Skip to content

Commit a0c99d8

Browse files
drwetterdrwetter
authored
Merge pull request #2934 from testssl/shorten_badssl
Shorten badssl GHA as they fail too often
2 parents 0b9715c + 1ce514d commit a0c99d8

File tree

4 files changed

+48
-33
lines changed

4 files changed

+48
-33
lines changed

‎t/21_baseline_starttls.t‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -40,15 +40,15 @@ $uri="smtp-relay.gmail.com:587";
4040
# unlink "tmp.json";
4141
# we will have client simulations later, so we don't need to run everything again:
4242
printf "\n%s\n", "STARTTLS SMTP unit test via sockets --> $uri ...";
43-
$socket_out = `./testssl.sh $check2run_smtp -t smtp $uri 2>&1`;
43+
$socket_out = `$prg $check2run_smtp -t smtp $uri 2>&1`;
4444
# $socket_json = json('tmp.json');
4545
unlike($socket_out, qr/$socket_regex_bl/, "");
4646
$tests++;
4747

4848
#2
4949
# unlink "tmp.json";
5050
printf "\n%s\n", "STARTTLS SMTP unit tests via OpenSSL --> $uri ...";
51-
$openssl_out = `./testssl.sh --ssl-native $check2run_smtp -t smtp $uri 2>&1`;
51+
$openssl_out = `$prg --ssl-native $check2run_smtp -t smtp $uri 2>&1`;
5252
# $openssl_json = json('tmp.json');
5353
unlike($openssl_out, qr/$openssl_regex_bl/, "");
5454
$tests++;
@@ -58,14 +58,14 @@ $uri="pop.gmx.net:110";
5858
#3
5959
# unlink "tmp.json";
6060
printf "\n%s\n", "STARTTLS POP3 unit tests via sockets --> $uri ...";
61-
$socket_out = `./testssl.sh $check2run -t pop3 $uri 2>&1`;
61+
$socket_out = `$prg $check2run -t pop3 $uri 2>&1`;
6262
# $socket_json = json('tmp.json');
6363
unlike($socket_out, qr/$socket_regex_bl/, "");
6464
$tests++;
6565

6666
#4
6767
printf "\n%s\n", "STARTTLS POP3 unit tests via OpenSSL --> $uri ...";
68-
$openssl_out = `./testssl.sh --ssl-native $check2run -t pop3 $uri 2>&1`;
68+
$openssl_out = `$prg --ssl-native $check2run -t pop3 $uri 2>&1`;
6969
# $openssl_json = json('tmp.json');
7070
unlike($openssl_out, qr/$openssl_regex_bl/, "");
7171
$tests++;
@@ -75,14 +75,14 @@ $uri="imap.gmx.net:143";
7575
#5
7676
# unlink "tmp.json";
7777
printf "\n%s\n", "STARTTLS IMAP unit tests via sockets --> $uri ...";
78-
$socket_out = `./testssl.sh $check2run -t imap $uri 2>&1`;
78+
$socket_out = `$prg $check2run -t imap $uri 2>&1`;
7979
# $socket_json = json('tmp.json');
8080
unlike($socket_out, qr/$socket_regex_bl/, "");
8181
$tests++;
8282

8383
#6
8484
printf "\n%s\n", "STARTTLS IMAP unit tests via OpenSSL --> $uri ...";
85-
$openssl_out = `./testssl.sh --ssl-native $check2run -t imap $uri 2>&1`;
85+
$openssl_out = `$prg --ssl-native $check2run -t imap $uri 2>&1`;
8686
# $openssl_json = json('tmp.json');
8787
unlike($openssl_out, qr/$openssl_regex_bl/, "");
8888
$tests++;
@@ -92,7 +92,7 @@ $uri="mail.tigertech.net:4190";
9292
#7
9393
# unlink "tmp.json";
9494
printf "\n%s\n", "STARTTLS MANAGE(SIEVE) unit tests via sockets --> $uri ...";
95-
$socket_out = `./testssl.sh $check2run -t sieve $uri 2>&1`;
95+
$socket_out = `$prg $check2run -t sieve $uri 2>&1`;
9696
# $socket_json = json('tmp.json');
9797
unlike($openssl_out, qr/$openssl_regex_bl/, "");
9898
$tests++;
@@ -102,22 +102,22 @@ $uri="jabber.org:5222";
102102
#8
103103
# unlink "tmp.json";
104104
printf "\n%s\n", "STARTTLS XMPP unit tests via sockets --> $uri ...";
105-
$socket_out = `./testssl.sh $check2run -t xmpp $uri 2>&1`;
105+
$socket_out = `$prg $check2run -t xmpp $uri 2>&1`;
106106
# $socket_json = json('tmp.json');
107107
unlike($openssl_out, qr/$openssl_regex_bl/, "");
108108
$tests++;
109109

110110
# commented out, bc of travis' limits
111111
#
112112
#printf "\n%s\n", "STARTTLS XMPP unit tests via OpenSSL --> $uri ...";
113-
#$openssl_out = `./testssl.sh --ssl-native $check2run -t xmpp $uri 2>&1`;
113+
#$openssl_out = `$prg --ssl-native $check2run -t xmpp $uri 2>&1`;
114114
# $openssl_json = json('tmp.json');
115115
#unlike($openssl_out, qr/$openssl_regex_bl/, "");
116116
#$tests++;
117117

118118
# $uri="jabber.ccc.de:5269";
119119
# printf "\n%s\n", "Quick STARTTLS XMPP S2S unit tests via sockets --> $uri ...";
120-
# $openssl_out = `./testssl.sh --openssl=/usr/bin/openssl -p $check2run -t xmpp-server $uri 2>&1`;
120+
# $openssl_out = `$prg --openssl=/usr/bin/openssl -p $check2run -t xmpp-server $uri 2>&1`;
121121
# # $openssl_json = json('tmp.json');
122122
# unlike($openssl_out, qr/$openssl_regex_bl/, "");
123123
# $tests++;
@@ -128,7 +128,7 @@ $uri="ldap.uni-rostock.de:21";
128128
#9
129129
# unlink "tmp.json";
130130
printf "\n%s\n", "STARTTLS FTP unit tests via sockets --> $uri ...";
131-
$socket_out = `./testssl.sh $check2run -t ftp $uri 2>&1`;
131+
$socket_out = `$prg $check2run -t ftp $uri 2>&1`;
132132
# $socket_json = json('tmp.json');
133133
# OCSP stapling fails sometimes with: 'offered, error querying OCSP responder (ERROR: No Status found)'
134134
$socket_out =~ s/ error querying OCSP responder .*\n//g;
@@ -138,7 +138,7 @@ $tests++;
138138
# commented out, bc of travis' limits
139139
#
140140
# printf "\n%s\n", "STARTTLS FTP unit tests via OpenSSL --> $uri ...";
141-
# $openssl_out = `./testssl.sh --ssl-native $check2run -t ftp $uri 2>&1`;
141+
# $openssl_out = `$prg --ssl-native $check2run -t ftp $uri 2>&1`;
142142
# $openssl_json = json('tmp.json');
143143
# OCSP stapling fails sometimes with: 'offered, error querying OCSP responder (ERROR: No Status found)'
144144
# $openssl_out =~ s/ error querying OCSP responder .*\n//g;
@@ -151,14 +151,14 @@ $uri="db.debian.org:389";
151151

152152
#10
153153
printf "\n%s\n", "STARTTLS LDAP unit tests via sockets --> $uri ...";
154-
$socket_out = `./testssl.sh $check2run -t ldap $uri 2>&1`;
154+
$socket_out = `$prg $check2run -t ldap $uri 2>&1`;
155155
# $socket_json = json('tmp.json');
156156
unlike($socket_out, qr/$socket_regex_bl/, "");
157157
$tests++;
158158

159159
#11
160160
printf "\n%s\n", "STARTTLS LDAP unit tests via OpenSSL --> $uri ...";
161-
$openssl_out = `./testssl.sh --ssl-native $check2run -t ldap $uri 2>&1`;
161+
$openssl_out = `$prg --ssl-native $check2run -t ldap $uri 2>&1`;
162162
# $openssl_json = json('tmp.json');
163163
unlike($openssl_out, qr/$openssl_regex_bl/, "");
164164
$tests++;
@@ -168,14 +168,14 @@ $tests++;
168168
#$uri="144.76.182.167:119";
169169

170170
#printf "\n%s\n", "STARTTLS NNTP unit tests via sockets --> $uri ...";
171-
#$socket_out = `./testssl.sh $check2run -t nntp $uri 2>&1`;
171+
#$socket_out = `$prg $check2run -t nntp $uri 2>&1`;
172172
#unlike($socket_out, qr/$socket_regex_bl/, "");
173173
#$tests++;
174174

175175
# commented out, bc of travis' limits
176176
#
177177
#printf "\n%s\n", "STARTTLS NNTP unit tests via OpenSSL --> $uri ...";
178-
#$openssl_out = `./testssl.sh --ssl-native $check2run -t nntp $uri 2>&1`;
178+
#$openssl_out = `$prg --ssl-native $check2run -t nntp $uri 2>&1`;
179179
# $openssl_json = json('tmp.json');
180180
#unlike($openssl_out, qr/$openssl_regex_bl/, "");
181181
#$tests++;

‎t/23_client_simulation.t‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ $tests++;
5757
#
5858
# unlink "tmp.json";
5959
#printf "\n%s\n", "STARTTLS: Client simulations unit test via OpenSSL --> $uri ...";
60-
#$openssl_out = `./testssl.sh --ssl-native $check2run -t smtp $uri 2>&1`;
60+
#$openssl_out = `$prg --ssl-native $check2run -t smtp $uri 2>&1`;
6161
## $openssl_json = json('tmp.json');
6262
#unlike($openssl_out, qr/$openssl_regex_bl/, "");
6363
#$tests++;

‎t/33_isJSON_severitylevel_valid.t‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ my (
1616
$tests = 0;
1717

1818
my $prg="./testssl.sh";
19-
my $check2run = '-S -e --ids-friendly -U --severity LOW --color 0';
19+
my $check2run = '-S --beast --sweet32 --breach --beast --lucky13 --rc4 --severity LOW --color 0';
2020
my $uri = 'badssl.com';
2121

2222
printf "\n%s\n", "Doing severity level checks";

‎t/51_badssl.com.t‎

Lines changed: 30 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,33 @@ use JSON;
77

88
my $tests = 0;
99
my $prg="./testssl.sh";
10+
my $check2run="-S -q --ip=one --color 0";
11+
my $okout;
12+
my $okjson;
13+
my $uri="badssl.com";
1014

1115
my (
1216
$out,
1317
$json,
1418
$found,
1519
);
16-
# OK
17-
pass("Running testssl.sh against badssl.com to create a baseline (may take 2~3 minutes)"); $tests++;
18-
my $okout = `$prg -S -e --freak --logjam --drown --rc4 --sweet32 --breach --winshock --crime --jsonfile tmp.json --color 0 badssl.com`;
19-
my $okjson = json('tmp.json');
20+
21+
die "Unable to open $prg" unless -f $prg;
22+
23+
# Provide proper start conditions
24+
unlink 'tmp.json';
25+
26+
#1+#2 OK
27+
pass("Running testssl.sh against $uri to create a baseline (may take 2-3 minutes)"); $tests++;
28+
$okout = `$prg $check2run --jsonfile tmp.json $uri`;
29+
$okjson = json('tmp.json');
2030
unlink 'tmp.json';
2131
cmp_ok(@$okjson,'>',10,"We should have more then 10 findings"); $tests++;
2232

2333
# Expiration
24-
pass("Running testssl against expired.badssl.com"); $tests++;
25-
$out = `$prg -S --jsonfile tmp.json --color 0 expired.badssl.com`;
34+
$uri="expired.badssl.com";
35+
pass("Running testssl against $uri"); $tests++;
36+
$out = `$prg $check2run --jsonfile tmp.json $uri`;
2637
like($out, qr/Chain of trust\s+NOT ok \(expired\)/,"The chain of trust should be expired"); $tests++;
2738
like($out, qr/Certificate Validity \(UTC\)\s+expired/,"The certificate should be expired"); $tests++;
2839
$json = json('tmp.json');
@@ -39,8 +50,9 @@ foreach my $f ( @$json ) {
3950
is($found,1,"We should have a finding for this in the JSON output"); $tests++;
4051

4152
# Self signed and not-expired
42-
pass("Running testssl against self-signed.badssl.com"); $tests++;
43-
$out = `$prg -S --jsonfile tmp.json --color 0 self-signed.badssl.com`;
53+
$uri="self-signed.badssl.com";
54+
pass("Running testssl against $uri"); $tests++;
55+
$out = `$prg $check2run --jsonfile tmp.json $uri`;
4456
unlike($out, qr/Certificate Validity \(UTC\)s+expired/,"The certificate should not be expired"); $tests++;
4557
$json = json('tmp.json');
4658
unlink 'tmp.json';
@@ -81,8 +93,9 @@ foreach my $f ( @$okjson ) {
8193
is($found,1,"We should have a finding for this in the JSON output"); $tests++;
8294

8395
# Wrong host
84-
#pass("Running testssl against wrong.host.badssl.com"); $tests++;
85-
#$out = `./testssl.sh -S --jsonfile tmp.json --color 0 wrong.host.badssl.com`;
96+
#$uri="wrong.host.badssl.com";
97+
#pass("Running testssl against $uri"); $tests++;
98+
#$out = ``$prg $check2run --jsonfile tmp.json $uri`;
8699
#unlike($out, qr/Certificate Expiration\s+expired\!/,"The certificate should not be expired"); $tests++;
87100
#$json = json('tmp.json');
88101
#unlink 'tmp.json';
@@ -98,8 +111,9 @@ is($found,1,"We should have a finding for this in the JSON output"); $tests++;
98111
#is($found,1,"We had a finding for this in the JSON output"); $tests++;
99112

100113
# Incomplete chain
101-
pass("Running testssl against incomplete-chain.badssl.com"); $tests++;
102-
$out = `$prg -S --jsonfile tmp.json --color 0 incomplete-chain.badssl.com`;
114+
$uri='incomplete-chain.badssl.com';
115+
pass("Running testssl against $uri"); $tests++;
116+
$out = `$prg $check2run --jsonfile tmp.json $uri`;
103117
like($out, qr/Chain of trust.*?NOT ok\s+\(chain incomplete\)/,"Chain of trust should fail because of incomplete"); $tests++;
104118
$json = json('tmp.json');
105119
unlink 'tmp.json';
@@ -117,8 +131,9 @@ is($found,1,"We should have a finding for this in the JSON output"); $tests++;
117131
# TODO: RSA 8192
118132

119133
# TODO: CBC
120-
#pass("Running testssl against cbc.badssl.com"); $tests++;
121-
#$out = `./testssl.sh -e -U --jsonfile tmp.json --color 0 cbc.badssl.com`;
134+
#$uri='cbc.badssl.com';
135+
#pass("Running testssl against $uri"); $tests++;
136+
#$out = `$prg $check2run --jsonfile tmp.json $uri`;
122137
#like($out, qr/Chain of trust.*?NOT ok\s+\(chain incomplete\)/,"Chain of trust should fail because of incomplete"); $tests++;
123138
#$json = json('tmp.json');
124139
#unlink 'tmp.json';
@@ -144,5 +159,5 @@ sub json($) {
144159
}
145160

146161

147-
# vim:ts=5:sw=5:expandtab
162+
# vim:ts=5:sw=5:expandtab
148163

0 commit comments

Comments
 (0)