Cannot run on OSX #284
Comments
|
I'm running on Mavericks and 2.7dev works fine for me. Can you give a specific example of something that fails that we can test against? |
|
it just hangs forever at the last line rDNS (192.168.1.95): C02ML9L4FXYZ I actually have to kill the program / script because it will stay there forever (no errors). |
|
This is how I run it: ./testssl.sh 192.168.1.95:8181 |
|
If I run it the same way from an Ubuntu VM using the same IP and port, it works. Just on Mac it hangs. Here is my OS info: ProductName: Mac OS X |
|
BTW - I run with the command --debug=2 and it produced a directory with some debug files: ~/dev$ cat /tmp/ssltester.ZNlOEY/errorfile.txt ~/dev$ cat /tmp/ssltester.ZNlOEY/environment.txt CVS_REL: 1.379B 2015/09/25 12:35:41 PID: 89278 /usr/local/opt/openssl/bin/openssl version -a: OPENSSL_CONF: /tmp/ssltester.ZNlOEY/gost.conf PATH: /usr/local/opt/openssl:/usr/local/Library/ENV/4.3:/usr/local/opt/openssl/bin:/usr/bin:/bin:/usr/sbin:/sbin CAPATH: /etc/ssl/certs/ SHOW_EACH_C: 0 DEBUG: 2 HSTS_MIN: 179 HEADER_MAXSLEEP: 5 LANG="en_US.UTF-8" |
|
BTW - here is the command and it now shows one additional line before it hangs when I use debug=2: ~/dev$ testssl.sh --debug=2 192.168.1.95:8181 No mapping file found ########################################################### ########################################################### Using "OpenSSL 1.0.2f 28 Jan 2016" [~138 ciphers] on 192.168.1.95:8181 rDNS (192.168.1.95): C02ML9L4FD57. |
|
If I run that exact same command, it executes fine: Of course, I don't have anything sitting on that IP address. |
|
Trying that exact same command on an IP:port that I do have something listening on, I get way too much detail to show here. So, I will instead provide the output of the normal command without the "--debug=2" option: |
|
So, it seems to me that your problem is likely to be the somewhat older version of testssl.sh that you have running, or something specific to your particular machine. |
|
hmmm...ok...is there a way to see what the script is doing at the time it hangs, besides what we have already done? How do I get the same version of the script that you have? BTW, the script I am using runs fine on Ubuntu. |
|
Running this command: sudo testssl.sh --debug=6 --ip 192.168.1.95 192.168.1.95:8181 I get a few more lines at the end - It looks like it is hung after connecting: 192.168.1.95:8181 rDNS (192.168.1.95): C02ML9L4FD57. |
|
You could edit the first line of the testssl.sh script, where it currently says: And change that to be something more like: You get the latest development version of the testssl.sh script directly from this repo. See also the last paragraph of the section entitled "Longer read" at https://testssl.sh/ |
|
Note that the last line of your output above shows the following: So, that's most likely where the script is getting hung -- it is using openssl s_client to connect to that IP address, and it's waiting for a response. It shouldn't wait more than a couple of minutes before that connection attempt times out, and the script then continues with whatever the next line of code is. |
|
OK - replacing the first line in the script with this: #!/usr/bin/env bash -vx yielded this: 362> debugme(): [[ 6 -ge 2 ]] |
|
It hangs for over 10 minutes - still hanged |
|
After about 30 minutes or so, I get this - I run the command as sudo: 439> wait_kill(): ps 10433 Failure calling sysctl: Operation not permitted |
|
a) thx for everybody helping here |
|
PS: If I use Linux and use an IP which is in use but a port which is not, it works ok (there seems to be an error for the banner as it says 2.7dev): Same for FreeBSD 9..3 |
|
I am closing it as we would need an external IP to reproduce it. |
|
I think the problem was missunderstood. I cannot connect to my local glassfish web server and run the script from my mac but i can connect to the same glassfish server from a linux vm running on my mac. Therefore you really shouldnt need my glassfish server. The issue does not seem related to the server. It seems related to the script not running on my mac Sent from my iPhone
|
|
If need anything else from my mac environment ill be glad to provide it. Btw, i also tried to connect to another server on my network from my mac and had the same problem on my mac but not from my linux vm. Sent from my iPhone
|
|
I don't own a MAC and there are unfortunately no VMs, so that part I need a hand. And this bug report is not complete yet. What I am missing from you is more input: a) confirmation of the bug with the master from 2.7 Any special implementation of glassfish, what does the server banner say? |
Let me come back to the question from @bknowles : what does My humble guess is that your firewall is blocking it. |
|
@jrobertsz66 you please run |
|
It works: ~$ /usr/bin/openssl s_client -quiet -connect 192.168.1.95:8181 |
|
Well, please tell me if that is the correct output. It seems to work. After 10 secs or so I get this additional line: read:errno=0 The program then exits. |
|
Also answers to previous questions: a) I am running this version: testssl.sh 2.7dev from https://testssl.sh/dev/ b) Yes - using MAC OSX on the client side and se server side it hangs. If I run the same testssl.sh script from linux pointing to the same GF on the MAC it runs without hanging. c) It is not any special implementation of GF and I don't think it is related to GF and here is why: I was able to reproduce the error talking to PHP server (NOT GF) from my MAC using your script. If I run the script again from Linux pointing to that PHP server, it works again from Linux. Also, if I just take your script and run it from my MAC using www.google.com, it hangs again, but not when I run it from Linux. |
|
Here is the output when it hangs when I use the Google URL: ~/dev$ ./security/scripts/testssl.sh www.google.com No mapping file found ########################################################### ########################################################### Using "OpenSSL 1.0.2d 9 Jul 2015" [~138 ciphers] Testing all IPv4 addresses (port 443): 74.125.22.106 74.125.22.104 74.125.22.103 74.125.22.99 74.125.22.147 74.125.22.105Start 2016-02-29 12:42:57 -->> 74.125.22.106:443 (www.google.com) <<-- |
|
Could it be the OpenSSL version? |
|
@jrobertsz66 can't believe this. try to execute with @ all: somebody with a Mac: can you pls try to verify/falsify this? |
|
Tested on Yosemite with the 2.6 version and the Master with google.com and openssl 1.0.2h from macports. No hang, 2.7 seemingly much slower than 2.6. But: there seems to be a date format problem: Certificate Expiration >= 60 daysFailed conversion of |
|
@logopk : Thx for reporting. 2.6 is old, I am not going to fix that anymore (unless someone creates a PR). The For the upcoming release a final polish for Darwin will be requested. |
|
Dirk, the dateformat issue happened on 2.6 and 2.7dev on a German MacOS X Yosemite AND the 2.7dev docker-image of jumanjiman. |
|
@logopk : could you please do me the favor and open an new issue. If possible add the output of /tmp/ssltestter.*/environment.txt . |
Please try to be exact and careful description as otherwise we won't able to help you. One careful crafted reply suffices in the most cases. It looks like the openssl command doesn't hang but getting the HTTP header does. But I do not understand why that is not being killed. |
|
@drwetter: now if I check, the date format problem on the Mac happens only in 2.6 and it seems to be related to the missing LC_ALL=C. Fair enough if you don't change this anymore. I will file an issue for the docker version of 2.7dev. |
Hi,
When I run the latest script (dowloaded today) on OSX Mavericks - it just hangs. If I run the same script on Ubuntu server 14, it runs fine. Here is the output and then it just hangs after that.
No mapping file found
Using "OpenSSL 1.0.2f 28 Jan 2016" [~138 ciphers] on
C02ML9L4FXYZ:/usr/local/opt/openssl/bin/openssl
(built: "reproducible build, date unspecified", platform: "darwin64-x86_64-cc")
Testing now (2016-02-04 18:14) ---> 192.168.1.95:8181 (192.168.1.95) <---
rDNS (192.168.1.95): C02ML9L4FXYZ.
The text was updated successfully, but these errors were encountered: