Add heartbleed test

5 files changed, 84 insertions, 1 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e01d7ac..f5856b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.4
+
+- Add SSL Compressio check
+- Add Heartbleed test (requires python2)
+- Add some tooltips for topics
+
 ## 2.3
 
 - Add warning if certificate expires in < 30 days.
diff --git a/README.md b/README.md
index b65c4f3..48fbb3b 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,7 @@ Simple PHP script which decodes an SSL connection and/or certificate and display
 - Date validation
 - JSON API
 - Warnings for bad connection settings or certificate options
+- Heartbleed test
 
 ## Requirements
 
diff --git a/functions/connection.php b/functions/connection.php
index 03ac0db..0ecb9e0 100644
--- a/functions/connection.php
+++ b/functions/connection.php
@@ -88,6 +88,36 @@ function ssl_conn_ciphersuites($host, $port, $ciphersuites){
   return $results;
 }
 
+function test_heartbleed($host, $port) {
+  global $current_folder;
+  $exitstatus = 0;
+  $output = 0;
+  $cmdexitstatus = 0;
+  $cmdoutput = 0;
+  $result = 0;
+  $uuid = gen_uuid();
+  $tmpfile = "/tmp/" . $uuid . ".txt";
+  # check if python2 is available
+  exec("command -v python2 >/dev/null 2>&1", $cmdoutput, $cmdexitstatus);
+  if ($cmdexitstatus != 1) {
+    pre_dump("timeout 15 python2 " . getcwd() . "/inc/heartbleed.py " . escapeshellcmd($host) . " --json \"" . $tmpfile . "\" --threads 1 --port " . escapeshellcmd($port) . " --silent");
+    exec("timeout 15 python2 " . getcwd() . "/inc/heartbleed.py " . escapeshellcmd($host) . " --json \"" . $tmpfile . "\" --threads 1 --port " . escapeshellcmd($port) . " --silent", $output, $exitstatus);
+    if (file_exists($tmpfile)) {
+      $json_data = json_decode(file_get_contents($tmpfile),true);
+      foreach ($json_data as $key => $value) {
+        if ($value['status'] == true) {
+          $result = "vulnerable";
+        } else {
+          $result = "not_vulnerable";
+        }
+      }
+      unlink($tmpfile);
+    }
+  } else {
+    $result = "python2error";
+  }
+  return $result;
+}
 
 function test_sslv2($host, $port) {
   $exitstatus = 0;
@@ -401,6 +431,24 @@ function ssl_conn_metadata($data) {
   echo "</td>";
   echo "</tr>";
 
+  //heartbleed
+  if ($data['heartbleed'] != 'python2error') {
+    echo "<tr>";
+    echo "<td>";
+    echo "Heartbleed";
+    echo "</td>";
+    echo "<td>";
+
+    if ($data["heartbleed"] == "not_vulnerable") {
+      echo "<span class='text-success glyphicon glyphicon-ok'></span> - <span class='text-success'>Not vulnerable. </span>";
+    } elseif ($data["heartbleed"] == "vulnerable") {
+      echo "<span class='text-danger glyphicon glyphicon-remove'></span> - <span class='text-danger'>Vulnerable. </span>";
+    } 
+    echo "<a href='http://heartbleed.com/' data-toggle='tooltip' data-placement='top' title='Heartbleed is a serious vulnerability exposing server memory and thus private data to an attacker. Click the question mark for more info.'><span class='glyphicon glyphicon-question-sign' aria-hidden='true'></span></a>";
+    echo "</td>";
+    echo "</tr>";
+  }
+
   // headers
   echo "<tr>";
   echo "<td>";
@@ -532,6 +580,12 @@ function ssl_conn_metadata_json($host, $port, $read_stream, $chain_data=null) {
       $result["port"] = $port;
     }
 
+    //heartbleed
+    $result['heartbleed'] = test_heartbleed($host, $port);
+    if ($result['heartbleed'] == "vulnerable") {
+      $result["warning"][] = 'Vulnerable to the Heartbleed bug. Please update your OpenSSL ASAP!';
+    }
+
     // compression
     $compression = conn_compression($host, $port);
     if ($compression == false) { 
diff --git a/functions/textual.php b/functions/textual.php
index 4a1a48d..d33d184 100644
--- a/functions/textual.php
+++ b/functions/textual.php
@@ -55,4 +55,26 @@ function get_current_folder(){
 }
 
 
+function gen_uuid() {
+  return sprintf( '%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
+    // 32 bits for "time_low"
+    mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff ),
+
+    // 16 bits for "time_mid"
+    mt_rand( 0, 0xffff ),
+
+    // 16 bits for "time_hi_and_version",
+    // four most significant bits holds version number 4
+    mt_rand( 0, 0x0fff ) | 0x4000,
+
+    // 16 bits, 8 bits for "clk_seq_hi_res",
+    // 8 bits for "clk_seq_low",
+    // two most significant bits holds zero and one for variant DCE1.1
+    mt_rand( 0, 0x3fff ) | 0x8000,
+
+    // 48 bits for "node"
+    mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff )
+  );
+}
+
 ?>
\ No newline at end of file
diff --git a/functions/variables.php b/functions/variables.php
index 53556cd..28caaa1 100644
--- a/functions/variables.php
+++ b/functions/variables.php
@@ -17,7 +17,7 @@
 date_default_timezone_set('UTC');
 ini_set('default_socket_timeout', 2);
 
-$version = 2.3;
+$version = 2.4;
 
 $random_blurp = rand(1000,99999);