From 4c57b932ab42be3f36663ceeb54df08dadc46f67 Mon Sep 17 00:00:00 2001 From: Charles Strahan Date: Tue, 2 Feb 2016 18:02:31 -0500 Subject: cipherscan: init at rev 18b0d1b (Dec 17, 2015) CipherScan is a simple way to find out which SSL ciphersuites are supported by a target. It can take advantage of the extra features in Peter Mosmans' openssl fork (which is also included in this commit). --- pkgs/tools/security/cipherscan/default.nix | 43 ++++++++++++++ pkgs/tools/security/cipherscan/path.patch | 93 ++++++++++++++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 pkgs/tools/security/cipherscan/default.nix create mode 100644 pkgs/tools/security/cipherscan/path.patch (limited to 'pkgs/tools/security') diff --git a/pkgs/tools/security/cipherscan/default.nix b/pkgs/tools/security/cipherscan/default.nix new file mode 100644 index 000000000000..e75b53b257d1 --- /dev/null +++ b/pkgs/tools/security/cipherscan/default.nix @@ -0,0 +1,43 @@ +{ stdenv, lib, fetchFromGitHub, pkgconfig, openssl, makeWrapper, python, coreutils }: + +stdenv.mkDerivation rec { + name = "cipherscan-${version}"; + version = "2015-12-17"; + src = fetchFromGitHub { + owner = "jvehent"; + repo = "cipherscan"; + rev = "18b0d1b952d027d20e38f07329817873ec077d26"; + sha256 = "0b6fkfm2y8w04am4krspmapcc5ngn603n5rlwyjly92z2dawc7h8"; + }; + buildInputs = [ makeWrapper python ]; + patches = [ ./path.patch ]; + buildPhase = '' + substituteInPlace cipherscan \ + --replace "@OPENSSLBIN@" \ + "${openssl}/bin/openssl" \ + --replace "@TIMEOUTBIN@" \ + "${coreutils}/bin/timeout" \ + --replace "@READLINKBIN@" \ + "${coreutils}/bin/readlink" + + substituteInPlace analyze.py \ + --replace "@OPENSSLBIN@" \ + "${openssl}/bin/openssl" + ''; + installPhase = '' + mkdir -p $out/bin + + cp cipherscan $out/bin + cp openssl.cnf $out/bin + cp analyze.py $out/bin + + wrapProgram $out/bin/analyze.py --set PYTHONPATH "$PYTHONPATH" + ''; + meta = with lib; { + description = "Very simple way to find out which SSL ciphersuites are supported by a target"; + homepage = "https://github.com/jvehent/cipherscan"; + license = licenses.mpl; + platforms = platforms.all; + maintainers = with maintainers; [ cstrahan ]; + }; +} diff --git a/pkgs/tools/security/cipherscan/path.patch b/pkgs/tools/security/cipherscan/path.patch new file mode 100644 index 000000000000..3b6d8ef80509 --- /dev/null +++ b/pkgs/tools/security/cipherscan/path.patch @@ -0,0 +1,93 @@ +diff --git a/analyze.py b/analyze.py +index bb62af8..e929253 100755 +--- a/analyze.py ++++ b/analyze.py +@@ -418,13 +418,7 @@ def build_ciphers_lists(opensslbin): + + # use system openssl if not on linux 64 + if not opensslbin: +- if platform.system() == 'Linux' and platform.architecture()[0] == '64bit': +- opensslbin = mypath + '/openssl' +- elif platform.system() == 'Darwin' and platform.architecture()[0] == '64bit': +- opensslbin = mypath + '/openssl-darwin64' +- else: +- opensslbin='openssl' +- print("warning: analyze.py is using system's openssl, which may limit the tested ciphers and recommendations") ++ opensslbin = "@OPENSSLBIN@" + + logging.debug('Loading all ciphers: ' + allC) + all_ciphers = subprocess.Popen([opensslbin, 'ciphers', allC], +diff --git a/cipherscan b/cipherscan +index 236b34f..a240d13 100755 +--- a/cipherscan ++++ b/cipherscan +@@ -30,43 +30,12 @@ if [[ -n $NOAUTODETECT ]]; then + else + case "$(uname -s)" in + Darwin) +- opensslbin_name="openssl-darwin64" +- +- READLINKBIN=$(which greadlink 2>/dev/null) +- if [[ -z $READLINKBIN ]]; then +- echo "greadlink not found. (try: brew install coreutils)" 1>&2 +- exit 1 +- fi +- TIMEOUTBIN=$(which gtimeout 2>/dev/null) +- if [[ -z $TIMEOUTBIN ]]; then +- echo "gtimeout not found. (try: brew install coreutils)" 1>&2 +- exit 1 +- fi ++ READLINKBIN="@READLINKBIN@" ++ TIMEOUTBIN="@TIMEOUTBIN@" + ;; + *) +- opensslbin_name="openssl" +- +- # test that readlink or greadlink (darwin) are present +- READLINKBIN="$(which readlink)" +- +- if [[ -z $READLINKBIN ]]; then +- READLINKBIN="$(which greadlink)" +- if [[ -z $READLINKBIN ]]; then +- echo "neither readlink nor greadlink are present. install coreutils with {apt-get,yum,brew} install coreutils" 1>&2 +- exit 1 +- fi +- fi +- +- # test that timeout or gtimeout (darwin) are present +- TIMEOUTBIN="$(which timeout)" +- +- if [[ -z $TIMEOUTBIN ]]; then +- TIMEOUTBIN="$(which gtimeout)" +- if [[ -z $TIMEOUTBIN ]]; then +- echo "neither timeout nor gtimeout are present. install coreutils with {apt-get,yum,brew} install coreutils" 1>&2 +- exit 1 +- fi +- fi ++ READLINKBIN="@READLINKBIN@" ++ TIMEOUTBIN="@TIMEOUTBIN@" + + # Check for busybox, which has different arguments + TIMEOUTOUTPUT="$($TIMEOUTBIN --help 2>&1)" +@@ -1944,20 +1913,7 @@ do + done + + if [[ -z $OPENSSLBIN ]]; then +- readlink_result=$("$READLINKBIN" -f "$0") +- if [[ -z $readlink_result ]]; then +- echo "$READLINKBIN -f $0 failed, aborting." 1>&2 +- exit 1 +- fi +- REALPATH=$(dirname "$readlink_result") +- if [[ -z $REALPATH ]]; then +- echo "dirname $REALPATH failed, aborting." 1>&2 +- exit 1 +- fi +- OPENSSLBIN="${REALPATH}/${opensslbin_name}" +- if ! [[ -x "${OPENSSLBIN}" ]]; then +- OPENSSLBIN="$(which openssl)" # fallback to generic openssl +- fi ++ OPENSSLBIN="@OPENSSLBIN@" + fi + # use custom config file to enable GOST ciphers + if [[ -e $DIRNAMEPATH/openssl.cnf ]]; then -- cgit 1.4.1