Skip to content

Commit 6432376

Browse files
drwetterdrwetter
committed
Merge branch '3.3dev' into https_rr-3.3dev
2 parents c0b5735 + de222f1 commit 6432376

1 file changed

Lines changed: 26 additions & 23 deletions

File tree

‎testssl.sh‎

Lines changed: 26 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -196,16 +196,16 @@ ADDTL_CA_FILES="${ADDTL_CA_FILES:-""}" # single file with a CA in PEM format or
196196
TESTSSL_INSTALL_DIR="${TESTSSL_INSTALL_DIR:-""}" # If you run testssl.sh and it doesn't find it necessary file automagically set TESTSSL_INSTALL_DIR
197197
CA_BUNDLES_PATH="${CA_BUNDLES_PATH:-""}" # You can have your CA stores some place else
198198
EXPERIMENTAL=${EXPERIMENTAL:-false} # a development hook which allows us to disable code
199-
PROXY_WAIT=${PROXY_WAIT:-20} # waiting at max 20 seconds for socket reply through proxy
199+
PROXY_WAIT=${PROXY_WAIT:-10} # waiting at max 10 seconds for socket reply through proxy
200200
DNS_VIA_PROXY=${DNS_VIA_PROXY:-false} # do DNS lookups via proxy. --ip=proxy reverses this
201201
IGN_OCSP_PROXY=${IGN_OCSP_PROXY:-false} # Also when --proxy is supplied it is ignored when testing for revocation via OCSP via --phone-out
202-
HEADER_MAXSLEEP=${HEADER_MAXSLEEP:-5} # we wait this long before killing the process to retrieve a service banner / http header
202+
HEADER_MAXSLEEP=${HEADER_MAXSLEEP:-5} # we wait this long sec before killing the process to retrieve a service banner / http header
203203
MAX_SOCKET_FAIL=${MAX_SOCKET_FAIL:-2} # If this many failures for TCP socket connects are reached we terminate
204204
MAX_OSSL_FAIL=${MAX_OSSL_FAIL:-2} # If this many failures for s_client connects are reached we terminate
205205
MAX_STARTTLS_FAIL=${MAX_STARTTLS_FAIL:-2} # max number of STARTTLS handshake failures in plaintext phase
206206
MAX_HEADER_FAIL=${MAX_HEADER_FAIL:-2} # If this many failures for HTTP GET are encountered we don't try again to get the header
207207
MAX_WAITSOCK=${MAX_WAITSOCK:-5} # waiting at max 5 seconds for socket reply. There shouldn't be any reason to change this.
208-
QUIC_WAIT=${QUIC_WAIT:-3} # QUIC is UDP. Thus we run the connect in the background. This is how long to wait
208+
QUIC_WAIT=${QUIC_WAIT:-3} # QUIC is UDP. Thus we run the connect in the background. This is how long in sec to wait
209209
CCS_MAX_WAITSOCK=${CCS_MAX_WAITSOCK:-5} # for the two CCS payload (each). There shouldn't be any reason to change this.
210210
HEARTBLEED_MAX_WAITSOCK=${HEARTBLEED_MAX_WAITSOCK:-8} # for the heartbleed payload. There shouldn't be any reason to change this.
211211
STARTTLS_SLEEP=${STARTTLS_SLEEP:-10} # max time wait on a socket for STARTTLS. MySQL has a fixed value of 1 which can't be overwritten (#914)
@@ -1953,7 +1953,7 @@ http_head_printf() {
19531953
# $node works here good as it connects via IPv6 first, then IPv4.
19541954
# This is a subshell, so fd 8 is not inherited
19551955
bash -c "exec 8<>/dev/tcp/$node/80" 2>/dev/null &
1956-
wait_kill $! $HEADER_MAXSLEEP
1956+
wait_kill $! $((HEADER_MAXSLEEP * 10))
19571957
if [[ $? -ne 3 ]]; then
19581958
# process with pid !$ wasn't killed but was that a reject? So we try again
19591959
# to make sure there wasn't a TCP reset
@@ -2239,30 +2239,31 @@ check_revocation_ocsp() {
22392239
fi
22402240
}
22412241

2242-
# waits maxsleep seconds (arg2) until process with arg1 (pid) will be killed
2242+
# waits maxsleep 1/10 seconds (arg2) until process with arg1 (pid) will be killed
22432243
#
22442244
# return values
22452245
# 0: process terminated before be killed
22462246
# 3: was killed
22472247
#
22482248
wait_kill(){
2249-
local pid=$1 # pid we wait for or kill
2250-
local maxsleep=$2 # how long we wait before killing
2249+
local pid=$1 # pid we wait for or kill
2250+
local maxsleep=$2 # how long we wait before killing
22512251

22522252
HAD_SLEPT=0
22532253
while true; do
22542254
if ! ps $pid >/dev/null ; then
2255-
return 0 # process terminated before didn't reach $maxsleep
2255+
return 0 # process terminated before didn't reach $maxsleep
22562256
fi
22572257
[[ "$DEBUG" -ge 6 ]] && ps $pid
2258-
sleep 1
2258+
sleep 0.1
22592259
maxsleep=$((maxsleep - 1))
22602260
HAD_SLEPT=$((HAD_SLEPT + 1))
22612261
test $maxsleep -le 0 && break
2262-
done # needs to be killed:
2262+
done # needs to be killed:
22632263
kill $pid >&2 2>/dev/null
2264-
wait $pid 2>/dev/null # make sure pid terminated, see wait(1p)
2265-
return 3 # means killed
2264+
wait $pid 2>/dev/null # make sure pid terminated, see wait(1p)
2265+
HAD_SLEPT=$((HAD_SLEPT/10)) # correct HAD_SLEPT. #FIXME: is only being used by run_http_header()
2266+
return 3 # means killed
22662267
}
22672268

22682269
# Convert date formats -- we always use GMT=UTC here
@@ -2505,7 +2506,7 @@ service_detection() {
25052506
else
25062507
# SNI is not standardized for !HTTPS but fortunately for other protocols s_client doesn't seem to care
25072508
tm_out "$GET_REQ11" | $OPENSSL s_client $(s_client_options "$1 -quiet $BUGS -connect $NODEIP:$PORT $PROXY $SNI") >$TMPFILE 2>$ERRFILE &
2508-
wait_kill $! $HEADER_MAXSLEEP
2509+
wait_kill $! $((HEADER_MAXSLEEP * 10))
25092510
was_killed=$?
25102511
fi
25112512
head $TMPFILE | grep -aq '^HTTP/' && SERVICE=HTTP
@@ -2625,7 +2626,7 @@ run_http_header() {
26252626
[[ -z "$1" ]] && url="/" || url="$1"
26262627

26272628
tm_out "$GET_REQ11" | $OPENSSL s_client $(s_client_options "$OPTIMAL_PROTO $BUGS -quiet -ign_eof -connect $NODEIP:$PORT $PROXY $SNI") >$HEADERFILE 2>$ERRFILE &
2628-
wait_kill $! $HEADER_MAXSLEEP
2629+
wait_kill $! $((HEADER_MAXSLEEP * 10))
26292630
if [[ $? -eq 0 ]]; then
26302631
# Issue HTTP GET again as it properly finished within $HEADER_MAXSLEEP and didn't hang.
26312632
# Doing it again in the foreground to get an accurate header time
@@ -6257,7 +6258,7 @@ sub_quic() {
62576258
fi
62586259
OPENSSL_CONF='' $use_openssl s_client -quic -alpn h3 -connect $NODEIP:$PORT -servername $NODE </dev/null \
62596260
2>$sclient_errfile >$sclient_outfile &
6260-
wait_kill $! $QUIC_WAIT
6261+
wait_kill $! $((QUIC_WAIT * 10))
62616262
ret=$?
62626263
if [[ $ret -eq 3 ]]; then
62636264
# process was killed
@@ -11797,16 +11798,17 @@ starttls_just_send(){
1179711798
}
1179811799

1179911800
# arg1: (optional): wait time
11801+
#
1180011802
starttls_just_read(){
11801-
local waitsleep=$STARTTLS_SLEEP
11802-
[[ -n "$1" ]] && waitsleep=$1
11803+
local waitsleep=${1:-$STARTTLS_SLEEP}
11804+
1180311805
if [[ "$DEBUG" -ge 2 ]]; then
1180411806
echo "=== just read banner ==="
1180511807
cat <&5 &
1180611808
else
1180711809
dd of=/dev/null count=8 <&5 2>/dev/null &
1180811810
fi
11809-
wait_kill $! $waitsleep
11811+
wait_kill $! $((waitsleep * 10))
1181011812
return 0
1181111813
}
1181211814

@@ -12377,7 +12379,7 @@ sockread() {
1237712379
[[ -z "$2" ]] && maxsleep=$MAX_WAITSOCK || maxsleep=$2
1237812380
SOCK_REPLY_FILE=$(mktemp $TEMPDIR/ddreply.XXXXXX) || return 7
1237912381
dd bs=$1 of=$SOCK_REPLY_FILE count=1 <&5 2>/dev/null &
12380-
wait_kill $! $maxsleep
12382+
wait_kill $! $((maxsleep * 10))
1238112383
return $?
1238212384
}
1238312385

@@ -18134,13 +18136,14 @@ run_crime() {
1813418136
# when GET command was stalled or killed (which is no not always used)
1813518137
# and echos "warn_*". It return 0 when everything went ok and echos the
1813618138
# compression if any.
18139+
#
1813718140
sub_breach_helper() {
1813818141
local get_command="$1"
1813918142
local detected_compression=""
1814018143
local -i was_killed=0
1814118144

1814218145
safe_echo "$get_command" | $OPENSSL s_client $(s_client_options "$OPTIMAL_PROTO $BUGS -quiet -ign_eof -connect $NODEIP:$PORT $PROXY $SNI") 1>$TMPFILE 2>$ERRFILE &
18143-
wait_kill $! $HEADER_MAXSLEEP
18146+
wait_kill $! $((HEADER_MAXSLEEP * 10))
1814418147
was_killed=$? # !=0 when it was killed
1814518148
detected_compression=$(grep -ia ^Content-Encoding: $TMPFILE)
1814618149
detected_compression="$(strip_lf "$detected_compression")"
@@ -22574,7 +22577,7 @@ get_txt_record() {
2257422577
shouldwedo_ipv6() {
2257522578
"$do_ipv4_only" && return 0
2257622579
bash -c "exec 5<>/dev/tcp/$1/$PORT" &>/dev/null &
22577-
wait_kill $! $MAX_WAITSOCK
22580+
wait_kill $! $((MAX_WAITSOCK * 10))
2257822581
if [[ $? -eq 3 ]]; then
2257922582
# was killed, so this got stuck
2258022583
IPv6_OK=false
@@ -23186,7 +23189,7 @@ determine_optimal_proto() {
2318623189
$OPENSSL s_client $(s_client_options "$proto $BUGS -connect "$NODEIP:$PORT" -msg $PROXY $SNI") </dev/null >$TMPFILE 2>>$ERRFILE
2318723190
else
2318823191
safe_echo "$GET_REQ11" | $OPENSSL s_client $(s_client_options "$proto $BUGS -connect "$NODEIP:$PORT" -msg $PROXY $SNI -ign_eof -enable_pha") >$TMPFILE 2>>$ERRFILE &
23189-
wait_kill $! $HEADER_MAXSLEEP
23192+
wait_kill $! $((HEADER_MAXSLEEP * 10))
2319023193
if [[ $? -eq 0 ]]; then
2319123194
# Issue HTTP GET again as it properly finished within $HEADER_MAXSLEEP and didn't hang.
2319223195
# Doing it again in the foreground to get an accurate return code.
@@ -23224,7 +23227,7 @@ determine_optimal_proto() {
2322423227
if [[ "$(has_server_protocol "tls1_2")" -eq 0 ]] || [[ "$(has_server_protocol "tls1_1")" -eq 0 ]] || \
2322523228
[[ "$(has_server_protocol "tls1")" -eq 0 ]] || [[ "$(has_server_protocol "ssl3")" -eq 0 ]]; then
2322623229
safe_echo "$GET_REQ11" | $OPENSSL s_client $(s_client_options "$BUGS -connect "$NODEIP:$PORT" -msg $PROXY $SNI -ign_eof -no_tls1_3") >$TEMPDIR/client_auth_test.txt 2>>$ERRFILE &
23227-
wait_kill $! $HEADER_MAXSLEEP
23230+
wait_kill $! $((HEADER_MAXSLEEP * 10))
2322823231
# If the HTTP properly finished within $HEADER_MAXSLEEP and didn't hang, then
2322923232
# do it again in the foreground to get an accurate return code. If it did hang,
2323023233
# there is no way to test for client authentication, so don't try.

0 commit comments

Comments
 (0)