You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# This script (adapted from the ssh-audit project) will set up a docker image with
7
-
# multiple SSL/TLS servers. They are each executed one at a time, and sslscan is run
8
-
# against them. The output of sslscan is compared against the expected output. If
9
-
# they match, the test passes; otherwise the test fails.
6
+
# This script (adapted from the ssh-audit project) will set up a docker image with multiple SSL/TLS servers. They are each executed one at a time, and sslscan is run against them. The output of sslscan is compared against the expected output. If they match, the test passes; otherwise the test fails.
10
7
#
8
+
# Running this script with no arguments causes it to build the docker image (if it doesn't yet exist), then run all tests.
11
9
#
12
-
# For debugging purposes, here is a cheat sheet for manually running the docker image:
13
-
#
14
-
# docker run -p 4443:443 --security-opt seccomp:unconfined -it sslscan-test:3 /bin/bash
10
+
# Running the script with a test number argument (i.e.: './docker_test.sh 2') will run the docker image for test #2 only (in the background) and do nothing else. This allows the test itself to be debugged.
15
11
#
16
12
17
-
#
18
-
# Running this script with no arguments causes it to build the docker image (if it
19
-
# doesn't yet exist), then run all tests.
20
-
#
21
-
# Running the script with a test number argument (i.e.: './docker_test.sh 2') will
22
-
# run the docker image for test #2 only (in the background) and do nothing else. This
23
-
# allows the test itself to be debugged.
24
-
#
25
13
14
+
# This is the docker tag for the image. If this tag doesn't exist, then we assume the image is out of date, and generate a new one with this tag.
15
+
IMAGE_VERSION=4
26
16
27
-
# This is the docker tag for the image. If this tag doesn't exist, then we assume the
28
-
# image is out of date, and generate a new one with this tag.
29
-
IMAGE_VERSION=3
30
-
31
-
# This is the name of our docker image.
17
+
# This is the name of our test image.
32
18
IMAGE_NAME=sslscan-test
33
19
34
20
@@ -44,190 +30,12 @@ GREENB="\033[1;32m" # Green + bold
44
30
all_passed=1
45
31
46
32
47
-
# Number of processors on this system (used to compile parallel builds).
48
-
NUM_PROCS=`/usr/bin/nproc --all 2> /dev/null`
49
-
if [[ $NUM_PROCS=='' ]];then
50
-
NUM_PROCS=4
51
-
fi
52
-
53
-
54
33
# Returns 0 if current docker image exists.
55
34
functioncheck_if_docker_image_exists {
56
35
images=`docker image ls | grep -E "$IMAGE_NAME[[:space:]]+$IMAGE_VERSION"`
echo -e "\n\n${YELLOWB}Compiling OpenSSL v${version} with \"-j ${compile_num_procs}\"...${CLR}"
109
-
pushd$output_dir
110
-
./config $compile_args
111
-
if [[ $precompile_command!='' ]];then$precompile_command;fi
112
-
make -j $compile_num_procs
113
-
114
-
# Ensure that the 'openssl' command-line tool was built.
115
-
if [[ !-f"apps/openssl" ]];then
116
-
echo -e "${REDB}Error: compilation failed! apps/openssl not found.${CLR}\n\nStrangely, sometimes OpenSSL v1.0.0 fails for no reason; simply running this script again and changing nothing fixes the problem.\n\n"
117
-
exit 1
118
-
fi
119
-
120
-
# Copy the 'openssl' app to the top-level docker building dir as, e.g. 'openssl_prog_v1.0.0'. Then we can delete the source code directory and move on.
121
-
cp "apps/openssl""../openssl_prog_v${version}"
122
-
popd
123
-
124
-
# Delete the source code directory now that we built the 'openssl' tool and moved it out.
125
-
rm -rf $output_dir
126
-
echo -e "\n\n${YELLOWB}Compilation of v${version} finished.${CLR}\n\n"
make CFLAGS=-I${nettle_parent_dir} LDFLAGS="-L${nettle_source_dir_abs} -lhogweed -lnettle" -j $compile_num_procs
209
-
210
-
# Ensure that the gnutls-serv and gnutls-cli tools were built
211
-
if [[ (! -f "src/.libs/gnutls-cli") || (! -f "src/.libs/gnutls-serv") ]];then
212
-
echo -e "${REDB}Error: compilation failed! gnutls-cli and/or gnutls-serv not found.${CLR}\n"
213
-
exit 1
214
-
fi
215
-
216
-
# Copy the gnutls-cli and gnutls-serv apps to the top-level docker building dir as, e.g. 'gnutls-cli-v3.6.11.1'. Then we can delete the source code directory and move on.
#run_test_20 "0" # Unique GnuTLS algorithms that sslscan does not currently detect. Disabled until they are implemented.
279
83
}
280
84
281
85
@@ -327,17 +131,15 @@ function run_test_8 {
327
131
}
328
132
329
133
330
-
#Runs nginx with client certificate checking (signed by the CA in docker_test/ca_cert.pem). sslscan will connect and make an HTTP request (--http). The HTTP response code should be 200 to signify that the certificate was accepted. Otherwise, nginx returns HTTP code 400 if no client certificates were presented.
134
+
#OpenSSL v3.5.0, TLSv1.3 only, with all supported groups.
#Runs nginx with client certificate checking, just as above. Except this time, we connect with no certificate. The HTTP response code should be "400 Bad Request".
140
+
#GnuTLS v3.8.9, TLSv1.3 only, with all supported groups.
# Run a test. Set the first argument to '1' to enable test debugging. Second argument is the test number to run. Third argument is the executable and its args to be run inside the container.
395
207
functionrun_test {
396
208
debug=$1
397
209
test_number=$2
@@ -417,9 +229,7 @@ function run_test {
417
229
# Wait 250ms to ensure that the services in the container are fully initialized.
418
230
sleep 0.25
419
231
420
-
# Run sslscan and cut out the first two lines. Those contain the version number
421
-
# and local version of OpenSSL, which can change over time (and when they do, this
422
-
# would break the test if they were left in).
232
+
# Run sslscan and cut out the first two lines. Those contain the version number and local version of OpenSSL, which can change over time (and when they do, this would break the test if they were left in).
0 commit comments