From Fedora Project Wiki
No edit summary |
No edit summary |
||
Line 14: | Line 14: | ||
#::wget -q -O /dev/null https://rc4.badssl.com/ && echo "FAIL wget DEFAULT rc4" | #::wget -q -O /dev/null https://rc4.badssl.com/ && echo "FAIL wget DEFAULT rc4" | ||
#::wget -q -O /dev/null https://3des.badssl.com/ || echo "FAIL wget DEFAULT 3des" | #::wget -q -O /dev/null https://3des.badssl.com/ || echo "FAIL wget DEFAULT 3des" | ||
#::(sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect rc4.badssl.com:443 -servername rc4.badssl.com &>/dev/null && echo "FAIL s_client DEFAULT rc4 | #::(sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect rc4.badssl.com:443 -servername rc4.badssl.com &>/dev/null && echo "FAIL s_client DEFAULT rc4" | ||
#::(sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect 3des.badssl.com:443 -servername 3des.badssl.com &>/dev/null || echo "FAIL s_client DEFAULT 3des | #::(sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect 3des.badssl.com:443 -servername 3des.badssl.com &>/dev/null || echo "FAIL s_client DEFAULT 3des" | ||
#::curl -s https://rc4.badssl.com/ >/dev/null && echo "FAIL curl DEFAULT rc4" | #::curl -s https://rc4.badssl.com/ >/dev/null && echo "FAIL curl DEFAULT rc4" | ||
#::curl -s https://3des.badssl.com/ >/dev/null || echo "FAIL curl DEFAULT 3des"</pre> | #::curl -s https://3des.badssl.com/ >/dev/null || echo "FAIL curl DEFAULT 3des"</pre> | ||
Line 23: | Line 23: | ||
#::wget -q -O /dev/null https://3des.badssl.com/ && echo "FAIL wget FUTURE 3des" | #::wget -q -O /dev/null https://3des.badssl.com/ && echo "FAIL wget FUTURE 3des" | ||
#::wget -q -O /dev/null https://mozilla-modern.badssl.com/ || echo "FAIL wget FUTURE modern" | #::wget -q -O /dev/null https://mozilla-modern.badssl.com/ || echo "FAIL wget FUTURE modern" | ||
#::(sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect 3des.badssl.com:443 -servername 3des.badssl.com &>/dev/null && echo "FAIL s_client FUTURE 3des | #::(sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect 3des.badssl.com:443 -servername 3des.badssl.com &>/dev/null && echo "FAIL s_client FUTURE 3des" | ||
#::(sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect mozilla-modern.badssl.com:443 -servername mozilla-modern.badssl.com &>/dev/null || echo "FAIL s_client FUTURE modern | #::(sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect mozilla-modern.badssl.com:443 -servername mozilla-modern.badssl.com &>/dev/null || echo "FAIL s_client FUTURE modern" | ||
#::curl -s https://3des.badssl.com/ >/dev/null && echo "FAIL curl FUTURE 3des" | #::curl -s https://3des.badssl.com/ >/dev/null && echo "FAIL curl FUTURE 3des" | ||
#::curl -s https://mozilla-modern.badssl.com/ >/dev/null || echo "FAIL curl FUTURE modern"</pre> | #::curl -s https://mozilla-modern.badssl.com/ >/dev/null || echo "FAIL curl FUTURE modern"</pre> |
Revision as of 08:02, 30 March 2017
Description
Sanity of crypto-policies
How to test
We will test if at least some utilities using different libraries (gnutls, openssl, nss) pay attention to crypto policy setting
- Check LEGACY profile - currently FAILs with gnutls/wget (bug) and openssl/s_client (bug)
- update-crypto-policies --set LEGACY || echo "FAIL update LEGACY"
- wget -q -O /dev/null https://rc4.badssl.com/ || echo "FAIL wget LEGACY rc4"
- (sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect rc4.badssl.com:443 -servername rc4.badssl.com &>/dev/null || echo "FAIL s_client LEGACY rc4"
- curl -s https://rc4.badssl.com/ >/dev/null|| echo "FAIL curl LEGACY rc4"
- Check DEFAULT profile
- update-crypto-policies --set DEFAULT || echo "FAIL update DEFAULT"
- wget -q -O /dev/null https://rc4.badssl.com/ && echo "FAIL wget DEFAULT rc4"
- wget -q -O /dev/null https://3des.badssl.com/ || echo "FAIL wget DEFAULT 3des"
- (sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect rc4.badssl.com:443 -servername rc4.badssl.com &>/dev/null && echo "FAIL s_client DEFAULT rc4"
- (sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect 3des.badssl.com:443 -servername 3des.badssl.com &>/dev/null || echo "FAIL s_client DEFAULT 3des"
- curl -s https://rc4.badssl.com/ >/dev/null && echo "FAIL curl DEFAULT rc4"
- curl -s https://3des.badssl.com/ >/dev/null || echo "FAIL curl DEFAULT 3des"
- Check FUTURE profile
- update-crypto-policies --set FUTURE || echo "FAIL update FUTURE"
- wget -q -O /dev/null https://3des.badssl.com/ && echo "FAIL wget FUTURE 3des"
- wget -q -O /dev/null https://mozilla-modern.badssl.com/ || echo "FAIL wget FUTURE modern"
- (sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect 3des.badssl.com:443 -servername 3des.badssl.com &>/dev/null && echo "FAIL s_client FUTURE 3des"
- (sleep 5; echo -e "GET / HTTP/1.1\n\n") |openssl s_client -connect mozilla-modern.badssl.com:443 -servername mozilla-modern.badssl.com &>/dev/null || echo "FAIL s_client FUTURE modern"
- curl -s https://3des.badssl.com/ >/dev/null && echo "FAIL curl FUTURE 3des"
- curl -s https://mozilla-modern.badssl.com/ >/dev/null || echo "FAIL curl FUTURE modern"
Expected Results
Commands complete without FAIL
being printed.