DNS HTTPS RR (RFC 9460) for 3.3dev

.github/workflows/codespell.yml

@@ -12,5 +12,5 @@ jobs:
       - uses: actions/checkout@v4
       - uses: codespell-project/actions-codespell@master
         with:
-          skip: ca_hashes.txt,tls_data.txt,*.pem,OPENSSL-LICENSE.txt,CREDITS.md,openssl.cnf,fedora-dirk-ipv6.diff,testssl.1
-          ignore_words_list: borken,gost,ciph,ba,bloc,isnt,chello,fo,alle,anull
+          skip: ca_hashes.txt,tls_data.txt,*.pem,OPENSSL-LICENSE.txt,CREDITS.md,openssl.cnf,testssl.1
+          ignore_words_list: borken,gost,ciph,ba,bloc,isnt,chello,fo,alle,anull,experim

CHANGELOG.md

@@ -7,6 +7,7 @@
 * Bump SSLlabs rating guide to 2009r
 * Check for Opossum vulnerability
 * Enable IPv6 automagically, i.e. if target via IPv6 is reachable just (also) scan it
+* Detect and show DNS HTTPS RR (RFC 9460)
 
 ### Features implemented / improvements in 3.2
 

t/61_diff_testsslsh.t

@@ -63,11 +63,14 @@ $cat_csv      =~ s/AEAD-CHACHA20-POLY1305-SHA256/TLS_CHACHA20_POLY1305_SHA256/g;
 $cat_csv      =~ s/ECDH 253/ECDH 256/g;
 $baseline_csv =~ s/ECDH 253/ECDH 256/g;
 
-
 # this could contain the openssl path
 $cat_csv      =~ s/"engine_problem.*\n//g;
 $baseline_csv =~ s/"engine_problem.*\n//g;
 
+# QUIC gives different results on different platforms
+$cat_csv      =~ s/"QUIC.*\n//g;
+$baseline_csv =~ s/"QUIC.*\n//g;
+
 $diff = diff \$cat_csv, \$baseline_csv;
 
 # Compare the differences to the baseline file -- and print differences if there were detected.

t/baseline_data/default_testssl.csvfile

@@ -1,5 +1,6 @@
 "id","fqdn/ip","port","severity","finding","cve","cwe"
 "engine_problem","/","443","WARN","No engine or GOST support via engine with your ./bin/openssl.Linux.x86_64","",""
+"DNS_HTTPS_rrecord","testssl.sh/81.169.166.184","443","OK","1 . alpn='h2'","",""
 "service","testssl.sh/81.169.166.184","443","INFO","HTTP","",""
 "pre_128cipher","testssl.sh/81.169.166.184","443","INFO","No 128 cipher limit bug","",""
 "SSLv2","testssl.sh/81.169.166.184","443","OK","not offered","",""