3.2
77
workflow_dispatch:
8+
# Every week at 8am on Mondays, publish the 3.2 branch:
9+
# NOTE: `schedule` event is only triggered for the default branch:
10+
# https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule
811
schedule:
912
- cron: "0 8 * * 1"
1013

1114
env:
12-
BUILD_VERSION: "3.2"
13-
DOCKER_CLI_EXPERIMENTAL: enabled
15+
GIT_BRANCH: "3.2"
1416

1517
jobs:
1618

1719
deploy:
1820
runs-on: ubuntu-24.04
1921

2022
steps:
23+
- name: lowercase the repository name
24+
run: echo "REPO=${GITHUB_REPOSITORY@L}" >> "${GITHUB_ENV}"
25+
2126
- name: Source checkout
2227
uses: actions/checkout@v4
2328

2429
- name: Setup QEMU
2530
id: qemu
26-
uses: docker/setup-qemu-action@v3.6.0
31+
uses: docker/setup-qemu-action@v3
2732

2833
- name: Setup Buildx
2934
id: buildx
@@ -33,31 +38,31 @@ jobs:
3338
id: docker_meta
3439
uses: docker/metadata-action@v5
3540
with:
36-
images: ${{ github.repository }}
41+
images: ${{ env.REPO }}
3742
labels: |
38-
org.opencontainers.image.version=${{ env.BUILD_VERSION }}
43+
org.opencontainers.image.version=${{ env.GIT_BRANCH }}
3944
org.opencontainers.image.revision=${{ github.sha }}
40-
org.opencontainers.image.title=${{ github.repository }}
45+
org.opencontainers.image.title=${{ env.REPO }}
4146
4247
- name: GitHub login
4348
if: ${{ github.event_name != 'pull_request' }}
44-
uses: docker/login-action@v3.4.0
49+
uses: docker/login-action@v3
4550
with:
4651
registry: ghcr.io
47-
username: ${{ github.actor }}
52+
username: ${{ github.repository_owner }}
4853
password: ${{ secrets.GITHUB_TOKEN }}
4954

5055
- name: Build and push
51-
uses: docker/build-push-action@v6.16.0
56+
uses: docker/build-push-action@v6
5257
with:
5358
push: ${{ github.event_name != 'pull_request' }}
5459
context: .
5560
file: Dockerfile.alpine
5661
platforms: linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6,linux/ppc64le
57-
build-args: BUILD_VERSION
62+
build-args: GIT_BRANCH
5863
cache-from: type=gha, scope=${{ github.workflow }}
5964
cache-to: type=gha, scope=${{ github.workflow }}
6065
labels: ${{ steps.docker_meta.outputs.labels }}
6166
tags: |
62-
ghcr.io/${{ github.repository }}:${{ env.BUILD_VERSION }}
63-
ghcr.io/${{ github.repository }}:latest
67+
ghcr.io/${{ env.REPO }}:${{ env.GIT_BRANCH }}
68+
ghcr.io/${{ env.REPO }}:latest

‎.github/workflows/unit_tests_ubuntu.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
name: testssl.sh CI with Ubuntu
3+
4+
on:
5+
pull_request:
6+
paths-ignore:
7+
- 'utils/**'
8+
- 'doc/**'
9+
- 'bin/**'
10+
- '**.md'
11+
- '**.pem'
12+
- '**.pdf'
13+
- '**.html'
14+
- 'LICENSE'
15+
- 'Dockerfile'
16+
- 'Dockerfile.alpine'
17+
18+
permissions:
19+
contents: read
20+
21+
# see https://github.com/shogo82148/actions-setup-perl
22+
jobs:
23+
build:
24+
runs-on: ${{ matrix.os }}
25+
strategy:
26+
matrix:
27+
os: ['ubuntu-24.04']
28+
perl: ['5.38']
29+
name: Unit test on ${{ matrix.os }}
30+
steps:
31+
- uses: actions/checkout@v4
32+
33+
- name: Set up perl
34+
uses: shogo82148/actions-setup-perl@v1
35+
with:
36+
perl-version: ${{ matrix.perl }}
37+
38+
- name: Install OS dependencies
39+
run: |
40+
sudo apt install dnsutils jsonlint
41+
printf "%s\n" "----------"
42+
perl -V
43+
printf "%s\n" "----------"
44+
curl --version
45+
printf "%s\n" "----------"
46+
openssl version -a
47+
printf "%s\n" "----------"
48+
bash --version
49+
printf "%s\n" "----------"
50+
51+
- name: Install perl modules
52+
run: |
53+
cpanm --notest Test::More
54+
cpanm --notest Data::Dumper
55+
cpanm --notest JSON
56+
cpanm --notest Text::Diff
57+
58+
- name: run it
59+
run: |
60+
prove -v t

Dockerfile-alpine renamed to Dockerfile.alpine

File renamed without changes.

‎Dockerfile.md‎

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,13 @@ Use a volume bind mount to a local host directory to access the files outside of
1717
docker run --rm -it -v /tmp:/data --workdir /data ghcr.io/testssl/testssl.sh:3.2 --htmlfile ./ example.com
1818
```
1919

20-
**NOTE:**
21-
- The UID/GID ownership of the file will be created by the container user `testssl` (`1000:1000`), with permissions `644`.
22-
- Your host directory must permit the `testssl` container user or group to write to that host volume. You could alternatively use [`docker cp`](https://docs.docker.com/reference/cli/docker/container/cp/).
20+
> [!NOTE]
21+
> - The UID/GID ownership of the file will be created by the container user `testssl` (`1000:1000`), with permissions `644`.
22+
> - Your host directory must permit the `testssl` container user or group to write to that host volume. You could alternatively use [`docker cp`](https://docs.docker.com/reference/cli/docker/container/cp/).
2323
24-
### From DockerHub or GHCR
24+
## Images
25+
26+
### Available at DockerHub and GHCR
2527

2628
You can pull the image from either of these registries:
2729
- DockerHub: [`drwetter/testssl.sh`](https://hub.docker.com/r/drwetter/testssl.sh)
@@ -31,7 +33,7 @@ Supported tags:
3133
- `3.2` / `latest`
3234
- `3.0` is the old stable version ([soon to become EOL](https://github.com/testssl/testssl.sh/tree/3.0#status))
3335

34-
### Building
36+
### Building the `testssl.sh` container image
3537

3638
You can build with a standard `git clone` + `docker build`. Tagging the image will make it easier to reference.
3739

@@ -41,26 +43,30 @@ git clone --branch 3.2 --depth 1 https://github.com/testssl/testssl.sh .
4143
docker build --tag localhost/testssl.sh:3.2 .
4244
```
4345

44-
There are two base images available:
45-
- `Dockerfile` (openSUSE Leap), glibc-based + faster.
46-
- `Dockerfile-alpine` (Alpine), musl-based + half the size.
46+
There are two base images supported:
47+
- openSUSE Leap ([`Dockerfile`](./Dockerfile)), glibc-based + faster.
48+
- Alpine ([`Dockerfile`](./Dockerfile.alpine)), musl-based + half the size.
49+
50+
The Alpine variant is made available if you need broarder platform support, or an image about 30MB smaller at the expense of slightly slower performance.
4751

48-
Alpine is made available if you need broarder platform support or an image about 30MB smaller at the expense of speed.
52+
#### Tip - Remote build context + `Dockerfile`
4953

50-
#### Remote build context + `Dockerfile`
5154
You can build with a single command instead via:
5255

5356
```bash
5457
docker build --tag localhost/testssl.sh:3.2 https://github.com/testssl/testssl.sh.git#3.2
5558
```
5659

57-
This will produce a slightly larger image however as `.dockerignore` is not supported with remote build contexts.
60+
> [!NOTE]
61+
> This will produce a slightly larger image as [`.dockerignore` is not supported with remote build contexts](https://github.com/docker/buildx/issues/3169).
62+
63+
---
5864

59-
If you would like to build the Alpine image instead this way, just provide the alternative `Dockerfile` via `--file`:
65+
To build the Alpine image instead, additionally provide the ([alternative `Dockerfile`](./Dockerfile.alpine)) via the `--file` option:
6066

6167
```bash
6268
docker build \
6369
--tag localhost/testssl.sh:3.2-alpine \
64-
--file https://raw.githubusercontent.com/testssl/testssl.sh/3.2/Dockerfile-alpine \
70+
--file https://raw.githubusercontent.com/testssl/testssl.sh/3.2/Dockerfile.alpine \
6571
https://github.com/testssl/testssl.sh.git#3.2
6672
```

‎Readme.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
## Intro
33

4-
[![CI tests](https://github.com/testssl/testssl.sh/actions/workflows/unit_tests.yml/badge.svg)](https://github.com/testssl/testssl.sh/actions/workflows/unit_tests.yml)
4+
[![CI tests](https://github.com/testssl/testssl.sh/actions/workflows/unit_tests_ubuntu.yml/badge.svg)](https://github.com/testssl/testssl.sh/actions/workflows/unit_tests_ubuntu.yml)
55
[![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/testssl/testssl.sh?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
66
[![License](https://img.shields.io/github/license/testssl/testssl.sh)](https://github.com/testssl/testssl.sh/LICENSE)
77
[![Docker](https://img.shields.io/docker/pulls/drwetter/testssl.sh)](https://github.com/testssl/testssl.sh/blob/3.2/Dockerfile.md)
@@ -119,6 +119,9 @@ You can also debug yourself, see [here](https://github.com/testssl/testssl.sh/wi
119119

120120
Please address questions not specifically to the code of testssl.sh to the respective projects below.
121121

122+
#### AI powered docs @ DeepWiki
123+
* https://deepwiki.com/testssl/testssl.sh
124+
122125
#### Web frontend
123126
* https://github.com/johannesschaefer/webnettools
124127
* https://github.com/TKCERT/testssl.sh-webfrontend

‎etc/client-simulation.txt‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,31 @@
310310
ja4+=("t13d1713h1_5b57614c22b0_352634941f3a")
311311
current+=(true)
312312

313-
names+=("Chrome 27 Win 7")
313+
names+=("Android 15 (native)")
314+
short+=("android_15")
315+
ch_ciphers+=("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA")
316+
ciphersuites+=("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")
317+
ch_sni+=("$SNI")
318+
warning+=("")
319+
handshakebytes+=("16030108ad010008a9030391072cb3571b43dc4a8cc1ad1c53edf47f89a855e5e52a701befa485fdcc847d201e6800efce12bdb7a96cdb1d7b6c3d451f1e7275ef468a873b746fe29fa89e2200201a1a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035010008409a9a0000000500050100000000000b0002010044cd0005000302683200170000002b000706eaea03040303002d000201010000001b0019000016706c61792d66652e676f6f676c65617069732e636f6d001b0003020002002300000010000e000c02683208687474702f312e3100120000000a000c000a3a3a11ec001d00170018fe0d00da00000100017b002072f7b873fdab02ad8a7e3ef3dd54613a0051821d29bfcde7f71af8ac49860c0500b0eb42e5082e1426108b1f5d6f67b5c35e26d985cdd337873c1ab77f3fcedc1cbf68cc86b20d82e5764fbadf86df30d44696184d7f73c5d2b67c3bc1955f7ce21900b7448b8ad575ce3533d8bfd9c6b6415a8c523454145c4c6306531fbe2bf0979002fd79fa707dea23d8bcd180662617c0a8b7a1dec7c63eeaf3156571c1e0f97f418b6d278dedf0d07fe027aea8f370d020503cdf7225ba8d0d1c1374c0580382f2880aaf82b7bab3a93f0bb40c91c6000d0012001004030804040105030805050108060601003304ef04ed3a3a00010011ec04c0fba42d89e82e616023e892af4a115a4bc5272dd77199ea670f927605acbd8607741e878836d92b9b35b9c3183b02621c5b6bca8ea93433dc4ad8abaabfc6a69e639d4ac391e9862609bc4ef0c1ba8b674f981cabe3f13007858a029b4d0ba12d170074ffb1468106cc91f9a394a947dbe32312b6936c26b0ad114d54c496e3233c5c53c9f86c35043ab012f9b658040df4614db746075e708657784eb22b1d5e63247b7820e4431ace5a82a85c83bcd686ed3a64ee2b4c55159da00744e0103c74b351a2956d6ba54c54696ad3d742f7d389c257143402254e0c7e7f292d08a7ad896c485fc362a33c73958836c32675d97c4e79c9a92ee00bfd3939ecd09be3fc58e1247ae468848455391cd7291a140103a34f4b054a7e148c9b672cc2f29c4c0482dba0cc3239b32dc6973da04b499c820159a2ec9bba37c6661794cdbbb5bf98d30c4d627ece6a883139a287799591059b5ca949f82234c1960cdd51278152bd39f2b734c187a70c478bcc8908d335a2848ff4b0aeddb4491860a269a74e6b5875c201004a51b72ae79096ec7b5c508a25fc04e2f3a1f3b15bfdc2673ce48a172b4faf175b9ae2750102a50b9893f93b06c2104b6ee73eed379713738d4090c80b30c3afc242a2e0022d8a9559d776069337c314c3ae346da1420465e3b8039635813185ae57ba77e6bc57f9c8afe0388ed228772caa7aaa5037a5234d7c4e7fe0372202add9e471248a87215c6c9a2838fdd0088e039405e62225580e326357c3a2a76f0b775ba07ad451934a916e79c537f0c0ad56e0c939d142809b2b44d0c446f554e52770f3e8cba997a59aa86429304c33161d9806a42c4c4777d7cab66290d26381953276e42a7990214b45989b9a979da1674861da4cea454412ba980842b4e8852f26db1d94416d388826b66a727bb26a51a55ac5dca267cb765a8c0999794e2a1b21048527a4366c5e670f5c36b769b030673b6dee187250f637aeebae1f01260293124bf289246813a345011e04a3e107a27a2b4ab9f4bced961fc7f570116322dab98986185ebce85f674c1bf0e4774d87055d1c2a239758eb20ae45588a294937a4a39361001863931e5d350ee0bc2950228631d49755d26988198cb6592a36e65710e1614f4608c5432138a3a7edca8520b9328aa3a3904028f7803a365194cbba86aeec8dec9711c7574baf0a8061b93762120b94923293c8cda3316f79509bdfe2328106714578130879c63270391508b29e984789067a1c59af71a807e6cb474e888773abb53ea87cced11a6ab6498c301630a65e9d37cd8e44abb18b9f97d2391eb22acc74c2f02633ae3649faf19efbe7b56ac6265b46354bba7197ecb8651c1dbeec4031a9cc3da48d8c6993905a8f0cf131a90a23af5b5b6bd2571dc15c3233a7f74ca3da76cc889a0eba3161790471da3542b4da57d9a1b2fc7c9a2693110828c405d19b8d6a0cec2a911c375c1d100671471401435cfc050b3039730de5ad30b78fd1fcb4ffa604d78ba6f72979db56008d903950e43385184b344b4ea2c0a331d8afb1954f567bb20ceb957bc72bb0c685a0f4176875107e47b59f2b4616901d0c9612e529204ea524222b39dad558deb07bda9919ae25635ff6b791e354b19f92175ed1635841072717a2e7bf8ea666d4ef0087ffe8ef74c50317c30c1406bb15e3a02606e2be51eea33beed8a3a6aef44a001d0020e3b270223362eb0f688b920f024370f2bcdc58f22ef5e7a32cbf318805e67113ff010001006a6a000100002901ca01a5019f02e416892a2f1f90b8c577cb046e05e5df038964982ae7b5b00f2450f97b2820b6a503d15f01fd0e8abe4ab5bfe3383af1fed6b5efd49450f1b773050ed43c8d4623b7d61b9ba793ed8ac81530bf3630efc169e883047220d8b7cc3290375cf03a69217648b952c2c3635f8c1f713d175e0032846f1e8887e75485561dcf7cff2555ed833a4fa236df7cdf971eb6e186213d0779c6eeae1777582a0300a2668cfc948881278534c2e3c102667c8c84325e3d5e31efbae0fdcf31347540e03d8f3c3cbb94a113df6dbf9ae2bc54d14e27dd92cf0eb708e7c5ce73aec09c0f1e006110af1c9ffe2f41cca0982db2d0e329fe6296f65b1d3d9c9bf55d88cd97fb1361c5c86a71f704b56819a5d0266d4214379df7ce093297ab2eddb69c3275c4cb98f25e4ba1849e81d7eccc52294c6aba5f750e5c5c1d41be5f42008870780b86d340108e6ef3c29362a678896d376245418ac27de83e8de2ea309bd294d510a032ff47b5651bf2a8f53fd0bdf5b569576ef6b1ea249e3f2f4a88fdd99d54ce5b53d6935f1dcb4bb6ffeac2ad08f1d8882d54240048414d6a2b7a3e8a0e04cc81ca531600212096370dc60f1571e843667259d4e4eccda96828a23587ecde81ad55262c4c5968")
320+
protos+=("-no_ssl3 -no_ssl2")
321+
tlsvers+=("-tls1_3 -tls1_2")
322+
lowest_protocol+=("0x0303")
323+
highest_protocol+=("0x0304")
324+
alpn+=("h2,http/1.1")
325+
service+=("ANY")
326+
minDhBits+=(-1)
327+
maxDhBits+=(-1)
328+
minRsaBits+=(-1)
329+
maxRsaBits+=(-1)
330+
minEcdsaBits+=(-1)
331+
curves+=("X25519MLKEM768:x25519:secp256r1:secp384r1")
332+
requiresSha2+=(true)
333+
ja3+=("78c89591bc3fffbc6aa884cc7ebbbdb5")
334+
ja4+=("t13d1517h2_8daaf6152771_b6f405a00624")
335+
current+=(true)
336+
337+
names+=("Chrome 27 Win 7")
314338
short+=("chrome_27_win7")
315339
ch_ciphers+=("ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:CAMELLIA256-SHA:AES256-SHA:ECDHE-ECDSA-RC4-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:DHE-DSS-RC4-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:ECDH-RSA-RC4-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-RC4-SHA:ECDH-ECDSA-AES128-SHA:SEED-SHA:CAMELLIA128-SHA:RC4-SHA:RC4-MD5:AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA")
316340
ciphersuites+=("")

‎etc/client-simulation.wiresharked.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ testssl.sh uses the file `client-simulation.txt`. Previously we queried the SSLl
66

77
* Start wireshark / tcpdump at a client or router. If it's too noisy better filter for the target of your choice.
88
* Make sure you create a bit of encrypted traffic to your target. Attention, privacy: if you want to contribute, be aware that the ClientHello contains the target hostname (SNI).
9-
* Make sure the client traffic is specific: For just "Android" do not use an Android browser! Be also careful with factory installed Google Apps, especially on older devices as they might come with a different TLS stack.
9+
* Make sure the client traffic is specific: For just "Android" do not use an Android browser! Be also careful with factory installed Google Apps, especially on older devices as they might come with a different TLS stack. The play store or e.g. f-droid works.
1010
* Stop recording.
1111
* If needed sort for ClientHello.
1212
* Look for the ClientHello which matches the source IP + destination you had in mind. Check the destination hostname in the SNI extension so that you can be sure it's the right traffic.

0 commit comments

Comments
 (0)