(results)
| 173 | # is_intermediate is similar to is_old but for intermediate configuration from |
| 174 | # https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29 |
| 175 | def is_intermediate(results): |
| 176 | logging.debug('entering intermediate evaluation') |
| 177 | lvl = 'intermediate' |
| 178 | isinter = True |
| 179 | has_tls1 = False |
| 180 | has_pfs = True |
| 181 | has_sigalg = True |
| 182 | has_ocsp = True |
| 183 | all_proto = [] |
| 184 | for conn in results['ciphersuite']: |
| 185 | logging.debug('testing connection %s' % conn) |
| 186 | if conn['cipher'] not in inter["openssl_ciphers"]: |
| 187 | logging.debug(conn['cipher'] + ' is not in the list of intermediate ciphers') |
| 188 | failures[lvl].append("remove cipher " + conn['cipher']) |
| 189 | isinter = False |
| 190 | for proto in conn['protocols']: |
| 191 | if proto not in all_proto: |
| 192 | all_proto.append(proto) |
| 193 | if 'TLSv1' in conn['protocols']: |
| 194 | has_tls1 = True |
| 195 | if conn['sigalg'][0] not in inter["certificate_signatures"]: |
| 196 | logging.debug(conn['sigalg'][0] + ' is a not an intermediate signature') |
| 197 | has_sigalg = False |
| 198 | if conn['pfs'] != 'None': |
| 199 | if not has_good_pfs(conn['pfs'], inter["dh_param_size"], inter["ecdh_param_size"]): |
| 200 | logging.debug(conn['pfs']+ ' is not a good PFS parameter for the intermediate configuration') |
| 201 | has_pfs = False |
| 202 | if conn['ocsp_stapling'] == 'False': |
| 203 | has_ocsp = False |
| 204 | extra_proto = set(all_proto) - set(inter["tls_versions"]) |
| 205 | for proto in extra_proto: |
| 206 | logging.debug("found protocol not wanted in the intermediate configuration:" + proto) |
| 207 | failures[lvl].append('disable ' + proto) |
| 208 | isinter = False |
| 209 | missing_proto = set(inter["tls_versions"]) - set(all_proto) |
| 210 | for proto in missing_proto: |
| 211 | logging.debug("missing protocol wanted in the intermediate configuration:" + proto) |
| 212 | failures[lvl].append('consider enabling ' + proto) |
| 213 | if not has_sigalg: |
| 214 | failures[lvl].append("use a certificate signed with %s" % " or ".join(inter["certificate_signatures"])) |
| 215 | isinter = False |
| 216 | if not has_pfs: |
| 217 | failures[lvl].append("consider using DHE of at least 2048bits and ECC 256bit and greater") |
| 218 | if not has_ocsp: |
| 219 | failures[lvl].append("consider enabling OCSP Stapling") |
| 220 | if results['serverside'] != ('True' if inter['server_preferred_order'] else 'False'): |
| 221 | failures[lvl].append("enforce server side ordering" if inter['server_preferred_order'] else "enforce client side ordering") |
| 222 | isinter = False |
| 223 | return isinter |
| 224 | |
| 225 | # is_modern is similar to is_old but for modern configuration from |
| 226 | # https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility |
no test coverage detected