Skip to content

Commit f03440b

Browse files
drwetterdrwetter
committed
Speed up startup checks for supported curves and more
In order to avoid delays due to lookups of the hostname "invalid." we just avoid to use "invalid." whenever possible. :-) Therefore we just do a test before whether `$OPENSSL s_client 2>&1 </dev/null` does a connect, except when a WSL system is discovered. If that succeeds we omit the part `-connect invalid.` to check whether the curve is supported. In some quick testing this in fact improved the startup time. This seemed to work under Linux with several openssl and one LibreSSL binary. More testing would be required, especially e.g. under WSL / WSL2. Also in `sclient_supported()` the `$OPENSSL s_client` statement was changed in a similar fashion. That worked so far but would need to be observed more closely.
1 parent 9807bc3 commit f03440b

1 file changed

Lines changed: 32 additions & 18 deletions

File tree

‎testssl.sh‎

Lines changed: 32 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,8 @@ FNAME_PREFIX=${FNAME_PREFIX:-""} # output filename prefix, see --outprefi
184184
APPEND=${APPEND:-false} # append to csv/json/html/log file
185185
OVERWRITE=${OVERWRITE:-false} # overwriting csv/json/html/log file
186186
[[ -z "$NODNS" ]] && declare NODNS # If unset it does all DNS lookups per default. "min" only for hosts or "none" at all
187-
NXCONNECT=${NXCONNECT:-invalid.} # For WSL this helps avoiding DNS requests to "invalid." which windows seem to handle delayed
187+
NXDNS=${NXDNS:-invalid.} # For WSL this helps avoiding DNS requests to "invalid." which windows seem to handle delayed
188+
NXCONNECT="" # needed when when need to test capabilities of the openssl binary
188189
HAS_IPv6=${HAS_IPv6:-false} # if you have OpenSSL with IPv6 support AND IPv6 networking set it to yes
189190
ALL_CLIENTS=${ALL_CLIENTS:-false} # do you want to run all client simulation form all clients supplied by SSLlabs?
190191
OFFENSIVE=${OFFENSIVE:-true} # do you want to include offensive vulnerability tests which may cause blocking by an IDS?
@@ -5349,7 +5350,7 @@ sclient_supported() {
53495350
-tls1_3)
53505351
"$HAS_TLS13" || return 7
53515352
;;
5352-
*) if $OPENSSL s_client -connect $NXCONNECT "$1" </dev/null 2>&1 | grep -aiq "unknown option"; then
5353+
*) if $OPENSSL s_client $NXCONNECT "$1" </dev/null 2>&1 | grep -aiq "unknown option"; then
53535354
return 7
53545355
fi
53555356
;;
@@ -20394,9 +20395,8 @@ find_openssl_binary() {
2039420395
local s_client_has2=$TEMPDIR/s_client_has2.txt
2039520396
local s_client_starttls_has=$TEMPDIR/s_client_starttls_has.txt
2039620397
local s_client_starttls_has2=$TEMPDIR/s_client_starttls_has2
20397-
local openssl_location cwd=""
20398-
local ossl_wo_dev_info
20399-
local curve
20398+
local openssl_location="" cwd=""
20399+
local curve=""
2040020400
local ossl_line1="" yr=""
2040120401
local -a curves_ossl=("sect163k1" "sect163r1" "sect163r2" "sect193r1" "sect193r2" "sect233k1" "sect233r1" "sect239k1" "sect283k1" "sect283r1" "sect409k1" "sect409r1" "sect571k1" "sect571r1" "secp160k1" "secp160r1" "secp160r2" "secp192k1" "prime192v1" "secp224k1" "secp224r1" "secp256k1" "prime256v1" "secp384r1" "secp521r1" "brainpoolP256r1" "brainpoolP384r1" "brainpoolP512r1" "X25519" "X448" "brainpoolP256r1tls13" "brainpoolP384r1tls13" "brainpoolP512r1tls13" "ffdhe2048" "ffdhe3072" "ffdhe4096" "ffdhe6144" "ffdhe8192")
2040220402

@@ -20410,7 +20410,7 @@ find_openssl_binary() {
2041020410
# 2. otherwise, only if on Bash on Windows, use system binaries only.
2041120411
SYSTEM2="WSL"
2041220412
# Workaround for delayed responses of Windows DNS when using "invalid.", see #1738, #1812.
20413-
[[ $NXCONNECT == invalid. ]] && NXCONNECT=127.0.0.1:0
20413+
[[ $NXDNS == invalid. ]] && NXDNS=127.0.0.1:0
2041420414
elif test_openssl_suffix "$TESTSSL_INSTALL_DIR"; then
2041520415
: # 3. otherwise try openssl in path of testssl.sh
2041620416
elif test_openssl_suffix "$TESTSSL_INSTALL_DIR/bin"; then
@@ -20559,10 +20559,21 @@ find_openssl_binary() {
2055920559
$OPENSSL pkey -help 2>&1 | grep -q Error || HAS_PKEY=true
2056020560
$OPENSSL pkeyutl 2>&1 | grep -q Error || HAS_PKUTIL=true
2056120561

20562-
# Below and at other occurrences we do a little trick using "$NXCONNECT" to avoid plain and
20562+
if [[ SYSTEM2 == "WSL" ]]; then
20563+
NXCONNECT=-connect $NXDNS
20564+
else
20565+
# Do we need -connect invalid. or the like? If this connects and bails out with an error message, we do not
20566+
if $OPENSSL s_client 2>&1 </dev/null | grep -Eiaq 'Connection refused|connect error|Bad file descriptor'; then
20567+
NXCONNECT=""
20568+
else
20569+
NXCONNECT="-connect $NXDNS"
20570+
fi
20571+
fi
20572+
20573+
# Below and at other occurrences we do a little trick using "$NXDNS" to avoid plain and
2056320574
# link level DNS lookups. See issue #1418 and https://tools.ietf.org/html/rfc6761#section-6.4
2056420575
if "$HAS_TLS13"; then
20565-
$OPENSSL s_client -tls1_3 -sigalgs PSS+SHA256:PSS+SHA384 -connect $NXCONNECT </dev/null 2>&1 | grep -aiq "unknown option" || HAS_SIGALGS=true
20576+
$OPENSSL s_client -tls1_3 -sigalgs PSS+SHA256:PSS+SHA384 $NXCONNECT </dev/null 2>&1 | grep -aiq "unknown option" || HAS_SIGALGS=true
2056620577
fi
2056720578

2056820579
$OPENSSL s_client -noservername </dev/null 2>&1 | grep -aiq "unknown option" || HAS_NOSERVERNAME=true
@@ -20574,21 +20585,24 @@ find_openssl_binary() {
2057420585
$OPENSSL s_client -no_comp </dev/null 2>&1 | grep -aiq "unknown option" || HAS_NO_COMP=true
2057520586

2057620587
OPENSSL_NR_CIPHERS=$(count_ciphers "$(actually_supported_osslciphers 'ALL:COMPLEMENTOFALL' 'ALL')")
20577-
# The following statement works with OpenSSL 1.0.2, 1.1.1 and 3.0 and LibreSSL 3.4
2057820588
if $OPENSSL s_client -curves </dev/null 2>&1 | grep -aiq "unknown option"; then
20579-
# LibreSSL (tested with version 3.4.1 and 3.0.2) need -groups instead of -curve
20580-
# WSL users connect to "127.0.0.1:0", others to "invalid." or "invalid.:0"
20581-
# The $OPENSSL connect call deliberately fails: when the curve isn't available with the described error messages
20582-
for curve in "${curves_ossl[@]}"; do
20583-
$OPENSSL s_client -groups $curve -connect ${NXCONNECT%:*}:0 </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|Failed to set groups"
20584-
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
20585-
done
20589+
if $OPENSSL s_client -groups </dev/null 2>&1 | grep -aiq "unknown option"; then
20590+
# this is for openssl versions like 0.9.8, they do not have -groups or -curves -- just to be safe
20591+
:
20592+
else
20593+
# LibreSSL (tested with version 3.4.1 and 3.0.2) need -groups instead of -curve
20594+
# WSL users connect to "127.0.0.1:0", others to "invalid." or "invalid.:0"
20595+
# The $OPENSSL connect call deliberately fails: when the curve isn't available with the described error messages
20596+
for curve in "${curves_ossl[@]}"; do
20597+
$OPENSSL s_client -groups $curve $NXCONNECT </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|Failed to set groups"
20598+
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
20599+
done
20600+
fi
2058620601
else
2058720602
HAS_CURVES=true
2058820603
for curve in "${curves_ossl[@]}"; do
2058920604
# Same as above, we just don't need a port for invalid.
20590-
#FIXME: openssl 3 sometimes seems to hang when using '-connect invalid.' for up to 10 seconds
20591-
$OPENSSL s_client -curves $curve -connect $NXCONNECT </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|Call to SSL_CONF_cmd(.*) failed|cannot be set"
20605+
$OPENSSL s_client -curves $curve $NXCONNECT </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|Call to SSL_CONF_cmd(.*) failed|cannot be set"
2059220606
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
2059320607
done
2059420608
fi

0 commit comments

Comments
 (0)