forked from OWASP/O-Saft
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy patho-saft-man.pm
executable file
·3763 lines (2887 loc) · 147 KB
/
o-saft-man.pm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/perl -w
### This software is licensed under GPLv2. Please see o-saft.pl for details.
package main; # ensure that main:: variables are used
binmode(STDOUT, ":unix");
binmode(STDERR, ":unix");
my $man_SID= "@(#) o-saft-man.pm 1.7 14/12/11 16:07:12";
our $parent = (caller(0))[1] || "O-Saft";# filename of parent, O-Saft if no parent
$parent =~ s:.*/::;
our $ich = (caller(1))[1]; # tricky to get filename of myself when called from BEGIN
$ich = "o-saft-man.pm" if (! defined $ich); # sometimes it's empty :-((
$ich =~ s:.*/::;
our $version= _VERSION() || "$man_SID"; # version of parent, myself if empty
my $skip = 1;
our $egg = "";
our @DATA;
if (open(DATA, $ich)) {
# If this module is used in parent's BEGIN{} section, we don't have any
# file descriptor, in particular nothing beyond __DATA__. Hence we need
# to read the file --this one-- manually, and strip off anything before
# __DATA__. Stripping could be done using perl's grep, join and splice
# functions, but using a simple loop is more readable.
# Preformat plain text with markup for further simple substitutions. We
# use a modified (& instead of < >) POD markup as it is easy to parse.
# & was choosen 'cause it rarely appears in texts and is not a meta
# character in any of the supported output formats (text, wiki, html),
# and also causes no problems inside regex.
while (<DATA>) {
$skip = 2, next if (/^#begin/);
$skip = 0, next if (/^#end/);
$skip = 0, next if (/^__DATA__/);
$egg .= $_,next if ($skip eq 2);
next if ($skip ne 0);
next if (/^#/); # remove comments
next if (/^\s*#.*#$/); # remove formatting lines
s/^([A-Z].*)/=head1 $1/;
s/^ {4}([^ ].*)/=head2 $1/;
s/^ {6}([^ ].*)/=head3 $1/;
# for =item keep spaces as they are needed in man_help()
s/^( +[a-z0-9]+\).*)/=item * $1/;# list item, starts with letter or digit and )
s/^( +\*\* .*)/=item $1/; # list item, second level
s/^( +\* .*)/=item $1/; # list item, first level
s/^( {11})([^ ].*)/=item * $1$2/;# list item
s/^( {14})([^ ].*)/S&$1$2&/; # exactly 14 spaces used to highlight line
if (!m/^(?:=|S&|\s+\$0)/) { # no markup in example lines and already marked lines
s!(\s)((?:\+|--)[^,\s).]*)([,\s).])!$1I&$2&$3!g; # markup commands and options
# FIXME: fails for something like: --opt="foo bar"
}
s/((?:Net::SSLeay|ldd|openssl|timeout|IO::Socket(?:::SSL|::INET)?)\(\d\))/L&$1&/g;
s/((?:Net::SSL(?:hello|info)|o-saft(?:-dbx|-man|-usr|-README)(?:\.pm)?))/L&$1&/g;
s/ (L&[^&]*&)/ $1/g;
s/(L&[^&]*&) /$1 /g;
# If external references are enclosed in double spaces, we squesze
# leading and trailing spaces 'cause additional characters will be
# added later (i.e. in man_help()). Just pretty printing ...
if (m/^ /) { # add internal links; quick&dirty list here
s/ ((?:DEBUG|RC|USER)-FILE)/ X&$1&/g;
s/ (CONFIGURATION (?:FILE|OPTIONS))/ X&$1&/g;
s/ (COMMANDS|OPTIONS|RESULTS|CHECKS|OUTPUT) / X&$1& /g;
s/ (CUSTOMIZATION|SCORING|LIMITATIONS|DEBUG|EXAMPLES) / X&$1& /g;
}
s#\$VERSION#$version#g; # add current VERSION
s# \$0# $parent#g; # my name
push(@DATA, $_);
}
close(DATA);
}
our $\ = "";
## definitions: more documentations as data
## -------------------------------------
our %man_text = (
# short list of used terms and acronyms, always incomplete ...
'glossar' => {
'AA' => "Attribute Authority",
'AAD' => "additional authenticated data",
'ADH' => "Anonymous Diffie-Hellman",
'Adler32' => "hash function",
'AEAD' => "Authenticated Encryption with Additional Data",
'AECDHE' => "Anonymous Ephemeral ECDH",
'AEM' => "Authenticated Encryption Mode aka Advanced Encryption Mode aka OCB3",
'AES' => "Advanced Encryption Standard",
'AIA' => "Authority Information Access (certificate extension)",
'AKC' => "Agreement with Key Confirmation",
'AKID' => "Authority Key IDentifier",
'ALPN' => "Application Layer Protocol Negotiation",
'ARC4' => "Alleged RC4 (see RC4)",
'ARCFOUR' => "alias for ARC4",
'ARIA' => "128-bit Symmetric Block Cipher",
'ASN' => "Autonomous System Number",
'ASN.1' => "Abstract Syntax Notation One",
'BDH' => "Bilinear Diffie-Hellman",
'BEAST' => "Browser Exploit Against SSL/TLS",
'BER' => "Basic Encoding Rules",
'Blowfish' => "symmetric block cipher",
'BREACH' => "Browser Reconnaissance & Exfiltration via Adaptive Compression of Hypertext (a variant of CRIME)",
# http://www.breachattack.com/
'CAMELLIA' => "Encryption algorithm 128 bit (by Mitsubishi and NTT)",
'CAST-128' => "Carlisle Adams and Stafford Tavares, block cipher",
'CAST5' => "alias for CAST-128",
'CAST-256' => "Carlisle Adams and Stafford Tavares, block cipher",
'CAST6' => "alias for CAST-256",
'cipher suite' => "cipher suite is a named combination of authentication, encryption, and message authentication code algorithms",
'CA' => "Certificate Authority (aka root CA)",
'CBC' => "Cyclic Block Chaining",
'CBC ' => "Cipher Block Chaining (sometimes)",
'CBC ' => "Ciplier Block Chaining (sometimes)",
# ^^-- spaces to make key unique
'CBC-MAC' => "Cipher Block Chaining - Message Authentication Code",
'CBC-MAC-ELB' => "Cipher Block Chaining - Message Authentication Code - Encrypt Last Block",
'CCM' => "CBC-MAC Mode",
'CCS' => "Change Cipher Spec (protocol)",
'CDH' => "? Diffie-Hellman",
'CDP' => "CRL Distribution Points",
'CEK' => "Content Encryption Key",
'CFB' => "Cipher Feedback",
'CFB3' => "Cipher Feedback",
'CFBx' => "Cipher Feedback x bit mode",
'CHAP' => "Challenge Handshake Authentication Protocol",
'CKA' => "", # PKCS#11
'CKK' => "", # PKCS#11
'CKM' => "", # PKCS#11
'CMAC' => "Cipher-based MAC",
'CMP' => "X509 Certificate Management Protocol",
'CMS' => "Cryptographic Message Syntax",
'CMVP' => "Cryptographic Module Validation Program (NIST)",
'CN' => "Common Name",
'CP' => "Certificate Policy (certificate extension)",
'CPD' => "Certificate Policy Definitions",
'CPS' => "Certification Practice Statement",
'CRC' => "Cyclic Redundancy Check",
'CRIME' => "Compression Ratio Info-leak Made Easy (Exploit SSL/TLS)",
'CRL' => "Certificate Revocation List",
'CSP' => "Certificate Service Provider",
'CSP ' => "Critical Security Parameter (used in FIPS 140-2)",
'CSR' => "Certificate Signing Request",
'CP' => "Certificate Transparency",
'CTL' => "Certificate Trust Line",
'CTR' => "Counter Mode (sometimes: CM; block cipher mode)",
'CTS' => "Cipher Text Stealing",
'CWC' => "CWC Mode (Carter-Wegman + CTR mode; block cipher mode)",
'DAA' => "Data Authentication Algorithm",
'DAC' => "Data Authentication Code",
'DEK' => "Data Encryption Key",
'DER' => "Distinguished Encoding Rules",
'DES' => "Data Encryption Standard",
'DESede' => "alias for 3DES ?java only?",
'DESX' => "extended DES",
'3DES' => "Tripple DES (168 bits)",
'3DES-EDE' => "alias for 3DES",
'3TDEA' => "Three-key Tripple DEA (sometimes: Tripple DES; 168 bits)",
'2TDEA' => "Double-key Tripple DEA (sometimes: Double DES; 112 bits)",
'D5' => "Verhoeff's Dihedral Group D5 Check",
'DANE' => "DNS-based Authentication of Named Entities",
'DDH' => "Decisional Diffie-Hellman (Problem)",
'DEA' => "Data Encryption Algorithm (sometimes a synonym for DES)",
'DECIPHER' => "synonym for decryption",
'DER' => "Distinguished Encoding Rules",
'DH' => "Diffie-Hellman",
'DHE' => "Diffie-Hellman ephemeral", # historic acronym, often used, mainly in openssl
'DLIES' => "Discrete Logarithm Integrated Encryption Scheme",
'DN' => "Distinguished Name",
'DPA' => "Dynamic Passcode Authentication (see CAP)",
'DRBG' => "Deterministic Random Bit Generator",
'DSA' => "Digital Signature Algorithm",
'DSS' => "Digital Signature Standard",
'DTLS' => "Datagram TLS",
'DTLSv1' => "Datagram TLS 1.0",
'DV' => "Domain Validation",
'DV-SSL' => "Domain Validated Certificate",
'EAP' => "Extensible Authentication Protocol",
'EAP-PSK' => "Extensible Authentication Protocol using a Pre-Shared Key",
'EAX' => "EAX Mode (block cipher mode)",
'EAXprime' => "alias for EAX Mode",
'EC' => "Elliptic Curve",
'ECB' => "Electronic Code Book mode",
'ECC' => "Elliptic Curve Cryptography",
'ECDH' => "Elliptic Curve Diffie-Hellman",
'ECDHE' => "Ephemeral ECDH",
'ECDSA' => "Elliptic Curve Digital Signature Algorithm",
'ECGDSA' => "Elliptic Curve ??? DSA",
'ECIES' => "Elliptic Curve Integrated Encryption Scheme",
'ECKA' => "Elliptic Curve Key Agreement",
'ECKA-EG' => "Elliptic Curve Key Agreement of ElGamal Type",
'ECKDSA' => "Elliptic Curve ??? DSA",
'ECMQV' => "Elliptic Curve Menezes-Qu-Vanstone",
'ECOH' => "Elliptic Curve only hash",
'EDE' => "Encryption-Decryption-Encryption",
'EDH' => "Ephemeral Diffie-Hellman", # official acronym
'EGB' => "Entropy Gathering Daemon",
'ELB' => "Encrypt Last Block",
'ElGamal' => "asymmetric block cipher",
'ENCIPHER' => "synonym for encryption",
'EME' => "Encoding Method for Encryption",
'ESP' => "Encapsulating Security Payload",
'EV' => "Extended Validation",
'EV-SSL' => "Extended Validation Certificate",
'FEAL' => "Fast Data Encryption Algorithm",
'FFC' => "Finite Field Cryptography",
'FIPS' => "Federal Information Processing Standard",
'FIPS46-2' => "FIPS Data Encryption Standard (DES)",
'FIPS73' => "FIPS Guidelines for Security of Computer Applications",
'FIPS140-2' => "FIPS Security Requirements for Cryptographic Modules",
'FIPS140-3' => "proposed revision of FIPS 140-2",
'FIPS180-3' => "FIPS Secure Hash Standard",
'FIPS186-3' => "FIPS Digital Signature Standard (DSS)",
'FIPS197' => "FIPS Advanced Encryption Standard (AES)",
'FIPS198-1' => "FIPS The Keyed-Hash Message Authentication Code (HMAC)",
'FQDN' => "Fully-qualified Domain Name",
'FSB' => "Fast Syndrome Based Hash",
'FSM' => "Finite State Machine",
'FZA' => "FORTEZZA",
'G-DES' => "??? DES",
'GCM' => "Galois/Counter Mode (block cipher mode)",
'GHASH' => "Hash funtion used in GCM",
'GMAC' => "MAC for GCM",
'GOST' => "Gossudarstwenny Standard (block cipher)",
'Grainv1' => "stream cipher (64-bit IV)",
'Grainv128' => "stream cipher (96-bit IV)",
'hash127' => "fast hash function (by Dan Bernstein)",
'HAVAL' => "one-way hashing",
'HAS-160' => "hash function",
'HAS-V' => "hash function",
'HC128' => "stream cipher",
'HC256' => "stream cipher",
'HEARTBLEED'=> "attack against TLS extension heartbeat",
'HIBE' => "hierarchical identity-based encryption",
'HMAC' => "keyed-Hash Message Authentication Code",
'HMQV' => "h? Menezes-Qu-Vanstone",
'HSM' => "Hardware Security Module",
'HSTS' => "HTTP Strict Transport Security",
'HTOP' => "HMAC-Based One-Time Password",
'IAPM' => "Integrity Aware Parallelizable Mode (block cipher mode of operation)",
'ICM' => "Integer Counter Mode (alias for CTR)",
'IDEA' => "International Data Encryption Algorithm (by James Massey and Xuejia Lai)",
'IFC' => "Integer Factorization Cryptography",
'ISAKMP' => "Internet Security Association and Key Management Protocol",
'IV' => "Initialization Vector",
'JSSE' => "Java Secure Socket Extension",
'KEA' => "Key Exchange Algorithm (alias for FORTEZZA-KEA)",
'KEK' => "Key Encryption Key",
'KSK' => "Key Signing Key", # DNSSEC
'LM hash' => "LAN Manager hash aka LanMan hash",
'LFSR' => "Linear Feedback Shift Register",
'Lucky 13' => "Break SSL/TLS Protocol",
'MARS' => "",
'MAC' => "Message Authentication Code",
'MCF' => "Modular Crypt Format",
'MEE' => "MAC-then-Encode-then-Encrypt",
'MEK' => "Message Encryption Key",
'MDC2' => "Modification Detection Code 2 aka Meyer-Schilling",
'MDC-2' => "same as MDC2",
'MD2' => "Message Digest 2",
'MD4' => "Message Digest 4",
'MD5' => "Message Digest 5",
'MGF' => "Mask Generation Function",
'MISTY1' => "block cipher algorithm",
'MQV' => "Menezes-Qu-Vanstone (authentecated key agreement",
'NTLM' => "NT Lan Manager. Microsoft Windows challenge-response authentication method.",
'NPN' => "Next Protocol Negotiation",
'Neokeon' => "symmetric block cipher algorithm",
'NSS' => "Network Security Services",
'nonce' => "(arbitrary) number used only once",
'NULL' => "no encryption",
'NUMS' => "nothing up my sleeve numbers",
'OAEP' => "Optimal Asymmetric Encryption Padding",
'OFB' => "Output Feedback",
'OCB' => "Offset Codebook Mode (block cipher mode of operation)",
'OCB1' => "same as OCB",
'OCB2' => "improved OCB aka AEM",
'OCB3' => "improved OCB2",
'OFBx' => "Output Feedback x bit mode",
'OID' => "Object Identifier",
'OTP' => "One Time Pad",
'OCSP' => "Online Certificate Status Protocol",
'OCSP stapling' => "formerly known as: TLS Certificate Status Request",
'OMAC' => "One-Key CMAC, aka CBC-MAC",
'OMAC1' => "same as CMAC",
'OMAC2' => "same as OMAC",
'OV' => "Organisational Validation",
'OV-SSL' => "Organisational Validated Certificate",
'P12' => "see PKCS#12",
'P7B' => "see PKCS#7",
'PCT' => "Private Communications Transport",
'PACE' => "Password Authenticated Connection Establishment",
'PAKE' => "Password Authenticated Key Exchange",
'PBE' => "Password Based Encryption",
'PBKDF2' => "Password Based Key Derivation Function",
'PC' => "Policy Constraints (certificate extension)",
'PCBC' => "Propagating Cipher Block Chaining",
'PCFB' => "Periodic Cipher Feedback Mode",
'PEM' => "Privacy Enhanced Mail",
'PES' => "Proposed Encryption Standard",
'PFS' => "Perfect Forward Secrecy",
'PFX' => "see PKCS#12",
# 'PFX' => "Personal Information Exchange", # just for info
'PGP' => "Pretty Good Privacy",
'PII' => "Personally Identifiable Information",
'PKCS' => "Public Key Cryptography Standards",
'PKCS1' => "PKCS #1: RSA Encryption Standard",
'PKCS3' => "PKCS #3: RSA Encryption Standard on how to implement the Diffie-Hellman key exchange protocol",
'PKCS5' => "PKCS #5: RSA Encryption Standard on how to derive cryptographic keys from a password",
'PKCS6' => "PKCS #6: RSA Extended Certificate Syntax Standard",
'PKCS7' => "PKCS #7: RSA Cryptographic Message Syntax Standard",
'PKCS8' => "PKCS #8: RSA Private-Key Information Syntax Standard",
'PKCS10' => "PKCS #10: Describes a standard syntax for certification requests",
'PKCS11' => "PKCS #11: RSA Cryptographic Token Interface Standard (keys in hardware devices, cards)",
'PKCS12' => "PKCS #12: RSA Personal Information Exchange Syntax Standard (public + private key stored in files)",
'PKI' => "Public Key Infrastructure",
'PKIX' => "Internet Public Key Infrastructure Using X.509",
'PM' => "Policy Mappings (certificate extension)",
'PMAC' => "Parallelizable MAC (by Phillip Rogaway)",
'Poly1305-AES' => "MAC (by D. Bernstein)",
'POP' => "Proof of Possession",
'Poodle' => "Padding Oracle On Downgraded Legacy Encryption",
'PRF' => "pseudo-random function",
'PRNG' => "pseudo-random number generator",
'PSK' => "Pre-shared Key",
'RA' => "Registration Authority (aka Registration CA)",
'Rabbit' => "stream cipher algorithm",
'RADIUS' => "Remote Authentication Dial-In User Service",
'Radix-64' => "alias for Base-64",
'RBG' => "Random Bit Generator",
'RC2' => "Rivest Cipher 2, block cipher by Ron Rivest (64-bit blocks)",
'RC4' => "Rivest Cipher 4, stream cipher (aka Ron's Code)",
'RC5' => "Rivest Cipher 5, block cipher (32-bit word)",
'RC5-64' => "Rivest Cipher 5, block cipher (64-bit word)",
'RC6' => "Rivest Cipher 6",
'RCSU' => "Reuters' Compression Scheme for Unicode (aka SCSU)",
'Rijndael' => "symmetric block cipher algorithm",
'RIPEMD' => "RACE Integrity Primitives Evaluation Message Digest",
'RMAC' => "block cipher authentication mode",
'RNG' => "Random Number Generator",
'ROT-13' => "see XOR",
'RTP' => "Real-time Transport Protocol",
'RSA' => "Rivest Sharmir Adelman (public key cryptographic algorithm)",
'RSS-14' => "Reduced Space Symbology, see GS1",
'RTN' => "Routing transit number",
'SA' => "Subordinate Authority (aka Subordinate CA)",
'SAFER' => "Secure And Fast Encryption Routine, block cipher",
'Salsa20' => "stream cipher",
'SAM' => "syriac abbreviation mark",
'SAN' => "Subject Alternate Name",
'SBCS' => "single-byte character set",
'SCEP' => "Simple Certificate Enrollment Protocol",
'SCSU' => "Standard Compression Scheme for Unicode (compressed UTF-16)",
'SCSV' => "Signaling Cipher Suite Value",
'SCVP' => "Server-Based Certificate Validation Protocol",
'SDES' => "Security Description Protokol",
'SEED' => "128-bit Symmetric Block Cipher",
'Serpent' => "symmetric key block cipher (128 bit)",
'SGC' => "Server-Gated Cryptography",
'SHA' => "Secure Hash Algorithm",
'SHA-0' => "Secure Hash Algorithm (insecure version before 1995)",
'SHA-1' => "Secure Hash Algorithm (since 1995)",
'SHA-2' => "Secure Hash Algorithm (since 2002)",
'SHA-224' => "Secure Hash Algorithm (224 bit)",
'SHA-256' => "Secure Hash Algorithm (256 bit)",
'SHA-384' => "Secure Hash Algorithm (384 bit)",
'SHA-512' => "Secure Hash Algorithm (512 bit)",
'SHA1' => "alias for SHA-1 (160 bit)",
'SHA2' => "alias for SHA-2 (224, 256, 384 or 512 bit)",
'SHS' => "Secure Hash Standard",
'SIA' => "Subject Information Access (certificate extension)",
'SIC' => "Segmented Integer Counter (alias for CTR)",
'Skein' => "hash function",
'SKID' => "subject key ID (certificate extension)",
'Skipjack' => "block cipher encryption algorithm specified as part of the Fortezza",
'Snefu' => "hash function",
'SNI' => "Server Name Indication",
'SNOW' => "word-based synchronous stream ciphers (by Thomas Johansson and Patrik Ekdahl )",
'SPDY' => "Google's application-layer protocol on top of SSL",
'SPN' => "Substitution-Permutation Network",
'Square' => "block cipher",
'SRP' => "Secure Remote Password protocol",
'SRTP' => "Secure RTP",
'SSL' => "Secure Sockets Layer",
'SSLv2' => "Secure Sockets Layer Version 2",
'SSLv3' => "Secure Sockets Layer Version 3",
'SSP' => "Security Support Provider",
'SSPI' => "Security Support Provider Interface",
'SST' => "Serialized Certificate Store format",
'STS' => "Strict Transport Security",
'STS ' => "Station-to-Station protocol",
'TACK' => "Trust Assertions for Certificate Keys",
'TCB' => "Trusted Computing Base",
'TDEA' => "Tripple DEA",
'TEA' => "Tiny Encryption Algorithm",
'TEK' => "Traffic Encryption Key",
'Tiger' => "hash function",
'TIME' => "Timing Info-leak Made Easy (Exploit SSL/TLS)",
# 'TIME' => "A Perfect CRIME? TIME Will Tell",
'Threefish' => "hash function",
'TMAC' => "Two-Key CMAC, variant of CBC-MAC",
'TOCTOU' => "Time-of-check, time-of-use",
'TOFU' => "Trust on First Use",
'TR-02102' => "Technische Richtlinie 02102 (des BSI)",
'TSK' => "TACK signing key",
'TSP' => "trust-Management Service Provider",
'TLS' => "Transport Layer Security",
'TLSA' => "TLS Trus Anchors",
'TLSv1' => "Transport Layer Security version 1",
'TSK' => "Transmission Security Key",
'TTP' => "trusted Third Party",
'Twofish' => "symmetric key block cipher (128 bit)",
'UC' => "Unified Communications (SSL Certificate using SAN)",
'UCC' => "Unified Communications Certificate (rarley used)",
'UMAC' => "Universal hashing MAC; optimized for 32-bit architectures",
'VMAC' => "Universal hashing MAC; 64-bit variant of UMAC (by Ted Krovetz and Wei Dai)",
'VMPC' => "stream cipher",
'WHIRLPOOL' => "hash function",
'X.680' => "X.680: ASN.1",
'X.509' => "X.509: The Directory - Authentication Framework",
'X680' => "X.680: ASN.1",
'X509' => "X.509: The Directory - Authentication Framework",
'XCBC' => "variant of CMAC",
'XCBC-MAC' => "same as XCBC",
'XKMS' => "XML Key Management Specification",
'XMACC' => "counter-based XOR-MAC",
'XMACR' => "radomized XOR-MAC",
'XMLSIG' => "XML-Signature Syntax and Processing",
'XTEA' => "extended Tiny Encryption Algorithm",
'XUDA' => "Xcert Universal Database API",
'XXTEA' => "enhanced/corrected Tiny Encryption Algorithm",
'ZLIB' => "Lossless compression file format",
'ZSK' => "Zone Signing Key", # DNSSEC
},
# RFC 2246: TLS Version 1
# RFC 4346: TLS Version 1.1
# RFC 5246: TLS Version 1.2 http://tools.ietf.org/html/rfc5346
# RFC 2412: OAKLEY Key Determination Protocol (PFS - Perfect Forward Secrec')
# alle *DH* sind im Prinzip PFS.
# wird manchmal zusaetzlich mit DHE bezeichnet, wobei E für ephemeral
# also flüchtige, vergängliche Schlüssel steht
# D.H. ECDHE_* und DHE_* an den Anfang der Cipherliste stellen, z.B.
# TLS_ECDHE_RSA_WITH_RC4_128_SHA
# TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
# TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
# TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
# http://en.wikipedia.org/wiki/Perfect_forward_secrecy
# RFC 2818: ? (Namenspruefung)
# RFC 2712: TLSKRB: Addition of Kerberos Cipher Suites to Transport Layer Security (TLS)
# RFC 2986: PKCS#10
# RFC 5967: PKCS#10
# RFC 3268: TLSAES: Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS)
# RFC 5081: TLSPGP: Using OpenPGP Keys for Transport Layer Security (TLS) Authentication
# RFC 4279: TLSPSK: Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)
# RFC 4492: TLSECC: Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)
# RFC 3749: TLS Compression Method http://tools.ietf.org/html/rfc3749
# RFC 3943: TLS Protocol Compression Using Lempel-Ziv-Stac (LZS) http://tools.ietf.org/html/rfc3943
# RFC 3268: TLS Version 1 AES
# RFC 4132: TLS Version 1 Camellia
# RFC 4162: TLS Version 1 SEED
# RFC 3546: TLS Extensions
# RFC 4366: TLS Extensions
# AKID - authority key identifier
# Server name Indication (SNI): server_name
# Maximum Fragment Length Negotiation: max_fragment_length
# Client Certificate URLs: client_certificate_url
# Trusted CA Indication: trusted_ca_keys
# Truncated HMAC: truncated_hmac
# Certificate Status Request (i.e. OCSP stapling): status_request
# Error Alerts
# RFC 5764: TLS Extensions SRTP
# RFC 4366: OCSP stapling (http://en.wikipedia.org/wiki/OCSP_stapling)
# RFC 6066: OCSP stapling (http://en.wikipedia.org/wiki/OCSP_stapling) TLS Certificate Status Request
# RFC 6066: TLS Extensions: Extension Definitions
# PkiPath
# RFC 6066: TLS Extensions: Heartbeat https://tools.ietf.org/html/rfc6520
# RFC 4749: TLS Compression Methods
# RFC 5077: TLS session resumption
# RFC 4347: DTLS Datagram TLS
# RFC 2246: TLS protocol version 1.0 http://tools.ietf.org/html/rfc2246
# RFC 6101: SSL protocol version 3.0 http://tools.ietf.org/html/rfc6101
# RFC 6460: ?
# RFC 6125: Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)
# RFC 4210: X509 PKI Certificate Management Protocol (CMP)
# RFC 3739: x509 PKI Qualified Certificates Profile; EU Directive 1999/93/EC
# RFC 4158: X509 PKI Certification Path Building
# RFC 5055: Server-Based Certificate Validation Protocol (SCVP)
# RFC 2560: Online Certificate Status Protocol (OCSP)
# RFC 5019: simplified RFC 2560
# RFC 4387: X509 PKI Operational Protocols: Certificate Store Access via HTTP
# RFC 5746: TLS Renegotiation Indication Extension http://tools.ietf.org/html/rfc5746,
# AIA : {http://www.startssl.com/certs/sub.class4.server.ca.crt}
# CDP : {http://www.startssl.com/crt4-crl.crl, http://crl.startssl.com/crt4-crl.crl}
# OCSP : http://ocsp.startssl.com/sub/class4/server/ca
# cat some.crl | openssl crl -text -inform der -noout
# OCSP response "3" (TLS 1.3) ==> certifcate gueltig
# SPDY - SPDY Protocol : http://www.chromium.org/spdy/spdy-protocol
# False Start: https://www.imperialviolet.org/2012/04/11/falsestart.html
# https://technotes.googlecode.com/git/falsestart.html
# ALPN : http://tools.ietf.org/html/draft-friedl-tls-applayerprotoneg-02
# ALPN, NPN: https://www.imperialviolet.org/2013/03/20/alpn.html
# NPN : https://technotes.googlecode.com/git/nextprotoneg.html
# HSTS : http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02
# https://www.owasp.org/index.php/HTTP_Strict_Transport_Security
# Strict-Transport-Security: max-age=16070400; includeSubDomains
# Apache config:
# Header set Strict-Transport-Security "max-age=16070400; includeSubDomains"
# SNI apache: https://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI
# SSLStrictSNIVHostCheck, which controls whether to allow non SNI clients to access a name-based virtual host.
# when client provided the hostname using SNI, the new environment variable SSL_TLS_SNI
# TLS session resumption problem with session ticket
# see https://www.imperialviolet.org/2011/11/22/forwardsecret.html
# "Since the session ticket contains the state of the session, and
# thus keys that can decrypt the session, it too must be protected
# by ephemeral keys. But, in order for session resumption to be
# effective, the keys protecting the session ticket have to be kept
# around for a certain amount of time: the idea of session resumption
# is that you can resume the session in the future, and you can't
# do that if the server can't decrypt the ticket!
# So the ephemeral, session ticket keys have to be distributed to
# all the frontend machines, without being written to any kind of
# persistent storage, and frequently rotated."
# see also https://www.imperialviolet.org/2013/06/27/botchingpfs.html
#
# TACK http://tack.io/draft.html, 2013 Moxie Marlinspike, Trevor Perrin
#
# SCSV https://datatracker.ietf.org/doc/draft-bmoeller-tls-downgrade-scsv/?include_text=1
); # %man_text
## definitions: internal functions
## -------------------------------------
sub _man_dbx { print "#" . $ich . "::" . join(" ", @_, "\n") if (grep(/^--v/, @ARGV)>0); }
# When called from within parent's BEGIN{} section, options are not yet
# parsed, and so not available in %cfg. Hence we use @ARGV to check for
# options, which is not performant, but fast enough here.
sub man_cmdlist() {
# print commands and short description
# data is extracted from $parents internal data structure
my $skip = 1;
_man_dbx("_man_cmdlist($parent) ...");
# first print general commands, manually crafted here
# TODO needs to be computed, somehow ...
print <<EoHelp;
Commands for information about this tool
+dump Dumps internal data for SSL connection and target certificate.
+exec Internal command; should not be used directly.
+help Complete documentation.
+list Show all ciphers supported by this tool.
+libversion Show version of openssl.
+quit Show internal data and exit, used for debugging only.
+VERSION Just show version and exit.
+version Show version information for program and Perl modules.
Commands to check SSL details
+bsi Various checks according BSI TR-02102-2 compliance.
+check Check the SSL connection for security issues.
+check_sni Check for Server Name Indication (SNI) usage.
+ev Various checks according certificate's extended Validation (EV).
+http Perform HTTP checks.
+info Overview of most important details of the SSL connection.
+info--v More detailled overview.
+quick Quick overview of checks.
+s_client Dump data retrieved from "openssl s_client ..." call.
+sizes Check length, size and count of some values in the certificate.
+sni Check for Server Name Indication (SNI) usage.
+sts Various checks according STS HTTP header.
Commands to test target's ciphers
+cipher Check target for ciphers (using libssl)
+cipherraw Check target for all possible ciphers.
EoHelp
if (open(P, "<", $parent)) {
while(<P>) {
# find start of data structure
# all structure look like:
# our %check_some = ( # description
# 'key' => {... 'txt' => "description of value"},
# );
# where we extract the description of the checked class from first
# line and the command and its description from the data lines
if (m/^(?:my|our)\s+%(?:check_(?:[a-z0-9_]+)|data)\s*=\s*\(\s*#\s*(.*)/) {
$skip = 0;
print "Commands to show results of checked $1\n"; # print head line, quick&dirty
next;
}
$skip = 1, next if (m/^\s*\)\s*;/); # find end of data structure
next if ($skip == 1);
next if (m/^\s*'(?:SSLv2|SSLv3|D?TLSv1|TLSv11|TLSv12|TLSv13)-/); # skip internal counter
print "+$1\t$2\n" if m/^\s+'([^']*)'.*"([^"]*)"/;
}
close(P);
}
}
sub _man_http_head(){
print "X-Cite: Perl is a mess. But that's okay, because the problem space is also a mess. Larry Wall\r\n";
print "Content-type: text/plain; charset=utf-8\r\n";
print "\r\n";
}
sub _man_html_head(){
print << "EoHTML";
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title> . : O - S a f t — OWASP SSL audit for testers : . </title>
<script>
function d(id){return document.getElementById(id).style;}
function t(id){id.display=(id.display=='none')?'block':'none';}
</script>
<style>
.r{float:right;}
.c{!font-size:12pt !important;border:1px none black;font-family:monospace;background-color:lightgray;}
p{margin-left:2em;margin-top:0;}
h2, h3, h4, h5{margin-bottom:0.2em;}
h2{margin-top:-0.5em;padding:1em;height:1.5em;background-color:black;color:white;}
li{margin-left:2em;}
div{padding:0.5em;border:1px solid green;}
div[class=c]{padding:0pm;padding:0.1em;margin-left:4em;border:0px solid green;}
form{padding:1em;}
span{font-size:120%;border:1px solid green;}
</style>
</head>
<body>
<h2>O - S a f t   —   OWASP SSL advanced forensic tool</h2><!-- hides unwanted text before <body> tag -->
EoHTML
}
sub _man_html_foot(){
print << "EoHTML";
<a href="https://github.com/OWASP/O-Saft/" target=_github >Repository</a>
<a href="https://github.com/OWASP/O-Saft/blob/master/o-saft.tgz" target=_tar ><button value="" />Download (stable)</button></a><br>
<a href="https://owasp.org/index.php/O-Saft" target=_owasp >O-Saft Home</a>
<hr><p><span>© sic[✓]sec GmbH, 2012 - 2014</span></p>
</body></html>
EoHTML
}
sub _man_html_chck($){
#? same as _man_html_cbox() but without lable and only if passed parameter start with - or +
my $n = shift || "";
return "" if ($n !~ m/^(-|\+)+/);
return sprintf("<input type=checkbox name='%s' value='' > ", scalar((split(/\s+/,$n))[0]));
}
sub _man_name_ankor($){
my $n = shift;
$n =~ s/,//g; # remove comma
#$n =~ s/\s/_/g;# replace spaces
return $n;
}
sub _man_html_ankor($){
#? print ankor tag for each word in given parameter
my $n = shift;
my $a = "";
return sprintf('<a name="a%s"></a>', $n) if ($n !~ m/^[-\+]+/);
foreach $n (split(/[\s,]+/,$n)) {
$a .= sprintf("<a name='a%s'></a>", _man_name_ankor($n));
}
return $a;
}
sub _man_html_cbox($) { return sprintf("%8s--%-10s<input type=checkbox name=%-12s value='' > \n", "", $_[0], '"--' . $_[0] . '"'); }
sub _man_html_text($) { return sprintf("%8s--%-10s<input type=text name=%-12s size=8 > \n", "", $_[0], '"--' . $_[0] . '"'); }
sub _man_html_span($) { return sprintf("%8s<span>%s</span><br>\n", "", join(", ", @{$cfg{$_[0]}})); }
sub _man_html_cmd($) { return sprintf("%9s+%-10s<input type=text name=%-12s size=8 > \n", "", "", '"--' . $_[0] . '"'); }
sub _man_html_br() { return sprintf(" <br>\n"); }
sub _man_html($$) {
my $anf = shift; # pattern where to start extraction
my $end = shift; # pattern where to stop extraction
my $h = 0;
_man_dbx("_man_html($anf, $end) ...");
while ($_ = shift @DATA) {
last if/^TODO/;
$h=1 if/^=head1 $anf/;
$h=0 if/^=head1 $end/;
next if $h==0; # ignore "out of scope"
m/^=head1 (.*)/ && do { printf("\n<h1>%s %s </h1>\n",_man_html_ankor($1),$1);next;};
m/^=head2 (.*)/ && do { printf("%s\n<h3>%s %s </h3> <p onclick='t(this);return false;'>\n",_man_html_ankor($1),_man_html_chck($1),$1);next;};
m/^=head3 (.*)/ && do { printf("%s\n<h4>%s %s </h4> <p onclick='t(this);return false;'>\n",_man_html_ankor($1),_man_html_chck($1),$1);next;};
m/^\s*S&([^&]*)&/ && do { print "<div class=c >$1</div>\n"; next; }; # code or example line
s!'([^']*)'!<span class=c >$1</span>!g; # markup examples
s!"([^"]*)"!<cite>$1</cite>!g; # markup examples
s!L&([^&]*)&!<i>$1</i>!g; # markup other references
s!I&([^&]*)&!<a href="#a$1">$1</a>!g; # markup commands and options
s!X&([^&]*)&!<a href="#a$1">$1</a>!g; # markup references inside help
s!^\s+($parent .*)!<div class=c >$1</div>!; # example line
m/^=item +\* (.*)/&& do { print "<li>$1</li>\n";next;}; # very lazy ...
m/^=item +\*\* (.*)/ && do{ print "<li type=square style='margin-left:3em'>$1 </li>\n";next;};
s/^(=[^ ]+ )//; # remove remaining markup
s/^\s*$/<p>/; # add paragraph for formatting
print;
}
} # _man_html
sub _man_head($$) { printf("=%14s | %s\n", @_); printf("=%s+%s\n", '-'x15, '-'x60); }
sub _man_opt($$$) { printf("%16s%s%s\n", @_); }
sub _man_cmd($$) { printf(" +%-14s\t%s\n", @_); }
sub _man_arr($$$) {
my ($ssl, $sep, $dumm) = @_;
my @all = ();
push(@all, sprintf("0x%08X",$_)) foreach (@{$cfg{'cipherranges'}->{$ssl}});
printf("%16s%s%s\n", $ssl, $sep, join(" ", @all));
}
sub _man_cfg($$$$){
# print line in configuration format
my ($typ, $key, $sep, $txt) = @_;
$txt = '"' . $txt . '"' if ($typ =~ m/^cfg/);
$key = "--$typ=$key" if ($typ =~ m/^cfg/);
_man_opt($key, $sep, $txt);
}
sub _man_usr_value($) {
#? return value of argument $_[0] from @{$cfg{'usr-args'}}
my $key = shift;
$key =~ s/^(?:--|\+)//; # strip leading chars
my @arg = ""; # key, value (Note that value is anything right to leftmost = )
map({@arg = split("=", $_, 2) if /^$key/} @{$cfg{'usr-args'}}); # does not allow multiple $key in 'usr-args'
return $arg[1];
} # _man_usr_value
## definitions: print functions for help and information
## -------------------------------------
sub man_table($) {
#? print data from hash in tabular form, $typ denotes hash
my $typ = shift;
my %types = (
# typ header left separator header right
#-----------+---------------+-------+-------------------------------
'score' => ["key", "=", "SCORE\t# Description"],
'regex' => ["key", " => ", " Regular Expressions used internally"],
'abbr' => ["Abbrevation", " - ", "Description"],
'intern'=> ["Command", " ", " list of commands"],
'compl' => ["Compliance", " - ", "brief description of performed checks"],
'range' => ["range name", " - ", "hex values in this range"],
'data' => ["key", "=", "text"],
'check' => ["key", "=", "text"],
'text' => ["key", "=", "text"],
'cfg_check' =>["N/A", "=", "N/A"],
'cfg_data' =>["N/A", "=", "N/A"],
'cfg_text' =>["N/A", "=", "N/A"],
);
my ($key, $txt);
my $sep = $types{$typ}->[1];
_man_dbx("man_table($typ) ...");
_man_head($types{$typ}->[0], $types{$typ}->[2]) if ($typ !~ m/^cfg/);
if ($typ eq 'abbr') { _man_opt(do{(my $a=$_)=~s/ *$//;$a}, $sep, $man_text{'glossar'}->{$_}) foreach (sort keys %{$man_text{'glossar'}}); }
if ($typ eq 'regex') { _man_opt($_, $sep, $cfg{'regex'}->{$_}) foreach (sort keys %{$cfg{'regex'}}); }
if ($typ eq 'compl') { _man_opt($_, $sep, $cfg{'compliance'}->{$_}) foreach (sort keys %{$cfg{'compliance'}}); }
if ($typ eq 'score') { _man_opt($_, $sep . $checks{$_}->{score}, "\t# " . $checks{$_}->{txt}) foreach (sort keys %checks); }
#if ($typ eq 'range') { _man_arr($_, $sep, $cfg{'cipherranges'}->{$_}) foreach (sort keys %{$cfg{'cipherranges'}}); }
# above prints > 65.000 hex values, not very usefull ...
if ($typ eq 'range') { print qx(\\sed -ne '/^ *.cipherrange. /,/^ *., # cipherranges/p' $0); } # ToDo: quick&dirty backticks
if ($typ eq 'intern') {
foreach $key (sort keys %cfg) {
next if ($key eq 'cmd-intern'); # don't list myself
next if ($key !~ m/^cmd-(.*)/);
_man_opt("cmd-" . $1, $sep, "+" . join(" +", @{$cfg{$key}}));
}
}
if ($typ =~ m/check/) {
foreach $key (sort keys %checks) {
$txt = $checks{$key}->{txt};
_man_cfg($typ, $key, $sep, $txt);
}
}
if ($typ =~ m/data/) {
foreach $key (sort keys %data) {
$txt = $data{$key}->{txt};
_man_cfg($typ, $key, $sep, $txt);
}
}
if ($typ =~ m/text/) {
foreach $key (sort keys %text) {
next if (ref($text{$key}) ne ""); # skip except string
$txt = $text{$key};
$txt =~ s/(\n)/\\n/g;
$txt =~ s/(\r)/\\r/g;
$txt =~ s/(\t)/\\t/g;
_man_cfg($typ, $key, $sep, $txt);
}
print "
= Format is: KEY=TEXT ; NL, CR and TAB are printed as \\n, \\r and \\t
= The string @@ inside texts is used as placeholder.
= (Don't be confused about multiple = as they are part of TEXT.)
" if ($typ !~ m/^cfg/);
}
} # man_table
sub man_commands() {
#? print program's help about commands
# we do not use POD, as most texts are already in %data and %checks
# NOTE: unfortunately we cannot print alias commands, as they are not part
# of %data or %checks but are acceped dynamically in the argument parser
my $key;
_man_dbx("man_commands ...");
print "\n Summary and internal commands";
foreach $key (@{$cfg{'commands'}}) {
_man_cmd($key, "") if (_is_intern($key) > 0);
}
print "
Commands to show target, connection and certificate details
The names of these commands are mainly adopted to openssl's commands
(see \"openssl cipher\", \"openssl x509\").
All these commands just show a single detail which is also available
with the +text command.
";
foreach $key (@{$cfg{'commands'}}) {
next if (_is_intern($key) > 0);
next if (_is_hashkey($key, \%data) <= 0);
_man_cmd($key, $data{$key}->{txt});
}
print "
Commands for checks
Commands to show results of performed checks.
";
foreach $key (@{$cfg{'commands'}}) {
next if (_is_intern($key) > 0);
next if (_is_hashkey($key, \%checks) <= 0);
next if ($key =~ m/$cfg{'regex'}->{'SSLprot'}/);
_man_cmd($key, $checks{$key}->{txt});
}
} # man_commands
sub man_html() {
#? print complete HTML page for o-saft.pl --help=gen-html
#? recommended usage: $0 --no-warning --no-header --help=gen-html
_man_dbx("man_html ...");
_man_http_head(); #FIXME if (grep(/^usr-cgi/, @{$cfg{'usr-args'}}) > 0);
_man_html_head();
_man_html('NAME', 'TODO');
_man_html_foot();
} # man_html
sub man_cgi() {
#? print complete HTML page for o-saft.pl used as CGI
#? recommended usage: $0 --no-warning --no-header --help=gen-cgi
#? o-saft.cgi?--cgi=&--usr&--no-warning&--no-header=&--cmd=html
_man_dbx("man_cgi ...");
my $cgi = _man_usr_value('user-action') || _man_usr_value('usr-action') || "/cgi-bin/o-saft.cgi"; # get action from --usr-action= or set to default
#??# my $cgi = "/cgi-bin/o-saft.cgi"; # get action from --usr-action= or set to default
my $key = "";
_man_http_head(); #FIXME if (grep(/^usr-cgi/, @{$cfg{'usr-args'}}) > 0);
_man_html_head();
print << "EoHTML";
<a href="$cgi?--cgi&--help" target=_help ><button value="" />help</button></a>  
<a href="$cgi?--cgi&--help=command" target=_help ><button value="" />commands</button></a>  
<a href="$cgi?--cgi&--help=checks" target=_help ><button value="" />checks</button></a>  
<a href="$cgi?--cgi&--help=score" target=_help ><button value="" />score</button></a>  
<a href="$cgi?--cgi&--help=regex" target=_help ><button value="" />regex</button></a>  
<a href="$cgi?--cgi&--abbr" target=_help ><button value="" />Glossar</button></a>  
<a href="$cgi?--cgi&--todo" target=_help ><button value="" />ToDo</button></a><br>
<form action="$cgi" method=GET >
<input type=hidden name="--cgi" value="" >
<fieldset>
EoHTML
print _man_html_text('host');
print _man_html_text('port');
print << "EoHTML";
<div id=a style="display:block;">
<button class=r onclick="t(d('a'));t(d('b'));return false;">Full GUI</button><br>
EoHTML
foreach $key (qw(cmd cmd cmd cmd)) { print _man_html_cmd($key); }
print _man_html_br();
print _man_html_span('cmd-intern');
foreach $key (qw(sslv3 tlsv1 tlsv11 tlsv12 tlsv13 sslv2null BR
no-sni sni no-http http BR
no-dns dns no-cert BR
no-openssl openssl force-openssl BR
no-header header short showhost BR
enabled disabled BR
v v trace trace traceCMD traceKEY BR
)) {
if ($key eq 'BR') { print _man_html_br(); next; }
print _man_html_cbox($key);
}
foreach $key (qw(separator timeout legacy)) { print _man_html_text($key); }
print _man_html_br();
print _man_html_span('legacys');
print _man_html_text("format");
print _man_html_span('formats');
print << "EoHTML";
<br>
</div>
<div id=b style="display:none;">
<button class=r onclick="d('a').display='block';d('b').display='none';return false;">Simple GUI</button><br>
<input type=text name=--cmds size=55 /> 
EoHTML
_man_html("COMMANDS", 'LAZY');
print << "EoHTML";
</p>
</div>
<input type=submit value="go" />
</fieldset>
</form>
EoHTML
_man_html_foot();
} # man_cgi
sub man_wiki() {
#? print documentation for o-saft.pl in mediawiki format (to be used at owasp.org)
#? recommended usage: $0 --no-warning --no-header --help=gen-wiki
_man_dbx("man_wiki ...");
my $key = "";
# 1. generate wiki page header
print "
==O-Saft==
This is O-Saft's documentation as you get with:
o-saft.pl --help
__TOC__ <!-- autonumbering is ugly here, but can only be switched of by changing MediaWiki:Common.css -->
<!-- position left is no good as the list is too big and then overlaps some texts
{|align=right
|<div>__TOC__</div>
|}
-->
[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]] [[Category:SSL]]
----
";
# 2. enerate wiki page content
# extract from herein and convert POD syntax to mediawiki syntax
while ($_ = shift @DATA) {
last if/^=head1 TODO/;
s/^=head1 (.*)/====$1====/;
s/^=head2 (.*)/=====$1=====/;
s/^=head3 (.*)/======$1======/;
s/^=item (\*\* .*)/$1/; # list item, second level
s/^=item (\* .*)/$1/; # list item, first level
s/^=[^= ]+ *//; # remove remaining markup and leading spaces
print, next if/^=/; # no more changes in header lines
s!'([^']*)'!<code>$1</code>!g; # markup examples
s/^S&([^&]*)&/ $1/ && do { print; next; }; # code or example line; no more changes
s/X&([^&]*)&/[[#$1|$1]]/g; # markup references inside help
s/L&([^&]*)&/\'\'$1\'\'/g; # markup other references
s/I&([^&]*)&/\'\'$1\'\'/g; # markup commands and options
s/^ +//; # remove leftmost spaces (they are useless in wiki)
s/^([^=*].*)/:$1/; # ident all lines for better readability
s/^:?\s*($parent)/ $1/; # myself becomes wiki code line
s/^:\s+$/\n/; # remove empty lines
print;
}
# 2. generate wiki page footer
print "
----
<small>
Content of this wiki page generated with:
$parent --no-warning --no-header --help=gen-wiki
</small>
";
} # man_wiki
sub man_help($) {
#? print program's help
my $label = lc(shift) || ""; # || to avoid uninitialized value
my $anf = uc($label);
my $end = "[A-Z]";
_man_dbx("man_help($anf, $end) ...");
# no special help, print full one or parts of it
my $txt = join ("", @DATA);
if (grep(/^--v/, @ARGV) > 1){ # with --v --v
print scalar reverse "\n\n$egg";
return;
}
if ($label =~ m/^name/i) { $end = "TODO"; }
#$txt =~ s{.*?(=head. $anf.*?)\n=head. $end.*}{$1}ms;# grep all data
# above terrible performance and unreliable, hence in peaces below
$txt =~ s/.*?\n=head1 $anf//ms;
$txt =~ s/\n=head1 $end.*//ms; # grep all data
$txt = "\n=head1 $anf" . $txt;
$txt =~ s/\n=head2 ([^\n]*)/\n $1/msg;
$txt =~ s/\n=head3 ([^\n]*)/\n $1/msg;
$txt =~ s/\n=(?:[^ ]+ (?:\* )?)([^\n]*)/\n$1/msg;# remove inserted markup
$txt =~ s/\nS&([^&]*)&/\n$1/g;
$txt =~ s/[IX]&([^&]*)&/$1/g; # internal links without markup
$txt =~ s/L&([^&]*)&/"$1"/g; # external links, must be last one
print $txt;
if ($label =~ m/^todo/i) {
#$\ = "\n";
print "\n NOT YET IMPLEMENTED\n";
foreach $label (sort keys %checks) {
next if (_is_member($label, \@{$cfg{'cmd-NOT_YET'}}) <= 0);
print " " . $checks{$label}->{txt};
}
}
} # man_help
sub printhelp($) {
#? simple dispatcher for various help requests
my $hlp = shift;
_man_dbx("printhelp($hlp) ...");
# Note: some lower case strings are special
man_help('NAME'), return if ($hlp =~ /^$/);
man_help('TODO'), return if ($hlp =~ /^todo$/i);
man_html(), return if ($hlp =~ /^(gen-)?html$/);
man_wiki(), return if ($hlp =~ /^(gen-)?wiki$/);
man_cgi(), return if ($hlp =~ /^(gen-)?cgi$/i);
# Note: gen-cgi is called from within parent's BEGIN and hence
# causes some Use of uninitialized value within %cfg
# when called as gen-CGI it will not be called from within
# BEGIN amd hence %cfg is defined and will not result in warnings
# anything below requires data defined in parent