| 17 | |
| 18 | |
| 19 | def ssl_monkey(): |
| 20 | import ssl |
| 21 | |
| 22 | original = ssl.wrap_socket |
| 23 | |
| 24 | def wrap_socket_monkey(*args, **kwargs): |
| 25 | # Set up an OpenSSL cipher string. |
| 26 | # |
| 27 | # Rationale behind each part: |
| 28 | # |
| 29 | # * HIGH: only use the most secure class of ciphers and |
| 30 | # key lengths, generally being 128 bits and larger. |
| 31 | # |
| 32 | # * !aNULL: exclude cipher suites that contain anonymous |
| 33 | # key exchange, making man in the middle attacks much |
| 34 | # more tractable. |
| 35 | # |
| 36 | # * !SSLv2: exclude any SSLv2 cipher suite, as this |
| 37 | # category has security weaknesses. There is only one |
| 38 | # OpenSSL cipher suite that is in the "HIGH" category |
| 39 | # but uses SSLv2 protocols: DES_192_EDE3_CBC_WITH_MD5 |
| 40 | # (see s2_lib.c) |
| 41 | # |
| 42 | # Technically redundant given "!3DES", but the intent in |
| 43 | # listing it here is more apparent. |
| 44 | # |
| 45 | # * !RC4: exclude because it's a weak block cipher. |
| 46 | # |
| 47 | # * !3DES: exclude because it's very CPU intensive and |
| 48 | # most peers support another reputable block cipher. |
| 49 | # |
| 50 | # * !MD5: although it doesn't seem use of known flaws in |
| 51 | # MD5 is able to compromise an SSL session, the wide |
| 52 | # deployment of SHA-family functions means the |
| 53 | # compatibility benefits of allowing it are slim to |
| 54 | # none, so disable it until someone produces material |
| 55 | # complaint. |
| 56 | kwargs['ciphers'] = 'HIGH:!aNULL:!SSLv2:!RC4:!3DES:!MD5' |
| 57 | return original(*args, **kwargs) |
| 58 | |
| 59 | ssl.wrap_socket = wrap_socket_monkey |
| 60 | |
| 61 | |
| 62 | import argparse |