mirror of
https://github.com/Horizontal42/netsleuth.git
synced 2026-11-10 15:42:10 +03:00
99876103f8
tls_context() now defaults to real certificate verification instead of the
tool's original always-CERT_NONE posture; measure_tls() only falls back to
unverified on ssl.SSLCertVerificationError, retiming the retry since the
failed attempt's duration isn't representative. This is also the only way
to get subject/issuer/notAfter at all - getpeercert() returns {} for a
chain that never validated.
Every TLS result now carries cert_sha256 (SHA-256 of the full DER cert, not
the SPKI - that would need the cryptography package, a dependency this
doesn't need), cert_issuer, cert_days_remaining, and the long-dead
cert_verified field finally gets written. New tls.pinned_fingerprints
config (host -> expected hash, capped and hex-validated) drives three new
findings: a pin mismatch is crit, an unpinned validation failure is warn,
an expiring cert is warn.
Live-tested with --tls against real Cloudflare/Google endpoints - verified
handshake, correct issuer and expiry both times.
Part of plans/zesty-zooming-wilkinson.md (gitignored).
|
||
|---|---|---|
| .. | ||
| fixtures | ||
| conftest.py | ||
| test_bgp.py | ||
| test_bgp_path.py | ||
| test_captive_portal.py | ||
| test_cgnat_nat64.py | ||
| test_cli_formats.py | ||
| test_compare.py | ||
| test_config.py | ||
| test_dns_advanced.py | ||
| test_dns_leak.py | ||
| test_dnsbl_decode.py | ||
| test_dpi_check.py | ||
| test_exporter.py | ||
| test_exporter_l7.py | ||
| test_hop_asn.py | ||
| test_icmp_win_parse.py | ||
| test_icmp_win_trace.py | ||
| test_iface.py | ||
| test_interpret.py | ||
| test_interpret_l7.py | ||
| test_ip_geo_normalize.py | ||
| test_models.py | ||
| test_netinfo.py | ||
| test_orchestration.py | ||
| test_prefix_benchmark.py | ||
| test_prober_stats.py | ||
| test_reputation.py | ||
| test_speed_cloudflare.py | ||
| test_speed_fastcom.py | ||
| test_speed_math.py | ||
| test_stats.py | ||
| test_tls_rtt.py | ||
| test_traceparse.py | ||
| test_traceroute_cascade.py | ||
| test_watch.py | ||