-
-
Notifications
You must be signed in to change notification settings - Fork 86
/
Copy patho-saft.tcl
executable file
·5372 lines (5102 loc) · 231 KB
/
o-saft.tcl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/sh
#| restarts using wish \
exec wish "$0" ${1+"$@"}
#!#############################################################################
#!# Copyright (c) 2025, Achim Hoffmann
#!#----------------------------------------------------------------------------
#!# If this tool is valuable for you and we meet some day, you can spend me an
#!# O-Saft. I'll accept good wine or beer too :-). Meanwhile -- 'til we meet --
#!# your're encouraged to make a donation to any needy child you see. Thanks!
#!#----------------------------------------------------------------------------
#!# This software is provided "as is", without warranty of any kind, express or
#!# implied, including but not limited to the warranties of merchantability,
#!# fitness for a particular purpose. In no event shall the copyright holders
#!# or authors be liable for any claim, damages or other liability.
#!# This software is distributed in the hope that it will be useful.
#!#
#!# This software is licensed under GPLv2.
#!#
#!# GPL - The GNU General Public License, version 2
#!# as specified in: http://www.gnu.org/licenses/gpl-2.0
#!# or a copy of it https://github.com/OWASP/O-Saft/blob/master/LICENSE.md
#!# Permits anyone the right to use and modify the software without limitations
#!# as long as proper credits are given and the original and modified source
#!# code are included. Requires that the final product, software derivate from
#!# the original source or any software utilizing a GPL component, such as
#!# this, is also licensed under the same GPL license.
#!#############################################################################
#? NAME
#? $0 - simple GUI for o-saft.pl
#?
#? SYNOPSIS
#? $0 [OPTIONS] [host:port] [host:port] ...
#? $0 [OPTIONS] --load=result-from-o-saft.pl-file
#? $0 [OPTIONS] [+commands] [host:port] [host:port] ...
#?
#? DESCRIPTION
#? This is a simple GUI for O-Saft - OWASP SSL advanced forensic tool.
#? The GUI supports all commands (Cmd menu or Commands tab) and options
#? (Opt menu or Options tab) available in o-saft.pl. For each command
#? o-saft.pl will be executed as specified. Results are printed in a new
#? tab of the GUI. A filter to markup some important texts is applied to
#? the results in the GUI. This filter can be modified and extended (see
#? Config menu or Filter tab).
#? All results and settings (commands and options) can be saved to files.
#?
#? It can be used to read saved results from other calls of o-saft.pl.
#?
#? Any argument starting with + are considered a command for o-saft.pl
#? and o-saft.pl will be started with all other options, commands and
#? targets and show the results in the GUI.
#? This means that following usage provides the same results:
#? o-saft.pl +CMD --OPT ... target
#? $0 +CMD --OPT ... target
#?
#? Please section GUI below for a brief description of the tool.
#?
#? OPTIONS
#? Options for information and help (this tool):
#? --h print this text
# ? --h prints also the section HACKER's INFO
#? --help=opts print options (for compatibility with o-saft.pl)
#? --version print version number
#? +VERSION print version number (for compatibility with o-saft.pl)
#?
#? Options for configuration and startup behaviour:
#? --rc print template for .o-saft.tcl
#? --rc=FILE read configuration from FILE instead of .o-saft.tcl
#? --no-rc do not read .o-saft.tcl and o-saft-img.tcl
#? --no-docs use configuration texts returned from o-saft.pl instead of
#? reading prepared static files
#? --gen-docs generate static files for configuration texts
#? --pod use podviewer to show help text; default: (inline)
#? --tkpod use tkpod to show help text; default: (inline)
#? --perl=FILE use FILE as executable for perl; default: (empty)
#? --load=FILE read data from FILE and show in Result tab
#? --stdin read data from STDIN and show in Result tab
#?
#? Options for use with docker:
#? --docker use o-saft-docker instead of o-saft.pl
#? --docker-id=ID
#? use Docker image ID (registry:tag); default: owasp/o-saft
#? --docker-tag=ID use Docker image ID with tag; default: (empty)
#?
#? Options for GUI behaviour:
#? --gui dummy for compatibility with other tools
#? --gui-tip use own tooltip
#? --gui-button=text use simple texts as labels for buttons
#? --gui-button=image use images for buttons (see o-saft-img.tcl)
#? (not recommended on Mac OS X, because Aqua has nice buttons)
#? --gui-layout=classic tool layout for view on desktop
#? --gui-layout=tablet tool layout for tablet, smartphone; default
#? --gui-result=text print result of o-saft.pl as simple plain text
#? --gui-result=table print result of o-saft.pl formated in a table
#?
#? Options for debugging:
#? --v print verbose messages (startup and calling external tools)
#? --d print more verbose messages (for debugging)
#? --d=D print debug messages according level
#? D=1 - print verbose messages (main)
#? D=2 - print proc calls (those not triggerd by events)
#? D=4 - print debugging in proc
#? D=8 - print verbose debugging for "help" window
#? values can be combined, like --d=6 to print procs and data,
#? all --d=* imply --v
#? --trace use Tcl's trace to trace proc calls
#? --trace-CLI print command-line (for compatibility with other tools)
#?
#? Options for testing:
#? +quit exit without GUI (for compatibility with o-saft.pl)
#? --test=FILE read FILE and print on STDOUT; used for testing only
#? --test-docs just print used external o-saft.pl.--help=* files
#? --test-tcl just print debug information; similar to: --d +quit
#? --test-osaft just print text used for help window (help button)
#?
#? Option aliases for compatibility with other programs or legacy:
#? # Alias Option
#? #----------+--------------------
#? --image --gui-button=image
#? --text --gui-button=text
#? --tip --gui-tip
#? --id=ID --docker-id=ID
#? --tag=TAG --docker-tag=TAG
#?
#? Options passed through to o-saft.pl:
#? +* any option starting with +
#? --* any other option starting with --
# TODO: --post=PRG --post= parameter passed to o-saft
#?
#? GUI
#? All functionality is documented with balloon help on each checkbutton,
#? input field, button or table header line.
#? Unfortunately balloon help is not available on pulldown menues.
#?
#? Functinality related to o-saft.pl is available in the main window.
#? Result tab (see below) will be used to show results from o-saft.pl .
#? Often used commands and options for o-saft.pl are available in pull-
#? down menues. Additionally own windows are provided for all available
#? commands and options of o-saft.pl .
#?
#? ☰ (pullwon menu)
#? Contains at least:
#? All Command same as Cmd (pullwon menu)
#? All Options same as Opt (pullwon menu)
#? Config GUI same as Config (pullwon menu)
#? Load Results load results of o-saft.pl from file
#? Cipher Suites show table with all cipher suites
#? About show this help
#? Help show help of o-saft.pl
#? Quit bye, bye
#?
#? Cmd (pullwon menu)
#? Contains some often used commands and a submenu with all commands.
#? Note that selecting any of the +commands here starts o-saft.pl with
#? that command immediately and shows result in a new tab.
#?
#? Opt (pullwon menu)
#? Contains some often used options and a submenu with all options. They
#? will be used with next +commands or "Start" button.
#?
#? Config (pullwon menu)
#? Provides some more configurations, each in its own window.
#?
#? Start (button)
#? Calls o-saft.pl for specified targets. It should be used when other
#? +commands (see Cmd->All Commands menu) are selected.
#?
#? "target" (entry field)
#? List of target to be checked.
#?
#? Result tab
#? The results of o-saft.pl are shown in a new tab. The format (layout)
#? of the result can be simple "text" or "table". This can be configured
#? in the Config menu or Options tab.
#?
#? The difference between the formats are:
#? "table"
#? The table consist of 4 columns: Nr, Label, Value and Comment. It can
#? be sorted according each. All Filters are applied to matching lines.
#? The Filter will hide the lines completely.
#? Saving the results will only save the visible lines. These lines are
#? saved in the order of the last sorting.
#? Some informational lines and all header lines (see --header option)
#? from o-saft.pl are not shown and will not be saved.
#? "text"
#? In this format, the results are shown in the same format as returned
#? by o-saft.pl. Lines cannot be sorted. The Filter is applied to each
#? matching line. The Filter will just remove the text, but not hide
#? the lines.
#? Saving the result will save the complete text.
#?
#? Note that the +info command always uses "text" format".
#?
#? Each Result tab provides following Buttons: "Save", "STDOUT", "Filter"
#? and "Close tab".
#?
#? Tipp: if the results should look similar to those returned by o-saft.pl
#? use the "Filter" window and enable the "== CMT" checkbox.
#?
#? Status
#? A scrollable text is available at bottom of the main window. All calls
#? to o-saft.pl with all +commands and -options will be shown there. The
#? command are ready for C&P into a shell (if necessary).
#?
#? Examples for Filter in Result tab
#? Please see "Config Filter" window and its ballon help.
#?
#? Match complete line containing Certificate:
#? r=1 e=0 #=0 RegEx=Certificate
#? Match word Target:
#? r=0 e=1 #=6 RegEx=Target
#? Match label text and emphase:
#? r=1 e=0 #=1 RegEx=^[A-Za-z][^:]*\s* Font=osaftHead
#?
#? Help / Search
#? Beside balloon help, please see ☰ above.
#?
#? The [?] button or "? Help" menu entry opens a new window containing
#? the complete documentation of O-Saft, the result of: o-saft.pl +help .
#? The documentation contains clickable links (in blue) to other sections
#? in the text. Patterns may be specified to be searched for in the text.
#? All texts matching the pattern are highligted.
#? Search can be done forward and backward to the current positions, see
#? the [<] and [>] buttons at bottom of the window. Going to the next
#? or previous search result will then highlight the complete paragraph
#? containing the matched text.
#?
#? When more than 5 matches are found, an additional window will display
#? all matches as an overview. Click on a highligted match in this window
#? will show the paragraph containing the match in the help window.
#? When multiple "overview" windows are open, each handles its matches.
#?
#? The search pattern can be used in following modes:
#? exact - use pattern as literal text
#? regex - use pattern as regular expression (proper syntax required)
#? smart - convert pattern to RegEx: each character may be optional
#? fuzzy - convert pattern to RegEx: each position may be optional
#? Example:
#? exact: (adh|dha) - search for literal text (adh|dha)
#? regex: (adh|dha) - search for word adh or word dha
#? regex: her.*list - search for text her followed by list
#? regex: (and - fails, because of syntax error
#? smart: and - search for and or a?nd or an?d or and?
#? fuzzy: and - search for and or .?nd or a.?d or an.?
#?
#? Note: RegEx are applied to lines only, pattern cannot span more than a
#? single line.
#? The pattern must have at least 4 characters, except for mode "exact".
#?
#? The GUI contains various [?] buttons. Clicking such a button will show
#? the corresponding section in the help window (context sensitive).
#?
#? Key bindings
#? Following key bindings are defined:
#? <ButtonPress> start browser with selected link
#? <Control-ButtonPress-1> copy text to clipboard
#? <Shift-Control-ButtonPress-1> copy text to clipboard
#? <Control-v> copy text from clipboard
#? <Control-c> copy selected text to clipboard
#? q (quit) terminate Window or program (not in main window)
# ?
# ? Key bindings currently (2023) not used because they can't be disabled
# ? in entry or text widgets then:
# ? ! show window with About text
# ? ? show window with Help text
# ? c show window ciphers
# ? d show window tool settings (with --debug only)
# ? h show window with Help text
# ? q (quit) terminate Window or program
#?
#? CONFIGURATION
#? Some parts of the GUI, for example widget fonts or widget label texts,
#? can be customised in .o-saft.tcl , which will be searched for in the
#? user's HOME directory and in the local directory.
#? A sample .o-saft.tcl can be generated with --rc option. Please see
#? there for details.
#?
#? When started with any -d option, the Config pulldown menu provides a
#? "Config Tool" action which opens the window "Tool Settings" with some
#? internal settings. Changes there are applied to the tool immediately.
#? It's the "Tool Settings" tab in "classic" layout.
#?
#? Buttons
#? By default, an image will be used for most buttons. Images look more
#? modern than the standard Tcl/Tk buttons. Tcl/Tk does not support round
#? edges, images as background, or different look for activated buttons.
#? The images are read from a separate file: o-saft-img.tcl . If the file
#? is missing, no images will be used, but the simple text.
#? For each button an image can be specified in o-saft-img.tcl , example:
#? set IMG(my-file) [image create photo -file path/to/your-file ]
#? set cfg_images(+info) {my-file}; # where +info is your command
#?
#? Layouts
#? Two layouts, "classic" and "tablet" are provided, see "Change Layout"
#? to change it.
#?
#? GUI LIMITATIONS
#? All Result tabs are lost when switcheng the layout.
#?
#? DOCKER
#? This script can be used from within any Docker image. The host is then
#? responsible for providing the proper protocols for the GUI (i.e. X11).
#? In this case, anything is executed inside the Docker image, just the
#? graphical output is passed to the host. This mode is started with:
#? o-saft-docker --gui
#? which does the necessary magic with Docker for protocol and DISPLAY.
#?
#? When used with the --docker option, this script runs on the host and
#? connects to an O-Saft Docker image to execute o-saft.pl there with
#? all the selected commands and options.
#? In this mode, o-saft-docker will be used instead of o-saft.pl, which
#? must be available on the host.
#? Note that o-saft-docker relies on O-Saft's Docker image osawp/o-saft
#? which has its own (Docker) entrypoint. This means that o-saft-docker
#? is responsible to provide the same functionality as o-saft.pl does.
#? Adaptions, if necessary, should be done in o-saft-docker.
#?
#? Summary
#? o-saft.tcl --docker - run on host using o-saft.pl in Docker
#? o-saft-docker --gui - run in Docker with display to host
#?
#? PLATFORM ODDITIES
#? Mac OS X (Aqua)
#? Mac's Aqua enforces that the look & feel of the GUI complies to Aqua's
#? rules. Therefore some differences to standard Tcl/Tk are known:
#?
#? "Confirm" in dialogs is mandatory, see cfg(confirm) in .$0 .
#?
#? Aqua uses a small resize icon in the lower right corner of windows.
#? Therfore Tk objects n that area must be shifted left a few pixels. The
#? amount of pixels can be configured with myX(rpad) in .$0 .
#?
#? The program to be used to display web URLs must be defined properly in
#? prg(BROWSER), please see .$0 .
#?
#? Some special iconic characters are used in the menu texts (mainly left
#? of the text). These may be mising on some systems and then show quirky
#? icons.
#?
#? Wayland
#? Not yet tested.
#?
#? Windows
#? TBD
#?
#? X11, Xorg
#? Some Tk widgets seem to have limits. This may result in errors like:
#? X Error of failed request: BadAlloc (insufficient resources for operation)
#? A configurations exists as workaround to avoid such errors, please see
#? cfg(max53) in .$0 .
#?
#? None known.
#?
#? KNOWN PROBLEMS
#? Using option -v causes a Tcl error, like:
#? application-specific initialization failed: "-v" option requires an\
#? additional argument
#? This is a Tcl problem and cannot be fixed herein.
#?
#? The markup defined in the filters (see Filter tab) may not yet produce
#? perfect layouts for the results and the help texts, to be improved in
#? many ways.
#? Note that the markup is independent of the results and does not change
#? them, it just "highlight"s texts of the results.
#?
#? All --cfg-* settings from .o-saft.pl are not handled properly in the
#? GUI herein, in particular when texts are changed with this option.
#?
#? Some --legacy=* options are not handled properly. In particular the
#? result looks corrupted in table view when the option --legacy=compact
#? or --legacy=full is used; , use the text view for that.
#?
#? The busy cursor does not work on Win32 and Win64 systems.
#?
#? Selected coloured text will not be highlighted. Anyway it is selected.
#?
#? To pipe data in on STDIN, the option --stdin must be used, otherwise
#? it will not be read.
#?
#? Commands printed with --v on STDOUT (with prefix **INFO) may contain
#? curly brackets which are not part of the command or its arguments, but
#? a remnant of Tcl. However, the same command printed in the status line
#? of the GUI does not contain them.
#?
#? STDIN and _LOAD as filenames can not be used to load data.
#?
#? Not really a problem, but worth to mention:
#? It's not possible to map cipher suites to the proper SSL/TLS protocol
#? in the Result tab in table view. Therefore the cipher suite names are
#? prepended by the protocol.
#? Due technical reasons, the protocol and the cipher suite name will be
#? separated by the non-breaking space character U+2007.
#? Take care when processing saved results, [Save] and [STDOUT] button.
#?
#? ARGUMENTS
#? All arguments, except the options described above, are treated as a
#? hostname to be checked.
#?
#? ADDITIONAL SYNOPSIS
#? On some systems (i.e. Android) it could be difficult to pass arguments
#? and/or options to this script. To simulate passing options, following
#? alias names are provided:
#? o-saft--test-docs.tcl
#? o-saft--test-tcl.tcl
#? o-saft--test-osaft.tcl
#? o-saft--trace.tcl
#? o-saft--d.tcl
#? osaft--test-docs.tcl
#? osaft--test-tcl.tcl
#? osaft--test-osaft.tcl
#? osaft--trace.tcl
#? osaft--d.tcl
#?
#? SEE ALSO
#? o-saft
#? o-saft.pl
#? o-saft-docker
#?
#. LAYOUT
#. Following layouts (selected with --gui-layout= option) are available:
#.
#. --gui-layout=tablet
#. +---------------------------------------------------------------+
#. (M) | ☰ Cmd Opt Config |
#. |---------------------------------------------------------------|
#. (H) | Host:Port [________________________________________] [+] [-] |
#. | |
#. | +----------++----------+ |
#. (R) | | (n) +cmd || (m) +cmd | |
#. | + +------------------------------------------------+ |
#. | | | |
#. | | | |
#. | +-----------------------------------------------------------+ |
#. |---------------------------------------------------------------|
#. |---------------------------------------------------------------|
#. (S) | | | |
#. +---------------------------------------------------------------+
#.
#. --gui-layout=classic
#. +---------------------------------------------------------------+
#. (H) | Host:Port [________________________________________] [+] [-] |
#. | [!] [?] |
#. (C) | [Start] [+info] [+check] [+cipher] [+quick] [+vulns] [Load] |
#. (O) | [ ] --header [ ] --enabled [ ] --no-dns [ ] -no-http ... |
#. |---------------------------------------------------------------|
#. | +----------++---------++--------++----------++----------+ |
#. (T) | | Commands || Options || Filter || (n) +cmd || (m) +cmd | |
#. | + +------------------------------------------------+ |
#. | | | |
#. | | | |
#. | +-----------------------------------------------------------+ |
#. |---------------------------------------------------------------|
#. (S) | | | |
#. +---------------------------------------------------------------+
#.
#. Description
#. (H) - Frame containing hostnames to be checked
#. (M) - Frame containing menus for all commands, commands, options
#. ☰ - menubutton for all commands and options
#. Cmd - menubutton for quick commands (most often used)
#. Opt - menubutton for quick options (most often used)
#. Cfg - menubutton for configuration settings
#. (C) - Buttons for most commonly used commands
#. (O) - CheckButtons for most commonly used options
#. (R) - Frame containing panes (tab) for results
#. (T) - Frame containing panes (tab) for commands, options, filter,
#. config and results
#. (S) - Frame containing Status messages
#. [+] - Add line with Host:Port
#. [-] - Remove line with Host:Port
#. [!] - Help about $0
#. [?] - Help about o-saft.pl
#.
#. Filter tab Description
#. +---------------------------------------------------------------+
#. (f) | Key r e # RegEx Foreground Background Font u |
#. | +---------+--+--+--+------+----------+----------+--------+--- |
#. (F) | |== CMT * o 0 ^==* gray osaftHead x |
#. | +---------+--+--+--+------+----------+----------+--------+--- |
#. | ... |
#. +---------------------------------------------------------------+
#.
#. (f) - Headline for filter description
#. key - unique key for this filter
#. r - RegEx used as regular expression
#. e - RegEx used as exact match
#. # - Nr. of characters to be matched by RegEx
#. Foreground - colour for matched text
#. Background - colour for background of matched text
#. Font - use this font for matched text
#. u - matched text will be underlined
#. (F) - Filter settings
#. example of a filter
#.
#. For the main workflow use the --trace option, for example:
#. $0 --trace +quit
#. $0 --trace --gui-layout=classic
#.
#. LIMITATIONS
#. All help texts reference to the default hardcoded texts, even if they
#. are changed in .o-saft.tcl .
#. - TODO (2/2025): still true?
#.
#. HACKER's INFO
#. This is no academically perfect code, but quick&dirty scripted:
#. - makes use of global variables instead of passing parameters etc..
#. SEE Tcl:global
#. - mixes layout and functions and application logic
#. - some widget names are hardcoded
#. - als refer to the Annotations in o-saft.pl
#. SEE Note:Defensive Programming
#. SEE Note:Tcl
#.
#. Mac OS X (Aqua)
#. - moste platform-specific code is checked with _isaqua()
#. - TODO (8/2016):
#. - need to check if ugly hacks for Aqua (Mac OS X 10.6 with Tk 8.5.7)
#. are still necessary on modern Macs, in particular:
#. * tk_getSaveFile -confirmoverwrite
#. * package require Img
# - to view POD-files "cpan Tk Tk::Pod" should be installed
# - see also: https://wiki.tcl-lang.org/page/New+Tcl%2FTkAqua+FAQ
#.
#. Data used to build GUI
#. Generation of all objects (widgets in Tk slang) is done based on data
#. provided by o-saft.pl itself, in praticular some --help=* options,
#. see CONFIGURATION o-saft.pl below. Output of all --help=* must be
#. one item per line, like:
#. This is a label, grouping next lines
#. +command1 Command nr 1
#. +command2 Command nr 2
#. Options for commands
#. --opt1 this options does something
#. This tools relies on the format of these lines. If the format changes,
#. commands and options may be missing in the generated GUI.
#. Following options of o-saft.pl are used:
#. --help --help=opt --help=commands
#. A detailed example of the format can be found in proc create_win().
#. The functions create_win() and create_buttons() mainly use the RegEx
#. prg(rec*) defined in the CONFIGURATION (see below) to match output
#. from o-saft.pl . The code in these functions may be used to parse data
#. from other tools too.
#.
#. When building the complete documention (help window), additional text
#. documentation (beside that provided by +help) will be added before the
#. ATTRIBUTION section. Hence ATTRIBUTION must exist as section header
#. in output of "o-saft.pl +help".
#.
#. The tool will only work if o-saft.pl is available and executes without
#. errors. All commands and options of o-saft.pl will be available from
#. herein, except:
#. - all "--help*" options (as they make no sense here)
#. - "+cgi" and "+exec" command (they are for internal use only)
#.
#. Some Naming Conventions
#. - procedures:
#. config:* - reading, updating configurations
#. create_* - create widget or window
#. osaft_* - run external o-saft.pl (and process output)
#. search:* - searching texts in help (widget in help window)
#. gui* - anything realted to GUI widgets
#. obj* - operations on widgets
#. msg* - handling the message queue
#. - variables (system):
#. ::* - system and Tcl global variables with prefix ::
#. then no "global .." in procs necessary
#. - variables (GUI):
#. HELP- - prefix used for all Tcl-text tags in help
#. f_* - prefix used for all filter list variables
#. txt - a text widget
#. w or obj - any widget
#. parent - parent widget (may be toplevel)
#. exe() - global variable containing commands and options for
#. o-saft.pl from command-line
#. cfg() - global variable containing most configurations
#. cfg_colors()- global variable containing colours for widgets
#. cfg_texts() - global variable containing texts for widgets
#. cfg_tipps() - global variable containing texts for tooltips
#. search() - global variable containing texts used for searching
#. myX() - global variable for windows and window manager
#. - variables (O-Saft execution):
#. hosts() - global variable with list of hosts to be checked
#. results() - global variable containing results of executions
#. - comments
#. lines starting with #.
#. - these lines are intended for internal documentation
#. lines starting with #?
#. - these lines are intended for public documentation
#. lines starting with #? (inside proc definition)
#. - lines are used for internal developer documentation
#. lines starting with #|
#. - lines are used for internal developer documentation
#. lines with ;#
#. - Tcl requires a ; after the statement before any
#. comment; the ; is usually right before the #
#.
#. Coding (general)
#. Sequence of function definitions done to avoid forward declarations.
#. See Debugging Options below also.
#.
#. Coding (GUI)
#. Images (i.e. for buttons) are defined in o-saft-img.tcl, which must be
#. installed in same path as o-saft.tcl itself. The definitions are in
#. a separate file to keep the code more clean herein. If the file is not
#. found, a warning will be printed and Tcl/Tk buttons will be used.
#.
#. All buttons for the GUI are defined in a tabular array, where the key
#. is used as part of the object name. For details please see comments at
#. # define all buttons used in GUI
#. Note that the button texts defined there are displayed when using our
#. own "Copy Text" (see above) with <Control-ButtonPress-1>, even if the
#. button is displayed as image.
#.
#. Starting 11/2021 the default tool layout was changed from "classic" to
#. "tablet". This only affects building the GUI itself. The difference in
#. building the GUI is mainly controlled by the variable cfg(gui-layout).
#. This effects the procs: create_host() create_buttons() and gui_main().
#.
#. STDIN
#. Tcl's file handle (channel) for STDIN is named stdin, which is open by
#. default. Data piped to $0 can be read from this file handle.
#. But it is difficult to detect if data is available from stdin, if not,
#. Tcl's get() function simply hangs. To avoid this, the option --stdin
#. must be used if data should be read from STDIN, example:
#. cat some-file | $0 --stdin
#. o-saft.pl +check localhost | $0 --stdin
#. Reading from STDIN can simply be tested like
#. echo "label: no any comment" | $0 --stdin
#.
#. Note that STDIN is used as filename to indicate that Tcl's stdin file
#. handle should be used (which needs to be treated special).
#.
#. Tracing (GUI)
#. Tcl's trace functionality is used to trace most procs defined herein
#. and all created buttons. See trace_commands() and trace_buttons() for
#. details. Tracing does not yet work for buttons created in sub-windows.
#. Tracing is invoked with the --trace option.
#.
#. Copy Texts
#. All texts visible in the GUI, wether a label, a button, an entry or a
#. text itself, can be copied to the system's clipboard. This can be done
#. using the system's standard copy&paste methods, or with:
#. <Control-ButtonPress-1>
#. For debugging <Shift-Control-ButtonPress-1> will prefix the text by
#. the pathname and the class of the object containing the text.
#. Keep in mind that it also copies the huge text in the help window.
#. With <Control-ButtonPress-1> or <Shift-Control-ButtonPress-1> the
#. text will be copied to the (ICCCM) buffer CLIPBOARD. This ensures that
#. it will not interfere with the usual copy&paste buffer PRIMARY.
#. <ButtonPress-1> is the "select button", usually the left mouse button.
#. On X.org systems, the CLIPBOARD can be pasted using the context menu
#. (which is most likely the <left click>).
#. This behaviour is disabled with the --test-tcl option.
#.
#. Tracing (program flow)
#. --d=X - see description above
#.
#. Tracing and Debugging
#. All output for --trace and/or --dbx is printed on STDERR.
#. Trace messages are prefixed with: #[$0]:
#. Debug messages are prefixed with: #dbx# [$0]:
#.
#. --test=FILE
#. --test=FILE --gui-result=text
#. --test=FILE --gui-result=table
#. loads FILE into the GUI's tablelist widget and then calls the save
#. function, which prints the content of tablelist on STDOUT.
#. This is used in Makefile* for testing functionality, does not make
#. any sense otherwise.
#. The --gui-result=* option enforces to display and store the file
#. content in Tk's tablelist or text widget. The displayed output may
#. be slightly different, as the tablelist doesn't always contain all
#. data of the file.
#.
#. Tracing and Debugging with Alias Names
#. If arguments (options) can not be passed to the script (for example on
#. Android), alias names of the script can be used to simulate using the
#. options:
#. # alias name # behaves as called like
#. #-----------------------#-------------------------------
#. o-saft--test-docs.tcl $0 --test-docs
#. o-saft--test-tcl.tcl $0 --test-tcl
#. o-saft--test-osaft.tcl $0 --test-osaft
#. o-saft--d.tcl $0 --d
#. o-saft--trace.tcl $0 --trace
#.
#. Notes About Tcl/Tk
#. We try to avoid platform-specific code. The only exceptions since 2015
#. are the perl executable and the start method of the external browser.
#. Another exception (8/2016) is "package require Img" which is necessary
#. on some Mac OS X.
#. All external programs are started using Tcl's {*} syntax.
#.
#. If there is any text visible, we want to copy&paste it. Therefore most
#. texts are placed in Tk's text widget instead of a label widget, 'cause
#. text widgets allow selecting their content by default, while labels do
#. not. These text widgets are set to state "read-only" instaed of Tcl's
#. disabled state, see obj_readonly:set() for details.
#.
#? VERSION
#? @(#) 3.68 Spring Edition 2025
#?
#? AUTHOR
#? 04. April 2015 Achim Hoffmann
#?
#? Project Home: https://owasp.org/www-project-o-saft/
#? Help Online: https://www.owasp.org/index.php/O-Saft/Documentation
#? https://wiki.owasp.org/index.php/O-Saft/Documentation
#? Repository: https://github.com/OWASP/O-Saft
#?
# -----------------------------------------------------------------------------
set cfg(testtcl) 0
set cfg(needtk) 1 ;# load Tk if needed only; dirty hack for --h
#package require Tcl 8.5 ;# for documentation only
#package require Tk 8.5 ;# modern Tcl/Tk doesn't need it anymore
if {![info exists argv0]} { set argv0 "o-saft.tcl" } ;# if it is a tclet
if { [regexp -- {--h(elp)?} $argv]} {
set cfg(needtk) 0
}
if {![regexp -- {--test-?tcl} $argv]} {
# keep some systems quiet
if {0<$cfg(needtk)} {
package require Tk
}
set cfg(testtcl) 1
}
if {[info tclversion] < 8.5} {
puts stderr "**WARNING: some functionality may be missing"
}
#_____________________________________________________________________________
#___________________________________________________________ early bindings __|
# Bindings for simply copying text of any widget.
# To avoid conflicts with other common bindings, we use Ctrl + click to copy
# the text. Unfortunately this does not allow to select texts individually,
# but only as a whole.
# Bindings need to be done very early, so that they are active when Tcl/Tk's
# wish uses dialogs (i.e. tk_messagebox). The called function copy2clipboard
# might be defined later in the code, but it must be done before any usage.
# Hence it's defined right below.
if {0<$cfg(testtcl) && 0<$cfg(needtk)} {
# do not bind in debug-only mode to avoid errors, see "Key Bindings"
foreach klasse [list Button Combobox Entry Label Text Message Spinbox \
TButton TCombobox TEntry TLabel TText Frame Menu \
LabelFrame PanedWindow Scale Scrollbar \
Checkbutton Menubutton Radiobutton Dialog] {
bind $klasse <Control-ButtonPress-1> { copy2clipboard %W 0 }
bind $klasse <Shift-Control-ButtonPress-1> { copy2clipboard %W 1 }
}
}
proc copy2clipboard {w shift} {
#? copy visible text of object to clipboard
global cfg
set klasse [winfo class $w]
set txt {}
if {1==$shift} { set txt "$w $klasse: " }
# TODO: Menu, Spinbox not complete; some classes are missing
switch $klasse {
Frame { append dum "nothing to see in frames" }
Button -
Combobox -
Dialog -
Label -
Spinbox -
TButton -
TCombobox -
TLabel -
Menubutton -
Checkbutton -
Radiobutton { append txt [lindex [$w config -text] 4] }
Entry -
TEntry { append txt [string trim [$w get]] }
Text -
TText { append txt [string trim [$w get 1.0 end]] }
default { puts "** unknown class $klasse" }
}
if {1==$shift} {
set cmd ""
catch {lindex [$w config -command] 4} cmd ;# show error or command
append txt "\n -command $cmd"
}
pinfo "copy2clipboard($w, $shift): {\n $txt\n#}"
clipboard clear
clipboard append -type STRING -format STRING -- $txt
}; # copy2clipboard
#_____________________________________________________________________________
#____________________________________________________________ configuration __|
if {[info tclversion] < 8.5} {
# Tcl before 8.5 does not support dict, but there exists a backport,
# in following files:
# tclDict-8.5.1.tar.gz tclDict-8.5.2.tar.gz
# dict-8.5.1-win32.tar.gz dict-8.5.2-win32.tar.gz
# dict-8.5.1-linux-i386.tar.gz dict-8.5.2-linux-i386.tar.gz
# which were originialy (probably until 2013) found at
# http://pascal.scheffer.net/software/
# these libraries are available for 32-bit platforms only
if {[regexp {^(intel|x86_32|i386)$} $tcl_platform(machine)]} {
package require dict
}
# else { script bails out with errors below }
}
# TODO: encapsulate setting of ::TXTmap and ::MSG in a Tcl proc
# so it can completely disabled
# ::TXTmap define some general texts
# Following table defines texts used in error, warning and alike messages.
# For human readability, the texts are defined in a simple Tcl list which
# will be converted to a Tcl dict. This just avoids clumsy Tcl dict code.
# If more key-value pairs are necessary, simply add a column to the list
# if a new key-value pair is needed in the dict.
# SEE Tcl:global
set _dict_keys [list \
key text icon] ;# TODO: icon not yet used ...
#---------------+---------------+------------------------------
set _dict_vals [list \
{info "**INFO:" ::tk::icons::information } \
{error "**ERROR:" ::tk::icons::error } \
{warning "**WARNING:" ::tk::icons::warning } \
{hint "!!Hint:" ::tk::icons::information } \
{usage "Usage:" ::tk::icons::information } \
{dbx "#dbx# " {} } \
];#-------------+---------------+------------------------------
foreach values $_dict_vals {
set key [lindex $values 0] ;# first value is key itself
if {0<[llength [info commands lmap ]] } {
lmap k [lreplace $_dict_keys 0 0] v [lreplace $values 0 0] {
#dbx# puts "dict set ::TXTmap $key $k $v"
dict set ::TXTmap $key $k "$v"
}
} else {
# no lmap, must do it the traditional way
set txt [lindex $values 1]
set icon [lindex $values 2]
dict set ::TXTmap $key text $txt
dict set ::TXTmap $key icon $icon
}
}
# functions to get above texts and values
proc dict_txt:get {idx key} {
#? return value from dict; empty string if nothing exists
if {![dict exists $::TXTmap $idx]} { return "" }
if {![dict exists $::TXTmap $idx $key]} { return "" }
dict get $::TXTmap $idx $key
}; # dict_txt:get
proc txt_text:get {idx} { dict_txt:get $idx text }
proc txt_icon:get {idx} { dict_txt:get $idx icon }
# ::MSG define dictionary for error, warning etc. texts used in GUI
# Following dict simulates a message queue. Messages (mainly informational
# texts for the user) are simple added with a sequence number (idx). This
# sequence number is used to print messages in order off their occourence.
# This message queue is not necessary for the core functionality of this
# script, it just provides a user-friendly collection of warnings, errors.
# The dict provides following data foreach entry (idx):
# SEE Tcl:global
# Messages seq. nr key value # description (not part of dict)
#---------------+-------+------+---------+--------------------------------
dict set ::MSG 0 type "mandatory: info, error, warning, hint"
dict set ::MSG 0 text "mandatory: message text"
#---------------+-------+------+---------+--------------------------------
# idx=0 above is for documentation only
# functions to set and get the message queue MSG
# ::MSG avoids using "global MSG"
proc msg_type:set {idx txt} { dict set ::MSG $idx type $txt }
proc msg_text:set {idx txt} { dict set ::MSG $idx text $txt }
proc msg_type:get {idx} { dict get $::MSG $idx type }
proc msg_text:get {idx} { dict get $::MSG $idx text }
proc msg_keys:get {} { return [lrange [lsort -integer [dict keys $::MSG]] 1 end] }
#? return sorted list of indices (idx) without idx=0
proc msg_keys:last {} { return [lindex [msg_keys:get] end] }
#? return last indices in MSG, returns "" if only idx=0 exists
proc msg:append {type txt} {
#? add new message $txt of type $type to message queue MSG
set last [msg_keys:last]
# SEE Note:Defensive Programming
if {[regexp {^[0-9]+$} $last]} {
incr last
} else {
set last 1
}
msg_type:set $last $type
msg_text:set $last $txt
return
}; # msg:append
# some functions needed early
proc pwarn {txt} { puts stderr "[txt_text:get warning] $txt"; return }
#? output WARNING message
proc perr {txt} { puts stderr "[txt_text:get error ] $txt"; return }
#? output ERROR message
proc pinfo {txt} {
#? output INFO message
global cfg
# $cfg(VERB) may not yet set, hence checking options
if {![regexp -- {--(d|v|dbx|debug)( |$)} $::argv]} { return }
# SEE Note:Defensive Programming ; SEE Tcl:regexp
puts stderr "[txt_text:get info] $txt"
return
}; # pinfo
# this section mainly contains variable initialisations, it also defines some
# functions for easy access to configurations
# following arrays contain the index DESC multiple times, which means that it
# will be overwritten; doesn't harm, because it's used for documentation only
# in the code herein
proc docker:init {mode} {
#? initilise configuration for use with Docker image
# may be called with $mode=opt for --docker option or with $mode=prg to
# check if program name matches *-docker
# must be early definition, because called right after program start
global cfg prg
switch $mode {
prg { if {[regexp {\-docker$} $::argv0]} { set mode 1 } }
opt { set mode 1 }
}
if {1==$mode} {
set cfg(docker) 1
set prg(SAFT) "o-saft-docker"
}
# independent of mode, can always be set
if {1==[info exists ::env(o_saft_docker_tag)] } { set prg(docker-tag) $::env(o_saft_docker_tag) }
if {1==[info exists ::env(o_saft_docker_name)]} { set prg(docker-id) $::env(o_saft_docker_name) }
return
}; # docker:init
proc docker_args:get {} {
#? if in "docker mode" pass image ID to Docker;
# note that docker specific options must be before o-saft.pl commands or options
global prg
set do {}
if {[regexp {\-docker$} $prg(SAFT)]} {
lappend do "-id=$prg(docker-id)"
#lappend do "-tag=$prg(docker-tag)"
# FIXME: need to distinguish if --id= or --tag= was specified
}
return $do
}; # docker_args:get
proc _message {icon title txt} {
# print message, either with GUI or on STDERR
set str [txt_text:get $icon] ;# the identifier in $icon is the key in the dict also
if {""!=[info commands tk_messageBox]} {
if {![regexp -- {\+quit} $::argv]} {
# check in $argv because $cfg may not yet set
# +quit mainly used for testing
tk_messageBox -icon $icon -title "$str $title" -message "$txt"
return
}
}
# either mode=cli or +quit; same as perr, pwarn
puts stderr "$str $title #\n$txt"
return
};# _message
proc _isexecutable {ex} {
#? return 1 if $ex is executable, 0 otherwise
# uses "$ex -v" ... quick&dirty ('cause mainly used to check for perl)
catch { exec 2>@stdout {*}$ex -v } result exec_options
set code [dict get $exec_options -code]
if {0==$code} { return 1 }
set status [lindex [dict get $exec_options -errorcode] 2]
# print detailled error message
_message error "'$ex' not working:" [dict get $exec_options -errorinfo]
return 0
}; # _isexecutable
proc _isempty {str} { if { [regexp {^\s*$} $str]} { return 1 }; return 0; }
#? return 1 if string is empty, 0 otherwise
# NOTE that cfg() also contains all +commands and -options passed to o-saft.pl
# they are extracted in osaft_exec(); so the array indexes must not start with
# + or -
set cfg(SID) "@(#) o-saft.tcl 3.68 25/03/09 14:33:37"
set cfg(mySID) "$cfg(SID) Spring Edition 2025"
# contribution to SCCS's "what" to avoid additional characters
set cfg(VERSION) {3.68}
set cfg(TITLE) {O-Saft}
set cfg(RC) {.o-saft.tcl}
set cfg(RCmin) 1.13 ;# expected minimal version of cfg(RC)
set cfg(ICH) [file tail $argv0]
set cfg(DIR) [file dirname $argv0] ;# directory of cfg(ICH)
set cfg(ME) [info script] ;# set very early, may be missing later
# O-Saft means built-in
# own directories, may be redifined in RC-file, constant also used for filenames
set cfg(lib-dir) $cfg(DIR)/lib ;# own modules and documentation
set cfg(usr-dir) $cfg(DIR)/usr ;# user defined files