5b96f8fb47
limit number of forks needed to speed up execution
...
bash has a built in regular expression processor, we can match
lines using =~
moreover, stuff that will match while being inside parentheses is
later available in the BASH_REMATCH array
the IFS (Internal Field Separator) by default includes space, tab and
new line, as such we can use it to split longer lines to separate
words, just as awk '{print $1}' can, just need to put the value to
an array for that
we also don't have to use $(echo $var) when assigning variables, $var
is enough
bash has also built in substitution engine, so we can do ${var/,/ & }
to switch all commas to ampersands when using the variable
2014-10-18 17:20:20 +02:00
2e9c3fcc90
don't retry protocols we know don't work
...
When connection is unsuccessful with a given protocol, don't try it again
since we probably exhausted the ciphers supported by the protocol
makes scanning about 10% faster
2014-10-11 15:19:03 +02:00
0e6c40ad83
make handling of self signed certs more robust
...
openssl sometimes will print the filename, then the error, and finish
with OK, matching the colon and space prevents from considering such
certs to be valid
2014-10-11 15:19:03 +02:00
0071870c7c
few less forks in the script
...
again, we can use arrays and a bit advanced awk syntax to reduce
the number of forks necessary to run the script
2014-10-11 15:19:03 +02:00
9f9af9c71d
don't calculate sha sums for the certificates over and over
...
we can use cksum to calculate simple checksum much faster than
with using openssl, so we can compute sums only once
2014-10-11 15:19:03 +02:00
c2b3b6d7aa
use CApath for certificates and store certificates (v2)
...
CApath is about 20% faster than CAfile so use it, also
save the received certificates from the servers for later analysis
(proper hostname checking, looking for certificates sharing private key,
etc.)
Use the mechanism from cipherscan to find location of ca cert bundle
2014-10-11 15:19:03 +02:00
ea9f0056eb
clean up the extracted certificate
...
the certificate extracted in the above way will contain some junk
from openssl s_client output we don't want like verification status
we can remove it ro reduce disk usage for saved certificates
2014-10-11 15:19:03 +02:00
eaa64e48a3
add ability to also save leaf certificates and untrusted ones
2014-10-11 15:18:48 +02:00
38f428b476
add caching of intermediate CA certificates
2014-10-11 15:18:11 +02:00
512819a33f
no need to grep the input when we're using awk (v2)
...
awk has an inbuilt version of grep, also truncate processing as soon
as we find what we're looking for
This version uses slightly different syntax that is compatible with old
awk
2014-10-11 13:59:43 +02:00
0da92f25b7
verify server side ordering is used in analyze.py
2014-10-11 00:34:07 -04:00
1c9d52c94c
First shot at ordering analysis. Not yet perfect, but somewhat useful...
2014-10-10 20:30:27 -04:00
a46e474337
add some fubar recommentations
2014-10-10 19:07:31 -04:00
f4d0d598c7
analyze.py add option to give path to specific openssl
2014-10-10 18:56:44 -04:00
37f04054f8
fix json date to use UTC
2014-10-10 18:16:22 -04:00
86edd481f6
analyze.py uses provided openssl only on linux 64
2014-10-10 18:00:10 -04:00
81ef37c593
gitignore update
2014-10-10 17:31:44 -04:00
b80b5cdd35
hide errors when json format is used
2014-10-10 17:27:58 -04:00
278dab4800
Fix json date argument to be compatible on macos
2014-10-10 17:27:29 -04:00
f6f4fe8b86
Find timeout binary on linux and mac
2014-10-10 17:19:44 -04:00
c7c91ff5f8
updated authors
2014-10-10 16:56:06 -04:00
d5685da796
check that provided openssl is executable, fall back to system one if not
2014-10-10 16:56:00 -04:00
26aa8f9408
cleanups
2014-10-10 16:55:34 -04:00
7d2c8b4cad
Use local ca bundle if none is found on the system, fixes issues with MacOS
2014-10-10 16:55:09 -04:00
cc1230efd9
Analysis wording changes
2014-10-09 10:09:44 -04:00
a722ad177d
updated README with analysis info
2014-10-09 10:03:19 -04:00
5665951b09
minor analysis wording changes
2014-10-09 09:57:40 -04:00
215dbd0c1a
ignore openssl errors in analyze.py
2014-10-09 09:54:30 -04:00
e9110c6bc8
gitignore
2014-10-09 09:36:08 -04:00
405b104583
improved configuration analysis
2014-10-09 09:35:59 -04:00
2858ef8116
Revert "no need to grep the input when we're using awk"
...
This reverts commit 4c05897be2
2014-10-08 21:53:22 -04:00
34b2eb7819
First shot at cipherscan results analyzer
2014-10-08 21:53:05 -04:00
ca0ef2fc5c
fixes for the pull request #18
...
there were few small issues with the pull #18 even though jvehent merged
it, this fixes them
2014-10-06 13:26:53 -04:00
29109f1e64
update SEED and IDEA classification, do a total of broken ciphers
...
SEED and IDEA are not good ciphers, but not broken, so count them
separately, do a total count of servers that support broken and insecure
ciphers
2014-10-06 13:25:04 -04:00
4c05897be2
no need to grep the input when we're using awk
...
awk has an inbuilt version of grep, also truncate processing as soon
as we find what we're looking for
2014-10-06 13:24:39 -04:00
fb02ae87ac
add some comments, group related code
2014-10-06 13:22:29 -04:00
77671137df
add support for CApath
...
capath for relatively small cert sets (~300) makes scanning about 5%
faster
also do a little clean up of the command-to-run generation code
2014-10-06 13:22:15 -04:00
189460da9e
report if server uses client side or server side cipher ordering
2014-10-06 13:21:40 -04:00
a7ae42b08e
openssl in -ssl2 mode doesn't tolerate -servername option
...
when openssl is run in -ssl2 mode, it doesn't accept -servername
option and just aborts operation, it doesn't consider -status
to be special though.
Remove this option when running the SSLv2 portion of the test.
2014-10-06 13:21:16 -04:00
3a4a5f938d
add missing ocsp_staple header
2014-10-06 13:20:49 -04:00
8a0c9190a9
sort reported TLS session ticket hint using natural sort
2014-10-06 13:20:37 -04:00
ded65c40df
Merge pull request #22 from simondeziel/sdeziel
...
Use Debian's system-wide trust anchors when possible
2014-08-28 16:02:36 -04:00
ecd77f94fc
Merge pull request #18 from tomato42/wip
...
Hodgepodge of fixes
2014-08-28 16:02:19 -04:00
7dee967dd7
Attempt to use /etc/ssl/certs/ca-certificates.crt if no CACERTS
...
are available. On Debian, this is the default location for
system-wide trust anchors.
2014-07-25 10:01:31 -04:00
273211f025
Merge pull request #21 from azet/master
...
add real execution tracing to debug
2014-07-17 12:29:42 -04:00
efd84cdb24
add real execution tracing to debug
2014-07-17 18:08:29 +02:00
e345f6034d
Merge pull request #20 from PeterMosmans/binaries
...
Updated binary with latest 1.0.2-chacha build
2014-07-13 09:22:24 -04:00
b65c13c7b9
Compiled for 64-bit-linux from the following source:
...
https://github.com/PeterMosmans/openssl/tree/1.0.2-chacha
Added CAMELLIA 256SHA ciphers
2014-07-13 20:56:17 +10:00
26a24d0429
Updated binary with latest 1.0.2-chacha build
...
Compiled for 64-bit linux from the following source:
https://github.com/PeterMosmans/openssl/tree/1.0.2-chacha
2014-07-12 10:15:00 +10:00
60a6a02c6f
Merge pull request #19 from phlipper/patch-1
...
minor typo fix
2014-06-25 19:37:53 -04:00
Hubert Kario
Hubert Kario
Julien Vehent
Simon Deziel
Aaron Zauner
Peter Mosmans