Skip to content

Commit 1debbc9

Browse files
nabla-c0d3nabla-c0d3
authored
Merge pull request #702 from nabla-c0d3/dev
v6.2.0
2 parents 216ae90 + b2db8fa commit 1debbc9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+21957
-20764
lines changed

‎.github/workflows/scan_apache2_server.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
python -m pip install --upgrade pip setuptools
3535
3636
- name: Install SSLyze
37-
run: python setup.py install
37+
run: python -m pip install -e .
3838

3939
- name: Scan web server
4040
run: python tests/web_servers/scan_localhost.py apache2

‎.github/workflows/scan_iis_server.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
python -m pip install --upgrade pip setuptools
3333
3434
- name: Install SSLyze
35-
run: python setup.py install
35+
run: python -m pip install -e .
3636

3737
- name: Scan web server
3838
run: python tests/web_servers/scan_localhost.py iis

‎.github/workflows/scan_nginx_server.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
python -m pip install --upgrade pip setuptools
3232
3333
- name: Install SSLyze
34-
run: python setup.py install
34+
run: python -m pip install -e .
3535

3636
- name: Scan web server
3737
run: python tests/web_servers/scan_localhost.py nginx

‎.github/workflows/test_module_setup.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,6 @@ jobs:
2424
2525
- name: Test SSLyze module setup
2626
run: |
27-
python setup.py install
27+
python -m pip install -e .
2828
cd docs # Switch folder to avoid conflicts between ./sslyze and the installed sslyze module
2929
python ../api_sample.py

‎README.md‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Key features
1818
* Focus on speed and reliability: SSLyze is a battle-tested tool that is used to reliably scan **hundreds of thousands**
1919
of servers every day.
2020
* Easy to operationalize: SSLyze can be directly run from CI/CD, in order to continuously check a server against
21-
Mozilla's recommended TLS configuration.
21+
Mozilla's recommended TLS configurations.
2222
* Fully documented [Python API](https://nabla-c0d3.github.io/sslyze/documentation/) to run scans directly from any
2323
Python application, such as a function deployed to AWS Lambda.
2424
* Support for scanning non-HTTP servers including SMTP, XMPP, LDAP, POP, IMAP, RDP, Postgres and FTP servers.
@@ -82,7 +82,20 @@ mozilla.com:443: FAILED - Not compliant.
8282
* ciphers: Cipher suites {'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256', 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'} are supported, but should be rejected.
8383
```
8484

85-
This can be used to easily run an SSLyze scan as a CI/CD step.
85+
Alternatively, you can check against your own custom TLS configuration by providing a JSON file that follows Mozilla's TLS configuration format:
86+
87+
```
88+
$ python -m sslyze --custom_tls_config custom_tls_config_example.json mozilla.com
89+
```
90+
```
91+
Checking results against custom TLS configuration.
92+
93+
mozilla.com:443: OK - Compliant.
94+
```
95+
96+
See `custom_tls_config_example.json` for an example a custom TLS configuration that can be used by SSLyze.
97+
98+
**This functionality can be used to easily run an SSLyze scan as a CI/CD step in order to ensure TLS compliance.**
8699

87100
Development environment
88101
-----------------------

‎custom_tls_config_example.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"tls_versions": ["TLSv1.2", "TLSv1.3"],
3+
"certificate_types": ["ecdsa", "rsa"],
4+
"certificate_curves": ["prime256v1", "secp384r1"],
5+
"certificate_signatures": [
6+
"ecdsa-with-SHA256",
7+
"ecdsa-with-SHA384",
8+
"sha256WithRSAEncryption",
9+
"sha384WithRSAEncryption"
10+
],
11+
"ciphersuites": [
12+
"TLS_AES_256_GCM_SHA384",
13+
"TLS_CHACHA20_POLY1305_SHA256",
14+
"TLS_AES_128_GCM_SHA256"
15+
],
16+
"ciphers": {
17+
"caddy": [
18+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
19+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
20+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
21+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
22+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
23+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
24+
],
25+
"go": [
26+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
27+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
28+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
29+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
30+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
31+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
32+
],
33+
"iana": [
34+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
35+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
36+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
37+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
38+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
39+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
40+
],
41+
"openssl": [
42+
"ECDHE-ECDSA-AES256-GCM-SHA384",
43+
"ECDHE-RSA-AES256-GCM-SHA384",
44+
"ECDHE-ECDSA-AES128-GCM-SHA256",
45+
"ECDHE-RSA-AES128-GCM-SHA256",
46+
"ECDHE-ECDSA-CHACHA20-POLY1305",
47+
"ECDHE-RSA-CHACHA20-POLY1305"
48+
]
49+
},
50+
"tls_curves": ["X25519", "prime256v1", "secp384r1"],
51+
"rsa_key_size": 2048,
52+
"dh_param_size": 2048,
53+
"ecdh_param_size": 256,
54+
"hsts_min_age": 31536000,
55+
"maximum_certificate_lifespan": 90,
56+
"recommended_certificate_lifespan": 90,
57+
"ocsp_staple": true,
58+
"server_preferred_order": false
59+
}

‎docs/available-scan-commands.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ Result class
163163
Insecure Renegotiation
164164
**********************
165165

166-
**ScanCommand.SESSION_RENEGOTIATION**: Test a server for for insecure TLS renegotiation and client-initiated renegotiation.
166+
**ScanCommand.SESSION_RENEGOTIATION**: Test a server for insecure TLS renegotiation and client-initiated renegotiation.
167167

168168
Result class
169169
============

‎docs/documentation/.buildinfo‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
# Sphinx build info version 1
22
# This file records the configuration used when building these files. When it is not found, a full rebuild will be done.
3-
config: 094768c3cd394a7960733fba4a2e0033
3+
config: 23b7099385a204804e49af6cf47f195f
44
tags: 645f666f9bcd5a90fca523b33c5a78b7

‎docs/documentation/_static/basic.css‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -741,14 +741,6 @@ abbr, acronym {
741741
cursor: help;
742742
}
743743

744-
.translated {
745-
background-color: rgba(207, 255, 207, 0.2)
746-
}
747-
748-
.untranslated {
749-
background-color: rgba(255, 207, 207, 0.2)
750-
}
751-
752744
/* -- code displays --------------------------------------------------------- */
753745

754746
pre {

‎docs/documentation/_static/documentation_options.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
const DOCUMENTATION_OPTIONS = {
2-
VERSION: '6.1.0',
2+
VERSION: '6.2.0',
33
LANGUAGE: 'en',
44
COLLAPSE_INDEX: false,
55
BUILDER: 'html',

0 commit comments

Comments
 (0)