diff --git a/.gitignore b/.gitignore index 284e270..044f9d9 100644 --- a/.gitignore +++ b/.gitignore @@ -1,48 +1,14 @@ -# Python __pycache__/ *.py[cod] *$py.class -*.so -.Python -env/ -venv/ -ENV/ -env.bak/ -venv.bak/ -*.egg-info/ -dist/ -build/ - -# Security Analysis Results (user-generated) -*.json -*_results.txt -*_report.txt -*_audit.json -daily_check.json -weekly_audit.json -security_check.json - -# macOS -.DS_Store -.DS_Store? -._* -.Spotlight-V100 -.Trashes -ehthumbs.db -Thumbs.db - -# IDE +.pytest_cache/ +.coverage +htmlcov/ +.env +*.log .vscode/ .idea/ *.swp -*.swo -*~ - -# Temporary files -*.tmp -*.temp -*.log - -# User configuration -config.local.py -.env \ No newline at end of file +dist/ +build/ +*.egg-info/ \ No newline at end of file diff --git a/src/vpn_security.py b/src/vpn_security.py new file mode 100644 index 0000000..6522461 --- /dev/null +++ b/src/vpn_security.py @@ -0,0 +1,125 @@ +"""VPN Encryption and Protocol Security Checks Module. + +This module provides comprehensive security checks for VPN configurations, +focusing on encryption strength, protocol vulnerabilities, and best practices. +""" + +from typing import Dict, List, Optional, Any +import re +import ssl + +class VPNSecurityAssessment: + """Comprehensive VPN security assessment class.""" + + STRONG_ENCRYPTION_PROTOCOLS = { + 'TLS_1_2': {'min_key_length': 2048}, + 'TLS_1_3': {'min_key_length': 2048}, + } + + WEAK_PROTOCOLS = ['SSLv3', 'TLS_1_0', 'TLS_1_1'] + + @staticmethod + def check_encryption_strength(protocol: str, key_length: int) -> Dict[str, bool]: + """ + Evaluate the encryption strength of a VPN protocol. + + Args: + protocol (str): VPN encryption protocol + key_length (int): Key length in bits + + Returns: + Dict[str, bool]: Assessment results with security status + """ + results = { + 'is_secure': False, + 'recommendation': '' + } + + # Check against known strong protocols + if protocol in VPNSecurityAssessment.STRONG_ENCRYPTION_PROTOCOLS: + min_key_length = VPNSecurityAssessment.STRONG_ENCRYPTION_PROTOCOLS[protocol]['min_key_length'] + + if key_length >= min_key_length: + results['is_secure'] = True + results['recommendation'] = f"Protocol {protocol} with {key_length}-bit key is considered secure." + else: + results['recommendation'] = ( + f"Upgrade {protocol} key length from {key_length} to at least {min_key_length} bits." + ) + + # Check against weak protocols + if protocol in VPNSecurityAssessment.WEAK_PROTOCOLS: + results['is_secure'] = False + results['recommendation'] = f"Avoid protocol {protocol}. It has known security vulnerabilities." + + return results + + @staticmethod + def detect_protocol_vulnerabilities(protocol: str) -> List[str]: + """ + Detect known vulnerabilities in VPN protocols. + + Args: + protocol (str): VPN protocol to check + + Returns: + List[str]: List of detected vulnerabilities + """ + vulnerabilities = [] + + # Sample vulnerability checks (expand with real-world CVEs) + if protocol == 'SSLv3': + vulnerabilities.append('POODLE attack vulnerability') + + if protocol == 'TLS_1_0': + vulnerabilities.append('BEAST attack vulnerability') + + return vulnerabilities + + @staticmethod + def validate_cipher_suite(cipher_suite: str) -> Dict[str, bool]: + """ + Validate the security of a VPN cipher suite. + + Args: + cipher_suite (str): Cipher suite to evaluate + + Returns: + Dict[str, bool]: Cipher suite security assessment + """ + # Updated regex for strong cipher suites + strong_cipher_pattern = re.compile(r'(ECDHE|DHE).*(?:AES_256|AES256|GCM)') + + return { + 'is_secure': bool(strong_cipher_pattern.search(cipher_suite)), + 'recommendation': ( + 'Use modern cipher suites with perfect forward secrecy ' + 'and strong encryption algorithms.' + ) + } + +def perform_vpn_security_assessment( + protocol: str, + key_length: int, + cipher_suite: Optional[str] = None +) -> Dict[str, Any]: + """ + Comprehensive VPN security assessment function. + + Args: + protocol (str): VPN protocol + key_length (int): Encryption key length + cipher_suite (Optional[str]): VPN cipher suite + + Returns: + Dict[str, Any]: Comprehensive security assessment results + """ + assessment = { + 'encryption_strength': VPNSecurityAssessment.check_encryption_strength(protocol, key_length), + 'protocol_vulnerabilities': VPNSecurityAssessment.detect_protocol_vulnerabilities(protocol) + } + + if cipher_suite: + assessment['cipher_suite_security'] = VPNSecurityAssessment.validate_cipher_suite(cipher_suite) + + return assessment \ No newline at end of file diff --git a/tests/__init__.py b/tests/__init__.py new file mode 100644 index 0000000..93a2d4b --- /dev/null +++ b/tests/__init__.py @@ -0,0 +1 @@ +# Test package initialization \ No newline at end of file diff --git a/tests/test_vpn_security.py b/tests/test_vpn_security.py new file mode 100644 index 0000000..3393f47 --- /dev/null +++ b/tests/test_vpn_security.py @@ -0,0 +1,41 @@ +"""Test suite for VPN security assessment module.""" + +import pytest +from src.vpn_security import VPNSecurityAssessment, perform_vpn_security_assessment + +def test_check_encryption_strength_secure(): + """Test encryption strength for secure protocols.""" + result = VPNSecurityAssessment.check_encryption_strength('TLS_1_2', 2048) + assert result['is_secure'] is True + assert 'secure' in result['recommendation'] + +def test_check_encryption_strength_weak(): + """Test encryption strength for weak protocols.""" + result = VPNSecurityAssessment.check_encryption_strength('SSLv3', 1024) + assert result['is_secure'] is False + assert 'Avoid' in result['recommendation'] + +def test_detect_protocol_vulnerabilities(): + """Test detection of protocol vulnerabilities.""" + vulnerabilities = VPNSecurityAssessment.detect_protocol_vulnerabilities('SSLv3') + assert 'POODLE' in vulnerabilities[0] + +def test_validate_cipher_suite_secure(): + """Test validation of secure cipher suites.""" + result = VPNSecurityAssessment.validate_cipher_suite('ECDHE-RSA-AES256-GCM-SHA384') + assert result['is_secure'] is True + +def test_validate_cipher_suite_weak(): + """Test validation of weak cipher suites.""" + result = VPNSecurityAssessment.validate_cipher_suite('RC4-SHA') + assert result['is_secure'] is False + +def test_perform_vpn_security_assessment(): + """Test comprehensive VPN security assessment.""" + assessment = perform_vpn_security_assessment('TLS_1_2', 2048, 'ECDHE-RSA-AES256-GCM-SHA384') + + assert 'encryption_strength' in assessment + assert 'protocol_vulnerabilities' in assessment + assert 'cipher_suite_security' in assessment + + assert assessment['encryption_strength']['is_secure'] is True \ No newline at end of file