the
website or via other appropriate means. The latest applicable version will be available on our website.
Should you have any questions or remarks regarding this Privacy Policy, do not hesitate to contact us at
- legal@lhc.lu
+ privacy@lhc.lu
PROCESSING OF PERSONAL DATA
@@ -38,7 +38,7 @@
PROCESSING OF PERSONAL DATA
Luxembourg House of Cybersecurity g.i.e., 122 rue Adolphe Fischer, L-1521 Luxembourg
Tel: (+352) 274 00 98 601
- Email: legal@lhc.lu
+ Email: privacy@lhc.lu
WHAT PERSONAL DATA DO WE COLLECT ON OUR WEBSITE AND TO WHICH END?
@@ -113,7 +113,7 @@
SECURITY OF YOUR PERSONAL DATA
In particular, you have the right to access your personal data, to obtain the updating, the adjustment and the
erasure of the personal data and you can exercise the rights to restrict and to object the processing. You can
exercise the rights provided by articles 15 and the following of the GDPR contacting the following email address
- legal@lhc.lu.
+ privacy@lhc.lu.
In order to avoid unlawful access to your personal data, we will request you to provide a proof of your
identity. If
you have any queries about this Privacy Notice or experiencing any other privacy issue, we are striving to
diff --git a/templates/404.html b/templates/404.html
index 350a27b6..f8a88555 100644
--- a/templates/404.html
+++ b/templates/404.html
@@ -2,18 +2,28 @@
{% block content %}
-
-
-
-
404
+
+
+
+
404
-
We are sorry, Page not found!
-
-
The page you are looking for might have been removed,
+
We are sorry, Page not found!
+
The page you are looking for might have been removed,
had its name changed, or is temporarily unavailable.
diff --git a/testing/ciphers_info.py b/testing/ciphers_info.py
index b94120a3..bc7ea08c 100644
--- a/testing/ciphers_info.py
+++ b/testing/ciphers_info.py
@@ -1,4 +1,5 @@
import re
+import logging
from collections import OrderedDict
from enum import Enum
from math import log, pow
@@ -6,6 +7,46 @@
from nassl.legacy_ssl_client import LegacySslClient
from nassl.ssl_client import SslClient
+logger = logging.getLogger(__name__)
+
+
+class ModernConnection:
+ """
+ Wrapper class for modern TLS connections using SslClient.
+ This class provides a standardized interface for cipher suite testing
+ with modern TLS protocol versions (TLS 1.2, TLS 1.3).
+ Attributes:
+ ALL_CIPHERS (str): Cipher specification string for all available ciphers
+ """
+
+ ALL_CIPHERS = "ALL:COMPLEMENTOFALL"
+
+ @staticmethod
+ def get_peer_signature_digest():
+ """
+ Get the signature digest used in the TLS handshake.
+ In a real implementation, this would extract the signature algorithm
+ from the peer certificate. For this stub implementation, we return None
+ as a safe default.
+ Returns:
+ str or None: The signature digest algorithm name, or None if unavailable
+ """
+ return None
+
+
+class DebugConnection:
+ """
+ Wrapper class for legacy SSL/TLS connections using LegacySslClient.
+
+ This class provides a standardized interface for cipher suite testing
+ with legacy protocol versions (SSL 3.0, TLS 1.0, TLS 1.1).
+
+ Attributes:
+ ALL_CIPHERS (str): Cipher specification string for all available ciphers
+ """
+
+ ALL_CIPHERS = "ALL:COMPLEMENTOFALL"
+
class SecLevel(Enum):
GOOD = 3
@@ -259,8 +300,53 @@ def get_highest_set_bit(n):
# Load OpenSSL data about cipher suites
def load_cipher_info():
+ """
+ Load and parse cipher suite information from OpenSSL.
+
+ This function:
+ 1. Creates an instance of both legacy and modern SSL clients
+ 2. Retrieves all available cipher suites from each client
+ 3. Parses cipher descriptions to extract relevant properties
+ 4. Calculates security levels for each cipher
+
+ The resulting dictionary maps cipher names to CipherInfo objects containing:
+ - Connection class that supports the cipher
+ - TLS version
+ - Key exchange algorithms
+ - Authentication algorithm
+ - Bulk encryption algorithm and security length
+ - MAC algorithm
+ - Pre-calculated security level
+
+ Returns:
+ dict: A dictionary mapping cipher names to CipherInfo objects
+ """
+
class CipherInfo:
+ """
+ Container class for cipher suite information.
+
+ Attributes:
+ conn_class: The connection class that supports this cipher
+ name: The OpenSSL name of the cipher
+ tls_version: The TLS protocol version
+ kex_algs: Key exchange algorithms
+ auth_alg: Authentication algorithm
+ bulk_enc_alg: Bulk encryption algorithm
+ bulk_enc_alg_sec_len: Security length of the bulk encryption algorithm
+ mac_alg: Message Authentication Code algorithm
+ sec_level: Security level classification
+ supported_conns: Set of connection classes that support this cipher
+ """
+
def __init__(self, conn_class, match):
+ """
+ Initialize a CipherInfo object from a regex match object.
+
+ Args:
+ conn_class: The connection class that supports this cipher
+ match: A regex match object containing cipher information
+ """
self.conn_class = conn_class
self.name = match.group("name")
self.tls_version = match.group("tls_version")
@@ -314,7 +400,7 @@ def __init__(self, conn_class, match):
result[cipher_name] = ci
else:
- logger.warn(
+ logger.warning(
f"Unable to parse description of cipher {cipher_name} "
f'output by {client_class.__name__}: "{desc}"'
)
@@ -327,4 +413,4 @@ def __init__(self, conn_class, match):
cipher_infos = load_cipher_info()
-logger.info(f'Loaded data on {len(cipher_infos)} ciphers."')
+logger.info(f"Loaded data on {len(cipher_infos)} ciphers.")
diff --git a/testing/migrations/0005_cspendpoint_cspreport_and_more.py b/testing/migrations/0005_cspendpoint_cspreport_and_more.py
new file mode 100644
index 00000000..fe7ddb9e
--- /dev/null
+++ b/testing/migrations/0005_cspendpoint_cspreport_and_more.py
@@ -0,0 +1,99 @@
+# Generated by Django 4.2.11 on 2025-05-08 17:12
+
+from django.conf import settings
+import django.core.validators
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+ dependencies = [
+ migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+ ("testing", "0004_testreport"),
+ ]
+
+ operations = [
+ migrations.CreateModel(
+ name="CSPEndpoint",
+ fields=[
+ (
+ "id",
+ models.BigAutoField(
+ auto_created=True,
+ primary_key=True,
+ serialize=False,
+ verbose_name="ID",
+ ),
+ ),
+ (
+ "allowed_origin",
+ models.URLField(
+ help_text="The domain allowed to send reports to this endpoint.",
+ validators=[
+ django.core.validators.URLValidator(schemes=["https"])
+ ],
+ ),
+ ),
+ (
+ "endpoint_uuid",
+ models.CharField(
+ db_index=True, editable=False, max_length=64, unique=True
+ ),
+ ),
+ ("is_active", models.BooleanField(default=True)),
+ ("created_at", models.DateTimeField(auto_now_add=True)),
+ (
+ "user",
+ models.ForeignKey(
+ on_delete=django.db.models.deletion.CASCADE,
+ to=settings.AUTH_USER_MODEL,
+ ),
+ ),
+ ],
+ ),
+ migrations.CreateModel(
+ name="CSPReport",
+ fields=[
+ (
+ "id",
+ models.BigAutoField(
+ auto_created=True,
+ primary_key=True,
+ serialize=False,
+ verbose_name="ID",
+ ),
+ ),
+ ("report_data", models.JSONField()),
+ ("user_agent", models.CharField(max_length=255, null=True)),
+ ("occurred_at", models.DateTimeField(auto_now_add=True, db_index=True)),
+ (
+ "endpoint",
+ models.ForeignKey(
+ on_delete=django.db.models.deletion.CASCADE,
+ to="testing.cspendpoint",
+ ),
+ ),
+ ],
+ options={
+ "indexes": [
+ models.Index(
+ fields=["endpoint", "occurred_at"],
+ name="testing_csp_endpoin_f71d36_idx",
+ )
+ ],
+ },
+ ),
+ migrations.AddIndex(
+ model_name="cspendpoint",
+ index=models.Index(
+ fields=["user", "allowed_origin"], name="testing_csp_user_id_16ab2a_idx"
+ ),
+ ),
+ migrations.AddConstraint(
+ model_name="cspendpoint",
+ constraint=models.UniqueConstraint(
+ fields=("user", "allowed_origin"), name="unique_user_origin"
+ ),
+ ),
+ ]
diff --git a/testing/models.py b/testing/models.py
index 261d8ccd..f1dbf463 100644
--- a/testing/models.py
+++ b/testing/models.py
@@ -1,6 +1,10 @@
from django.db import models
-
+from django.contrib.auth import get_user_model
+from django.core.validators import URLValidator
+from django.conf import settings
from authentication.models import User
+import uuid
+import hashlib
class Domain(models.Model):
@@ -103,3 +107,57 @@ class TestReport(models.Model):
def __str__(self):
return f"{self.test_ran}_{self.tested_site.replace('.', '-')}"
+
+
+class CSPEndpoint(models.Model):
+ """Represents a CSP reporting endpoint configuration"""
+
+ user = models.ForeignKey(get_user_model(), on_delete=models.CASCADE)
+ allowed_origin = models.URLField(
+ help_text="The domain allowed to send reports to this endpoint.",
+ validators=[URLValidator(schemes=["https"])],
+ )
+ endpoint_uuid = models.CharField(
+ max_length=64, unique=True, editable=False, db_index=True
+ )
+ is_active = models.BooleanField(default=True)
+ created_at = models.DateTimeField(auto_now_add=True)
+
+ class Meta:
+ indexes = [
+ models.Index(fields=["user", "allowed_origin"]),
+ ]
+ constraints = [
+ models.UniqueConstraint(
+ fields=["user", "allowed_origin"], name="unique_user_origin"
+ )
+ ]
+
+ def save(self, *args, **kwargs):
+ if not self.endpoint_uuid:
+ namespace = uuid.uuid5(
+ uuid.NAMESPACE_DNS, f"{settings.SECRET_KEY[:16]}:{self.user.id}"
+ )
+ domain_uuid = uuid.uuid5(namespace, self.allowed_origin)
+ self.endpoint_uuid = hashlib.blake2b(
+ str(domain_uuid).encode(),
+ salt=settings.SECRET_KEY[:16].encode(),
+ digest_size=32,
+ ).hexdigest()
+ super().save(*args, **kwargs)
+
+
+class CSPReport(models.Model):
+ """Stores CSP violation reports"""
+
+ endpoint = models.ForeignKey(CSPEndpoint, on_delete=models.CASCADE)
+ report_data = models.JSONField() # Store the complete report
+ user_agent = models.CharField(
+ max_length=255, null=True
+ ) # Useful for debugging browser-specific issues
+ occurred_at = models.DateTimeField(auto_now_add=True, db_index=True)
+
+ class Meta:
+ indexes = [
+ models.Index(fields=["endpoint", "occurred_at"]),
+ ]
diff --git a/testing/templates/check_email.html b/testing/templates/check_email.html
index f6972434..e6b63c1a 100644
--- a/testing/templates/check_email.html
+++ b/testing/templates/check_email.html
@@ -36,7 +36,9 @@
Assess the security of your ema
- {% if domain %}
+ {% if domain and not error %}
Overview of {{ domain }}
@@ -155,7 +157,7 @@
Vulnerability
SPF Record
-
The Sender Policy Framework (SPF) is an email validation protocol that helps detect and block email spoofing. Email spoofing is a common technique used in phishing and spam emails. SPF allows the receiving mail server to verify that incoming mail from a domain comes from a host authorized by that domain’s administrators. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records.
+
The Sender Policy Framework (SPF) is an email validation protocol that helps detect and block email spoofing. Email spoofing is a common technique used in phishing and spam emails. SPF allows the receiving mail server to verify that incoming mail from a domain comes from a host authorized by that domain's administrators. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records.
-
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that provides additional protection against email spoofing and phishing attacks. It uses the Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) standards. DMARC enables a domain owner to specify how mail servers should handle messages from their domain that don’t pass SPF or DKIM checks. This adds an extra layer of security
+
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that provides additional protection against email spoofing and phishing attacks. It uses the Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) standards. DMARC enables a domain owner to specify how mail servers should handle messages from their domain that don't pass SPF or DKIM checks. This adds an extra layer of security