<commit_before>#!/usr/bin/env python
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# Contributor: <NAME> <EMAIL> [:ulfr]

from __future__ import print_function

import sys, os, json, subprocess, logging, argparse, platform, urllib2
from collections import namedtuple
from datetime import datetime
from copy import deepcopy

def str_compat(data):
    if sys.version_info >= (3,0):
        data = str(data, 'utf-8')
    return data

# has_good_pfs compares a given PFS configuration with a target
# dh parameter a target elliptic curve, and return true if good
# if `must_match` is True, the exact values are expected, if not
# larger pfs values than the targets are acceptable
def has_good_pfs(pfs, target_dh, target_ecc, must_match=False):
    if target_ecc and 'ECDH,' in pfs:
        # split string, expected format is 'ECDH,P-256,256bits'
        ecc = pfs.split(',')[2].split('b')[0]
        if int(ecc) < target_ecc:
            return False
        if must_match and int(ecc) != target_ecc:
            return False
    elif target_dh and 'DH,' in pfs:
        dhparam = pfs.split(',')[1].split('b')[0]
        if int(dhparam) < target_dh:
            return False
        if must_match and int(dhparam) != target_dh:
            return False
    return True

# is_fubar assumes that a configuration is not completely messed up
# and looks for reasons to think otherwise. it will return True if
# it finds one of these reason
def is_fubar(results):
    logging.debug('entering fubar evaluation')
    lvl = 'fubar'
    min_ec_size = min(old["ecdh_param_size"], inter["ecdh_param_size"], modern["ecdh_param_size"])

    fubar = False
    has_ssl2 = False
    has_wrong_pubkey = False
    has_wrong_ec_pubkey = False
    has_bad_sig = False
    has_untrust_cert = False
    has_wrong_pfs = False

    for conn in results['ciphersuite']:
        logging.debug('testing connection %s' % conn)
        pubkey_bits = int(conn['pubkey'][0])
        ec_kex = conn['cipher'].startswith('ECDHE-')

        if conn['cipher'] not in (set(old["ciphersuites"]) | set(inter["ciphersuites"]) | set(modern["ciphersuites"])):
            failures[lvl].append("remove cipher " + conn['cipher'])
            logging.debug(conn['cipher'] + ' is in the list of fubar ciphers')
            fubar = True
        if 'SSLv2' in conn['protocols']:
            has_ssl2 = True
            logging.debug('SSLv2 is in the list of fubar protocols')
            fubar = True
        if not ec_kex and pubkey_bits < 2048:
            has_wrong_pubkey = True
            logging.debug(conn['pubkey'][0] + ' is a fubar pubkey size')
            fubar = True
        if ec_kex and pubkey_bits < min_ec_size:
            has_wrong_ec_pubkey = True
            logging.debug(conn['pubkey'][0] + ' is a fubar EC pubkey size')
            fubar = True
        if conn['pfs'] != 'None':
            if not has_good_pfs(conn['pfs'], 1024, 160):
                logging.debug(conn['pfs']+ ' is a fubar PFS parameters')<commit_msg>Update EC check to use regexp and match all OpenSSL EC cipher suite variants<commit_after>#!/usr/bin/env python
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# Contributor: <NAME> <EMAIL> [:ulfr]

from __future__ import print_function

import sys, os, json, subprocess, logging, argparse, platform, urllib2, re
from collections import namedtuple
from datetime import datetime
from copy import deepcopy

def str_compat(data):
    if sys.version_info >= (3,0):
        data = str(data, 'utf-8')
    return data

# has_good_pfs compares a given PFS configuration with a target
# dh parameter a target elliptic curve, and return true if good
# if `must_match` is True, the exact values are expected, if not
# larger pfs values than the targets are acceptable
def has_good_pfs(pfs, target_dh, target_ecc, must_match=False):
    if target_ecc and 'ECDH,' in pfs:
        # split string, expected format is 'ECDH,P-256,256bits'
        ecc = pfs.split(',')[2].split('b')[0]
        if int(ecc) < target_ecc:
            return False
        if must_match and int(ecc) != target_ecc:
            return False
    elif target_dh and 'DH,' in pfs:
        dhparam = pfs.split(',')[1].split('b')[0]
        if int(dhparam) < target_dh:
            return False
        if must_match and int(dhparam) != target_dh:
            return False
    return True

# is_fubar assumes that a configuration is not completely messed up
# and looks for reasons to think otherwise. it will return True if
# it finds one of these reason
def is_fubar(results):
    logging.debug('entering fubar evaluation')
    lvl = 'fubar'
    min_ec_size = min(old["ecdh_param_size"], inter["ecdh_param_size"], modern["ecdh_param_size"])

    fubar = False
    has_ssl2 = False
    has_wrong_pubkey = False
    has_wrong_ec_pubkey = False
    has_bad_sig = False
    has_untrust_cert = False
    has_wrong_pfs = False

    for conn in results['ciphersuite']:
        logging.debug('testing connection %s' % conn)
        pubkey_bits = int(conn['pubkey'][0])
        ec_kex = re.match(r"(ECDHE|EECDH|ECDH)-", conn['cipher'])

        if conn['cipher'] not in (set(old["ciphersuites"]) | set(inter["ciphersuites"]) | set(modern["ciphersuites"])):
            failures[lvl].append("remove cipher " + conn['cipher'])
            logging.debug(conn['cipher'] + ' is in the list of fubar ciphers')
            fubar = True
        if 'SSLv2' in conn['protocols']:
            has_ssl2 = True
            logging.debug('SSLv2 is in the list of fubar protocols')
            fubar = True
        if not ec_kex and pubkey_bits < 2048:
            has_wrong_pubkey = True
            logging.debug(conn['pubkey'][0] + ' is a fubar pubkey size')
            fubar = True
        if ec_kex and pubkey_bits < min_ec_size:
            has_wrong_ec_pubkey = True
            logging.debug(conn['pubkey'][0] + ' is a fubar EC pubkey size')
            fubar = True
        if conn['pfs'] != 'None':
            if not has_good_pfs(conn['pfs'], 1024, 160):
                logging.debug(conn['pfs']+ ' is a fubar PFS parameters')
{'fraction_non_alphanumeric': 0.106055851898337, 'fraction_numerical': 0.011295889551302165, 'mean_word_length': 2.854292623941959, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5947906', 'n_tokens_mistral': 2125, 'n_tokens_neox': 2026, 'n_words': 642}