From 4eb0b0bf7aaa280f27df6037c781dffdfbafdeceda96c70f60e67e3a68544ce3 Mon Sep 17 00:00:00 2001 From: Marcus Meissner Date: Fri, 24 Jan 2020 10:01:15 +0000 Subject: [PATCH] Accepting request 766707 from home:mnhauke:branches:home:buschmann23 Initial package for testssl.sh OBS-URL: https://build.opensuse.org/request/show/766707 OBS-URL: https://build.opensuse.org/package/show/network:utilities/testssl.sh?expand=0&rev=1 --- .gitattributes | 23 ++++ .gitignore | 1 + testssl.sh-2.9.95-set-install-dir.patch | 11 ++ testssl.sh-3.0.tar.gz | 3 + testssl.sh.changes | 156 ++++++++++++++++++++++++ testssl.sh.rpmlintrc | 1 + testssl.sh.spec | 59 +++++++++ 7 files changed, 254 insertions(+) create mode 100644 .gitattributes create mode 100644 .gitignore create mode 100644 testssl.sh-2.9.95-set-install-dir.patch create mode 100644 testssl.sh-3.0.tar.gz create mode 100644 testssl.sh.changes create mode 100644 testssl.sh.rpmlintrc create mode 100644 testssl.sh.spec diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..9b03811 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,23 @@ +## Default LFS +*.7z filter=lfs diff=lfs merge=lfs -text +*.bsp filter=lfs diff=lfs merge=lfs -text +*.bz2 filter=lfs diff=lfs merge=lfs -text +*.gem filter=lfs diff=lfs merge=lfs -text +*.gz filter=lfs diff=lfs merge=lfs -text +*.jar filter=lfs diff=lfs merge=lfs -text +*.lz filter=lfs diff=lfs merge=lfs -text +*.lzma filter=lfs diff=lfs merge=lfs -text +*.obscpio filter=lfs diff=lfs merge=lfs -text +*.oxt filter=lfs diff=lfs merge=lfs -text +*.pdf filter=lfs diff=lfs merge=lfs -text +*.png filter=lfs diff=lfs merge=lfs -text +*.rpm filter=lfs diff=lfs merge=lfs -text +*.tbz filter=lfs diff=lfs merge=lfs -text +*.tbz2 filter=lfs diff=lfs merge=lfs -text +*.tgz filter=lfs diff=lfs merge=lfs -text +*.ttf filter=lfs diff=lfs merge=lfs -text +*.txz filter=lfs diff=lfs merge=lfs -text +*.whl filter=lfs diff=lfs merge=lfs -text +*.xz filter=lfs diff=lfs merge=lfs -text +*.zip filter=lfs diff=lfs merge=lfs -text +*.zst filter=lfs diff=lfs merge=lfs -text diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..57affb6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.osc diff --git a/testssl.sh-2.9.95-set-install-dir.patch b/testssl.sh-2.9.95-set-install-dir.patch new file mode 100644 index 0000000..6d02188 --- /dev/null +++ b/testssl.sh-2.9.95-set-install-dir.patch @@ -0,0 +1,11 @@ +--- a/testssl.sh 2019-04-25 09:21:23.000000000 +0200 ++++ b/testssl.sh 2019-04-27 11:51:37.267236022 +0200 +@@ -136,7 +136,7 @@ + declare -r SYSTEM="$(uname -s)" + declare -r SYSTEMREV="$(uname -r)" + SYSTEM2="" # currently only being used for WSL = bash on windows +-TESTSSL_INSTALL_DIR="${TESTSSL_INSTALL_DIR:-""}" # If you run testssl.sh and it doesn't find it necessary file automagically set TESTSSL_INSTALL_DIR ++TESTSSL_INSTALL_DIR="${TESTSSL_INSTALL_DIR:-"/usr/share/testssl-sh"}" # If you run testssl.sh and it doesn't find it necessary file automagically set TESTSSL_INSTALL_DIR + CA_BUNDLES_PATH="${CA_BUNDLES_PATH:-""}" # You can have your stores some place else + ADDITIONAL_CA_FILES="${ADDITIONAL_CA_FILES:-""}" # single file with a CA in PEM format or comma separated lists of them + CIPHERS_BY_STRENGTH_FILE="" diff --git a/testssl.sh-3.0.tar.gz b/testssl.sh-3.0.tar.gz new file mode 100644 index 0000000..00af9d0 --- /dev/null +++ b/testssl.sh-3.0.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ab3c9a000f0f6703e4fc94821e06f531de6d2799322bf534188ebf766365a9c1 +size 9207778 diff --git a/testssl.sh.changes b/testssl.sh.changes new file mode 100644 index 0000000..ad60d0f --- /dev/null +++ b/testssl.sh.changes @@ -0,0 +1,156 @@ +------------------------------------------------------------------- +Thu Jan 23 20:42:34 UTC 2020 - Martin Hauke + +- Update to version 3.0 + * Full support of TLS 1.3, shows also drafts supported + * Extended protocol downgrade checks + * ROBOT check + * Better TLS extension support + * Better OpenSSL 1.1.1 and higher versions support as well as + LibreSSL >3 + * DNS over Proxy and other proxy improvements + * Decoding of unencrypted BIG IP cookies + * Initial client certificate support + * Warning of 825 day limit for certificates issued after + 2018/3/1 + * Socket timeouts (--connect-timeout) + * IDN/IDN2 servername/URI + emoji support, supposed + libidn/idn2 is installed and DNS resolver is recent)support + * Initial support for certificate compression + * Better JSON output: renamed IDs and findings shorter/better + parsable, also includes certficate + * JSON output now valid also for non-responding servers + * Testing now per default 370 ciphers + * Further improving the robustness of TLS sockets (sending + and parsing) + * Support of supplying timeout value for openssl connect + -- useful for batch/mass scanning + * File input for serial or parallel mass testing can be also in + nmap grep(p)able (-oG) format + * LOGJAM: now checking also for DH and FFDHE groups (TLS 1.2) + * PFS: Display of elliptical curves supported, DH and FFDHE + groups (TLS 1.2 + TLS 1.3) + * Check for session resumption (Ticket, ID) + * TLS Robustness check GREASE and more + * Server preference distinguishes between TLS 1.3 and lower + protocols + * Mark TLS 1.0 and TLS 1.1 as deprecated + * Does a few startup checks which make later tests easier and + faster (determine_optimal_\*()) + * Expect-CT header detection + * --phone-out does certificate revocation checks via OCSP + (LDAP+HTTP) and with CRL + * --phone-out checks whether the private key has been + compromised via https://pwnedkeys.com/ + * Missing SAN warning + * Added support for private CAs + * Way better handling of connectivity problems (counting those, + if threshold exceeded -> bye) + * Fixed TCP fragmentation + * Added --ids-friendly switch + * Exit codes better: 0 for running without error, 1+n for small + errors, >240 for major errors. + * Better error msg suppression (not fully installed OpenSSL) + * Better parsing of HTTP headers & better output of longer HTTP + headers + * Display more HTTP security headers + * HTTP Basic Auth support for HTTP header + * experimental "eTLS" detection + * Dockerfile and repo @ docker hub with that file (see above) + * Java Root CA store added + * Better support for XMPP via STARTTLS & faster + * Certificate check for to-name in stream of XMPP + * Support for NNTP and LMTP via STARTTLS, fixes for MySQL and + PostgresQL + * Support for SNI and STARTTLS + * More robustness for any STARTTLS protocol (fall back to + plaintext while in TLS caused problems) + * Renegotiation checks improved, also no false potive for Node.js + anymore + * Major update of client simulations with self-collected + up-to-date data + * Update of CA certificate stores + * Lots of bug fixes + * More travis/CI checks -- still place for improvements + * Bigger man page review +- specfile cleanup +- Add testssl.sh.rpmlintrc + +------------------------------------------------------------------- +Wed Dec 11 21:11:28 UTC 2019 - Matthias Fehring + +- Update to testssl.sh 2.9.96 (aka 3.0rc6) + * Socket timeouts (--connect-timeout) + * IDN/IDN2 servername support + * pwnedkeys.com support + * Initial support for certificate compression + * Initial client certificate support + * Better indentation for HTTP header outputs + * Better parsing of HTTP headers + * Penalize absence of TLS 1.2 anymore if server supports TLS 1.3 only + * Several improvements related to protocol determination and downgrade responses + * Some logic related using TLS 1.3 aware OpenSSL binaries more or less automagically + * Internal improvements to server preference checks + * Lots of internal and some speed improvements in "pre-flight checks" (comes before outputting any test) + * Mark TLS 1.0 and TLS 1.1 as deprecated + * Support newer OpenSSL/LibreSSL versions + * Improved detection of wrong user input when file was supplied for --csv,--json and --html + * Update client handshakes with newer client data and deprecate other clients + * Regression in CAA RR fixed + * Session resumption fixes + * Session ticket fixes + * Fixes for STARTTLS MySQL and PostgreSQL + * Unit tests for (almost) every STARTTLS protocol supported + * A lot of minor fixes + +------------------------------------------------------------------- +Sat Apr 27 09:55:54 UTC 2019 - Matthias Fehring + +- Update to testssl.sh 2.9.95 (aka 3.0rc5) + * Modernized client handshakes + * Further code sanitizing + * Fixes in CSV files and JSON files creation and some ACE + loadbalancer related improvements + * Fix session tickets and resumption + * OpenSSL 1.1.1 fixes + * Darwin OpenSSL binary + * Updated certificate store + * Add SSLv2 to SWEET +- update testssl.sh-2.9.92-set-install-dir.patch to + testssl.sh-2.9.95-set-install-dir.patch + +------------------------------------------------------------------- +Tue Feb 19 10:43:36 UTC 2019 - Matthias Fehring + +- Update to testssl.sh 2.9.94 (aka 3.0rc4) + * Documentation fixes and additions + * Add new openssl helper binaries + * Bug fix: Scan continues if one of multiple IP addresses per + hostname has a problem + * "eTLS" detection ("visibility information") + * Minimize initial warning "doesn't seem to be a TLS/SSL enabled + server" by using sockets + * Several improvement for SSLv2 only servers + * Handle different cipher preference < TLS 1.3 vs. TLS 1.3 + * Clarify & improve Standard Cipher check (potentially breaking + change) + * Improve SWEET32 test + * Finding certificates is faster and independent on openssl + +------------------------------------------------------------------- +Sat Dec 1 15:58:11 UTC 2018 - Matthias Fehring + +- Update to testssl.sh 2.9.93 (aka 3.0rc3) + * add SSLv2 ciphers *total ciphers now being tested for: 370) + * updated client simulation data + * TLS 1.3 improvements + * STARTTLS NNTP support + * STARTTLS XMPP faster and more reliable + * include DH groups (primes) in pfs section + * Fix TCP fragmentation under remaining OS: FreeBSD / Mac OS X + * further bugfixes and clarifications + +------------------------------------------------------------------- +Wed Nov 28 09:52:06 UTC 2018 - Matthias Fehring + +- initial package version 2.9.92 (aka 3.0rc2) diff --git a/testssl.sh.rpmlintrc b/testssl.sh.rpmlintrc new file mode 100644 index 0000000..6f098d9 --- /dev/null +++ b/testssl.sh.rpmlintrc @@ -0,0 +1 @@ +addFilter("W: pem-certificate /usr/share/testssl-sh/etc/.*pem") diff --git a/testssl.sh.spec b/testssl.sh.spec new file mode 100644 index 0000000..8f2bd0c --- /dev/null +++ b/testssl.sh.spec @@ -0,0 +1,59 @@ +# +# spec file for package testssl.sh +# +# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2018 Matthias Fehring +# +# All modifications and additions to the file contributed by third parties +# remain the property of their copyright owners, unless otherwise agreed +# upon. The license for this file, and modifications and additions to the +# file, is the same license as for the pristine package itself (unless the +# license for the pristine package is not an Open Source License, in which +# case the license is the MIT License). An "Open Source License" is a +# license that conforms to the Open Source Definition (Version 1.9) +# published by the Open Source Initiative. + +# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# + +%define _data_dir_name testssl-sh + +Name: testssl.sh +Version: 3.0 +Release: 0 +Summary: Testing TLS/SSL Encryption Anywhere On Any Port +License: GPL-2.0-or-later +Group: Productivity/Networking/Security +Url: https://testssl.sh +Source0: https://github.com/drwetter/%{name}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +Source1: testssl.sh.rpmlintrc +Patch0: testssl.sh-2.9.95-set-install-dir.patch +Requires: openssl +Requires: bash >= 3.2 +BuildArch: noarch + +%description +testssl.sh is a free command line tool which checks a server's service on +any port for the support of TLS/SSL ciphers, protocols as well as some +cryptographic flaws. + +%prep +%setup -q +%patch0 -p1 +sed -i 's|#!/usr/bin/env bash|#!/usr/bin/bash|g' testssl.sh + +%build + +%install +install -D -m 0644 -t %{buildroot}/%{_datadir}/%{_data_dir_name}/etc etc/* +install -D -m 0755 -t %{buildroot}/%{_bindir} %{name} +install -D -m 0644 -T doc/testssl.1 %{buildroot}/%{_mandir}/man1/%{name}.1 + +%files +%license LICENSE +%doc CHANGELOG.md CREDITS.md Readme.md +%{_bindir}/%{name} +%{_datadir}/%{_data_dir_name} +%{_mandir}/man1/%{name}.1%{ext_man} + +%changelog