don't calculate sha sums for the certificates over and over
we can use cksum to calculate simple checksum much faster than with using openssl, so we can compute sums only once
This commit is contained in:
parent
68da6f00b6
commit
413a43ecbf
30
cipherscan
30
cipherscan
|
@ -48,6 +48,10 @@ TIMEOUT=30
|
||||||
# trust anchors are stored
|
# trust anchors are stored
|
||||||
CAPATH=""
|
CAPATH=""
|
||||||
SAVECRT=""
|
SAVECRT=""
|
||||||
|
unset known_certs
|
||||||
|
declare -A known_certs
|
||||||
|
unset cert_checksums
|
||||||
|
declare -A cert_checksums
|
||||||
|
|
||||||
# because running external commands like sleep incurs a fork penalty, we
|
# because running external commands like sleep incurs a fork penalty, we
|
||||||
# first check if it is necessary
|
# first check if it is necessary
|
||||||
|
@ -184,15 +188,25 @@ test_cipher_on_target() {
|
||||||
for ((i=0; i<$certificate_count; i=i+1 )); do
|
for ((i=0; i<$certificate_count; i=i+1 )); do
|
||||||
|
|
||||||
# extract i'th certificate
|
# extract i'th certificate
|
||||||
local cert=$(awk -v i=$i 'split_after == 1 {n++;split_after=0}
|
local cert=$(awk -v i=$i 'BEGIN { output=0;n=0 }
|
||||||
/-----END CERTIFICATE-----/ {split_after=1}
|
/-----BEGIN CERTIFICATE-----/ { output=1 }
|
||||||
{if (n == i) print }
|
output==1 { if (n==i) print }
|
||||||
' <<<"$tmp")
|
/-----END CERTIFICATE-----/ { output=0; n++ }' <<<"$tmp")
|
||||||
# clean up the cert from junk before BEGIN CERTIFICATE
|
# put the output to an array instead awk '{print $1}'
|
||||||
cert=$(${OPENSSLBIN} x509 <<<"$cert" 2>/dev/null)
|
local cksum=($(cksum <<<"$cert"))
|
||||||
|
# compare the values not just checksums so that eventual collision
|
||||||
|
# doesn't mess up results
|
||||||
|
if [[ ${known_certs[$cksum]} == $cert ]]; then
|
||||||
|
if [ -n "${current_certificates}" ]; then
|
||||||
|
current_certificates+=","
|
||||||
|
fi
|
||||||
|
current_certificates+="\"${cert_checksums[$cksum]}\""
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
# compute sha256 fingerprint of the certificate
|
# compute sha256 fingerprint of the certificate
|
||||||
local sha256sum=$(${OPENSSLBIN} x509 -outform DER <<<"$cert" 2>/dev/null |\
|
local sha256sum=$(${OPENSSLBIN} x509 -outform DER\
|
||||||
|
<<<"$cert" 2>/dev/null |\
|
||||||
${OPENSSLBIN} dgst -sha256 -r 2>/dev/null| awk '{print $1}')
|
${OPENSSLBIN} dgst -sha256 -r 2>/dev/null| awk '{print $1}')
|
||||||
|
|
||||||
# check if it is a CA certificate
|
# check if it is a CA certificate
|
||||||
|
@ -238,6 +252,8 @@ test_cipher_on_target() {
|
||||||
current_certificates+=","
|
current_certificates+=","
|
||||||
fi
|
fi
|
||||||
current_certificates+="\"${sha256sum}\""
|
current_certificates+="\"${sha256sum}\""
|
||||||
|
known_certs[$cksum]="$cert"
|
||||||
|
cert_checksums[$cksum]="$sha256sum"
|
||||||
done
|
done
|
||||||
debug "current_certificates: $current_certificates"
|
debug "current_certificates: $current_certificates"
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue