MacOS X test requested #40

drwetter · 2014-11-27T20:43:19Z

Can't tell whether with that old openssl version (native but ports would be interesting too) a error free detection is possible. Without BSD ports under FreeBSD 9 I get useless results.

Can somebody please check against testssl.sh and let me know? Thx!

dmitris · 2015-01-19T13:27:13Z

Is it still outstanding? Which command would you want to try on a Mac -
./testssl.sh https://85.214.71.41
or something else?

drwetter · 2015-01-19T14:44:16Z

That would be great! And the info on the OpenSSL version used (openssl version -a).

PS: The IP address above is not mine anymore. If you mind rather use something different (dev.testssl.sh or testssl.sh).

drwetter · 2015-05-09T09:34:09Z

can somebody help here for the upcoming 2.4?

keith4 · 2015-05-09T17:38:48Z

Is there a specific version of OS X you want tested?

Sent from my iPhone

On May 9, 2015, at 5:34 AM, Dirk Wetter [email protected] wrote:

can somebody help here for the upcoming 2.4?

—
Reply to this email directly or view it on GitHub.

drwetter · 2015-05-09T19:28:47Z

Am 9. Mai 2015 19:38:49 MESZ, schrieb keith4 [email protected]:

Is there a specific version of OS X you want tested?

I own no Apple, so basically every test would help. Best would be first the latest and greatest.

I will do final test on FreeBSD 9 too but I can't tell how much both differ.

Important to me would be glitches in the output and differences in the results.

Cheers, Dirk

On May 9, 2015, at 5:34 AM, Dirk Wetter [email protected]
wrote:

can somebody help here for the upcoming 2.4?

—
Reply to this email directly or view it on GitHub.

Reply to this email directly or view it on GitHub:
#40 (comment)

salt-lick · 2015-05-10T03:30:16Z

OSX 10.10.3
./testssl.sh testssl.sh

¡¡¡ at your own risk !!! /usr/bin/openssl is way too old (< version 1.0)
Proceeding may likely result in false negatives or positives

Followed this http://apple.stackexchange.com/a/126832 and it allowed me to run the script with out this that error.

I then run into this issue.

" Has server cipher order? yes (OK)
Negotiated protocol TLSv1.2
Negotiated cipher ECDHE-RSA-AES256-GCM-SHA384
Cipher order
Protocol:TLSv1: Cipher:ECDHE-RSA-AES256-SHA Cipher:ECDHE-RSA-AES256-SHA Cipher:ECDHE-RSA-AES256-SHA Cipher:ECDHE-RSA-AES256-SHA Cipher:ECDHE-RSA-AES256-SHA Cipher:ECDHE-RSA-AES256-SHA Cipher:ECDHE-RSA-AES256-SHA Cipher:ECDHE-RSA-AES256-SHA Cipher:ECDHE-RSA-AES256-SHA ^C"

Remember when it it did this before?

salt-lick · 2015-05-10T03:39:38Z

also:

./testssl.sh dev.testssl.sh

#########################################################
testssl.sh v2.4rc1 (https://testssl.sh)
($Id: testssl.sh,v 1.242 2015/05/06 16:48:50 dirkw Exp $)

This program is free software. Redistribution +
modification under GPLv2 is permitted.
USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!

Note: you can only check the server with what is
available (ciphers/protocols) locally on your machine!
#########################################################

Using "OpenSSL 1.0.2a 19 Mar 2015" [~ 136 ciphers] on
dev:/usr/local/bin/openssl
(built: "reproducible build, date unspecified", platform: "darwin64-x86_64-cc")

Testing now (2015-05-09 22:38) ---> 81.169.199.25:443 (dev.testssl.sh) <---

rDNS (81.169.199.25): testssl.sh
Service detected: HTTP

--> Testing protocols (via sockets for SSLv2, SSLv3)

SSLv2 not offered (OK)
SSLv3 not offered (OK)
TLS 1 offered
TLS 1.1 offered
TLS 1.2 offered (OK)
SPDY/NPN http/1.1 (advertised)

--> Testing standard cipher lists

Null Cipher not offered (OK)
Anonymous NULL Cipher offered (NOT ok)
Anonymous DH Cipher offered (NOT ok)
40 Bit encryption offered (NOT ok)
56 Bit encryption Local problem: No 56 Bit encryption configured in /usr/local/bin/openssl
Export Cipher (general) offered (NOT ok)
Low (<=64 Bit) offered (NOT ok)
DES Cipher offered (NOT ok)
Triple DES Cipher offered
Medium grade encryption offered
High grade encryption offered (OK)

--> Testing server preferences

Has server cipher order? nope (NOT ok)
Negotiated protocol TLSv1.2
Negotiated cipher DHE-RSA-SEED-SHA (limited sense as client will pick)
Negotiated cipher per proto (limited sense as client will pick)
Cipher:0000: Protocol:SSLv3
Cipher:DHE-RSA-SEED-SHA: Protocol:TLSv1, Protocol:TLSv1.1, Protocol:TLSv1.2
Cipher:ECDHE-RSA-AES256-GCM-SHA384: http/1.1
No further cipher order check as order is determined by the client

--> Testing server defaults (Server Hello)

TLS timestamp: random values, no fingerprinting possible
date: illegal option -- -
usage: date [-jnu] [-d dst] [-r seconds] [-t west] [-v[+|-]val[ymwdHMS]] ...
[-f fmt date | [[[mm]dd]HH]MM[[cc]yy][.ss]] [+format]
./testssl.sh: line 1281: 1431229148 - : syntax error: operand expected (error token is " ")

drwetter · 2015-05-10T08:40:29Z

Thx for this one.

Need to provide a date function for BSD/Linux.. The cipher order formatting will be done also

drwetter · 2015-05-10T17:23:07Z

did some FreeBSD 9 tests.. Looking at that there's still some way to go. How realistic is it a MAC user doesn't use ports?

salt-lick · 2015-05-10T23:23:58Z

I would say, if you were on OSX and running this script, you would be using a port.

Latest Pull
./testssl.sh dev.testssl.sh
--> Testing HTTP header response

HSTS --
HPKP --
Server Apache 1.3.37 (Tunix)
Application tr: illegal option -- t
usage: tr [-Ccsu] string1 string2
tr [-Ccu] -d string1
tr [-Ccu] -s string1
tr [-Ccu] -ds string1 string2

./testssl.sh reddit.com

Cipher order
Protocol:TLSv1: Cipher:ECDHE-RSA-AES128-SHA Cipher:ECDHE-RSA-AES128-SHA Cipher:ECDHE-RSA-AES128-SHA repeat

drwetter · 2015-05-11T06:58:13Z

Those two should fixed, thx for reporting!

FYI: Supporting bare openssl (FreeBSD has "OpenSSL 0.9.8za-freebsd") would be a pain -- I am testing the return values. With "normal" openssl binaries this works if the server doesn't provide the tested feature. OpenSSL 0.9.8za instead returns always 0 and throws an error.

salt-lick · 2015-05-11T11:56:51Z

Looks like you got them now. Great work.

drwetter · 2015-05-11T14:23:44Z

Thx, @salt-lick!

@ALL: If there's anything else using ports, pls let me know. Otherwise I am closing this issue soon.

I will have a closer look @ #101, #102, #103 though but a first glance let me assume the old openssl is the culprit here. That won't be done in 2.4, maybe in a later release.

drwetter · 2015-05-18T19:56:13Z

done for 2.4

- http date - cipher list in preferences - GET_REQ11 now closes the connection - openssl_age comes afeter the banner so that help doesn't need to go thru this - uname -s ==> SYSTEM

This PR provides improvements to `run_mass_testing_parallel()`. Currently, `run_mass_testing_parallel()` treats `$MAX_PARALLEL` as the maximum difference between the number of the test whose results were last processed and the number of the most recently started test. This means that test testssl#40 will not be started until the results of test #20 have been processed. I've encountered situations in which tests 21 though 39 have completed, but test #20 is still running, and so no new tests are started. This PR fixes the problem by checking the status of all running child tests to see if any are complete, rather than just looking at `$NEXT_PARALLEL_TEST_TO_FINISH`. This prevents one slow child test (or a few slow child tests) from slowing up the entire mass testing process. This PR also changes the basis for determining whether a slow child process should be killed. Rather than waiting `$MAX_WAIT_TEST` seconds from the time that the parent started waiting (which is rather arbitrary), it kills the process if `$MAX_WAIT_TEST` seconds have passed since the child test was started. Given this, and that the above change makes it less likely that a slow child test will slow up the overall testing, I increased `$MAX_WAIT_TEST` from 600 seconds to 1200 seconds. I added some `debugme` statements that provide feedback on the status of testing, but in non-debug mode there may be a perception issue. If one test (e.g., test #20) is very slow, testssl.sh will not display any results from later tests until the slow test finishes, even though testssl.sh will continue running new tests in the background. The user, seeing no output from testssl.sh for an extended period of time, may think that testssl.sh has frozen, even though it is really just holding back on displaying the later results so that the results will be displayed in the order in which the tests were started.

drwetter added help wanted question labels Nov 27, 2014

drwetter mentioned this issue Nov 28, 2014

CI #26

Closed

drwetter closed this as completed in 2f79ba5 May 10, 2015

drwetter reopened this May 10, 2015

This was referenced May 10, 2015

no ports && FreeBSD 9 / MacOS X: protocol FP #101

Closed

no ports && FreeBSD 9 / MacOS X: RC4 #102

Closed

no ports && FreeBSD 9 / MacOS X: BEAST #103

Closed

drwetter added a commit that referenced this issue May 11, 2015

- two fixes from #40 reported by @salt-lick

08fe890

drwetter mentioned this issue May 12, 2015

Final testing for 2.4 #92

Closed

drwetter closed this as completed May 18, 2015

drwetter added a commit that referenced this issue Sep 6, 2015

- NUMEROUS FreeBSD9/Darwin FIXES #40

26b4a53

- http date - cipher list in preferences - GET_REQ11 now closes the connection - openssl_age comes afeter the banner so that help doesn't need to go thru this - uname -s ==> SYSTEM

drwetter added a commit that referenced this issue Sep 6, 2015

- two fixes from #40 reported by @salt-lick

8a039b8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MacOS X test requested #40

MacOS X test requested #40

drwetter commented Nov 27, 2014

dmitris commented Jan 19, 2015

drwetter commented Jan 19, 2015

drwetter commented May 9, 2015

keith4 commented May 9, 2015

drwetter commented May 9, 2015

salt-lick commented May 10, 2015

salt-lick commented May 10, 2015

drwetter commented May 10, 2015

drwetter commented May 10, 2015

salt-lick commented May 10, 2015

drwetter commented May 11, 2015

salt-lick commented May 11, 2015

drwetter commented May 11, 2015

drwetter commented May 18, 2015

MacOS X test requested #40

MacOS X test requested #40

Comments

drwetter commented Nov 27, 2014

dmitris commented Jan 19, 2015

drwetter commented Jan 19, 2015

drwetter commented May 9, 2015

keith4 commented May 9, 2015

drwetter commented May 9, 2015

salt-lick commented May 10, 2015

salt-lick commented May 10, 2015

drwetter commented May 10, 2015

drwetter commented May 10, 2015

salt-lick commented May 10, 2015

drwetter commented May 11, 2015

salt-lick commented May 11, 2015

drwetter commented May 11, 2015

drwetter commented May 18, 2015