(results)
| 110 | # the parameters of an old configuration are not found. Those parameters |
| 111 | # are defined in https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility |
| 112 | def is_old(results): |
| 113 | logging.debug('entering old evaluation') |
| 114 | lvl = 'old' |
| 115 | isold = True |
| 116 | has_3des = False |
| 117 | has_sha1 = True |
| 118 | has_pfs = True |
| 119 | has_ocsp = True |
| 120 | all_proto = [] |
| 121 | for conn in results['ciphersuite']: |
| 122 | logging.debug('testing connection %s' % conn) |
| 123 | # flag unwanted ciphers |
| 124 | if conn['cipher'] not in old["openssl_ciphers"]: |
| 125 | logging.debug(conn['cipher'] + ' is not in the list of old ciphers') |
| 126 | failures[lvl].append("remove cipher " + conn['cipher']) |
| 127 | isold = False |
| 128 | # verify required 3des cipher is present |
| 129 | if conn['cipher'] == 'DES-CBC3-SHA': |
| 130 | has_3des = True |
| 131 | for proto in conn['protocols']: |
| 132 | if proto not in all_proto: |
| 133 | all_proto.append(proto) |
| 134 | # verify required sha1 signature is used |
| 135 | if 'sha1WithRSAEncryption' not in conn['sigalg']: |
| 136 | logging.debug(conn['sigalg'][0] + ' is a not an old signature') |
| 137 | has_sha1 = False |
| 138 | # verify required pfs parameter is used |
| 139 | if conn['pfs'] != 'None': |
| 140 | if not has_good_pfs(conn['pfs'], old["dh_param_size"], old["ecdh_param_size"], True): |
| 141 | logging.debug(conn['pfs']+ ' is not a good PFS parameter for the old configuration') |
| 142 | has_pfs = False |
| 143 | if conn['ocsp_stapling'] == 'False': |
| 144 | has_ocsp = False |
| 145 | extra_proto = set(all_proto) - set(old["tls_versions"]) |
| 146 | for proto in extra_proto: |
| 147 | logging.debug("found protocol not wanted in the old configuration:" + proto) |
| 148 | failures[lvl].append('disable ' + proto) |
| 149 | isold = False |
| 150 | missing_proto = set(old["tls_versions"]) - set(all_proto) |
| 151 | for proto in missing_proto: |
| 152 | logging.debug("missing protocol wanted in the old configuration:" + proto) |
| 153 | failures[lvl].append('enable ' + proto) |
| 154 | isold = False |
| 155 | if not has_3des: |
| 156 | logging.debug("DES-CBC3-SHA is not supported and required by the old configuration") |
| 157 | failures[lvl].append("add cipher DES-CBC3-SHA") |
| 158 | isold = False |
| 159 | if not has_sha1: |
| 160 | failures[lvl].append("use a certificate with sha1WithRSAEncryption signature") |
| 161 | isold = False |
| 162 | if not has_pfs: |
| 163 | failures[lvl].append("use DHE of {dhe}bits and ECC of {ecdhe}bits".format( |
| 164 | dhe=old["dh_param_size"], ecdhe=old["ecdh_param_size"])) |
| 165 | isold = False |
| 166 | if not has_ocsp: |
| 167 | failures[lvl].append("consider enabling OCSP Stapling") |
| 168 | if results['serverside'] != ('True' if old['server_preferred_order'] else 'False'): |
| 169 | failures[lvl].append("enforce server side ordering" if old['server_preferred_order'] else "enforce client side ordering") |
no test coverage detected