yawast 0.5.0.beta7 → 0.5.0.beta8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/scanner/plugins/ssl/sweet32.rb +25 -2
- data/lib/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 76e1b89755a35676aaf8b0c09b610374cc65ffb0
|
|
4
|
+
data.tar.gz: d724a23dfeadf0c7caa6cd6d743d0f4b7bb8e7fe
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 632588ee25be17d27c1c280db6ce036bb6947edba73d6b656934942977501363de41da0b2e6f7b483285a828f239ad81dd84ff98c63f043d35ebfe9f20be0b62
|
|
7
|
+
data.tar.gz: 9e90bb7d3cd0cdb5929a1ed7bd42e18d60a47a84808ee35dcc546b6560f78e2d657dffccc62ddbaccc3a3babf6c43406a7a6a03d030b7764853f31bc8ccf5225
|
|
@@ -21,6 +21,9 @@ module Yawast
|
|
|
21
21
|
req.keep_alive_timeout = 600
|
|
22
22
|
headers = Yawast::Shared::Http.get_headers
|
|
23
23
|
|
|
24
|
+
#we will use HEAD by default, but allow GET if we have issues with HEAD
|
|
25
|
+
use_head = true
|
|
26
|
+
|
|
24
27
|
#force 3DES - this is to ensure that 3DES specific limits are caught
|
|
25
28
|
req.ciphers = ['3DES']
|
|
26
29
|
|
|
@@ -32,7 +35,23 @@ module Yawast
|
|
|
32
35
|
|
|
33
36
|
begin
|
|
34
37
|
req.start do |http|
|
|
35
|
-
|
|
38
|
+
|
|
39
|
+
head = nil
|
|
40
|
+
begin
|
|
41
|
+
if use_head
|
|
42
|
+
head = http.head(uri.path, headers)
|
|
43
|
+
else
|
|
44
|
+
head = http.request_get(uri.path, headers)
|
|
45
|
+
end
|
|
46
|
+
rescue
|
|
47
|
+
#check if we are using HEAD or GET. If we've already switched to GET, no need to do this again.
|
|
48
|
+
if use_head
|
|
49
|
+
head = http.request_get(uri.path, headers)
|
|
50
|
+
|
|
51
|
+
#if we are here, that means that HEAD failed, but GET didn't, so we'll use GET from now on.
|
|
52
|
+
use_head = false
|
|
53
|
+
end
|
|
54
|
+
end
|
|
36
55
|
|
|
37
56
|
#check to see if this is on Cloudflare - they break Keep-Alive limits, creating a false positive
|
|
38
57
|
head.each do |k, v|
|
|
@@ -57,7 +76,11 @@ module Yawast
|
|
|
57
76
|
#cache the number of hits
|
|
58
77
|
hits = http.instance_variable_get(:@ssl_context).session_cache_stats[:cache_hits]
|
|
59
78
|
10000.times do |i|
|
|
60
|
-
|
|
79
|
+
if use_head
|
|
80
|
+
http.head(uri.path, headers)
|
|
81
|
+
else
|
|
82
|
+
http.request_get(uri.path, headers)
|
|
83
|
+
end
|
|
61
84
|
|
|
62
85
|
# hack to detect transparent disconnects
|
|
63
86
|
if http.instance_variable_get(:@ssl_context).session_cache_stats[:cache_hits] != hits
|
data/lib/version.rb
CHANGED