2
0
mirror of https://github.com/mozilla/cipherscan.git synced 2024-11-04 23:13:41 +01:00

collect stats about compression and renegotiation

since no support for compression and support for renegotiation are
necessary for the server to have a secure configuration, collect
and report those two too
This commit is contained in:
Hubert Kario 2014-11-01 21:06:23 +01:00
parent 73b21d3977
commit 99a0b6be07
2 changed files with 88 additions and 0 deletions

View File

@ -195,6 +195,8 @@ declare -A sigalgs_fallback
# array with preferred sigalgs for aRSA and aECDSA ciphers
declare -a sigalgs_preferred_rsa
declare -a sigalgs_preferred_ecdsa
renegotiation=""
compression=""
# because running external commands like sleep incurs a fork penalty, we
# first check if it is necessary
@ -359,6 +361,8 @@ parse_openssl_output() {
current_pubkey=0
current_trusted="False"
current_sigalg="None"
current_renegotiation="False"
current_compression=""
certs_found=0
current_raw_certificates=()
@ -388,6 +392,19 @@ parse_openssl_output() {
continue
fi
# renegotiation support
if [[ $line =~ Secure\ Renegotiation\ IS\ supported ]]; then
current_renegotiation="secure"
fi
if [[ $line =~ Secure\ Renegotiation\ IS\ NOT\ supported ]]; then
current_renegotiation="insecure"
fi
# compression settings
if [[ $line =~ Compression:\ (.*) ]]; then
current_compression="${BASH_REMATCH[1]}"
fi
# extract the signing algorithm used in TLSv1.2 ephemeral kex
if [[ $line =~ Peer\ signing\ digest ]]; then
local match=($line)
@ -840,6 +857,26 @@ display_results_in_terminal() {
fi
echo -e "Curves ordering: $curvesordering - fallback: $fallback_supported"
fi
if [[ $renegotiation ]]; then
if [[ $renegotiation == "secure" ]]; then
echo -e "Server ${c_green}supports${c_reset} secure renegotiation"
else
echo -e "Server ${c_red}DOESN'T${c_reset} support secure renegotiation"
fi
else
echo "Renegotiation test error"
fi
if [[ $compression ]]; then
if [[ $compression != "NONE" ]]; then
color="${c_red}"
else
color="${c_green}"
fi
echo -e "Server supported compression methods:" \
"${color}$compression${c_reset}"
else
echo -e "Supported compression methods ${c_red}test error${c_reset}"
fi
if [[ $TEST_KEX_SIGALG == "True" ]]; then
echo
@ -948,6 +985,18 @@ display_results_in_json() {
echo -n ",\"curves_fallback\":\"$fallback_supported\""
fi
if [[ $renegotiation ]]; then
echo -n ",\"renegotiation\":\"$renegotiation\""
else
echo -n ",\"renegotiation\":\"False\""
fi
if [[ $compression ]]; then
echo -n ",\"compression\":\"$compression\""
else
echo -n ",\"compression\":\"False\""
fi
if [[ $TEST_KEX_SIGALG == "True" ]]; then
echo -n ',"sigalgs":{'
echo -n "\"ordering\":\"${sigalgs_ordering}\","
@ -1260,6 +1309,16 @@ test_tls_tolerance() {
tls_tolerance[$version]="False"
else
tls_tolerance[$version]="True $current_protocol $current_cipher $current_trusted"
# collect renegotiation info
if [[ $current_renegotiation != "False" ]]; then
renegotiation="$current_renegotiation"
fi
# collect compression info
if [[ $version == "big-TLSv1.2" || -z $compression ]]; then
compression="$current_compression"
fi
fi
done

View File

@ -138,6 +138,8 @@ fallback_ids[' '] = i
pfssigalgfallback = defaultdict(int)
pfssigalgs = defaultdict(int)
pfssigalgsordering = defaultdict(int)
compression = defaultdict(int)
renegotiation = defaultdict(int)
dsarsastack = 0
total = 0
for r,d,flist in os.walk(path):
@ -161,6 +163,8 @@ for r,d,flist in os.walk(path):
temppfssigalgordering = {}
temppfssigalgfallback = {}
temppfssigalgs = {}
tempcompression = {}
temprenegotiation = {}
ciphertypes = 0
AESGCM = False
AESCBC = False
@ -324,6 +328,13 @@ for r,d,flist in os.walk(path):
except KeyError:
pass
""" get some extra data about server """
if 'renegotiation' in results:
temprenegotiation[results['renegotiation']] = 1
if 'compression' in results:
tempcompression[results['compression']] = 1
""" loop over list of ciphers """
for entry in results['ciphersuite']:
@ -538,6 +549,12 @@ for r,d,flist in os.walk(path):
for s in tempsigstats:
sigalg[s] += 1
for s in temprenegotiation:
renegotiation[s] += 1
for s in tempcompression:
compression[s] += 1
if len(tempticketstats) == 1:
for s in tempticketstats:
tickethint[s + " only"] += 1
@ -785,6 +802,18 @@ for stat in sorted(pfssigalgfallback):
percent = round(pfssigalgfallback[stat] / total * 100, 4)
sys.stdout.write(stat.ljust(30) + " " + str(pfssigalgfallback[stat]).ljust(10) + str(percent).ljust(9) + "\n")
print("\nRenegotiation Count Percent ")
print("-------------------------+---------+--------")
for stat in natural_sort(renegotiation):
percent = round(renegotiation[stat] / total * 100, 4)
sys.stdout.write(stat.ljust(25) + " " + str(renegotiation[stat]).ljust(10) + str(percent).ljust(9) + "\n")
print("\nCompression Count Percent ")
print("-------------------------+---------+--------")
for stat in natural_sort(compression):
percent = round(compression[stat] / total * 100, 4)
sys.stdout.write(stat.ljust(25) + " " + str(compression[stat]).ljust(10) + str(percent).ljust(9) + "\n")
print("\nTLS session ticket hint Count Percent ")
print("-------------------------+---------+--------")
for stat in natural_sort(tickethint):