LittleNellie/cipherscan
2
0
Fork 0
mirror of https://github.com/mozilla/cipherscan.git synced 2024-11-22 22:33:40 +01:00
Code Issues Releases Wiki Activity

don't retry protocols we know don't work

Browse Source 
When connection is unsuccessful with a given protocol, don't try it again
since we probably exhausted the ciphers supported by the protocol

makes scanning about 10% faster
This commit is contained in:
Hubert Kario 2014-07-12 01:30:17 +02:00
parent 94a1c6fc0d
commit 26204115bf
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cipherscan
View File

@ -52,6 +52,8 @@ unset known_certs
declare -A known_certs declare -A known_certs
unset cert_checksums unset cert_checksums
declare -A cert_checksums declare -A cert_checksums
unset ok_protocols
declare -A ok_protocols
# because running external commands like sleep incurs a fork penalty, we # because running external commands like sleep incurs a fork penalty, we
# first check if it is necessary # first check if it is necessary
@ -134,6 +136,9 @@ test_cipher_on_target() {
certificates="" certificates=""
for tls_version in "-ssl2" "-ssl3" "-tls1" "-tls1_1" "-tls1_2" for tls_version in "-ssl2" "-ssl3" "-tls1" "-tls1_1" "-tls1_2"
do do
if [[ ${ok_protocols[$tls_version]} -eq 1 ]]; then
continue
fi
# sslv2 client hello doesn't support SNI extension # sslv2 client hello doesn't support SNI extension
# in SSLv3 mode OpenSSL just ignores the setting so it's ok # in SSLv3 mode OpenSSL just ignores the setting so it's ok
# -status exception is ignored in SSLv2, go figure # -status exception is ignored in SSLv2, go figure
@ -259,6 +264,7 @@ test_cipher_on_target() {
# parsing finished, report result # parsing finished, report result
if [[ -z "$current_protocol" || "$current_cipher" == '(NONE)' ]]; then if [[ -z "$current_protocol" || "$current_cipher" == '(NONE)' ]]; then
ok_protocols["$tls_version"]=1
# connection failed, try again with next TLS version # connection failed, try again with next TLS version
continue continue
else else
@ -626,6 +632,8 @@ results=()
# Call to the recursive loop that retrieves the cipher preferences # Call to the recursive loop that retrieves the cipher preferences
get_cipher_pref $CIPHERSUITE get_cipher_pref $CIPHERSUITE
unset ok_protocols
declare -A ok_protocols
test_serverside_ordering test_serverside_ordering