def _process_parsing_results(self, args_command_list): """ Performs various sanity checks on the command line that was used to launch SSLyze. Returns the shared_settings object to be fed to plugins. """ shared_settings = {} # Sanity checks on the client cert options if bool(args_command_list.cert) ^ bool(args_command_list.key): raise CommandLineParsingError( 'No private key or certificate file were given. See --cert and --key.' ) # Private key and cert formats if args_command_list.certform == 'DER': args_command_list.certform = SSL_FILETYPE_ASN1 elif args_command_list.certform == 'PEM': args_command_list.certform = SSL_FILETYPE_PEM else: raise CommandLineParsingError('--certform should be DER or PEM.') if args_command_list.keyform == 'DER': args_command_list.keyform = SSL_FILETYPE_ASN1 elif args_command_list.keyform == 'PEM': args_command_list.keyform = SSL_FILETYPE_PEM else: raise CommandLineParsingError('--keyform should be DER or PEM.') # Let's try to open the cert and key files if args_command_list.cert: try: open(args_command_list.cert, "r") except: raise CommandLineParsingError( 'Could not open the client certificate file "' + str(args_command_list.cert) + '".') if args_command_list.key: try: open(args_command_list.key, "r") except: raise CommandLineParsingError( 'Could not open the client private key file "' + str(args_command_list.key) + '"') # Try to load the cert and key in OpenSSL try: sslClient = SslClient() sslClient.use_private_key(args_command_list.cert, args_command_list.certform, args_command_list.key, args_command_list.keyform, args_command_list.keypass) except _nassl.OpenSSLError as e: if 'bad decrypt' in str(e.args): raise CommandLineParsingError( 'Could not decrypt the private key. Wrong passphrase ?' ) raise CommandLineParsingError( 'Could not load the certificate or the private key. Passphrase needed ?' ) # HTTP CONNECT proxy shared_settings['https_tunnel_host'] = None if args_command_list.https_tunnel: # Parse the proxy URL parsedUrl = urlparse(args_command_list.https_tunnel) if not parsedUrl.netloc: raise CommandLineParsingError( 'Invalid Proxy URL for --https_tunnel, discarding all tasks.' ) if parsedUrl.scheme in 'http': defaultPort = 80 elif parsedUrl.scheme in 'https': defaultPort = 443 else: raise CommandLineParsingError( 'Invalid URL scheme for --https_tunnel, discarding all tasks.' ) if not parsedUrl.hostname: raise CommandLineParsingError( 'Invalid Proxy URL for --https_tunnel, discarding all tasks.' ) try: shared_settings[ 'https_tunnel_port'] = parsedUrl.port if parsedUrl.port else defaultPort except ValueError: # The supplied port was not a number raise CommandLineParsingError( 'Invalid Proxy URL for --https_tunnel, discarding all tasks.' ) shared_settings['https_tunnel_host'] = parsedUrl.hostname shared_settings['https_tunnel_user'] = parsedUrl.username shared_settings['https_tunnel_password'] = parsedUrl.password # STARTTLS if args_command_list.starttls: if args_command_list.starttls not in self.START_TLS_PROTS: raise CommandLineParsingError(self.START_TLS_USAGE) if args_command_list.starttls and args_command_list.https_tunnel: raise CommandLineParsingError( 'Cannot have --https_tunnel and --starttls at the same time.') # Number of connection retries if args_command_list.nb_retries < 1: raise CommandLineParsingError( 'Cannot have a number smaller than 1 for --nb_retries.') # All good, let's save the data for key, value in args_command_list.__dict__.iteritems(): shared_settings[key] = value return shared_settings
class SslClient_Tests_PrivateKey(unittest.TestCase): def setUp(self): self.sslClient = SslClient(sslVersion=SSLV23, sslVerify=SSL_VERIFY_NONE) testFile = tempfile.NamedTemporaryFile(delete=False) testFile.write("""-----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,7D15D836EE9E1B77 fzTe/7+BUBBpW7rFqfffSMeNTNwjVT8uT6+aQFkv1sazU295heEWcvnqYPQ2suDS dqud4pxLizkSRZpAIoKZV/E0z3iM1zsrGiyNXZ3mouRjSZdESEBnPEbtIdsyHLkL 9arhA/kvuMqXMjgun+tPD0+ETlaFf5GCKgfFQzbF2W4WpeEXii43ZLZ9UmObUUql 5Y65K/07+ga/dj3E+l1dLtA7VhVV5CK+8TTmVdqOr85pEZ/BC3U09vnwovDWJ+l0 sV7GhzsDFSpwxeArZy7wSMkSOTe71O1gvjOxWlupznFcZvirhRtI+5k1/btcn7hx 8b7dp36pTb/GfwaeUVsAvJBqwdSun3NOWX7zJxIDGU6LxA80eiV4z3SxAykS52gl rlb2e+F6dV+tRuREfaDaeS1DSlDMp1mQjPSD2ix6nSypv19FHdh01OoCd0OFxM6D xs5RQnUeu4J9g45Wdp6lmXM62EhUqYLKRbjXnZbFMlVMq81UwpMazwAruTEOCxl4 iQk3rNzfREONa9HeshiMlkeRAQpyB1qLZwhoTwTl6xKaMkt6nFEE6qX1KrrACHkH CFJVbuWVJCyoRFv+0Gypi7zn1ZZGkE4inDHxqIzUa0sSmbShEWooTxCyGUSoosaY u2ozh8ESQCy03JFR9DY6mo3YekbIcCEjgdmE35nK4lJQFbo3A8YlHunEdVK0tb8Z Wxf7cJ6J55bG5/Kft65kJnXAHrV9LnM1tPiRkB8umZkj/ou5NpDKiuLjR+WBfwi0 tqXk90NdSqJtMMGgrtVM84TYFPXP58QCBnE9oAI7XYM1rusuVBOXZw== -----END RSA PRIVATE KEY----- """) testFile.close() self.testFile = testFile testFile2 = tempfile.NamedTemporaryFile(delete=False) testFile2.write("""-----BEGIN CERTIFICATE----- MIIDCjCCAnOgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBgDELMAkGA1UEBhMCRlIx DjAMBgNVBAgMBVBhcmlzMQ4wDAYDVQQHDAVQYXJpczEWMBQGA1UECgwNRGFzdGFy ZGx5IEluYzEMMAoGA1UECwwDMTIzMQ8wDQYDVQQDDAZBbCBCYW4xGjAYBgkqhkiG 9w0BCQEWC2xvbEBsb2wuY29tMB4XDTEzMDEyNzAwMDM1OFoXDTE0MDEyNzAwMDM1 OFowgZcxCzAJBgNVBAYTAkZSMQwwCgYDVQQIDAMxMjMxDTALBgNVBAcMBFRlc3Qx IjAgBgNVBAoMGUludHJvc3B5IFRlc3QgQ2xpZW50IENlcnQxCzAJBgNVBAsMAjEy MRUwEwYDVQQDDAxBbGJhbiBEaXF1ZXQxIzAhBgkqhkiG9w0BCQEWFG5hYmxhLWMw ZDNAZ21haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDlnvP1ltVO 8JDNT3AA99QqtiqCi/7BeEcFDm2al46mv7looz6CmB84osrusNVFsS5ICLbrCmeo w5sxW7VVveGueBQyWynngl2PmmufA5Mhwq0ZY8CvwV+O7m0hEXxzwbyGa23ai16O zIiaNlBAb0mC2vwJbsc3MTMovE6dHUgmzQIDAQABo3sweTAJBgNVHRMEAjAAMCwG CWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNV HQ4EFgQUYR45okpFsqTYB1wlQQblLH9cRdgwHwYDVR0jBBgwFoAUP0X2HQlaca7D NBzVbsjsdhzOqUQwDQYJKoZIhvcNAQEFBQADgYEAWEOxpRjvKvTurDXK/sEUw2KY gmbbGP3tF+fQ/6JS1VdCdtLxxJAHHTW62ugVTlmJZtpsEGlg49BXAEMblLY/K7nm dWN8oZL+754GaBlJ+wK6/Nz4YcuByJAnN8OeTY4Acxjhks8PrAbZgcf0FdpJaAlk Pd2eQ9+DkopOz3UGU7c= -----END CERTIFICATE----- """) testFile2.close() self.testFile2 = testFile2 def test_use_private_key(self): self.assertIsNone(self.sslClient.use_private_key(self.testFile2.name, SSL_FILETYPE_PEM, self.testFile.name, SSL_FILETYPE_PEM, 'testPW')) def test_use_private_key_bad(self): self.assertRaisesRegexp(_nassl.OpenSSLError, 'bad decrypt', self.sslClient.use_private_key, self.testFile2.name, SSL_FILETYPE_PEM, self.testFile.name, SSL_FILETYPE_PEM, 'badPW')
def _process_parsing_results(self, args_command_list): """ Performs various sanity checks on the command line that was used to launch SSLyze. Returns the shared_settings object to be fed to plugins. """ shared_settings = {} # Sanity checks on the client cert options if bool(args_command_list.cert) ^ bool(args_command_list.key): raise CommandLineParsingError('No private key or certificate file were given. See --cert and --key.') # Private key and cert formats if args_command_list.certform == 'DER': args_command_list.certform = SSL_FILETYPE_ASN1 elif args_command_list.certform == 'PEM': args_command_list.certform = SSL_FILETYPE_PEM else: raise CommandLineParsingError('--certform should be DER or PEM.') if args_command_list.keyform == 'DER': args_command_list.keyform = SSL_FILETYPE_ASN1 elif args_command_list.keyform == 'PEM': args_command_list.keyform = SSL_FILETYPE_PEM else: raise CommandLineParsingError('--keyform should be DER or PEM.') # Let's try to open the cert and key files if args_command_list.cert: try: open(args_command_list.cert,"r") except: raise CommandLineParsingError('Could not open the client certificate file "' + str(args_command_list.cert) + '".') if args_command_list.key: try: open(args_command_list.key,"r") except: raise CommandLineParsingError('Could not open the client private key file "' + str(args_command_list.key) + '"') # Try to load the cert and key in OpenSSL try: sslClient = SslClient() sslClient.use_private_key(args_command_list.cert, args_command_list.certform, args_command_list.key, args_command_list.keyform, args_command_list.keypass) except _nassl.OpenSSLError as e: if 'bad decrypt' in str(e.args): raise CommandLineParsingError('Could not decrypt the private key. Wrong passphrase ?') raise CommandLineParsingError('Could not load the certificate or the private key. Passphrase needed ?') # HTTP CONNECT proxy shared_settings['https_tunnel_host'] = None if args_command_list.https_tunnel: # Parse the proxy URL parsedUrl = urlparse(args_command_list.https_tunnel) if not parsedUrl.netloc: raise CommandLineParsingError( 'Invalid Proxy URL for --https_tunnel, discarding all tasks.') if parsedUrl.scheme in 'http': defaultPort = 80 elif parsedUrl.scheme in 'https': defaultPort = 443 else: raise CommandLineParsingError( 'Invalid URL scheme for --https_tunnel, discarding all tasks.') if not parsedUrl.hostname: raise CommandLineParsingError( 'Invalid Proxy URL for --https_tunnel, discarding all tasks.') try : shared_settings['https_tunnel_port'] = parsedUrl.port if parsedUrl.port else defaultPort except ValueError: # The supplied port was not a number raise CommandLineParsingError( 'Invalid Proxy URL for --https_tunnel, discarding all tasks.') shared_settings['https_tunnel_host'] = parsedUrl.hostname shared_settings['https_tunnel_user'] = parsedUrl.username shared_settings['https_tunnel_password'] = parsedUrl.password # STARTTLS if args_command_list.starttls: if args_command_list.starttls not in self.START_TLS_PROTS: raise CommandLineParsingError(self.START_TLS_USAGE) if args_command_list.starttls and args_command_list.https_tunnel: raise CommandLineParsingError( 'Cannot have --https_tunnel and --starttls at the same time.') # Number of connection retries if args_command_list.nb_retries < 1: raise CommandLineParsingError( 'Cannot have a number smaller than 1 for --nb_retries.') # All good, let's save the data for key, value in args_command_list.__dict__.iteritems(): shared_settings[key] = value return shared_settings
def _process_parsing_results(self, args_command_list): """ Performs various sanity checks on the command line that was used to launch SSLyze. Returns the shared_settings object to be fed to plugins. """ shared_settings = {} # Sanity checks on the client cert options if bool(args_command_list.cert) ^ bool(args_command_list.key): raise CommandLineParsingError('No private key or certificate file were given. See --cert and --key.') # Private key and cert formats if args_command_list.certform is'DER': args_command_list.certform = SSL_FILETYPE_ASN1 elif args_command_list.certform is 'PEM': args_command_list.certform = SSL_FILETYPE_PEM else: raise CommandLineParsingError('--certform should be DER or PEM.') if args_command_list.keyform is'DER': args_command_list.keyform = SSL_FILETYPE_ASN1 elif args_command_list.keyform is 'PEM': args_command_list.keyform = SSL_FILETYPE_PEM else: raise CommandLineParsingError('--keyform should be DER or PEM.') # Let's try to open the cert and key files if args_command_list.cert: try: open(args_command_list.cert,"r") except: raise CommandLineParsingError('Could not open the client certificate file "' + str(args_command_list.cert) + '".') if args_command_list.key: try: open(args_command_list.key,"r") except: raise CommandLineParsingError('Could not open the client private key file "' + str(args_command_list.key) + '"') # Try to load the cert and key in OpenSSL try: sslClient = SslClient() sslClient.use_private_key(args_command_list.cert, args_command_list.certform, args_command_list.key, args_command_list.keyform, args_command_list.keypass) except _nassl.OpenSSLError as e: if 'bad decrypt' in str(e.args): raise CommandLineParsingError('Could not decrypt the private key. Wrong passphrase ?') raise CommandLineParsingError('Could not load the certificate or the private key. Passphrase needed ?') # HTTP CONNECT proxy if args_command_list.https_tunnel: if '2.7.' not in platform.python_version(): # Python 2.7 only raise CommandLineParsingError( '--https_tunnel requires Python 2.7.X. ' 'Current version is ' + platform.python_version() + '.') try: # Need to parse the proxy host:port string now (user,password),(host, port) = TargetStringParser.parse_proxy_target_str(args_command_list.https_tunnel) shared_settings['https_tunnel_host'] = host shared_settings['https_tunnel_port'] = port shared_settings['https_tunnel_user'] = user shared_settings['https_tunnel_password'] = password except InvalidTargetError: raise CommandLineParsingError( 'Not a valid host/port for --https_tunnel' ', discarding all tasks.') else: shared_settings['https_tunnel_host'] = None shared_settings['https_tunnel_port'] = None # STARTTLS if args_command_list.starttls: if args_command_list.starttls not in self.START_TLS_PROTS: raise CommandLineParsingError(self.START_TLS_USAGE) if args_command_list.starttls and args_command_list.https_tunnel: raise CommandLineParsingError( 'Cannot have --https_tunnel and --starttls at the same time.') # Number of connection retries if args_command_list.nb_retries < 1: raise CommandLineParsingError( 'Cannot have a number smaller than 1 for --nb_retries.') # All good, let's save the data for key, value in args_command_list.__dict__.iteritems(): shared_settings[key] = value return shared_settings
class SslClient_Tests_PrivateKey(unittest.TestCase): def setUp(self): self.sslClient = SslClient(sslVersion=SSLV23, sslVerify=SSL_VERIFY_NONE) testFile = tempfile.NamedTemporaryFile(delete=False) testFile.write("""-----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,7D15D836EE9E1B77 fzTe/7+BUBBpW7rFqfffSMeNTNwjVT8uT6+aQFkv1sazU295heEWcvnqYPQ2suDS dqud4pxLizkSRZpAIoKZV/E0z3iM1zsrGiyNXZ3mouRjSZdESEBnPEbtIdsyHLkL 9arhA/kvuMqXMjgun+tPD0+ETlaFf5GCKgfFQzbF2W4WpeEXii43ZLZ9UmObUUql 5Y65K/07+ga/dj3E+l1dLtA7VhVV5CK+8TTmVdqOr85pEZ/BC3U09vnwovDWJ+l0 sV7GhzsDFSpwxeArZy7wSMkSOTe71O1gvjOxWlupznFcZvirhRtI+5k1/btcn7hx 8b7dp36pTb/GfwaeUVsAvJBqwdSun3NOWX7zJxIDGU6LxA80eiV4z3SxAykS52gl rlb2e+F6dV+tRuREfaDaeS1DSlDMp1mQjPSD2ix6nSypv19FHdh01OoCd0OFxM6D xs5RQnUeu4J9g45Wdp6lmXM62EhUqYLKRbjXnZbFMlVMq81UwpMazwAruTEOCxl4 iQk3rNzfREONa9HeshiMlkeRAQpyB1qLZwhoTwTl6xKaMkt6nFEE6qX1KrrACHkH CFJVbuWVJCyoRFv+0Gypi7zn1ZZGkE4inDHxqIzUa0sSmbShEWooTxCyGUSoosaY u2ozh8ESQCy03JFR9DY6mo3YekbIcCEjgdmE35nK4lJQFbo3A8YlHunEdVK0tb8Z Wxf7cJ6J55bG5/Kft65kJnXAHrV9LnM1tPiRkB8umZkj/ou5NpDKiuLjR+WBfwi0 tqXk90NdSqJtMMGgrtVM84TYFPXP58QCBnE9oAI7XYM1rusuVBOXZw== -----END RSA PRIVATE KEY----- """) testFile.close() self.testFile = testFile testFile2 = tempfile.NamedTemporaryFile(delete=False) testFile2.write("""-----BEGIN CERTIFICATE----- MIIDCjCCAnOgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBgDELMAkGA1UEBhMCRlIx DjAMBgNVBAgMBVBhcmlzMQ4wDAYDVQQHDAVQYXJpczEWMBQGA1UECgwNRGFzdGFy ZGx5IEluYzEMMAoGA1UECwwDMTIzMQ8wDQYDVQQDDAZBbCBCYW4xGjAYBgkqhkiG 9w0BCQEWC2xvbEBsb2wuY29tMB4XDTEzMDEyNzAwMDM1OFoXDTE0MDEyNzAwMDM1 OFowgZcxCzAJBgNVBAYTAkZSMQwwCgYDVQQIDAMxMjMxDTALBgNVBAcMBFRlc3Qx IjAgBgNVBAoMGUludHJvc3B5IFRlc3QgQ2xpZW50IENlcnQxCzAJBgNVBAsMAjEy MRUwEwYDVQQDDAxBbGJhbiBEaXF1ZXQxIzAhBgkqhkiG9w0BCQEWFG5hYmxhLWMw ZDNAZ21haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDlnvP1ltVO 8JDNT3AA99QqtiqCi/7BeEcFDm2al46mv7looz6CmB84osrusNVFsS5ICLbrCmeo w5sxW7VVveGueBQyWynngl2PmmufA5Mhwq0ZY8CvwV+O7m0hEXxzwbyGa23ai16O zIiaNlBAb0mC2vwJbsc3MTMovE6dHUgmzQIDAQABo3sweTAJBgNVHRMEAjAAMCwG CWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNV HQ4EFgQUYR45okpFsqTYB1wlQQblLH9cRdgwHwYDVR0jBBgwFoAUP0X2HQlaca7D NBzVbsjsdhzOqUQwDQYJKoZIhvcNAQEFBQADgYEAWEOxpRjvKvTurDXK/sEUw2KY gmbbGP3tF+fQ/6JS1VdCdtLxxJAHHTW62ugVTlmJZtpsEGlg49BXAEMblLY/K7nm dWN8oZL+754GaBlJ+wK6/Nz4YcuByJAnN8OeTY4Acxjhks8PrAbZgcf0FdpJaAlk Pd2eQ9+DkopOz3UGU7c= -----END CERTIFICATE----- """) testFile2.close() self.testFile2 = testFile2 def test_use_private_key(self): self.assertIsNone( self.sslClient.use_private_key(self.testFile2.name, SSL_FILETYPE_PEM, self.testFile.name, SSL_FILETYPE_PEM, 'testPW')) def test_use_private_key_bad(self): self.assertRaisesRegexp(_nassl.OpenSSLError, 'bad decrypt', self.sslClient.use_private_key, self.testFile2.name, SSL_FILETYPE_PEM, self.testFile.name, SSL_FILETYPE_PEM, 'badPW')
def _process_parsing_results(self, args_command_list): """ Performs various sanity checks on the command line that was used to launch SSLyze. Returns the shared_settings object to be fed to plugins. """ shared_settings = {} # Sanity checks on the client cert options if bool(args_command_list.cert) ^ bool(args_command_list.key): raise CommandLineParsingError( 'No private key or certificate file were given. See --cert and --key.' ) # Private key and cert formats if args_command_list.certform is 'DER': args_command_list.certform = SSL_FILETYPE_ASN1 elif args_command_list.certform is 'PEM': args_command_list.certform = SSL_FILETYPE_PEM else: raise CommandLineParsingError('--certform should be DER or PEM.') if args_command_list.keyform is 'DER': args_command_list.keyform = SSL_FILETYPE_ASN1 elif args_command_list.keyform is 'PEM': args_command_list.keyform = SSL_FILETYPE_PEM else: raise CommandLineParsingError('--keyform should be DER or PEM.') # Let's try to open the cert and key files if args_command_list.cert: try: open(args_command_list.cert, "r") except: raise CommandLineParsingError( 'Could not open the client certificate file "' + str(args_command_list.cert) + '".') if args_command_list.key: try: open(args_command_list.key, "r") except: raise CommandLineParsingError( 'Could not open the client private key file "' + str(args_command_list.key) + '"') # Try to load the cert and key in OpenSSL try: sslClient = SslClient() sslClient.use_private_key(args_command_list.cert, args_command_list.certform, args_command_list.key, args_command_list.keyform, args_command_list.keypass) except _nassl.OpenSSLError as e: if 'bad decrypt' in str(e.args): raise CommandLineParsingError( 'Could not decrypt the private key. Wrong passphrase ?' ) raise CommandLineParsingError( 'Could not load the certificate or the private key. Passphrase needed ?' ) # HTTP CONNECT proxy if args_command_list.https_tunnel: if '2.7.' not in platform.python_version(): # Python 2.7 only raise CommandLineParsingError( '--https_tunnel requires Python 2.7.X. ' 'Current version is ' + platform.python_version() + '.') try: # Need to parse the proxy host:port string now (host, port) = TargetStringParser.parse_target_str( args_command_list.https_tunnel, 443) shared_settings['https_tunnel_host'] = host shared_settings['https_tunnel_port'] = port except InvalidTargetError: raise CommandLineParsingError( 'Not a valid host/port for --https_tunnel' ', discarding all tasks.') else: shared_settings['https_tunnel_host'] = None shared_settings['https_tunnel_port'] = None # STARTTLS if args_command_list.starttls: if args_command_list.starttls not in self.START_TLS_PROTS: raise CommandLineParsingError(self.START_TLS_USAGE) if args_command_list.starttls and args_command_list.https_tunnel: raise CommandLineParsingError( 'Cannot have --https_tunnel and --starttls at the same time.') # Number of connection retries if args_command_list.nb_retries < 1: raise CommandLineParsingError( 'Cannot have a number smaller than 1 for --nb_retries.') # All good, let's save the data for key, value in args_command_list.__dict__.iteritems(): shared_settings[key] = value return shared_settings