LittleNellie/cipherscan
2
0
Fork 0
mirror of https://github.com/mozilla/cipherscan.git synced 2024-11-22 14:23:41 +01:00
Code Issues Releases Wiki Activity

make 2048 DHE key optional in intermediate level

Browse Source
This commit is contained in:
Julien Vehent 2014-10-18 08:20:00 -04:00
parent ebf4f8bcc7
commit a17cfe373e
1 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
analyze.py
View File

@ -177,7 +177,6 @@ def is_intermediate(results):
if conn['pfs'] != 'None': if conn['pfs'] != 'None':
if not has_good_pfs(conn['pfs'], 2048, 256): if not has_good_pfs(conn['pfs'], 2048, 256):
logging.debug(conn['pfs']+ ' is not a good PFS parameter for the intermediate configuration') logging.debug(conn['pfs']+ ' is not a good PFS parameter for the intermediate configuration')
inter = False
has_pfs = False has_pfs = False
if conn['ocsp_stapling'] == 'False': if conn['ocsp_stapling'] == 'False':
has_ocsp = False has_ocsp = False
@ -200,8 +199,7 @@ def is_intermediate(results):
if not has_sha256: if not has_sha256:
failures[lvl].append("consider using a SHA-256 certificate") failures[lvl].append("consider using a SHA-256 certificate")
if not has_pfs: if not has_pfs:
failures[lvl].append("use DHE of at least 2048bits and ECC or at least 256bits") failures[lvl].append("consider using DHE of at least 2048bits and ECC of at least 256bits")
inter = False
if not has_ocsp: if not has_ocsp:
failures[lvl].append("consider enabling OCSP Stapling") failures[lvl].append("consider enabling OCSP Stapling")
if results['serverside'] != 'True': if results['serverside'] != 'True':
@ -249,7 +247,7 @@ def is_modern(results):
failures[lvl].append("use a SHA-256 certificate") failures[lvl].append("use a SHA-256 certificate")
modern = False modern = False
if not has_pfs: if not has_pfs:
failures[lvl].append("use DHE of at least 2048bits and ECC or at least 256bits") failures[lvl].append("use DHE of at least 2048bits and ECC of at least 256bits")
modern = False modern = False
if not has_ocsp: if not has_ocsp:
failures[lvl].append("consider enabling OCSP Stapling") failures[lvl].append("consider enabling OCSP Stapling")
@ -352,7 +350,7 @@ def process_results(data, level=None, do_json=False):
return True return True
if len(failures['fubar']) > 0: if len(failures['fubar']) > 0:
print("\nThings that are really FUBAR:") print("\nThings that are bad:")
for failure in failures['fubar']: for failure in failures['fubar']:
print("* " + failure) print("* " + failure)