2
0
mirror of https://github.com/mozilla/cipherscan.git synced 2024-11-04 15:03:41 +01:00

in "no-untrusted mode": filter out ADH and AECDH suites

If server negotiates ADH or AECDH suite, openssl returns "ok" in
cert checking. Don't mark server as trusted because of that.

Don't collect statistics on servers that provide only untrusted
connections.
This commit is contained in:
Hubert Kario 2014-04-05 20:21:35 +02:00
parent 9f43f3df2d
commit ba1031367f

View File

@ -65,8 +65,11 @@ for r,d,flist in os.walk(path):
""" loop over list of ciphers """
for entry in results['ciphersuite']:
if 'True' in entry['trusted']:
trusted = True
# some servers return different certificates with different
# ciphers, also we may become redirected to other server with
# different config (because over-reactive IPS)
if 'False' in entry['trusted'] and report_untrused == False:
continue;
""" store the ciphers supported """
if 'AES-GCM' in entry['cipher']:
@ -115,6 +118,9 @@ for r,d,flist in os.walk(path):
if ECDSA:
dualstack = True
if 'True' in entry['trusted'] and not 'ADH' in entry['cipher'] and not 'AECDH' in entry['cipher']:
trusted = True
""" save key signatures size """
tempsigstats[entry['sigalg'][0]] = 1
@ -216,6 +222,10 @@ for r,d,flist in os.walk(path):
# break
print("SSL/TLS survey of %i websites from Alexa's top 1 million" % total)
if report_untrused == False:
print("Stats only from connections that did provide valid certificates")
print("(or anonymous DH from servers that do also have valid certificate installed)\n")
""" Display stats """
print("\nSupported Ciphers Count Percent")
print("-------------------------+---------+-------")